soc.octade.net is a Fediverse instance that uses the ActivityPub protocol. In other words, users at this host can communicate with people that use software like Mastodon, Pleroma, Friendica, etc. all around the world.

This server runs the snac software and there is no automatic sign-up process.

Admin email
social@octade.net

Search results for tag #infosec

[?]AA » 🌐
@AAKL@infosec.exchange

Today's ransomware targets include Omni Hotels and Resorts ransomware.live/id/T21uaSBIb3R

Also:

Bridgestone HosePower, LLC ransomware.live/id/QnJpZGdlc3R

First and Final Warning - IHG Hotels & Resorts (Estate) ransomware.live/id/Rmlyc3QgYW5

Australia: Calvary Christian College ransomware.live/id/Q2FsdmFyeSB

More ransomware.live/

    Nicole Parsons boosted

    [?]Alesandro Ortiz 🇵🇷🏳️‍🌈 » 🌐
    @AlesandroOrtiz@infosec.exchange

    Queens Public Library in NYC got ransomware'd last night. Email sent to patrons confirms ransomware incident.

    Email from Queens Public Library: Dear Customer, We are writing to update you about the significant network outage that continues to affect the systems at all our locations. This disruption, the result of a ransomware attack, continues to impact the following services: Queens Public Library website (queenslibrary.org) On-site Computers Check-out and Return Machines Free Wi-Fi Access QPL Mobile App Digital Media Services All QPL locations remain open as scheduled; however, certain virtual and in-person programs may be impacted. Please check with your local branch. During this outage, renewals are also unavailable. As a reminder, customers are not charged late fines on borrowed materials. We are working closely with law enforcement and cybersecurity experts to address this situation, and we will keep you informed. Please note it will take some time before the Library's network and systems are restored. Check for updates on our social media channels: BlueSky Facebook Instagram LinkedIn Threads X You may call (718) 990-0728 for assistance. We apologize for any inconvenience and ask for your patience and understanding as we manage this challenge. —Queens Public Library

    Alt...Email from Queens Public Library: Dear Customer, We are writing to update you about the significant network outage that continues to affect the systems at all our locations. This disruption, the result of a ransomware attack, continues to impact the following services: Queens Public Library website (queenslibrary.org) On-site Computers Check-out and Return Machines Free Wi-Fi Access QPL Mobile App Digital Media Services All QPL locations remain open as scheduled; however, certain virtual and in-person programs may be impacted. Please check with your local branch. During this outage, renewals are also unavailable. As a reminder, customers are not charged late fines on borrowed materials. We are working closely with law enforcement and cybersecurity experts to address this situation, and we will keep you informed. Please note it will take some time before the Library's network and systems are restored. Check for updates on our social media channels: BlueSky Facebook Instagram LinkedIn Threads X You may call (718) 990-0728 for assistance. We apologize for any inconvenience and ask for your patience and understanding as we manage this challenge. —Queens Public Library

      Cindʎ Xiao 🍉 boosted

      [?]Matt "msw" Wilson » 🌐
      @msw@mstdn.social

      RE: hachyderm.io/@damienmiller/117

      It's important to remember that OpenSSH is highly build-time configurable software. Only certain build configurations and system states present a real concern as an "emergent property" of this complex system.

      For everyone else, it's a latent or "non-expressing" defect in source code.

      Paul_IPv6 boosted

      [?]Damien Miller » 🌐
      @damienmiller@hachyderm.io

      OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability.

      openssh.com/releasenotes.html#

      If you operate a Linux system that uses musl libc without PAM (Alpine Linux is one example) then stop reading and set PasswordAuthentication=no or disable SSH for these systems IMMEDIATELY.

      This vulnerability does not exist on non-Linux systems, Linux/glibc systems and Linux systems that use PAM for password authentication.

      We consider the root cause of this bug to be outside OpenSSH itself, but we're in a good position to deliver a mitigation quickly.

      We are making this release as fast as possible (we learned of the problem yesterday) because we have recently observed multiple cases of rapid bug rediscovery by AI agents, sometimes within hours, and so now consider long embargo periods to be a dangerous practice that primarily benefits attackers.

      Thanks for Özgün Kültekin of Wakefield (wakefield.co) for reporting this problem to us and for the Alpine Linux developers for making an updated release available at very short notice.

        [?]AA » 🌐
        @AAKL@infosec.exchange

        New.

        "Attackers using the Anubis ransomware targeted a U.S. organization in October 2026 using a new custom backdoor that Symantec has called Backdoor.Lindnor."

        "The backdoor masqueraded as a Chrome component and as a VMware file, and was found on two Microsoft SQL Server machines."

        "Within roughly an hour, the attackers dropped at least 13 executables to help terminate security services, along with five publicly known vulnerable drivers."

        Symantec: New Lindnor Backdoor and Glut of Security Killers Used in Ransomware Attack on U.S. Org security.com/threat-intelligen

          [?]AA » 🌐
          @AAKL@infosec.exchange

          That kinda states the obvious, thanks to the incessant bungling of AI companies. What is the answer?

          Rapid7: Gartner Report: The Attack Path is Closing Faster than Most Teams Can Patch rapid7.com/blog/post/ai-gartne @Rapid7Official

            [?]AA » 🌐
            @AAKL@infosec.exchange

            New.

            "The vulnerability exposes a wide attack surface, enabling silent exfiltration of entire chat history, credential theft via phishing, and malware delivery."

            Check Point: ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration research.checkpoint.com/2026/c

              [?]AA » 🌐
              @AAKL@infosec.exchange

              Updated.

              Picus: CVE-2026-119977: When Updating WordPress Becomes the Vulnerability picussecurity.com/resource/blo

                [?]AA » 🌐
                @AAKL@infosec.exchange

                New.

                Microsoft: Email threat landscape: Q3 2026 trends and insights microsoft.com/en-us/security/b

                  Scott Francis boosted

                  [?]AA » 🌐
                  @AAKL@infosec.exchange

                  This was posted yesterday, if you missed it. I wonder if all of the proxy services are Russia-related, which would be telling. Go ahead, open a new Pandora's box.

                  "One of the proxy services is a Russian company whose founder’s web hosting business was ground zero for cyberattacks against election systems in Arizona and Illinois in 2016."

                  "Infatica’s founder Vladimir Fomenko is a Russian man whose hosting firm King Servers was home to six of the eight internet addresses used by Russia’s state security services to compromise databases for election systems in Arizona and Illinois in 2016."

                  Here's Layer3 Intel's research on this from yesterday: layer3intel.com/blog/residenti

                  KrebsonSecurity: Want to Rent an Internet Address at the White House? krebsonsecurity.com/2026/11/wa @briankrebs

                    [?]Eric Carroll » 🌐
                    @EricCarroll@cosocial.ca

                    OpenWRT & alpine impacted for last 10 years.

                    Tl;dr random password login to disabled accounts. Patch up now, folks.

                    sshhole.com/

                      [?]AA » 🌐
                      @AAKL@infosec.exchange

                      New.

                      Kaspersky: The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603 securelist.com/storm-2603-file @Kaspersky

                        Nullstring 🏴‍☠️ boosted

                        [?]Xavier Ashe :donor: » 🌐
                        @Xavier@infosec.exchange

                        so openssh on musl linux (alpine, openwrt, buildroot, yocto, and a lot of the docker images you've pulled) has had a little problem since 2016.

