Search/illia
Known CVEs
0
Highest CVSS
—
In KEV
0
Vendor
simple like page
Connections
5 relationships
USN-7927-3: urllib3 regression
Details USN-7927-1 fixed vulnerabilities in urllib3. The update for CVE-2025-66471 introduced a regression in urllib3 when decompressing zstd data. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Illia Volochii discovered that urllib3 did not limit the steps in a decompression chain. An attacker could possibly use this issue to cause urllib3 to use excessive resources, causing a denial of service. (CVE-2025-66418) Rui Xi discovered that urllib3 incorrectly handled highly compressed data. An attacker could possibly use this issue to cause urllib3 to use excessive resources, causing a denial of service. This issue only affected Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10. (CVE-2025-66471) For the brotli encoding, the fix for USN-7927-1 fixed vulnerabilities in urllib3. The update for CVE-2025-66471 introduced a regression in urllib3 when decompressing zstd data. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Illia Volochii discovered that urllib3 did not limit the steps in a decompression chain. An attacker could possibly use this issue to cause urllib3 to use excessive resources, causing a denial of service. (CVE-2025-66418) Rui Xi discovered that urllib3 incorrectly handled highly compressed data. An attacker could possibly use this issue to cause urllib3 to use excessive resources, causing a denial of service. This issue only affected Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10. (CVE-2025-66471) For the brotli encoding, the fix for CVE-2025-66471 requires an additional security update in the brotli package. The problem can be corrected by updating your system to the following package versions: Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.
ubuntu.comJan 13, 2026extracted
USN-7927-1: urllib3 vulnerabilities
Details Illia Volochii discovered that urllib3 did not limit the steps in a decompression chain. An attacker could possibly use this issue to cause urllib3 to use excessive resources, causing a denial of service. (CVE-2025-66418) Rui Xi discovered that urllib3 incorrectly handled highly compressed data. An attacker could possibly use this issue to cause urllib3 to use excessive resources, causing a denial of service. This issue only affected Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10. (CVE-2025-66471) For the brotli encoding, the fix for CVE-2025-66471 requires an additional security update in the brotli package. Illia Volochii discovered that urllib3 did not limit the steps in a decompression chain. An attacker could possibly use this issue to cause urllib3 to use excessive resources, causing a denial of service. (CVE-2025-66418) Rui Xi discovered that urllib3 incorrectly handled highly compressed data. An attacker could possibly use this issue to cause urllib3 to use excessive resources, causing a denial of service. This issue only affected Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10. (CVE-2025-66471) For the brotli encoding, the fix for CVE-2025-66471 requires an additional security update in the brotli package. The problem can be corrected by updating your system to the following package versions: Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.
ubuntu.comDec 11, 2025extracted
Ukraine’s ousted cyber chief posts bail in corruption case
Ukraine’s ousted cyber chief posts bail in corruption case Ukraine’s anti-corruption court said on Wednesday that Illia Vitiuk, the former cyber chief of the country’s security service (SBU) posted a bail of more than 9 million hryvnias ($218,000) in a corruption case. Vitiuk, who was dismissed last May after an earlier probe into his finances, is accused of illicit enrichment. Under the bail conditions, he must appear when summoned, report any change of residence, avoid contact with certain individuals and surrender his foreign passports to investigators. Ukraine’s National Anti-Corruption Bureau (NABU) last week formally charged Vitiuk, saying his family bought a Kyiv apartment in December 2023 for about $535,000 but reported it at nearly half the price. Investigators said the funds were transferred by a man accused of embezzling from the state railway and related firms, and alleged there was no evidence that Vitiuk’s wife had provided the legal and consulting services she cited as the source of the money. In court last week, prosecutors pointed to correspondence between Vitiuk’s wife and a realtor indicating the apartment cost significantly more than the declared amount. They also said documents meant to support her consulting work appeared to have been backdated. Vitiuk rejected the charges as “arbitrary” during a hearing last Thursday, insisting the indictment contained no evidence that he orchestrated his wife’s alleged sham business and claiming he had no knowledge of the apartment’s purchase price. The SBU described the case as politically motivated, accusing NABU of retaliation after SBU officers detained several of its employees earlier this summer. It said anti-corruption detectives had failed to produce convincing evidence. Ukrainian journalists and anti-corruption activists who previously spoke with Recorded Future News cast doubt on the SBU’s defense and called it unfounded. Vitiuk is not the first Ukrainian cyber official accused of financial abuse. In November, two senior cybersecurity officials were dismissed amid an investigation into suspected embezzlement of state funds. They are accused of involvement in a software procurement scheme in which $1.7 million was allegedly embezzled between 2020 and 2022. Daryna Antoniuk is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.
