← Feed

Posts

• View post

  Bugtraq is back: "I have acquired securityfocus.com and the Bugtraq name. Not to build a museum - to restart the conversation. The mission is unchanged: full disclosure, researcher-first, no corporate filter. The old archives, sourced from community copies of what was always public mailing list traffic, will be preserved and made accessible separately." https://lists.securityfocus.com/hyperkitty/list/bugtraq@securityfocus.com/thread/CHKLXLA7SJEWLDFHWXB3QU57ADOXGL2E/

• View post

  So @irsdl@infosec.exchange released a new version of YSoNet (a forge of ysoserial.net), with some cool new features / gadgets: ▸ DataTable + DataTableTypeSpoof Same-graph DataTable root carrier for RCE. No nested BinaryFormatter or extra binder boundary. TypeSpoof emits a real DataTable subclass, so blocking only the exact DataTable wire name may not prevent reconstruction. ▸ TypeConfuseDelegateFileOperations Five delegate-confusion variants for writing, copying, moving and truncating files....

• View post

  CVE-2026-16232 Check Point SmartConsole Authentication Bypass Technical Analysis from Rapid7: https://www.rapid7.com/blog/post/ra-check-point-smartconsole-authentication-bypass-technical-analysis-cve-2026-16232/ PoC Exploit: https://github.com/sfewer-r7/CVE-2026-16232

• View post

  I know it's still a while away, but on November 12, 2026, I'll be speaking about “Private AI/Inference” at the "IT Kongress" in Neu-Ulm (Germany): Talk will be in German https://www.it-kongress.com/index.php/programm-und-anmeldung/ki-und-automatisierung-use-ai-because-nobody-is-watching/

• View post

  I am aware that bug bounty programs are overwhelmed by low-quality AI submissions, but I have also observed a general decline in the validation process, particularly when reporting issues that fall outside the web technology stack. I can generate highly detailed reports that describe the issue, include a proof of concept, and yet they often struggle to validate the finding.

• View post

  WordPress, the most widely used CMS, has just released an emergency update for a critical security vulnerability. Update your sites and blogs immediately. https://wordpress.org/news/2026/07/wordpress-7-0-2-release/

• View post

  Steven Fewer from (@Rapid7Official@infosec.exchange) killing it again as always, this time with SharePoint (CVE-2026-55040) https://www.rapid7.com/blog/post/ve-cve-2026-55040-microsoft-sharepoint-jwt-token-authentication-bypass-fixed/

• View post

  So, @Rapid7Official@infosec.exchange is shutting down AttackerKB (https://attackerkb.com/) soon. I view this as a case where an initially promising idea became overwhelmed by low‑quality reports from contributors. Anyway, archive any data you wish to retain.

• View post

  If you want to quickly burn tokens, let an LLM evaluate a CVSS rating.

• View post

  So @nostarch@mastodon.social currently provides a summer sale (40 percent off).

• View post

  RE: https://infosec.exchange/@mogwailabs_gmbh/115941084350429064 I'm getting old. Instead of analyzing vulnerabilities, I analyze regulations 😩

• View post

  @lcamtuf Due to the EU Cyber Resilience Act, auto-updates will become mandatory, as products must provide an automatic update feature. Looking forward to all the vulnerabilities in auto-update services...