                        accounts that should never take a password at all (root, your key-only deploy user, ldap users, the default user on alpine's aws and azure images) take any password longer than 256 characters.

                        yes, any password. yes. i know. yes.
                        sshhole.com/

                          [?]AA » 🌐
                          @AAKL@infosec.exchange

                          New.

                          "Between March and September 2026, thousands of Android phones belonging to retail banking customers in the META region were confirmed to be infected with the malware Group-IB tracks as Mirax."

                          Group-IB: From Streaming to Stealing: Mirax and the Rise of Server-side Android Device Takeover in META group-ib.com/blog/mirax-androi

                            [?]AA » 🌐
                            @AAKL@infosec.exchange

                            Broadcom has an upddate for a critical vulnerability first posted yesterday. You'll need a login for details.

                            Broadcom: CRITICAL: Endevor Bridge for Git 3.0.1 to 3.2.14 Advisory for Compromised eMudhra Intermediate CA Certificates support.broadcom.com/web/ecx/s

                            Cisco:

                            New advisory addresses a high-severity vulnerability first posted on October 27.

                            Cisco: CVE-2026-105482, CVE-2026-105483, and CVE-2026-106069: Vulnerabilities in Node.js and Brotli Affecting Cisco Products sec.cloudapps.cisco.com/securi @TalosSecurity

                              [?]AA » 🌐
                              @AAKL@infosec.exchange

                              New.

                              "Installing a specially crafted app can leave an Android phone stuck in a crash loop, even if you never open it or grant it a single permission. The app contains no code and never needs to run."

                              "When we looked closer to find out why, we found the problem wasn't the malware—it was the Android itself."

                              Bitdefender: GhostMap: The Android flaw that crashes your phone before you open the app bitdefender.com/en-us/blog/lab

                                Svanni boosted

                                [?]Aljoscha Rittner (beandev) [er/ihm] » 🌐
                                @beandev@social.tchncs.de

                                Nach Hackerangriff: Uni Leipzig wohl noch wochenlang offline

                                mdr.de/nachrichten/sachsen/lei

                                > Auch fünf Tage nach dem Angriff arbeitet die Universität Leipzig weiter an der Wiederherstellung ihrer IT. Während die Ursachen noch untersucht werden, häufen sich die Einschränkungen im Studienalltag. Wann die Seite wieder online geht, ist offen.

                                Und irgendwie ist immer noch unklar was passiert ist und welche Daten ggf abgeflossen sind.

                                [?]AA » 🌐
                                @AAKL@infosec.exchange

                                OpenAI is now messing with Linux. This was posted yesterday:

                                "We've developed an autonomous vulnerability discovery, exploitation, and patching pipeline. In one run with our cyber model, it validated and generated patches for 948 local privilege escalation vulnerabilities in Linux at an API cost of $1.2 million."

                                OpenAI: A thousand fewer paths to root openai.com/index/a-thousand-fe

                                The other headline:

                                The Hacker News: OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run thehackernews.com/2026/11/open @thehackernews

                                  [?]AA » 🌐
                                  @AAKL@infosec.exchange

                                  New.

                                  Alpine Security advisory: openssh-server password authentication bypass alpinelinux.org/posts/2026-11-

                                  More:

                                  The Hacker News: OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux thehackernews.com/2026/11/open @thehackernews

                                    AA boosted

                                    [?]EUVD Bot » 🤖 🌐
                                    @EUVD_Bot@mastodon.social

                                    🚨 EUVD-2026-117481

                                    📊 Score: n/a
                                    📦 Product: Apache OFBiz
                                    🏢 Vendor: Apache Software Foundation
                                    📅 Updated: 2026-11-05

                                    📝 Server-Side Request Forgery in SurveyWrapper in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated back-office user holding catalog permission to cause the server to fetch and render attacker-controlled URLs — including in...

                                    🔗 euvd.enisa.europa.eu/vulnerabi

                                      [?]AA » 🌐
                                      @AAKL@infosec.exchange

                                      Of course, no one will abuse this. Nope. Never.

                                      "Claude itself can now vouch for employees, so workplace plugins such as Notion, Figma, and Supabase connect automatically."

                                      The New Stack: “Signing in to your company’s plugins one by one is annoying”: Anthropic’s fix puts Claude in the identity business thenewstack.io/claude-plugin-i @TheNewStack

                                        [?]AA » 🌐
                                        @AAKL@infosec.exchange

                                        9to5Mac: The record $6.3B Binance heist started with a fake Homebrew install on Mac 9to5mac.com/2026/11/04/securit @9to5Mac

                                          [?]AA » 🌐
                                          @AAKL@infosec.exchange

                                          MacRumors: macOS 27.3 Includes an Important Security Fix macrumors.com/2026/11/04/macos @macrumors

                                            [?]AA » 🌐
                                            @AAKL@infosec.exchange

                                            "Apple will begin checking publicly shared iCloud links for harmful content with its 27.3 updates, with violations risking account bans or law enforcement referrals."

                                            Apple Insider: iCloud's 'Anyone with the Link' option will trigger Apple content checks appleinsider.com/articles/26/1 @appleinsider

                                              [?]AA » 🌐
                                              @AAKL@infosec.exchange

                                              Microsoft posted this yesterday: Fake-download campaign uses trojanized installers to deliver monetization payloads microsoft.com/en-us/security/b

                                                [?]AA » 🌐
                                                @AAKL@infosec.exchange

                                                There's a new Chrome release and a lot of fixes along with it.

                                                chromium.googlesource.com/chro

                                                Google: Chrome Beta for Desktop Update chromereleases.googleblog.com/

                                                  [?]AA » 🌐
                                                  @AAKL@infosec.exchange

                                                  Cisco has three advisories today.

                                                  New, medium-severity: CVE-2026-76506: Cisco UCS Central Software Remote Code Execution Vulnerability sec.cloudapps.cisco.com/securi

                                                  Here are the others: sec.cloudapps.cisco.com/securi @TalosSecurity

                                                    [?]AA » 🌐
                                                    @AAKL@infosec.exchange

                                                    New.

                                                    ESET: SlippyNunchucks hijacks Sogou Input Method’s brand promotion mechanism to distribute malware welivesecurity.com/en/eset-res @ESETresearch

                                                    More:

                                                    Infosecurity-Magazine: China-Aligned Group Abuses Sogou Input Method to Deliver Malware infosecurity-magazine.com/news

                                                      [?]AA » 🌐
                                                      @AAKL@infosec.exchange

                                                      So it's not just economic sabotage, now that the refrigeration controllers are game.

                                                      "Unauthorized actors took control of some refrigeration controllers in EFS’s cold storage rooms in the night between November 1 and 2, notably in facilities in the Burgundy and Franche-Comté region, in east-central France."

                                                      Infosecurity-Magazine: France Blood Service Cyber-Attack Sends Blood Storage Temperatures to 110°C infosecurity-magazine.com/news

                                                        [?]AA » 🌐
                                                        @AAKL@infosec.exchange

                                                        Check Point posted this yesterday:

                                                        "We observed the jailbreak being used by a cybercrime actor, alongside Cobalt Strike, the VulnClaw agent and the Ladon framework. While this does not imply that the package was designed for cybercrime, it shows that these dual-use toolkits are actively used by threat actors."

