#Security

🚨 Actively abused vulnerability in WP 🚨

WordPress has an actively abused SQL injection in the core in versions =<7.0.1. You should update to 7.0.2 as soon as humanly possible. Sites are already exploited.

Check whether the site has admin users that you don't recognize

More info: patchstack

Note: it has been a long time since there was a nasty vuln like this in the WP core.

#WordPress #Security #Vulnerability #Exploit #Patch

🚨 Actively abused vulnerability in WP 🚨

WordPress has an actively abused SQL injection in the core in versions =<7.0.1. You should update to 7.0.2 as soon as humanly possible. Sites are already exploited.

Check whether the site has admin users that you don't recognize

More info: patchstack

Note: it has been a long time since there was a nasty vuln like this in the WP core.

#WordPress #Security #Vulnerability #Exploit #Patch

If you use BotKit, update to a patched release now. CVE-2026-62857 affects Fedify's NodeInfo client, and BotKit includes the affected Fedify versions as a dependency.

Fedify can look up a remote server's NodeInfo document to learn what software it runs. The lookup first fetches the server's /.well-known/nodeinfo document, then follows the NodeInfo document URL advertised in that response. The vulnerable paths are getNodeInfo() and the Context.lookupNodeInfo() method that wraps it: affected versions sent both requests without checking that their destinations were on the public internet. Because the second URL comes from the remote server's response, an attacker who controls a server being looked up could point it at a loopback address, a link-local cloud metadata endpoint, an RFC 1918 host, or a data: URL. Depending on the deployment environment and network routing, this could cause a BotKit application that looks up NodeInfo to fetch non-public network resources and return their contents to the application.

The fix routes both requests through Fedify's public-address validation. It checks every request before sending it, including each redirect hop, limits the number of redirects, refuses redirects that cross protocols, and rejects non-HTTP(S) URLs. Servers are exposed only if they look up remote NodeInfo, but such lookups are commonly used for peer discovery and instance metadata.

BotKit 0.4.x versions through 0.4.4 and BotKit 0.5.0 are affected. Patched releases are 0.4.5 and 0.5.1. BotKit 0.4.5 uses Fedify 2.1.19, and BotKit 0.5.1 uses Fedify 2.3.3.

For BotKit 0.5.x, update @fedify/botkit:

npm  update  @fedify/botkit
yarn upgrade @fedify/botkit
pnpm update  @fedify/botkit
bun  update  @fedify/botkit
deno update  @fedify/botkit

For BotKit 0.4.x, update @fedify/botkit:

npm  update  @fedify/botkit@0.4.5
yarn upgrade @fedify/botkit@0.4.5
pnpm update  @fedify/botkit@0.4.5
bun  update  @fedify/botkit@0.4.5
deno update  @fedify/botkit@0.4.5

After updating, redeploy. The GitHub Security Advisory is GHSA-hqph-j65v-8cq5, and the CVE ID is CVE-2026-62857. See also Fedify's own announcement.

Thanks to @rvzsec and @manus-use for the report and responsible disclosure.

If anything is unclear, feel free to ask on GitHub Discussions or Matrix.

If you use BotKit, update to a patched release now. CVE-2026-62857 affects Fedify's NodeInfo client, and BotKit includes the affected Fedify versions as a dependency.

Fedify can look up a remote server's NodeInfo document to learn what software it runs. The lookup first fetches the server's /.well-known/nodeinfo document, then follows the NodeInfo document URL advertised in that response. The vulnerable paths are getNodeInfo() and the Context.lookupNodeInfo() method that wraps it: affected versions sent both requests without checking that their destinations were on the public internet. Because the second URL comes from the remote server's response, an attacker who controls a server being looked up could point it at a loopback address, a link-local cloud metadata endpoint, an RFC 1918 host, or a data: URL. Depending on the deployment environment and network routing, this could cause a BotKit application that looks up NodeInfo to fetch non-public network resources and return their contents to the application.

The fix routes both requests through Fedify's public-address validation. It checks every request before sending it, including each redirect hop, limits the number of redirects, refuses redirects that cross protocols, and rejects non-HTTP(S) URLs. Servers are exposed only if they look up remote NodeInfo, but such lookups are commonly used for peer discovery and instance metadata.

BotKit 0.4.x versions through 0.4.4 and BotKit 0.5.0 are affected. Patched releases are 0.4.5 and 0.5.1. BotKit 0.4.5 uses Fedify 2.1.19, and BotKit 0.5.1 uses Fedify 2.3.3.

For BotKit 0.5.x, update @fedify/botkit:

npm  update  @fedify/botkit
yarn upgrade @fedify/botkit
pnpm update  @fedify/botkit
bun  update  @fedify/botkit
deno update  @fedify/botkit

For BotKit 0.4.x, update @fedify/botkit:

npm  update  @fedify/botkit@0.4.5
yarn upgrade @fedify/botkit@0.4.5
pnpm update  @fedify/botkit@0.4.5
bun  update  @fedify/botkit@0.4.5
deno update  @fedify/botkit@0.4.5

After updating, redeploy. The GitHub Security Advisory is GHSA-hqph-j65v-8cq5, and the CVE ID is CVE-2026-62857. See also Fedify's own announcement.

Thanks to @rvzsec and @manus-use for the report and responsible disclosure.

If anything is unclear, feel free to ask on GitHub Discussions or Matrix.

If you use BotKit, update to a patched release now. CVE-2026-62857 affects Fedify's NodeInfo client, and BotKit includes the affected Fedify versions as a dependency.

Fedify can look up a remote server's NodeInfo document to learn what software it runs. The lookup first fetches the server's /.well-known/nodeinfo document, then follows the NodeInfo document URL advertised in that response. The vulnerable paths are getNodeInfo() and the Context.lookupNodeInfo() method that wraps it: affected versions sent both requests without checking that their destinations were on the public internet. Because the second URL comes from the remote server's response, an attacker who controls a server being looked up could point it at a loopback address, a link-local cloud metadata endpoint, an RFC 1918 host, or a data: URL. Depending on the deployment environment and network routing, this could cause a BotKit application that looks up NodeInfo to fetch non-public network resources and return their contents to the application.

