← Feed

Posts

• View post

  RE: https://digipres.club/@foone/117515687469904550 You heard her. From now on we're a base9 society and the numeral 4 shall henceforth be an illegal character.

• View post

  Auth bypasses are so hot right now. https://nvd.nist.gov/vuln/detail/cve-2026-112352 Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection. Attackers can guess default account names such as Admin or sftp_user and submit a forged username cookie to satisfy the...

• View post

  If you can't handle me at my fedi, you don't deserve me at my LinkedIn.

• View post

  I'm really hoping I can get my ducting replaced to get my heat on soon.

• View post

  You. Had. One. Job. https://nvd.nist.gov/vuln/detail/cve-2026-96760 Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.

• View post

  Palo finally published an advisory outlining impact from CVE-2026-111497 in brotli. https://security.paloaltonetworks.com/CVE-2026-111497 A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream....

• View post

• View post

• View post

  If your org's response to this week is "What can we purchase to get us out of this situation?" instead of something like "How can we enable the analysts we have to do their job and get us out of this?" then you are doing it wrong.

• View post

  @nerpulus@mastodon.online https://masto.deoan.org/@neurovagrant/117475385470377669

• View post

  Had anyone tried making cybersecurity vendors aware of cybersecurity instead of just focusing on practitioners? I feel like there may be a missed opportunity there, especially with how this week has gone.

• View post

  The "h" in "php" is an upside down "4". Coincidence? I think not. :catte:

• View post

  Don't let the Node vuln slip through the cracks just because it's harder to meme.

• View post

  Has anyone been able to successfully convince their execs that the takeaway from all this "Vulnpocalypse" or whatever is that architecture is actually important and to not blindly trust the claims of vendors? I've been trying unsuccessfully. The general consensus seems to be "We can fix this exposed attack surface by purchasing more attack surface."

• View post

  Is today the day people realize that full disclosure is responsible disclosure? The FUD around the embargo nonsense has made things so much worse.

• View post

• View post

  I'm already seeing CVEs for projects impacted by the number 4. https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2 https://github.com/astral-sh/uv/security/advisories/GHSA-hq85-5cpj-mr62

• View post

  I love Sesame Street, I really do. But maybe it's not the place to learn crypto.

• View post

  AWSKeys-selfservice.xlsx 👀

• View post

  The amount of VULTR IPs posted by this bot lately is funny. AS20473 is absolutely a naughty ASN and not in a fun way. I highly recommend blocking it bidirectionally if you can. @monitorsg@infosec.exchange

• View post

  Happy Friday to everyone except @homeassistant@fosstodon.org

• View post

  RE: https://infosec.exchange/@perfect10_bot/117451484061265305 Go hack more AI shit. An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.

• View post

  RE: https://mastodon.social/@anon_opin/117435590597969188 Did LibreOffice write this?

• View post

• View post

  Are we to the point as an industry yet where we can start sharing JA4 fingerprints and the like as atomic indicators or is it like ASNs where too many of the multi-billion dollar companies can't be bothered to provide effective controls to their customers instead of the standard "Trust me, bro" model?

• View post

  Security assholes: Utilities need to step up to defend themselves from The Cyber Pearl Harbors and AI and quantum and and and... The shit utilities actually have to defend against: https://www.bbc.co.uk/news/uk-scotland-glasgow-west-52591605

• View post

  Looks like today's theme is

• View post

  RE: https://flipboard.com/@theseattletimes/seattle-news-27p8llobz/-/a-hmU0ZkezRoyJdeBo1mY5Hg%3Aa%3A2857557016-%2F0 After Decades of Making it Impossible for Teens to Travel Safely in the Suburbs, Teens are Using E-bikes to Get Around and the Karens are Big Mad There, I fixed the headline for you.

• View post

  Fuck Cybersecurity Awareness Month, October is Pitbull Awareness Month.

• View post