                                                        Check Point: Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak Bundles research.checkpoint.com/2026/f

                                                        More:

                                                        The Hacker News: Researchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak Toolkit thehackernews.com/2026/11/rese @thehackernews

                                                          [?]AA » 🌐
                                                          @AAKL@infosec.exchange

                                                          Posted yesterday:

                                                          CRITICAL: Possible arbitrary file write and read in Rails Active Storage image analysis github.com/rails/rails/securit

                                                          More:

                                                          The Hacker News: Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads thehackernews.com/2026/11/crit @thehackernews

                                                            [?]AA » 🌐
                                                            @AAKL@infosec.exchange

                                                            New.

                                                            Sekoia: Poisoned Source: APT29 watering holes target mobile devices with n-day exploits sekoia.com/blog/poisoned-sourc @sekoia_io

                                                            More:

                                                            The Hacker News: APT29-Linked Attackers Hijack Web Analytics Script to Deliver iOS and Android Exploits thehackernews.com/2026/11/apt2 @thehackernews

                                                              [?]AA » 🌐
                                                              @AAKL@infosec.exchange

                                                              "Pitango and F2 Venture Capital led Brava’s $15 million seed round. Angel investors also participated, including executives from Anthropic, Microsoft, and Check Point."

                                                              "'You can’t automate a decision based on evidence no one ever proved',” said Basre. 'We’re solving the problem that comes before AI can make the right decision: making sure the security infrastructure actually sees the threats it’s supposed to detect'.”

                                                              The Next Web: Brava secures $15M to help security teams find threats their systems miss thenextweb.com/news/brava-secu

                                                                [?]AA » 🌐
                                                                @AAKL@infosec.exchange

                                                                Interesting, but will it work?

                                                                "Tencent said it restricted the model's cybersecurity training to defensive uses, such as identifying software flaws and helping fix them. It excluded material on ​building hacking tools, breaking into systems and testing systems for weaknesses."

                                                                Reuters: Tencent rolls out AI model trained with limited cybersecurity data amid hacking fears reuters.com/legal/litigation/t @Reuters

                                                                  [?]AA » 🌐
                                                                  @AAKL@infosec.exchange

                                                                  Reuters: French bank Credit Mutuel Arkea hit by cyberattack reuters.com/technology/french- @Reuters

                                                                    [?]Rob Vincent 🎙️ » 🌐
                                                                    @Rob_T_Firefly@masto.hackers.town

                                                                    Spotted in our local high school. The kids may, in fact, be alright.

                                                                    Flyer posted in a school hallway advertising an extracurricular "Hack Club." A text box reads, "Something suspicious is happening after school. A new teacher. A new club. Whodunnit?" Activities mentioned include cybersecurity, digital forensics, case files, puzzles, and a game night. A "to-do" box contains a checklist which reads, "play games," "solve puzzles," and "uncover the truth." The ending blurb reads, "Join the cyber sleuths, All students welcome." The graphic design is 1990s PC desktop, naturally.

                                                                    Alt...Flyer posted in a school hallway advertising an extracurricular "Hack Club." A text box reads, "Something suspicious is happening after school. A new teacher. A new club. Whodunnit?" Activities mentioned include cybersecurity, digital forensics, case files, puzzles, and a game night. A "to-do" box contains a checklist which reads, "play games," "solve puzzles," and "uncover the truth." The ending blurb reads, "Join the cyber sleuths, All students welcome." The graphic design is 1990s PC desktop, naturally.

                                                                      [?]AA » 🌐
                                                                      @AAKL@infosec.exchange

                                                                      Oh, well, that seems like the modus operandi anyway.

                                                                      "These workers argued that OpenAI's controls were so lax ‌that outsiders, including foreign governments, could obtain sensitive information about the AI lab's technology with relative ease, the people said. For example, anybody at OpenAI who could access its code could see the technical details underlying many company projects."

                                                                      "OpenAI has begun to shift strategy to address security issues, according to two people familiar with the matter."

                                                                      Reuters: OpenAI employees warned about operational security lapses for years, sources say reuters.com/business/openai-em @Reuters

                                                                        [?]ṫẎℭỚ◎ᾔ ṫ◎ℳ » 🌐
                                                                        @TycoonTom@infosec.exchange

                                                                        @briankrebs Yes,🤔mSeven Software has provided no details about what system was targeted, how long the incident lasted, or whether vault data was actually exposed.🤦🏼Users are facing the daunting task of triaging hundreds of records and should assume a worst-case scenario and treat stored data as potentially compromised. :ablobcateyeroll:

                                                                          [?]AA » 🌐
                                                                          @AAKL@infosec.exchange

                                                                          The Register: Password manager mSecure tells users to change passwords, won't say why theregister.com/security/2026/ @theregister @carlypage

                                                                            [?]AA » 🌐
                                                                            @AAKL@infosec.exchange

                                                                            New.

                                                                            VulnCheck: CWP2Shell: The Login Page That Never Says No vulncheck.com/blog/control-web @vulncheck

                                                                              [?]AA » 🌐
                                                                              @AAKL@infosec.exchange

                                                                              Cloudflare has a new product announcement.

                                                                              Zero Wire is "a public vulnerability intelligence feed on Cloudflare Radar, bringing the clarity of a news wire service to critical security developments."

                                                                              And ...

                                                                              "Zero Wire lives inside Cloudflare Radar under the security section."

                                                                              Cloudflare: Introducing Zero Wire, a hub for investigating critical Internet vulnerabilities blog.cloudflare.com/zero-wire/ @cloudflare

                                                                              @ifin

                                                                                [?]AA » 🌐
                                                                                @AAKL@infosec.exchange

                                                                                Microsoft posted this yesterday, if you missed it.

                                                                                Microsoft: What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks microsoft.com/en-us/security/b

                                                                                  [?]AA » 🌐
                                                                                  @AAKL@infosec.exchange

                                                                                  New advisory relating to September vulnerability CVE-2026-76461.

                                                                                  CRITICAL: Cisco Secure Email Gateway SQL Injection Vulnerability sec.cloudapps.cisco.com/securi @TalosSecurity

                                                                                    [?]AA » 🌐
                                                                                    @AAKL@infosec.exchange

                                                                                    Wow. I guess the phrase should read: "... from the addicts who blamed the disclosure for cutting off their AI air supply."

                                                                                    "An OpenCode user who reported a loophole in its free AI usage limits became the target of harassment, including comments encouraging suicide, from people who blamed the disclosure for cutting off their supply of free AI."

                                                                                    Socket: OpenCode User Hit with Hostile Backlash After Reporting Free AI Loophole socket.dev/blog/opencode-free- @SocketSecurity

                                                                                      [?]AA » 🌐
                                                                                      @AAKL@infosec.exchange

                                                                                      Any.Run: Major Cyber Attacks in October 2026: Fake AI, Account Takeovers, and Remote Access Threaten US and EU any.run/cybersecurity-blog/maj @anyrun_app

                                                                                        BrianKrebs boosted

                                                                                        [?]AA » 🌐
                                                                                        @AAKL@infosec.exchange

                                                                                        If you missed this Google announcement yesterday:

                                                                                        Google: Shutting the Door on the XCPE Botnet cloud.google.com/blog/topics/t

                                                                                        More:

                                                                                        KrebsonSecurity: Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies krebsonsecurity.com/2026/11/te @briankrebs

                                                                                          [?]AA » 🌐
                                                                                          @AAKL@infosec.exchange

                                                                                          If you missed these releases yesterday:

                                                                                          Red Hat: CRITICAL: RHSB-2026-016 Use-after-free - kernel IPv4 (CVE-2026-98432) access.redhat.com/security/vul

                                                                                          Canonical: Fixes available in -proposed pocket for CVE-2026-98432 ubuntu.com/blog/fixes-availabl

                                                                                          More:

                                                                                          The Hacker News: Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing thehackernews.com/2026/11/red- @thehackernews

                                                                                            [?]AA » 🌐
                                                                                            @AAKL@infosec.exchange

                                                                                            New advisory.