The fix routes both requests through Fedify's public-address validation. It checks every request before sending it, including each redirect hop, limits the number of redirects, refuses redirects that cross protocols, and rejects non-HTTP(S) URLs. Servers are exposed only if they look up remote NodeInfo, but such lookups are commonly used for peer discovery and instance metadata.

BotKit 0.4.x versions through 0.4.4 and BotKit 0.5.0 are affected. Patched releases are 0.4.5 and 0.5.1. BotKit 0.4.5 uses Fedify 2.1.19, and BotKit 0.5.1 uses Fedify 2.3.3.

For BotKit 0.5.x, update @fedify/botkit:

npm  update  @fedify/botkit
yarn upgrade @fedify/botkit
pnpm update  @fedify/botkit
bun  update  @fedify/botkit
deno update  @fedify/botkit

For BotKit 0.4.x, update @fedify/botkit:

npm  update  @fedify/botkit@0.4.5
yarn upgrade @fedify/botkit@0.4.5
pnpm update  @fedify/botkit@0.4.5
bun  update  @fedify/botkit@0.4.5
deno update  @fedify/botkit@0.4.5

After updating, redeploy. The GitHub Security Advisory is GHSA-hqph-j65v-8cq5, and the CVE ID is CVE-2026-62857. See also Fedify's own announcement.

Thanks to @rvzsec and @manus-use for the report and responsible disclosure.

If anything is unclear, feel free to ask on GitHub Discussions or Matrix.

If you use BotKit, update to a patched release now. CVE-2026-62857 affects Fedify's NodeInfo client, and BotKit includes the affected Fedify versions as a dependency.

Fedify can look up a remote server's NodeInfo document to learn what software it runs. The lookup first fetches the server's /.well-known/nodeinfo document, then follows the NodeInfo document URL advertised in that response. The vulnerable paths are getNodeInfo() and the Context.lookupNodeInfo() method that wraps it: affected versions sent both requests without checking that their destinations were on the public internet. Because the second URL comes from the remote server's response, an attacker who controls a server being looked up could point it at a loopback address, a link-local cloud metadata endpoint, an RFC 1918 host, or a data: URL. Depending on the deployment environment and network routing, this could cause a BotKit application that looks up NodeInfo to fetch non-public network resources and return their contents to the application.

The fix routes both requests through Fedify's public-address validation. It checks every request before sending it, including each redirect hop, limits the number of redirects, refuses redirects that cross protocols, and rejects non-HTTP(S) URLs. Servers are exposed only if they look up remote NodeInfo, but such lookups are commonly used for peer discovery and instance metadata.

BotKit 0.4.x versions through 0.4.4 and BotKit 0.5.0 are affected. Patched releases are 0.4.5 and 0.5.1. BotKit 0.4.5 uses Fedify 2.1.19, and BotKit 0.5.1 uses Fedify 2.3.3.

For BotKit 0.5.x, update @fedify/botkit:

npm  update  @fedify/botkit
yarn upgrade @fedify/botkit
pnpm update  @fedify/botkit
bun  update  @fedify/botkit
deno update  @fedify/botkit

For BotKit 0.4.x, update @fedify/botkit:

npm  update  @fedify/botkit@0.4.5
yarn upgrade @fedify/botkit@0.4.5
pnpm update  @fedify/botkit@0.4.5
bun  update  @fedify/botkit@0.4.5
deno update  @fedify/botkit@0.4.5

After updating, redeploy. The GitHub Security Advisory is GHSA-hqph-j65v-8cq5, and the CVE ID is CVE-2026-62857. See also Fedify's own announcement.

Thanks to @rvzsec and @manus-use for the report and responsible disclosure.

If anything is unclear, feel free to ask on GitHub Discussions or Matrix.

6 Security Settings Every GitHub Maintainer Should Enable This Week, by (not on Mastodon or Bluesky):

https://github.blog/security/6-security-settings-every-github-maintainer-should-enable-this-week/?ref=frontenddogma.com

#github #security #configuration #documentation

OpenSSL HollowByte: A DoS Hiding in 11 Bytes https://lobste.rs/s/tvpnsm #security
https://sec.okta.com/articles/2026/06/openssl-hollowbtye-a-dos-hiding-in-11-bytes/

wp2shell: Pre Authentication RCE in WordPress Core https://lobste.rs/s/aipvbn #security #web
https://wp2shell.com/

If you use Fedify, update to a patched release now. CVE-2026-62857 affects Fedify's NodeInfo client. An attacker who runs any instance your server looks up could cause that server to fetch non-public network destinations and return their contents to your application, depending on the deployment environment and network routing.

Fedify can look up a remote instance's NodeInfo document to learn what software it runs. The lookup happens in two steps: it fetches the instance's /.well-known/nodeinfo document, then follows the NodeInfo document URL that response advertises. The vulnerable path is getNodeInfo(), along with the Context.lookupNodeInfo() method that wraps it: affected versions sent both requests without validating the destination against public-network expectations. Because that second URL comes straight out of the remote server's response body, the instance being looked up fully controls it, and could point it at a loopback address, a link-local metadata endpoint, an RFC 1918 host, or a data: URL. Servers are exposed only if they look up NodeInfo, but that lookup is routine for peer discovery and instance metadata.

The fix routes both requests through the same public-address validation Fedify already applied to WebFinger lookups and remote document loading. Every request is now checked before it is sent, including each redirect hop, so a public URL cannot bounce a request to an internal address. Redirects are followed with a cap and are refused if they cross protocols, and non-HTTP(S) URLs such as data: are rejected outright.

These are patch releases, so they tighten behavior without adding new API. If you deliberately look up NodeInfo on a private or intranet address, such as in a closed federation or a test environment, these releases will now refuse it. An allowPrivateAddress opt-out is coming in 2.4.0.

Current patched releases are 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2. The GitHub Security Advisory is GHSA-hqph-j65v-8cq5, and the CVE ID is CVE-2026-62857.

