← Feed

Posts

• View post

  The week only keeps getting better... apparently, multiple not yet fixed Linux kernel vulnerabilities were disclosed by accident when they were posted to the public mailing list rather than the private one. Oops. https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities #infosec #cybersecurity

• View post

  Gamers Nexus video on chaining ASUS router and LG TV exploits does a good job in explaining these things in layman’s terms. https://www.youtube.com/watch?v=kYnwCx2SNYY #infosec #cybersecurity

• View post

  ICEYE and Nokia partner with The Ministry of Defence of Ukraine to develop sovereign satcom capability. Having partners deliver intel is good, but having the capability to collect it yourself is even better - and more reliable. https://www.iceye.com/newsroom/press-releases/iceye-and-nokia-partner-with-the-ministry-of-defence-of-ukraine-to-develop-sovereign-satcom-capability

• View post

  For some reason, the CVE-2026-111497 buffer overflow vulnerability in the #brotli decoder is mostly associated with #nodejs, but this is a far wider issue. Brotli compression is supported by many client-side applications processing HTTP responses. While some of them have sandboxes and a quick update cycle (read: web browsers), many don't. In particular, many devices and applications using #curl / libcurl are affected and must be updated ASAP. https://github.com/advisories/GHSA-9v8h-qqgm...

• View post

  #git command https remote is affected by the #brotli buffer overflow vulnerability CVE-2026-111497 since it enables compression support: https://github.com/git/git/blob/7e34d8174dcda3435d1404c9a30bef46afe6c13e/http.c#L2284 https://github.com/git/git/blob/7e34d8174dcda3435d1404c9a30bef46afe6c13e/remote-curl.c#L980 Make sure to update brotli as soon as possible. https://github.com/advisories/GHSA-9v8h-qqgm-4m35 #infosec #cybersecurity #CVE_2026_111497

• View post

  Hack of the day: When working with ordered datasets, the GNU diff tool can be used for all kinds of filtering and formatting by different combinations of --unchanged-line-format, --old-line-format and --new-line-format. "%L" includes the line in question, and you can omit any output by specifying the given format as "". For example, only gives lines that the new file omits, but prefixes them with "deprecated_": diff --old-line-format=&q...

• View post

  Use of setjmp()/longjmp() in code is typically a sign of laziness - and translates to "We didn't bother writing proper error handling". It's like using abort() but even worse. longjmp() out of the blue breaks the control flow of the application and easily leads to all kinds of resource leaks and state inconsistencies. The legitimate use cases for setjmp()/longjmp() are few and far between. #C #programming

• View post

  With this #GitHub runner vulnerability in place, dependencies could have been tampered with and malicious payloads injected into the built software. Any software built with these runners since the #eMudhra was made public and until the runners are fixed must be considered compromised. https://infosec.exchange/@yossarian/117516807638615410

• View post

  Rest in peace Patrick Stewart

• View post

  While the latest #ChatControl proposal didn't proceed to a vote, the proponents of the interception of all chat traffic will undoubtedly continue their efforts to get the law passed - like they have for years now. It will resurface shortly, disguised and modified but effectively pushing for the same end result: removal of end-to-end encryption. We must stay vigilant and continue to fight for our freedoms. #StopChatcontrol #privacy

• View post

  We Finns do love our salty liquorice... https://www.saarioinen.fi/tuotteet/salmiakkimaksalaatikko-350g/?lang=en

• View post

  #Debian [DSA 6528-1] linux kernel #security update has fixes to 1313 CVEs. https://lists.debian.org/debian-security-announce/2026/msg00441.html

• View post

  I've been quite happy with #Strongbox password manager. I migrated years ago from 1Password when they dropped functionality I needed and revoked the lifetime subscription.

• View post

  I spent nearly six hours tracking down a bug that was caused by not blocking signals correctly. As a result, signal processing could occur in the middle of a critical section. To make matters worse, the crash would only occur much later when the desync from the earlier overlapping execution would result in use-after-free and crash. The crash would not occur every time since it was timing-dependent - the signal would need to hit a relatively small window to trigger the issue. Figuring out the ro...