                                                                                            Warning: The site linked here is a privacy nightmare: opsshield.com/notice/cpguard-u

                                                                                            More:

                                                                                            The Hacker News: cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes thehackernews.com/2026/11/cpgu @thehackernews

                                                                                              [?]AA » 🌐
                                                                                              @AAKL@infosec.exchange

                                                                                              The perfect headline of the day.

                                                                                              This assumes North Korea is behind the Binance attack, based on FBI sources, though "he source of the attack has not yet been officially confirmed."

                                                                                              The Conversation: How North Korea became a world leader in state‑sponsored hacking theconversation.com/how-north- @TheConversationUS

                                                                                                [?]Pseudo Nym » 🌐
                                                                                                @pseudonym@mastodon.online

                                                                                                @ocdtrekkie @jalefkowit

                                                                                                For those of us in Usenet back in the 90s who recall the "September that next ended" I propose this has been the Cybersecurity Awareness October that never ended.

                                                                                                "4" can be the new "green card lottery" touchstone.

                                                                                                  [?]DEF CON » 🌐
                                                                                                  @defcon@defcon.social

                                                                                                  DEF CON Training is returning to Singapore in March 2027!

                                                                                                  We’re excited to bring the DEF CON Training experience back to Singapore, connecting the cybersecurity community with new opportunities to sharpen their expertise.

                                                                                                  Courses are NOW posted on our website:
                                                                                                  sg.shop.defcon.org/collections

                                                                                                  Take a look to get a preview of what is to come and secure your seat! Early bird prices available until December 31.

                                                                                                  cllasses posted flyer

                                                                                                  Alt...cllasses posted flyer

                                                                                                    CryptoLek 🍉🌻 boosted

                                                                                                    [?]iljakrasnjanski » 🌐
                                                                                                    @iljakrasnjanski@infosec.exchange

                                                                                                    Hi Infosec.Exchange. I'm Ilja Krasnjanski, an independent security researcher.

                                                                                                    This year I reconstructed UNK_DeadDrop, a fake-job-interview campaign aimed at developers, from retained artifacts without running a sample: a 14-part series, a paper, and an open-source static scanner with YARA rules. I'll post the findings here one at a time.

                                                                                                    krasforge.github.io/UNK_DeadDr

                                                                                                      [?]AA » 🌐
                                                                                                      @AAKL@infosec.exchange

                                                                                                      Wired: Hundreds of Mundane AI Apps Are Hiding Sexually Abusive Deepfake Features wired.com/story/hundreds-of-mu @WIRED @mattburgess

                                                                                                        [?]AA » 🌐
                                                                                                        @AAKL@infosec.exchange

                                                                                                        New.

                                                                                                        VulnCheck: Exploitation Targeting Node-RED, a Tool Embedded in ICS Products vulncheck.com/blog/exploitatio @vulncheck

                                                                                                          [?]AA » 🌐
                                                                                                          @AAKL@infosec.exchange

                                                                                                          New.

                                                                                                          Rapid7: Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527) rapid7.com/blog/post/etr-addit @Rapid7Official

                                                                                                            [?]AA » 🌐
                                                                                                            @AAKL@infosec.exchange

                                                                                                            In the year 2026, dumb companies were still leaving vital customer data unsecured on their servers. We should start a new category.

                                                                                                            "Names, email addresses, and email-verification status
                                                                                                            Dates of birth, phone numbers, and ZIP codes
                                                                                                            Veteran status
                                                                                                            Account-creation dates and login counts
                                                                                                            IP addresses from customers’ most recent logins, which can indicate their approximate location"

                                                                                                            Malwrebytes: Applebee’s customer data exposed by password left in app malwarebytes.com/blog/news/202

                                                                                                            @cR0w

                                                                                                              [?]AA » 🌐
                                                                                                              @AAKL@infosec.exchange

                                                                                                              New.

                                                                                                              "This is an open-source framework in which an LLM orchestrator on the command-and-control server plans actions, selects tools, and generates commands, while an implant executes them on compromised hosts. Using CyberStrikeAI, the attackers progressed from reconnaissance to full domain compromise."

                                                                                                              Kaspersky: CyberStrikeAI in the wild: the use of AI in real-world attacks on organizations securelist.com/tr/cyberstrikea @Kaspersky

                                                                                                              @ifin

                                                                                                                [?]AA » 🌐
                                                                                                                @AAKL@infosec.exchange

                                                                                                                New.

                                                                                                                Fortinet: BITTER Expands Its Arsenal with PapRAT fortinet.com/blog/threat-resea @fortinet

                                                                                                                  [?]AA » 🌐
                                                                                                                  @AAKL@infosec.exchange

                                                                                                                  Judging by the state of things, this should be the critical infrastructure and lack of resilience year.

                                                                                                                  CISA Kicks Off Critical Infrastructure Security and Resilience Month 2026 cisa.gov/news-events/news/cisa

                                                                                                                    [?]AA » 🌐
                                                                                                                    @AAKL@infosec.exchange

                                                                                                                    They probably missed the frozen meat the first time.

                                                                                                                    The Record: Second wave of suspected cyberattacks hits supermarket freezers across Europe therecord.media/cyberattack-gr @therecord_media

                                                                                                                      [?]AA » 🌐
                                                                                                                      @AAKL@infosec.exchange

                                                                                                                      Apple Insider: German politicians targeted by iPhone spyware appleinsider.com/articles/26/1 @appleinsider @WGallagher

                                                                                                                      The Record: Apple warns users in 99 countries of mercenary spyware therecord.media/apple-warns-us @therecord_media

                                                                                                                        [?]AA » 🌐
                                                                                                                        @AAKL@infosec.exchange

                                                                                                                        Opinion by Donavan Cheah, Emerging Trends Working Group Member, ISACA.

                                                                                                                        Infosecurity-Magazine: You Are Not the Target of AI Agents: You Are the Shortcut infosecurity-magazine.com/opin

                                                                                                                          [?]AA » 🌐
                                                                                                                          @AAKL@infosec.exchange

                                                                                                                          Unfortunately, I couldn't find the actual report. But this is probably all you need to know about this company:

                                                                                                                          "Armadin is an AI-native cybersecurity company focused on building the ultimate attacker."

                                                                                                                          Infosecurity-Magazine: Armadin Tests Find 88% of Severe Flaws Outside Vendor Advisories infosecurity-magazine.com/news

                                                                                                                            [?]AA » 🌐
                                                                                                                            @AAKL@infosec.exchange

                                                                                                                            New.