Update @fedify/fedify:

npm  update  @fedify/fedify
yarn upgrade @fedify/fedify
pnpm update  @fedify/fedify
bun  update  @fedify/fedify
deno update  @fedify/fedify

After updating, redeploy. If you run other Fedify-based servers, update those too.

Thanks to @rvzsec and @manus-use for the report and responsible disclosure.

If anything is unclear, ask below.

If you use Fedify, update to a patched release now. CVE-2026-62857 affects Fedify's NodeInfo client. An attacker who runs any instance your server looks up could cause that server to fetch non-public network destinations and return their contents to your application, depending on the deployment environment and network routing.

Fedify can look up a remote instance's NodeInfo document to learn what software it runs. The lookup happens in two steps: it fetches the instance's /.well-known/nodeinfo document, then follows the NodeInfo document URL that response advertises. The vulnerable path is getNodeInfo(), along with the Context.lookupNodeInfo() method that wraps it: affected versions sent both requests without validating the destination against public-network expectations. Because that second URL comes straight out of the remote server's response body, the instance being looked up fully controls it, and could point it at a loopback address, a link-local metadata endpoint, an RFC 1918 host, or a data: URL. Servers are exposed only if they look up NodeInfo, but that lookup is routine for peer discovery and instance metadata.

The fix routes both requests through the same public-address validation Fedify already applied to WebFinger lookups and remote document loading. Every request is now checked before it is sent, including each redirect hop, so a public URL cannot bounce a request to an internal address. Redirects are followed with a cap and are refused if they cross protocols, and non-HTTP(S) URLs such as data: are rejected outright.

These are patch releases, so they tighten behavior without adding new API. If you deliberately look up NodeInfo on a private or intranet address, such as in a closed federation or a test environment, these releases will now refuse it. An allowPrivateAddress opt-out is coming in 2.4.0.

Current patched releases are 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2. The GitHub Security Advisory is GHSA-hqph-j65v-8cq5, and the CVE ID is CVE-2026-62857.

Update @fedify/fedify:

npm  update  @fedify/fedify
yarn upgrade @fedify/fedify
pnpm update  @fedify/fedify
bun  update  @fedify/fedify
deno update  @fedify/fedify

After updating, redeploy. If you run other Fedify-based servers, update those too.

Thanks to @rvzsec and @manus-use for the report and responsible disclosure.

If anything is unclear, ask below.

If you use Fedify, update to a patched release now. CVE-2026-62857 affects Fedify's NodeInfo client. An attacker who runs any instance your server looks up could cause that server to fetch non-public network destinations and return their contents to your application, depending on the deployment environment and network routing.

Fedify can look up a remote instance's NodeInfo document to learn what software it runs. The lookup happens in two steps: it fetches the instance's /.well-known/nodeinfo document, then follows the NodeInfo document URL that response advertises. The vulnerable path is getNodeInfo(), along with the Context.lookupNodeInfo() method that wraps it: affected versions sent both requests without validating the destination against public-network expectations. Because that second URL comes straight out of the remote server's response body, the instance being looked up fully controls it, and could point it at a loopback address, a link-local metadata endpoint, an RFC 1918 host, or a data: URL. Servers are exposed only if they look up NodeInfo, but that lookup is routine for peer discovery and instance metadata.

The fix routes both requests through the same public-address validation Fedify already applied to WebFinger lookups and remote document loading. Every request is now checked before it is sent, including each redirect hop, so a public URL cannot bounce a request to an internal address. Redirects are followed with a cap and are refused if they cross protocols, and non-HTTP(S) URLs such as data: are rejected outright.

These are patch releases, so they tighten behavior without adding new API. If you deliberately look up NodeInfo on a private or intranet address, such as in a closed federation or a test environment, these releases will now refuse it. An allowPrivateAddress opt-out is coming in 2.4.0.

Current patched releases are 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2. The GitHub Security Advisory is GHSA-hqph-j65v-8cq5, and the CVE ID is CVE-2026-62857.

Update @fedify/fedify:

npm  update  @fedify/fedify
yarn upgrade @fedify/fedify
pnpm update  @fedify/fedify
bun  update  @fedify/fedify
deno update  @fedify/fedify

After updating, redeploy. If you run other Fedify-based servers, update those too.

Thanks to @rvzsec and @manus-use for the report and responsible disclosure.

If anything is unclear, ask below.

If you use Fedify, update to a patched release now. CVE-2026-62857 affects Fedify's NodeInfo client. An attacker who runs any instance your server looks up could cause that server to fetch non-public network destinations and return their contents to your application, depending on the deployment environment and network routing.

Fedify can look up a remote instance's NodeInfo document to learn what software it runs. The lookup happens in two steps: it fetches the instance's /.well-known/nodeinfo document, then follows the NodeInfo document URL that response advertises. The vulnerable path is getNodeInfo(), along with the Context.lookupNodeInfo() method that wraps it: affected versions sent both requests without validating the destination against public-network expectations. Because that second URL comes straight out of the remote server's response body, the instance being looked up fully controls it, and could point it at a loopback address, a link-local metadata endpoint, an RFC 1918 host, or a data: URL. Servers are exposed only if they look up NodeInfo, but that lookup is routine for peer discovery and instance metadata.

The fix routes both requests through the same public-address validation Fedify already applied to WebFinger lookups and remote document loading. Every request is now checked before it is sent, including each redirect hop, so a public URL cannot bounce a request to an internal address. Redirects are followed with a cap and are refused if they cross protocols, and non-HTTP(S) URLs such as data: are rejected outright.

These are patch releases, so they tighten behavior without adding new API. If you deliberately look up NodeInfo on a private or intranet address, such as in a closed federation or a test environment, these releases will now refuse it. An allowPrivateAddress opt-out is coming in 2.4.0.

Current patched releases are 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2. The GitHub Security Advisory is GHSA-hqph-j65v-8cq5, and the CVE ID is CVE-2026-62857.