therecord.mediaSep 10, 2025extracted
Corruption case against ousted cyber chief is ‘revenge,’ Ukraine’s security service says
Corruption case against ousted cyber chief is ‘revenge,’ Ukraine’s security service says Ukraine’s security service (SBU) is accusing the country’s anti-corruption agencies of seeking “revenge” by bringing charges against the former head of the agency’s cybersecurity unit. On Tuesday, the country’s National Anti-Corruption Bureau (NABU) and the Specialized Anti-Corruption Prosecutor’s Office (SAP) announced a “suspicion” — a formal criminal charge under Ukrainian law and the first step in criminal proceedings — against ousted cyber official Illia Vitiuk. In a statement following the announcement, the SBU claimed the anti-corruption offices were prosecuting Vitiuk in retaliation for the security service’s detention of several NABU employees earlier this summer. Vitiuk is a well-known figure in Ukraine’s cybersecurity community who has spoken at international conferences and given interviews to media outlets around the world. He was formally dismissed from his post last May after an earlier probe into his finances. Investigative journalists reported that his family’s real estate holdings exceeded their official salaries. “The suspicion announced against Vitiuk is an act of revenge for our effective counteraction to Russian influence in government institutions and for exposing several NABU employees for committing crimes,” the SBU said. In July, the security service detained a senior NABU detective on suspicion of aiding Russia. NABU said Ukrainian law enforcement also searched the homes of at least 15 of its employees at the time, and claimed that the raids were conducted without court warrants, while three of its detectives were subjected to “excessive physical force.” NABU said on Tuesday that in December 2023 Vitiuk’s family bought a Kyiv apartment for $535,000 but reported it at nearly half that price. His wife claimed the funds came from legal and consulting work, but NABU reportedly found that payments were made by a man accused of embezzling from the state railway and related companies. Investigators said there was no proof Vitiuk’s wife provided any services to him and that the companies involved appeared to be fictitious. Vitiuk is suspected of illicit enrichment — when an official’s assets far exceed legitimate income — and of filing false asset declarations, which require officials to publicly disclose their wealth. SBU’s claims The SBU claimed the case is politically motivated, noting that charges against Vitiuk were brought only after NABU officials were detained, and said investigators at NABU and SAP had failed to present convincing evidence to support the allegations against Vitiuk. “There are strong grounds to speak of selective justice by NABU and SAP against an SBU officer,” the SBU claimed. Vitaliy Shabunin, head of Ukraine’s leading anti-corruption nonprofit, cast doubt on the legitimacy of the SBU’s claims. He said journalists had revealed Vitiuk’s luxury real estate a year-and-a-half ago and that NABU has been investigating the case ever since. The suspicion against the former cyber chief was prepared before the agency raided NABU detectives’ apartments, he added. Anna Babinets, editor-in-chief of the Slidstvo.Info investigative outlet, also cast doubt on the SBU’s defense. “I’ve never read such lengthy institutional praise for an official formally suspected of illicit enrichment,” she said. Slidstvo.Info was the first outlet to report on Vitiuk’s alleged corruption. The SBU pointed to a report by the National Agency on Corruption Prevention (NACP), which said it found no evidence of Vitiuk’s illicit enrichment and concluded the apartment was legally purchased with his wife’s declared business income. But according to a Ukrainian anti-corruption expert who spoke to Recorded Future News on condition of anonymity, the NACP doesn’t have investigative powers and can’t verify whether the money sent to Vitiuk’s wife was actually payment for real work. NABU believes she didn’t provide legal services, yet still received money from a suspect in a major embezzlement case. “The only surprising thing is why the NACP didn’t establish the real market value of the apartment registered to Vitiuk’s wife, since its actual value was much higher than what was stated in the purchase agreement,” the expert added. He noted that while it’s unusual for law enforcement agencies to accuse anti-graft bodies of retaliation, it has happened in Ukraine before. In 2017, then-SBU deputy head Pavlo Demchyna accused an anti-corruption investigator of falsifying records after journalists reported that his partner owned luxury property and cars far beyond her income. Vitiuk sparked controversy when it was reported that he sought to have the journalist behind the investigation drafted into the army. According to local media reports at the time, officers from the enlistment office, alongside an official from Vitiuk’s SBU department, approached the reporter in a Kyiv shopping center and accused him of evading military service. Vitiuk has not commented on his case and has reportedly been reassigned to combat duty, leaving Kyiv for the frontline. His current whereabouts are unknown. He is not the first Ukrainian cyber official suspected of financial abuse. In November, two high-ranking cybersecurity officials in Ukraine were dismissed amid an investigation into suspected embezzlement of state funds. They are suspected of involvement in a software procurement scheme in which they allegedly embezzled $1.72 million between 2020 and 2022. Daryna Antoniuk is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.
therecord.mediaSep 3, 2025extracted