                                                                                                                            Mandiant/Google: The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources cloud.google.com/blog/topics/t

                                                                                                                            Shutting the Door on the XCPE Botnet cloud.google.com/blog/topics/t

                                                                                                                            More:

                                                                                                                            The Hacker News: Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access thehackernews.com/2026/11/goog @thehackernews

                                                                                                                              [?]Trail of Bits » 🌐
                                                                                                                              @trailofbits@infosec.exchange

                                                                                                                              Stable software often ships with known bugs because the fixes are never backported. That backlog is now an easy target for cyber-capable agents.

                                                                                                                              A backport used to take an engineer days. With Codex and GPT-5.6, we’ve cut that to ~30 min for a straightforward fix (~3h for an involved one) and applied 149 CVE fixes to the Linux kernel so far.
                                                                                                                              blog.trailofbits.com/2026/11/0

                                                                                                                                Social coding commons boosted

                                                                                                                                [?]Raze ___ [OCTADE] » 🌐
                                                                                                                                @8@star.octade.net

                                                                                                                                Help me find profiles to follow ...

                                                                                                                                Looking for these kinds of accounts to follow to keep informed on software and papers:

                                                                                                                                1. ActivityPub and Fediverse hosters and software developers.
                                                                                                                                2. Secure communication hosters and software developers.
                                                                                                                                3. Usenet / NNTP hosters and software developers.
                                                                                                                                4. Cryptographers, cryptanalysts, cipher code makers and breakers.
                                                                                                                                5. Writers of papers and preprints.
                                                                                                                                6. Textual Criticism buffs and translators, including producers of papers and software.

                                                                                                                                  [?]AA » 🌐
                                                                                                                                  @AAKL@infosec.exchange

                                                                                                                                  There's an interesting entry in today's ransomware postings, claimed by a new gang:

                                                                                                                                  *** - AmplifAI (GoDaddy instance) ransomware.live/id/QW1wbGlmQUk ***

                                                                                                                                  Also, Japan's Shibata Co., Ltd. ransomware.live/id/U2hpYmF0YSB

                                                                                                                                  More: ransomware.live/

                                                                                                                                    [?]Dr. Fortyseven 🥃 █▓▒░ » 🌐
                                                                                                                                    @fortyseven@defcon.social

                                                                                                                                    reddit.com/r/agi/comments/1xjd

                                                                                                                                      [?]AA » 🌐
                                                                                                                                      @AAKL@infosec.exchange

                                                                                                                                      Today's lucky ransomware targets include the Philippines Light Rail Manila ransomware.live/id/TGlnaHQgUmF

                                                                                                                                      - US: Service One Transportation ransomware.live/id/U2VydmljZSB

                                                                                                                                      INTI International University & Colleges ransomware.live/id/SU5USSBJbnR

                                                                                                                                      More: ransomware.live/

                                                                                                                                        [?]AA » 🌐
                                                                                                                                        @AAKL@infosec.exchange

                                                                                                                                        New.

                                                                                                                                        Microsoft: From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths microsoft.com/en-us/security/b

                                                                                                                                          [?]AA » 🌐
                                                                                                                                          @AAKL@infosec.exchange

                                                                                                                                          New.

                                                                                                                                          Socket: Cursor Removes Malicious Claude Code 2.1.313 Extension From Its Marketplace socket.dev/blog/claude-code-ex @SocketSecurity

                                                                                                                                            [?]AA » 🌐
                                                                                                                                            @AAKL@infosec.exchange

                                                                                                                                            This was posted yesterday.

                                                                                                                                            "Somewhere along the way, cybersecurity turned into a certification arms race."

                                                                                                                                            "Does another certification actually make the organization more secure?"

                                                                                                                                            Blackpoint: Death by a 1000 Frameworks blackpointcyber.com/blog/death

                                                                                                                                              [?]AA » 🌐
                                                                                                                                              @AAKL@infosec.exchange

                                                                                                                                              Bitdefender: FTC takes down 19 fake government websites, cracks down on impersonation scams bitdefender.com/en-us/blog/hot

                                                                                                                                                [?]AA » 🌐
                                                                                                                                                @AAKL@infosec.exchange

                                                                                                                                                about the Binance heist.

                                                                                                                                                AP: Blockchain intelligence firms link North Korea to $6.3B hack on Binance apnews.com/article/binance-cry @AssociatedPress

                                                                                                                                                  [?]Mark Wyner Won’t Comply :vm: » 🌐
                                                                                                                                                  @markwyner@mas.to

                                                                                                                                                  The more I think about it, the more this makes me angry.

                                                                                                                                                  I have had jobs with leadership who treat people like this. It damages your health (mental, physical, and emotional).

                                                                                                                                                  And in a market like ours, I suspect there are a lot of people at Proton who have pits in their stomachs. They’re expressing their pain to their partners, or kids, or friends. Feeling trapped.

                                                                                                                                                  This is what emotional abuse, toxic masculinity, and tech-bro capitalism look like. I’m tired of people thinking ethics and technology aren’t intersectional. They are.

                                                                                                                                                  Fuck Andy Yen, and fuck @protonprivacy.

                                                                                                                                                  🧵 2/2

                                                                                                                                                  Quote from Andy Yen that reads: “That’s bullshit and loser thinking. Of course it’s possible to be fast and secure. Stop thinking always of how to be slower, and focus more on how to be faster. Only losers think like that. Stop lovingly handcrafting all our code and use AI more.” It cites the source as 404media.co/manifestos-fear-and-loser-thinking-inside-protons-ai-reckoning.

                                                                                                                                                  Alt...Quote from Andy Yen that reads: “That’s bullshit and loser thinking. Of course it’s possible to be fast and secure. Stop thinking always of how to be slower, and focus more on how to be faster. Only losers think like that. Stop lovingly handcrafting all our code and use AI more.” It cites the source as 404media.co/manifestos-fear-and-loser-thinking-inside-protons-ai-reckoning.

                                                                                                                                                    [?]AA » 🌐
                                                                                                                                                    @AAKL@infosec.exchange

                                                                                                                                                    Put a smile on your face.

                                                                                                                                                    The Record: Polymarket confirms cyberattack on third-party provider after outages therecord.media/polymarket-con @therecord_media @jgreig

                                                                                                                                                      [?]AA » 🌐
                                                                                                                                                      @AAKL@infosec.exchange

                                                                                                                                                      Cursor posted on this on X.

                                                                                                                                                      The Hacker News: Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor thehackernews.com/2026/10/offi @thehackernews

                                                                                                                                                        [?]Pseudo Nym » 🌐
                                                                                                                                                        @pseudonym@mastodon.online

                                                                                                                                                        Oh, for the love of dog.

                                                                                                                                                        If you are at all interested in you should be following @GossiTheDog for his excellent coverage.

                                                                                                                                                        In the last 24 hours we've had a 6 billion (with a B) theft from the cryptocurrency exchange, which may or may not (my money is in "may") have been due to a compromised Claude code extension phorion.io/blog/offical-claude

                                                                                                                                                        Which seems to have auto updated many developer machines to have remote access backdoors.

                                                                                                                                                        HugOps to all security computer touchers or there today.

                                                                                                                                                          [?]AA » 🌐
                                                                                                                                                          @AAKL@infosec.exchange

                                                                                                                                                          Binance was hacked yesterday. This is an update.