Update @fedify/fedify:

npm  update  @fedify/fedify
yarn upgrade @fedify/fedify
pnpm update  @fedify/fedify
bun  update  @fedify/fedify
deno update  @fedify/fedify

After updating, redeploy. If you run other Fedify-based servers, update those too.

Thanks to @rvzsec and @manus-use for the report and responsible disclosure.

If anything is unclear, ask below.

How Far Behind the Frontier are Leading Open Weight Models on Cyber? https://lobste.rs/s/vrcctk #security #vibecoding
https://www.aisi.gov.uk/blog/how-far-behind-the-frontier-are-leading-open-weight-models-on-cyber

Journey to Root, Episode I: The Maglev King https://lobste.rs/s/i0mnxl #security #vibecoding
https://blog.calif.io/p/journey-to-root-episode-i-the-maglev

PACT: Anonymous Credentials for the Web – Mozilla Hacks https://lobste.rs/s/6pdyiy #privacy #security
https://hacks.mozilla.org/2026/06/pact-anonymous-credentials-for-the-web/

Amnesty International (@amnesty) Security Lab just released their most complete breakdown of the Pegasus spyware.

If you have time, go give it a read

https://securitylab.amnesty.org/latest/2026/07/inside-pegasus-the-evolution-of-the-worlds-most-notorious-spyware/

#cybersecurity #infosec #pegasus #spyware #security

Amnesty International (@amnesty) Security Lab just released their most complete breakdown of the Pegasus spyware.

If you have time, go give it a read

https://securitylab.amnesty.org/latest/2026/07/inside-pegasus-the-evolution-of-the-worlds-most-notorious-spyware/

#cybersecurity #infosec #pegasus #spyware #security

Amnesty International (@amnesty) Security Lab just released their most complete breakdown of the Pegasus spyware.

If you have time, go give it a read

https://securitylab.amnesty.org/latest/2026/07/inside-pegasus-the-evolution-of-the-worlds-most-notorious-spyware/

#cybersecurity #infosec #pegasus #spyware #security

Amnesty International (@amnesty) Security Lab just released their most complete breakdown of the Pegasus spyware.

If you have time, go give it a read

https://securitylab.amnesty.org/latest/2026/07/inside-pegasus-the-evolution-of-the-worlds-most-notorious-spyware/

#cybersecurity #infosec #pegasus #spyware #security

Securing DNSSEC Keys via Threshold ECDSA From Generic MPC (2019) https://lobste.rs/s/e9jl9m #cryptography #security
https://eprint.iacr.org/2019/889

You can't bug fix your way out of the vulnpocalypse https://lobste.rs/s/nkrgcp #security
https://alexgaynor.net/2026/jul/15/you-cant-bugfix-your-way-out-of-the-vulnpocalypse/

Ignore DNSSEC if You Like MITM Attacks, by (not on Mastodon or Bluesky):

https://whynothugo.nl/journal/2026/06/24/ignore-dnssec-if-you-like-mitm-attacks/?ref=frontenddogma.com

#security #dns

@aproposnix

This is a great and important article by @soatok

It also mentions how anyone, not just #security experts, can help make E2EE on the ActivityPub #fediverse a reality.

For instance by #fedi devs by supporting #FEP 521a: Representing actor's public keys in their #ActivityPub implementation:

https://fediverse.codeberg.page/fep/fep/521a/

Or help improve the #UX of E2EE enabled fedi apps. Or even just spread the word around by boosting the article around, and give impetus to #E2EE adoption.

See also:

https://swicg.github.io/activitypub-e2ee/

https://publickey.directory/

The Long Tail of Work Left Until ActivityPub Has E2EE - Dhole Moments

#activitypub #e2ee #security #fediverse

https://soatok.blog/2026/07/15/the-long-tail-of-work-left-until-activitypub-has-e2ee/

The Long Tail of Work Left Until ActivityPub Has E2EE - Dhole Moments

#activitypub #e2ee #security #fediverse

https://soatok.blog/2026/07/15/the-long-tail-of-work-left-until-activitypub-has-e2ee/

A Filtering engine and DB for unpropagated kernel security patches https://lobste.rs/s/pfz6dj #linux #release #security
https://patchless.natey.sh

The Long Tail of Work Left Until ActivityPub Has E2EE - Dhole Moments

#activitypub #e2ee #security #fediverse

https://soatok.blog/2026/07/15/the-long-tail-of-work-left-until-activitypub-has-e2ee/

SELinux Userspace Utilities: Local Denial-of-Service Attack Vectors in seunshare in release 3.10 https://lobste.rs/s/h2qy4t #linux #security
https://security.opensuse.org/2026/07/15/selinux-seunshare.html

Microsoft Confirms Windows GDID Device Identifier That Cannot Be Disabled, Documented in FBI Case Filing https://lobste.rs/s/agkcmz #security #windows
https://www.ghacks.net/2026/07/12/microsoft-confirms-windows-gdid-device-identifier-that-cannot-be-disabled-documented-in-fbi-case-filing/

Listening to @anwesha speak on Demystifying the EU Cyber Resilience Act at #EuroPython2026

This slide is the new reality!

#EP2026 #OpenSource #Security #Python

Listening to @anwesha speak on Demystifying the EU Cyber Resilience Act at #EuroPython2026

This slide is the new reality!

#EP2026 #OpenSource #Security #Python

Full disclosure: Arbitrary code execution in Cursor https://lobste.rs/s/vlr279 #editors #security #vibecoding
https://mindgard.ai/blog/cursor-0day-when-full-disclosure-becomes-the-only-protection-left

The Memory Heist https://lobste.rs/s/lelroo #ai #security
https://ayush.digital/blog/the-memory-heist

Enable SHA Pinning for GitHub Actions Across Personal Repositories #github #powershell #security https://www.meziantou.net/enable-sha-pinning-for-github-actions-across-personal-repositories.htm?utm_medium=social&utm_source=mastodon

zizmor 1.27 is released!

this release includes (experimental) support for GitHub's new "parallel steps" pattern, among other enhancements and bug fixes.

full notes:

https://docs.zizmor.sh/release-notes/#1270

#rust #security

zizmor 1.27 is released!

this release includes (experimental) support for GitHub's new "parallel steps" pattern, among other enhancements and bug fixes.

full notes:

https://docs.zizmor.sh/release-notes/#1270

#rust #security

TFTP Honey pot Results https://lobste.rs/s/048t8w #security
https://bruceediger.com/posts/tftp-honeypot-results/

Security is crucial for a service like https://fediverse.info, which is why I am enforcing all invited admins to configure 2FA during the onboarding process!