• View post

  It appears that AI companies target open source contributors with their marketing spam: "we noticed you contributed to curl/curl — thanks for helping build open source. We're running a small program for Github OSS contributors and would love to invite you. You'll receive $25 in XXXXXXXXX credits to use frontier AI models (this time YYYYY) through a single OpenAI-compatible endpoint." #enshittification

• View post

  Yet another linux LPE to root. "CVE-2026-64564: Linux SCTP ASCONF transport UAF leading to local privilege escalation and container escape" https://www.openwall.com/lists/oss-security/2026/08/06/3 #CVE_2026_64564 #infosec #cybersecurity

• View post

  "As was standard in our cyber testing, we had intentionally permitted internet access, and model-provider cyber classifiers were deliberately disabled" 🤦‍♂️ What exactly did they expect would happen when following such policy? ref: https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing

• View post

  "Embargo klo 01:00" ja juttu julkaistu 00:01 - nyt ei kai ihan mennyt niin kuin suunniteltiin. #yleisradio

• View post

  #Engadget, yes we do have a reason not to watch #Babylon5 from YouTube.

• View post

  Bouncy Castle Java 1.85 has been released. It includes fixes to various rather significant vulnerabilities and weaknesses. Some highlights: - CVE-2026-8763 - Name Constraints bypass via trailing dot in rfc822Name and URI. - CVE-2026-12803 - KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery). - CVE-2026-12816 - IESEngine stream-mode MAC forgery via length-dependent KDF split. - CVE-2026-58061 - CCM-family modes write plaintext to caller buffer before tag check....

• View post

  Some time ago I discovered a meddled in the middle vulnerability between N-able agent and nCentral server that allowed full SYSTEM compromise of the endpoints, but this vulnerability in nCentral server is far far far worse: https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/ #nablencentral #CVE_2026_18577 #infosec #cybersecurity

• View post

  40 years of #Byterapers: 1986: https://www.youtube.com/watch?v=txaIWaT6zik 2026: https://www.youtube.com/watch?v=TmwjZ33ID5k (Assembly 2026 #democompetition winner) Congratulations on continuing to be awesome! #demoscene

• View post

  Last night I "discovered" a vulnerability in a very widely used open-source tool. The tool is nearly 40 years old, and the vulnerability is at least 28 years old. Interestingly, Apple has a fix included that dates it back to 2008, but it appears for whatever reason the fix never made it to upstream. Result? Everyone else is vulnerable today. I am not pointing fingers here, but clearly something went wrong. I've now reported the issue upstream, which will hopefully eventually lea...

• View post

  No, the libssh2 vulnerability CVE-2026-55200 isn't end of the world. 1. You need to defeat ASLR to successfully exploit it. The PoC works only when you disable ASLR. In most realistic use cases you need additional off-band infoleak from the app using libssh2. 2. You also must somehow convince the victim to connect to your malicious server, OR compromise some existing server to perform the attack. Calling this a "CRITICAL VULNERABILITY" is dumb.

• View post

  Back when the "internet" involved expensive phone calls and modems, someone figured out that a video backup system (VBS) could be used to distribute hundreds of megabytes of "backups" between friends by shipping a VHS cassette in a padded envelope. You just needed a VCR (everyone had one), and a small harness that could sample the video signal from the VCR for the software to decode. Interestingly, the Video Backup System website is still up: http://www.hugolyppens.com/VBS....

• View post

  13 2026-07-24 16:23:31 +0000 error: Corrected error, no action required., CPU 2, bank Unified Memory Controller (bank=17), mcg mcgstatus=0, mci CECC, mca DRAM ECC error. Ext Err Code: 0 Memory Error 'mem-tx: generic read, tx: generic, level: L3/generic', memory_channel=0,csrow=0, mcgcap=0x0000011c, status=0x9c2041000000011b, addr=0x72fb55480, misc=0xd01a000101000000, walltime=0x6a639183, cpuid=0x00a20f10, bank=0x00000011, microcode=0x0a201030 #ECCMemory saving the day.

• View post

  #openai #huggingface

• View post

  VESA Monitor Control Command Set (MCCS) standard "Asset Tag" function has a gaping flaw. The key is 16-bit and there is no rate limiting. 🤦‍♂️

• View post

  #Amazon #CloudFront seems to having global issues. https://health.aws.amazon.com/health/status

• View post

  I've started to outright block accounts posting AI slop or parroting AI company PR statements. Life is too short.