                                                                                                                                                          CNBC: $6.3 billion Binance hack is largest crypto theft on record cnbc.com/2026/10/29/circle-tet @CNBC

                                                                                                                                                            [?]Pseudo Nym » 🌐
                                                                                                                                                            @pseudonym@mastodon.online

                                                                                                                                                            Report is now up to 6 billion USD.

                                                                                                                                                            apnews.com/article/binance-cry

                                                                                                                                                            Not sure how they insure or claw back 6 billion.

                                                                                                                                                            Also the quote:

                                                                                                                                                            "Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions,”...

                                                                                                                                                            “We have found no evidence of any wallet private key leak,” it added.
                                                                                                                                                            ---
                                                                                                                                                            That doesn't make it better.

                                                                                                                                                              Guy boosted

                                                                                                                                                              [?]Marin Ivezic » 🌐
                                                                                                                                                              @infosec@defcon.social

                                                                                                                                                              Alice & Bob published a resource estimate today: 22,593 cat qubits could factor RSA-2048 in about three days, and the elliptic-curve discrete logarithm on secp256k1, Bitcoin's curve, would take about an hour on at most 29,588 qubits.

                                                                                                                                                              postquantum.com/security-pqc/a

                                                                                                                                                              What the paper achieves:
                                                                                                                                                              • The smallest RSA-2048 estimate I know of that runs in days, and the lowest qubits times runtime of any that comes with a paper.
                                                                                                                                                              • A physical compilation of Shor's algorithm for cat qubits, with layouts and schedules for every qubit of the dominant subroutines.
                                                                                                                                                              • A proposed common benchmark, a 512-bit discrete logarithm, that other architectures could run before RSA-2048.

                                                                                                                                                              What it assumes:
                                                                                                                                                              • No bit-flips during the run, which the paper equates with a bit-flip time of about 100 years per qubit.
                                                                                                                                                              • The best peer-reviewed measurement with quantum control is 22 seconds. Alice & Bob's own preliminary results reach 44 minutes, and about four hours on qubits where it has not yet shown the same level of control.
                                                                                                                                                              • Its largest chip with error-correction results has 12 cat qubits, running a distance-3 repetition code that is not yet below threshold.
                                                                                                                                                              • A variant with an extra error-correction layer relaxes the bit-flip requirement to about 1.3 hours, at about 45,000 qubits, but no gate set exists yet for that layer.

                                                                                                                                                              What it changes:
                                                                                                                                                              • No compliance date. NIST's final IR 8547 deprecates RSA and ECC after 2030 and disallows them after 2035.
                                                                                                                                                              • The order of work, possibly: on the same machine an elliptic-curve key takes about an hour against about three days for RSA-2048.

                                                                                                                                                              Free webinar on the 2026 estimates, today at 15:00 UTC, recording for everyone who registers: quantumacademy.com/event/webin

                                                                                                                                                                your auntifa liza 🇵🇷 🦛 🦦 boosted

                                                                                                                                                                [?]Mark Wyner Won’t Comply :vm: » 🌐
                                                                                                                                                                @markwyner@mas.to

                                                                                                                                                                RE: mas.to/@markwyner/116184563372

                                                                                                                                                                Imagine trusting your privacy with a company who favors speed over integrity.

                                                                                                                                                                A @protonprivacy employee cautioned against releasing new code that wasn’t properly tested. Andy Yen responded to all Proton employees:

                                                                                                                                                                “That’s bullshit and loser thinking. Of course it’s possible to be fast and secure. Stop thinking always of how to be slower, and focus more on how to be faster. Only losers think like that. Stop lovingly handcrafting all our code and use AI more.”

                                                                                                                                                                Some of us keep warning folks to avoid Proton. Unfortunately, others, like trusted source @privacyguides, ignore the red flags and recommend it anyway. If you use Proton, you’re at risk.

                                                                                                                                                                404media.co/manifestos-fear-an

                                                                                                                                                                🧵 1/2

                                                                                                                                                                  your auntifa liza 🇵🇷 🦛 🦦 boosted

                                                                                                                                                                  [?]Tinker ☀️ » 🌐
                                                                                                                                                                  @tinker@infosec.exchange

                                                                                                                                                                  I was just in the middle of writing up a really cool new hack methodology and realized.... I no longer care to do write ups for hacking.

                                                                                                                                                                  I'm proper and completely done.

                                                                                                                                                                  I also am really tired of AI scraping up all of my previous writings and shitting it out wrongly and without attributions.

                                                                                                                                                                  Instead, I'll go to my local hacker meetup next week and do a quick unrecorded fire talk to anyone who shows up.

                                                                                                                                                                  Then I'll sit down and have a meal and drink with my friends.

                                                                                                                                                                  And it'll be good.

                                                                                                                                                                    IFIN - The Independent Federated Intelligence Network boosted

                                                                                                                                                                    [?]AA » 🌐
                                                                                                                                                                    @AAKL@infosec.exchange

                                                                                                                                                                    New.

                                                                                                                                                                    Radware: Inside a GitHub Supply Chain Attack Campaign: Command Injection, Attempts to Exfiltrate CI/CD Data, and Evidence of Execution radware.com/blog/inside-a-gith @ifin

                                                                                                                                                                    More:

                                                                                                                                                                    The Register: Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour theregister.com/security/2026/ @theregister @jessica_lyons

                                                                                                                                                                      [?]Eddie. » 🌐
                                                                                                                                                                      @infoseclogger@infosec.exchange

                                                                                                                                                                      Question for people who have attended defcon:

                                                                                                                                                                      I was going thinking about submitting a talk on Win Conditions, and using my work transitioning family and friends to Linux as the story to explain milestones and how 80% of a transition is still a huge win.

                                                                                                                                                                      Would people want to hear this talk?
                                                                                                                                                                      Is this the type of talk that would be approved?


                                                                                                                                                                        [?]your auntifa liza 🇵🇷 🦛 🦦 » 🌐
                                                                                                                                                                        @blogdiva@mastodon.social

                                                                                                                                                                        🔥🔥🔥🔥🔥🔥🔥🔥🔥

                                                                                                                                                                        » Massive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE Agents | WIRED
                                                                                                                                                                        wired.com/story/massive-leak-e

                                                                                                                                                                          AA boosted

                                                                                                                                                                          [?]Walker » 🌐
                                                                                                                                                                          @Walker@infosec.exchange

                                                                                                                                                                          This past week, the number of unsolicited bug reports submitted by external researchers has increased exponentially.

                                                                                                                                                                          I suspect that AI is fueling the rise. Too bad clients do not have a bug bounty program. Clients do not appreciate the threats akin to hostage negotiations when payment is declined.

                                                                                                                                                                            [?]Yale Privacy Lab » 🤖 🌐
                                                                                                                                                                            @yaleprivacylab@privacysafe.social

                                                                                                                                                                            TOMORROW: Join us online, in New Haven, or in Boston for , a joint event with @fsf ! Our @profdiggity will be interviewing @hen from @techlore at 1:00pm EDT

                                                                                                                                                                            Register: my.fsf.org/civicrm/event/regis

                                                                                                                                                                              [?]Trail of Bits » 🌐
                                                                                                                                                                              @trailofbits@infosec.exchange

                                                                                                                                                                              We’re still testing how exploitable the Node.js/Brotli bug (CVE-2026-111497) is, but we’ve found it’s hard to tell whether you’re even affected.