#fediverseInfo #security

Privacy Guide

Anleitung zur Wahrung der Privatsphäre im Internet.

#Privacy #Security #Privatsphäre #Linux

https://gnulinux.ch/privacy-guide

Unauthenticated RCE in Motorola's MR2600 Router https://lobste.rs/s/s1jwea #security
https://mrbruh.com/motorola/

🟠 CVE-2026-61876 - High (8.8)

LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCPv6 Client FQDN containing script tags that execute in the administr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61876/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-61876 - High (8.8)

LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCPv6 Client FQDN containing script tags that execute in the administr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61876/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Hacking Apple - SQL Injection to Remote Code Execution — ProjectDiscovery Blog https://lobste.rs/s/axamxi #security
https://projectdiscovery.io/blog/hacking-apple-with-sql-injection

reaction: A daemon that scans program outputs for repeated patterns, and takes action via @fanf https://lobste.rs/s/zzdc8x #security
https://framagit.org/ppom/reaction

You Shouldn’t Trust Trusted Publishing, by @yossarian:

https://blog.yossarian.net/2026/07/07/You-shouldnt-trust-trusted-publishing?ref=frontenddogma.com

#security #authentication

An update on the scraper situation via @fanf https://lobste.rs/s/kpaxih #security #web
https://lwn.net/SubscriberLink/1080822/990a8a5e2d379085/

Continuwuity 26.6.0, the lightweight Matrix chat server, is finally out! This is by far our largest release ever yet! There are so many incredible improvements in this release, and there's never been a better time to get started!

https://forgejo.ellis.link/continuwuation/continuwuity/releases/tag/v26.6.0

#Matrix #Continuwuity #SelfHosted #Federated #Homeserver #OpenSource #FOSS #Privacy #Security #Messaging #Release

Kundendaten bei Dienstleister abgeflossen: Datenschutzvorfall beim Lidl-Shop

Unbekannte konnten auf eine Datei mit Kundendaten zugreifen und stahlen persönliche Kundendaten. Lidl hat reagiert und betroffene Kunden angeschrieben.

https://www.heise.de/news/Kundendaten-bei-Dienstleister-abgeflossen-Datenschutzvorfall-beim-Lidl-Shop-11361337.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Datenbanken #IT #Security #news

npm Install-Time Security and GAT bypass2fa Deprecation, by (not on Mastodon or Bluesky):

https://github.blog/changelog/2026-07-08-npm-install-time-security-and-gat-bypass2fa-deprecation/?ref=frontenddogma.com

#npm #security #deprecation

Very excited to share stories, insights, recommendations at my first @europython

I'll also be attending the Packaging and Language Summits, as well as any other opportunities to increase awareness of #Python and #PyPI #OpenSource #SupplyChain #Security initiatives.

#EP2026 #TooManyHashtags #SorryNotSorry

BREAKING: The EU has passed “Chat Control 1.0”

This makes it MANDATORY for companies to scan private messages and submit them to EU authorities.

This includes #WhatsApp, Emails, #Instagram DM’s, and other major forms of communication.

This is so absurd it is hard to believe it is even happening. And we need more than ever apps that are decentralized without a central point of failure

#Europe #ChatControl #privacy #onlineSafety #freedom #security #autonomy #eu #email #decentralization

DirtySlide - root on macOS from one missing bounds check https://lobste.rs/s/27vr6v #mac #security
https://gracecondition.github.io/posts/dirtyslide/

Something I probably should've done a while ago, but I finally set up two-factor authentication on my Mastodon account.

The process was super smooth and it works perfectly. Highly recommend!

https://fedi.tips/using-two-factor-authentication-2fa-on-mastodon/

#mastodon #fediverse #2FA #TwoFactorAuthentication #security #OnlineSecurity

GitLost: How We Tricked GitHub’s AI Agent into Leaking Private Repos https://lobste.rs/s/rcg4bo #security #vibecoding
https://noma.security/blog/gitlost-how-we-tricked-githubs-ai-agent-into-leaking-private-repos/

Announcing the Save CTFs Fund https://lobste.rs/s/geibgn #security
https://osec.io/blog/save-ctfs-fund/

Crucially, everything about this is fully e2e encrypted and decentralised: your account is a crypto key, and you are mainly responsible for keeping the list of people you are "friends" with.

3rd party servers act as dumb "mailbox" relays (to make up for the fact that most people's devices aren't always online or can't easily work as p2p), but only store fully encrypted payloads, and can theoretically be replaced by any other system.

2/ 🧵

#e2ee #crypto #security #decentralized #p2p

Crucially, everything about this is fully e2e encrypted and decentralised: your account is a crypto key, and you are mainly responsible for keeping the list of people you are "friends" with.

3rd party servers act as dumb "mailbox" relays (to make up for the fact that most people's devices aren't always online or can't easily work as p2p), but only store fully encrypted payloads, and can theoretically be replaced by any other system.

2/ 🧵

#e2ee #crypto #security #decentralized #p2p

OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root (CVE-2026-57589) https://lobste.rs/s/7hmu0w #openbsd #security
https://nvd.nist.gov/vuln/detail/cve-2026-57589

A Final Return for OpenBSD Anti-Return-Oriented Programming Mitigations https://lobste.rs/s/xclcel #pdf #openbsd #security
https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6869668

A Measurement Study on the Adoption of Pledges and Unveils in the OpenBSD Operating System https://lobste.rs/s/sglhvg #openbsd #security
https://arxiv.org/pdf/2607.03056

New Research: A "Verified" GitHub Commit Is NOT Unique https://lobste.rs/s/qlw9wg #programming #security
https://www.internationalcyberdigest.com/new-research-a-verified-github-commit-is-not-unique/

Call me nuts but I love passwords with quotes ( ' <- this thing), spaces and periods in them.