                                                                                                                                                                              Brotli’s decoder gets bundled into apps, packages, and containers, and patching your OS library leaves those copies alone. Node’s fetch() decodes Brotli responses even when the request asks for no compression.

                                                                                                                                                                              Brotli Checker finds vulnerable copies, even in stripped binaries.
                                                                                                                                                                              github.com/trailofbits/brotli-

                                                                                                                                                                                Tinker ☀️ boosted

                                                                                                                                                                                [?]Pseudo Nym » 🌐
                                                                                                                                                                                @pseudonym@mastodon.online

                                                                                                                                                                                @coreysnipes @tinker

                                                                                                                                                                                The security posture can not be truly known. It can only be experienced.

                                                                                                                                                                                The absence of the asset inventory is not enlightenment.

                                                                                                                                                                                Before patching the systems, chop wood, carry water, and run vuln scans. After patching the system, chop wood, carry water, and run vuln scans.

                                                                                                                                                                                  Cenobyte :abunhdowohop: boosted

                                                                                                                                                                                  [?]Xavier Ashe :donor: » 🌐
                                                                                                                                                                                  @Xavier@infosec.exchange

                                                                                                                                                                                  Screen grab from the Matrix looking at the matrix symbols flows down the screen. Overlayed text says, "I don't even see the CVEs anymore."

                                                                                                                                                                                  Alt...Screen grab from the Matrix looking at the matrix symbols flows down the screen. Overlayed text says, "I don't even see the CVEs anymore."

                                                                                                                                                                                    [?]Flippin' 'eck, Tucker! [he/him] » 🌐
                                                                                                                                                                                    @losttourist@social.chatty.monster

                                                                                                                                                                                    @bryan Oh hooray. I've just been thinking what an awfully quiet and boring time it's been in and worlds this week.

                                                                                                                                                                                      Magnus boosted

                                                                                                                                                                                      [?]Andrew :hokkaido: :famichiki: » 🌐
                                                                                                                                                                                      @piepants@famichiki.jp

                                                                                                                                                                                      The Doctor Who meme “is four a lot?” “depends on the context. as a private key? no. PHP vulnerabilities? yes.”

                                                                                                                                                                                      Alt...The Doctor Who meme “is four a lot?” “depends on the context. as a private key? no. PHP vulnerabilities? yes.”

                                                                                                                                                                                        [?]argv[-1] » 🌐
                                                                                                                                                                                        @argv_minus_one@mastodon.sdf.org

                                                                                                                                                                                        @fluepke

                                                                                                                                                                                        It's not their fault that lots of devices and software, including and , *don't check revocation*.

                                                                                                                                                                                        This isn't just an epic fail at . This is also an epic fail in all manner of clients.

                                                                                                                                                                                        If not for this shocking act of negligence by just about everyone who ever wrote a TLS client, it'd have been a simple matter of “sorry everyone, reissue your certs” and then it's back to business as usual at eMudhra.

                                                                                                                                                                                        @dee @q

                                                                                                                                                                                          [?]Walker » 🌐
                                                                                                                                                                                          @Walker@infosec.exchange

                                                                                                                                                                                          We are getting reports of attempts against web servers a day before the public announcement as seen in logs.

                                                                                                                                                                                          How is your Thursday going?

                                                                                                                                                                                            [?]shellsharks » 🌐
                                                                                                                                                                                            @shellsharks@shellsharks.social

                                                                                                                                                                                            I think we can all agree that the ongoing PHP situation (#php2shell) is pure chaos. Sites being pulled down, everyone scrambling to produce a working exploit, botched disclosure, tons of half-assed exploitation attempts in the wild, etc. But my favorite part of this whole mess has been watching everyone and their mom trying to claim some bit of credit for it all... read on if you want a bit of a laugh (or you just want to try to make sense of it)

                                                                                                                                                                                            shellsharks.com/php2chaos

                                                                                                                                                                                              GeePawHill boosted

                                                                                                                                                                                              [?]xoron :verified: » 🌐
                                                                                                                                                                                              @xoron@infosec.exchange

                                                                                                                                                                                              The Signal Protocol in Rust

                                                                                                                                                                                              TL;DR: I have open-sourced a implementation of the that compiles to for -based messaging, overcoming the limitations of the official library.

                                                                                                                                                                                              I am sharing my implementation of the Signal Protocol designed specifically for the . While the official libsignal is the gold standard, its targets are often optimized for Node.js, which creates integration challenges for client-side web applications.

                                                                                                                                                                                              My version is built in and compiles to , utilizing to provide robust for decentralized environments. It currently powers the end-to-end security for my series of messaging projects.

                                                                                                                                                                                              Protocol Demo:
                                                                                                                                                                                              signal.positive-intentions.com/

                                                                                                                                                                                              P2P Messaging roadmap:
                                                                                                                                                                                              glitr.io/docs/technical/roadmap

                                                                                                                                                                                              I am looking for feedback from the and community. If you have experience with audits or formal-proof verification, I would appreciate your eyes on the codebase as I work toward a more finished state.

                                                                                                                                                                                              GitHub Repository:
                                                                                                                                                                                              github.com/positive-intentions

                                                                                                                                                                                              signal protocol

                                                                                                                                                                                              Alt...signal protocol

                                                                                                                                                                                                A Part of Bee boosted

                                                                                                                                                                                                [?]Mike Sheward » 🌐
                                                                                                                                                                                                @SecureOwl@infosec.exchange

                                                                                                                                                                                                a reminder that if you see a vendor having an unscheduled outage today to apply PHP patches - that is actually one of the most encouraging things you can see from an perspective, because it means

                                                                                                                                                                                                A) someone/some people at the vendor is paying attention

                                                                                                                                                                                                B) that person/people has enough sway to have them bring down prod in the middle of the day to apply patches

                                                                                                                                                                                                C) enough people at the vendor actually know what software they are running to know its an issue that needs to be dealt with

                                                                                                                                                                                                So, reach out to them and let them know you appreciate it - so they have something to show people who push back the next time a similar thing happens

                                                                                                                                                                                                  sb boosted

                                                                                                                                                                                                  [?]Michał "rysiek" Woźniak · 🇺🇦 » 🌐
                                                                                                                                                                                                  @rysiek@mstdn.social

                                                                                                                                                                                                  This week in

                                                                                                                                                                                                  Alt...An old silent movie, showing Buster Keaton removing obstacles in front of a slowly running steam train, in the most slap-sticky fashion you can imagine.

                                                                                                                                                                                                    [?]R.L. Dane :Debian: :FreeBSD: :OpenBSD: :NetBSD:🍵 :MiraLovesYou: [he/him/my good fellow] » 🌐
                                                                                                                                                                                                    @rl_dane@polymaths.social

                                                                                                                                                                                                    @MaddieM4

                                                                                                                                                                                                    I worked in #infosec in the "naughties." Even back then, I thought the prevalent concept of "security as a product" was laughable.

                                                                                                                                                                                                    With all of the stuff that's going on today, I wish we'd just start over from scratch using NASA Apollo-esque coding standards. Do less, and make it solid. Heck, go for some Djikstraesque "provability." I dunno. Everything is just so slipshod.

                                                                                                                                                                                                    (And to those reading, I'm not saying that as an attack on the PHP devs. They're doing the best they can with the resources they're given, and should be commended for working so hard to hold up 70% of the web, for crying out loud)

                                                                                                                                                                                                      [?]ṫẎℭỚ◎ᾔ ṫ◎ℳ » 🌐
                                                                                                                                                                                                      @TycoonTom@infosec.exchange

                                                                                                                                                                                                      @briankrebs 🚨 A critical vulnerability🚨 affecting all PHP versions back to 5.4 allows attackers to execute arbitrary commands on the server without authentication. If you are responsible for any public-facing PHP-based system (Wordpress, forums, etc.) you'll want to take immediate action.

                                                                                                                                                                                                      Reports call this one of the most serious security issues has ever faced. Working exploits are publicly available and attacks are underway. Reuters reports that government websites across Europe and elsewhere have been taken offline to prevent their attack.

                                                                                                                                                                                                      Mitigations can be applied to the PHP.INI configuration file for immediate protection, but the PHP binaries should be updated. Patched releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

                                                                                                                                                                                                      The PHP project's home page has all the details and mitigations: php.net/

                                                                                                                                                                                                        Guillaume Ross boosted

                                                                                                                                                                                                        [?]IAintShootinMis » 🌐
                                                                                                                                                                                                        @iaintshootinmis@digitaldarkage.cc

                                                                                                                                                                                                        Anyone have the data in a searchable format? Or the data? Really hoping or someone makes it easily searchable so we can threat hunt our companies/vendors/et al.

                                                                                                                                                                                                          [?]Trail of Bits » 🌐
                                                                                                                                                                                                          @trailofbits@infosec.exchange

                                                                                                                                                                                                          We analyzed thousands of Codex sessions across our Patch the Planet work and built patching-bugs, a plugin that reproduces a bug on a running build, writes the fix, and proves it: the original code fails, the patch passes, and a revert brings the bug back.

                                                                                                                                                                                                          Then regression-hunt, our second new plugin, checks what the fix broke. Install both and run them on your next bug report.

                                                                                                                                                                                                          blog.trailofbits.com/2026/10/2

                                                                                                                                                                                                            [?]Pseudo Nym » 🌐
                                                                                                                                                                                                            @pseudonym@mastodon.online

                                                                                                                                                                                                            @angusm

                                                                                                                                                                                                            My guess is it will be something like this:

                                                                                                                                                                                                            0: <do most of the right things>
                                                                                                                                                                                                            1: Copy private key value a byte at a time into target buffer
                                                                                                                                                                                                            2: forget to increment target buffer index
                                                                                                                                                                                                            3: Profit!

                                                                                                                                                                                                              [?]Michał "rysiek" Woźniak · 🇺🇦 » 🌐
                                                                                                                                                                                                              @rysiek@mstdn.social

                                                                                                                                                                                                              Sury PHP repo has upgrades already.

                                                                                                                                                                                                              I see upgrades also for 7x and 8.0.x, 8.1.x, which I thought are not getting the patch. Unclear what that means, but those updated packages were not there 10min ago, so it seems related to the CVEs?

                                                                                                                                                                                                                A Part of Bee boosted

                                                                                                                                                                                                                [?]Soatok Dreamseeker [he/him] » 🌐
                                                                                                                                                                                                                @soatok@furry.engineer

                                                                                                                                                                                                                Embargo is lifted.

                                                                                                                                                                                                                github.com/php/php-src/securit

                                                                                                                                                                                                                github.com/php/php-src/securit

                                                                                                                                                                                                                Patched versions:

                                                                                                                                                                                                                • 8.5.12
                                                                                                                                                                                                                • 8.4.27
                                                                                                                                                                                                                • 8.3.36
                                                                                                                                                                                                                • 8.2.35

                                                                                                                                                                                                                (Some operating systems backport fixes and may have a different version number with the fix. I personally use deb.sury.org on Debian/Ubuntu to have some sanity, but not everyone does, so check your OS for specific guidance.)

                                                                                                                                                                                                                  [?]Walker » 🌐
                                                                                                                                                                                                                  @Walker@infosec.exchange

                                                                                                                                                                                                                  Happy PHP Wednesday.

                                                                                                                                                                                                                  "In the last hour, two remote code execution vulnerabilities in PHP have been leaked. These vulnerabilities were previously scheduled under embargo and due for release on Thursday at 11 am ET," watchTowr CEO Benjamin Harris told BleepingComputer.

                                                                                                                                                                                                                  bleepingcomputer.com/news/secu

                                                                                                                                                                                                                    Nicole Parsons boosted

                                                                                                                                                                                                                    [?]Michał "rysiek" Woźniak · 🇺🇦 » 🌐
                                                                                                                                                                                                                    @rysiek@mstdn.social

                                                                                                                                                                                                                    this is probably a good moment to consider going static site for your next project :blobcatcoffee:

                                                                                                                                                                                                                      🗳
                                                                                                                                                                                                                      John M. Gamble boosted

                                                                                                                                                                                                                      [?]rk: it’s hyphen-minus actually » 🌐
                                                                                                                                                                                                                      @rk@mastodon.well.com

                                                                                                                                                                                                                      Hey infosec folks, how’s this week going?

                                                                                                                                                                                                                      Red team, great:2
                                                                                                                                                                                                                      Red team, bad:2
                                                                                                                                                                                                                      Blue team, great:1
                                                                                                                                                                                                                      Blue team, bad:6

                                                                                                                                                                                                                        [?]Dr. Fortyseven 🥃 █▓▒░ » 🌐
                                                                                                                                                                                                                        @fortyseven@defcon.social

                                                                                                                                                                                                                        All users are encouraged to prepare now so they can upgrade as soon as the release is available.

                                                                                                                                                                                                                        php.net/archive/2026.php#2026-

                                                                                                                                                                                                                          [?]Plaid [He/His] » 🌐
                                                                                                                                                                                                                          @plaidtron3000@jorts.horse

                                                                                                                                                                                                                          Me, to no one in particular: “0b100”

                                                                                                                                                                                                                          Everyone in everywhere: AAAAHAHAHAHAHAHAHAHAHAHAHAHAHAHA

                                                                                                                                                                                                                            ari :prideified: boosted

                                                                                                                                                                                                                            [?]Michał "rysiek" Woźniak · 🇺🇦 » 🌐
                                                                                                                                                                                                                            @rysiek@mstdn.social

                                                                                                                                                                                                                            The day started with a major Google Cloud outage in Europe, proceeded swiftly to the eMudhra root cert dumpsterfuck, and now the critical PHP vulns are starting to hit.

                                                                                                                                                                                                                            Cool, cool. :blobcatcoffee:

                                                                                                                                                                                                                              [?]Michał "rysiek" Woźniak · 🇺🇦 » 🌐
                                                                                                                                                                                                                              @rysiek@mstdn.social

                                                                                                                                                                                                                              4, 56, 66, 115, 155, 156, 230 and 237? Amazing, I have the same combination on my luggage!

                                                                                                                                                                                                                                [?]Michał "rysiek" Woźniak · 🇺🇦 » 🌐
                                                                                                                                                                                                                                @rysiek@mstdn.social

                                                                                                                                                                                                                                Looking back, Mozilla could have just as well added Honest Achmed's root CA anyway:
                                                                                                                                                                                                                                bugzilla.mozilla.org/show_bug.

                                                                                                                                                                                                                                  Back to top - More...

                                                                                                                                                                                                                                  about this site - powered by snac/2.93-dev