#Security

You shouldn’t trust Trusted Publishing

https://blog.yossarian.net/2026/07/07/You-shouldnt-trust-trusted-publishing

#python #security #oss

You shouldn't trust Trusted Publishing by @yossarian https://lobste.rs/s/8d9pgd #python #security
https://blog.yossarian.net/2026/07/07/You-shouldnt-trust-trusted-publishing

You shouldn’t trust Trusted Publishing

https://blog.yossarian.net/2026/07/07/You-shouldnt-trust-trusted-publishing

#python #security #oss

Reporting a 19+ Years Hidden Linux Kernel Zero-Day for Google kernelCTF: CVE-2026-43456 https://lobste.rs/s/txjns0 #linux #networking #security
https://gmo-cybersecurity.com/blog/19-years-hidden-80000-rewarded-reporting-a-linux-kernel-zero-day-for-google-kernelctf/

AT&T's very rare Security-Plus Telephone https://lobste.rs/s/fw8e40 #cryptography #historical #security
https://www.electrospaces.net/2025/10/an-interesting-advertisement-for-stu.html

Securing agentic identity https://lobste.rs/s/ssdcnh #security
https://codon.org.uk/~mjg59/blog/p/securing-agentic-identity/

Poison, redzones and shadows: inside KASAN – Bootlin https://lobste.rs/s/exuqoz #linux #security
https://bootlin.com/blog/poison-redzones-and-shadows-inside-kasan/

Januscape: Guest-to-Host Escape in KVM/x86 https://lobste.rs/s/jea4xl #linux #security
https://github.com/V4bel/Januscape

Backstage access: an unauthenticated SQL injection in Front Gate Tickets https://lobste.rs/s/fplb85 #security
https://ian.sh/frontgate

Web Security docs on MDN https://lobste.rs/s/b3elwj #release #security
https://openwebdocs.org/content/posts/security-docs-sovereign-tech-agency/

Bench Press: Leaking Text Nodes with CSS via @goldstein https://lobste.rs/s/qyugm7 #css #security
https://blog.pspaul.de/posts/bench-press-leaking-text-nodes-with-css/

Anthropic secretly installs spyware when you install Claude Desktop

Anthropic's Claude Desktop silently installs a Native Messaging bridge into seven Chromium browsers, including browsers Anthropic's own documentation says it does not support, and browsers the user has not even installed.

https://www.thatprivacyguy.com/blog/anthropic-spyware

#ai #privacy #eprivacy #compliance #infosec #gdpr #law #cyber #security #anthropic #claude

Non-hybrid PQ-only TLS and the MIKEY-IBAKE intervention https://lobste.rs/s/f2xgzo #cryptography #security
https://libroot.org/posts/non-hybrid-pq-only-tls-and-mikey-ibake/

Bad Epoll (CVE-2026-46242) https://lobste.rs/s/drf6my #linux #security
https://github.com/J-jaeyoung/bad-epoll

npm Adds Preventive Account Protection for High-Impact Accounts, by (not on Mastodon or Bluesky):

https://github.blog/changelog/2026-06-25-npm-adds-preventive-account-protection-for-high-impact-accounts/?ref=frontenddogma.com

#npm #security

SecretSpec 0.13: SDKs for Python, Node.js, Go, Ruby, and Haskell https://lobste.rs/s/5r5ebh #release #security
https://secretspec.dev/blog/secretspec-0-13-sdks/

Anthropic secretly installs spyware when you install Claude Desktop

Anthropic's Claude Desktop silently installs a Native Messaging bridge into seven Chromium browsers, including browsers Anthropic's own documentation says it does not support, and browsers the user has not even installed.

https://www.thatprivacyguy.com/blog/anthropic-spyware

#ai #privacy #eprivacy #compliance #infosec #gdpr #law #cyber #security #anthropic #claude

Dissecting and Exploiting Linux LPE Variant: DirtyClone (CVE-2026-43503) https://lobste.rs/s/adgyhb #linux #security
https://research.jfrog.com/post/dissecting-and-exploiting-linux-lpe-variant-dirtyclone-cve-2026-43503/

「VPC内通信もTLSにすべき？」と聞かれて ── そもそもAWS内で盗聴できるのか脅威モデルで確かめた話 #Security - Qiita https://qiita.com/ntaka329/items/de23144fdf7305a2e0c1

> 公共系の案件で「ゲートウェイ（ALB）までは暗号化されているけど、その内側、VPCの中は平文ですよね。それで問題ないんですか？」と指摘されました。

VPCがSDN（Software Defined Network）でできていて、他人の通信を覗くような盗聴が非常に困難なことは、以前から知ってはいました。ただ、いざ「なぜ大丈夫と言えるのか」を根拠立てて説明しようとすると、正確な一次情報がどこにあるのかを即答できず、VPC encryption controlsのような最近の動向も追えていませんでした。

そこで、VPC内（題材は ALB → ECS の1区間）のTLS化が必要かどうかを、改めて一次情報と脅威モデルで整理し直してみました。

#AWS

「VPC内通信もTLSにすべき？」と聞かれて ── そもそもAWS内で盗聴できるのか脅威モデルで確かめた話 #Security - Qiita https://qiita.com/ntaka329/items/de23144fdf7305a2e0c1

> 公共系の案件で「ゲートウェイ（ALB）までは暗号化されているけど、その内側、VPCの中は平文ですよね。それで問題ないんですか？」と指摘されました。

VPCがSDN（Software Defined Network）でできていて、他人の通信を覗くような盗聴が非常に困難なことは、以前から知ってはいました。ただ、いざ「なぜ大丈夫と言えるのか」を根拠立てて説明しようとすると、正確な一次情報がどこにあるのかを即答できず、VPC encryption controlsのような最近の動向も追えていませんでした。

そこで、VPC内（題材は ALB → ECS の1区間）のTLS化が必要かどうかを、改めて一次情報と脅威モデルで整理し直してみました。

#AWS

The pandemic of incomplete OpenSSL error handling https://lobste.rs/s/xqqamf #security
https://blog.jak-linux.org/2026/07/03/openssl-pandemic/

Google open sources their Zero-Knowledge Proof (ZKP) libraries to support age ID verification.

1. Authenticate your birth date with a trusted authority (the Issuer) and receive a cryptographically signed digital certificate.
2. A website requiring an age ID sends you a random maths puzzle.
3. The ZKP library solves the puzzle with your digital cert and replies with the proof.
4. Using the Issuers Public Cert the website validates the proof.

#security #ageID #ZKP

https://blog.google/innovation-and-ai/technology/safety-security/opening-up-zero-knowledge-proof-technology-to-promote-privacy-in-age-assurance/

Espionage Against the European Parliament: Member of Committee Investigating Spyware Hacked with Pegasus https://lobste.rs/s/xwsfs3 #security
https://citizenlab.ca/research/member-of-committee-investigating-spyware-hacked-with-pegasus/

What We Talk About When We Talk About Malware https://lobste.rs/s/ltsgnw #android #security
https://f-droid.org/2026/07/01/adv-malware.html

Fedora 45 Considering x86_64 Shadow Stack Usage By Default https://lobste.rs/s/pgxaog #linux #security
https://www.phoronix.com/news/Fedora-45-Consider-Shadow-Stack

⚠️ Guix security alert ⚠️

Critical security vulnerabilities in the guix daemon and substitute capabilities have been disclosed. ALL users should immediately update.

https://guix.gnu.org/en/blog/2026/guix-substitute-pull-vulnerabilities/

#guix #security #update

⚠️ Guix security alert ⚠️

Critical security vulnerabilities in the guix daemon and substitute capabilities have been disclosed. ALL users should immediately update.

https://guix.gnu.org/en/blog/2026/guix-substitute-pull-vulnerabilities/

#guix #security #update

How OpenSSH implements privilege separation https://lobste.rs/s/kfavsp #security #unix
https://github.com/openssh/openssh-portable/blob/master/README.privsep

Arbitrary code execution breaking sandboxes in KDE Plasma https://lobste.rs/s/ovcwkm #security
https://blog.kimiblock.top/2026/07/01/arbitrary-code-execution-in-kde-plasma/

Newly discovered PamStealer isn't your typical macOS malware https://lobste.rs/s/q4m3fa #mac #security
https://arstechnica.com/security/2026/07/new-pamstealer-macos-malware-uses-clever-tradecraft-to-remain-stealthy/

Google open sources their Zero-Knowledge Proof (ZKP) libraries to support age ID verification.

1. Authenticate your birth date with a trusted authority (the Issuer) and receive a cryptographically signed digital certificate.
2. A website requiring an age ID sends you a random maths puzzle.
3. The ZKP library solves the puzzle with your digital cert and replies with the proof.
4. Using the Issuers Public Cert the website validates the proof.

#security #ageID #ZKP

https://blog.google/innovation-and-ai/technology/safety-security/opening-up-zero-knowledge-proof-technology-to-promote-privacy-in-age-assurance/

Preventing token theft https://lobste.rs/s/agwtde #security
https://codon.org.uk/~mjg59/blog/p/preventing-token-theft/

Try the `upki` preview for Ubuntu via @fanf https://lobste.rs/s/981pzy #linux #security
https://jnsgr.uk/2026/07/upki-preview-for-ubuntu/

Creating a development sandbox with crosvm https://lobste.rs/s/mml3sh #practices #security #virtualization
https://www.erat.org/crosvm.html

Unprivileged root via an out-of-bounds write in the FUSE readdir cache (CVE-2026-31694) https://lobste.rs/s/0kc445 #linux #security
https://cyberstan.co.uk/fuse-readdir-oob/

Open Source as Infrastructure: Taking Roads and Bridges literally via @robey https://lobste.rs/s/z2wzap #security #testing
https://nesbitt.io/2026/06/30/taking-roads-and-bridges-literally.html

After 8.5 awesome years, today is my last day at 1Password.

I can't even begin to describe how much the experience impacted me as a person. I moved from casual customer support and social media management all the way through to the security team, eventually becoming its longest-tenured member. Some of my greatest hits included:

• Pioneering the creation of 1Password's Privacy Team as its first IC
• Creating a fully functional DSR program from the ground up
• Forming the first internal data map
• Developing a process with which to work law enforcement
• Becoming a SME on all things consumer product security
• Collaboration with Legal, GRC, Customer Support, and plenty of others

My entire future has been shaped by what I accomplished while I was there, and I'll remember it forever. What's next? I'm not sure yet! I think I'll take a bit of time for myself and then start looking for my next big thing. I'm open to suggestions, though, and so if you or someone you know is looking for someone in privacy, shoot me a message!

#work #fediHire #getfedihired #privacy #security

After 8.5 awesome years, today is my last day at 1Password.

I can't even begin to describe how much the experience impacted me as a person. I moved from casual customer support and social media management all the way through to the security team, eventually becoming its longest-tenured member. Some of my greatest hits included:

• Pioneering the creation of 1Password's Privacy Team as its first IC
• Creating a fully functional DSR program from the ground up
• Forming the first internal data map
• Developing a process with which to work law enforcement
• Becoming a SME on all things consumer product security
• Collaboration with Legal, GRC, Customer Support, and plenty of others

My entire future has been shaped by what I accomplished while I was there, and I'll remember it forever. What's next? I'm not sure yet! I think I'll take a bit of time for myself and then start looking for my next big thing. I'm open to suggestions, though, and so if you or someone you know is looking for someone in privacy, shoot me a message!

#work #fediHire #getfedihired #privacy #security

Building a passive Ethernet tap https://lobste.rs/s/qwk5vn #hardware #networking #security
https://blog.lvmbdv.dev/posts/building-a-passive-ethernet-tap/

The @w3c "Standards Vulnerability Disclosure & Handling Process Policy" document explains how to responsibly report #security vulnerabilities in W3C specifications. It defines the process for reporting, acknowledging, verifying, resolving, and disclosing security issues in #WebStandards #GroupNoteDraft

▶️ https://www.w3.org/TR/security-disclosure/

We appreciate researchers helping keep the Web secure by reporting issues in W3C specifications.

Feedback welcome: https://github.com/w3c/security-disclosure/issues

The Threat of Residential Proxies via @fanf https://lobste.rs/s/x8qug8 #security
https://www.feistyduck.com/newsletter/issue_138_the_threat_of_residential_proxies

Everyone's using AI to write code faster. Almost nobody's using it to write code better. It's where the next wave of breaches and a 2am page will come from... So I built something to help myself, and I'm putting it out there.

It's a Claude Code skill called senior-engineering-partner. It's not autocomplete. It's the strict senior engineer who reviews your pull request, asks why you skipped the tests, and won't let you ship a hardcoded secret because you were "just prototyping."

A few things it does:

・ Enforces a real workflow. Agree on the spec, plan in verifiable steps, write the test first, then prove the work before calling it done.

・ Holds a security floor that never moves. Whether you're prototyping or running in production, the secrets and input-validation basics stay non-negotiable. Cheap doesn't mean insecure.

・ Refuses to hallucinate. It verifies claims about your environment by running a real command, rather than inventing a flag or an API that sounds right.

・ Switches modes depending on how you call it: reviewer, debugger, mentor, or pair programmer.

It's open source under Apache-2.0, stack-agnostic, and built around Python, Bash, Apps Script, and JavaScript.

Here's my ask. Use it. Then tell me where it's wrong. I want the good feedback and the brutal feedback, plus any capability you wish it had. The whole point is to encode what senior engineers actually do, and I'd rather hear it breaks on your stack than find out later.

What would you want a skill like this to enforce?

https://github.com/bjgreenberg/senior-engineering-partner

#ClaudeCode #AI #SoftwareEngineering #AppDev #DevOps #security #privacy #cloud #infosec #cybersecurity

Everyone's using AI to write code faster. Almost nobody's using it to write code better. It's where the next wave of breaches and a 2am page will come from... So I built something to help myself, and I'm putting it out there.

It's a Claude Code skill called senior-engineering-partner. It's not autocomplete. It's the strict senior engineer who reviews your pull request, asks why you skipped the tests, and won't let you ship a hardcoded secret because you were "just prototyping."

A few things it does:

・ Enforces a real workflow. Agree on the spec, plan in verifiable steps, write the test first, then prove the work before calling it done.

・ Holds a security floor that never moves. Whether you're prototyping or running in production, the secrets and input-validation basics stay non-negotiable. Cheap doesn't mean insecure.

・ Refuses to hallucinate. It verifies claims about your environment by running a real command, rather than inventing a flag or an API that sounds right.

・ Switches modes depending on how you call it: reviewer, debugger, mentor, or pair programmer.

It's open source under Apache-2.0, stack-agnostic, and built around Python, Bash, Apps Script, and JavaScript.

Here's my ask. Use it. Then tell me where it's wrong. I want the good feedback and the brutal feedback, plus any capability you wish it had. The whole point is to encode what senior engineers actually do, and I'd rather hear it breaks on your stack than find out later.

What would you want a skill like this to enforce?

https://github.com/bjgreenberg/senior-engineering-partner

#ClaudeCode #AI #SoftwareEngineering #AppDev #DevOps #security #privacy #cloud #infosec #cybersecurity

Claude Code Is Steganographically Marking Requests https://lobste.rs/s/qs2sxd #security #vibecoding
https://thereallo.dev/blog/claude-code-prompt-steganography

Soatok’s Informal Guide to Threat Models https://lobste.rs/s/gwrlsv #rant #security
https://soatok.blog/2026/06/30/soatoks-informal-guide-to-threat-models/

The @w3c "Standards Vulnerability Disclosure & Handling Process Policy" document explains how to responsibly report #security vulnerabilities in W3C specifications. It defines the process for reporting, acknowledging, verifying, resolving, and disclosing security issues in #WebStandards #GroupNoteDraft

▶️ https://www.w3.org/TR/security-disclosure/

We appreciate researchers helping keep the Web secure by reporting issues in W3C specifications.

Feedback welcome: https://github.com/w3c/security-disclosure/issues

Unprivileged root via a use-after-free in DRM GEM change_handle (CVE-2026-46215) https://lobste.rs/s/hh5yyq #linux #security
https://cyberstan.co.uk/drm-lpe-linux/

pomerium: Pomerium is an identity and context-aware access proxy https://lobste.rs/s/9mtucy #networking #security #web
https://github.com/pomerium/pomerium

ipv6_frag_escape: Linux LPE - Reliable Jail/Container Escape https://lobste.rs/s/eihlve #devops #security
https://github.com/sgkdev/ipv6_frag_escape

Do excellent vulnerability reports via @andrewnez https://lobste.rs/s/pwr4h7 #security
https://daniel.haxx.se/blog/2026/06/29/do-excellent-vulnerability-reports/

Longinus: 2 Boundaries in One Bug, Piercing Chrome’s Renderer and V8 Sandbox with a Single Vulnerability, CVE-2026-6307 https://lobste.rs/s/uaoe9y #security #web
https://nebusec.ai/research/v8-cve-2026-6307-writeup/

Blocking Install Scripts Is Not a Silver Bullet, by @ulisesgascon (@nodesource.bsky.social):

https://nodesource.com/blog/npm-v12-install-scripts-not-a-silver-bullet?ref=frontenddogma.com

#npm #security

Autocrypt v2 - Post-Quantum and Reliable Deletion https://lobste.rs/s/esy9xh #cryptography #security
https://autocrypt2.org

Integrity on Embedded Linux Devices under the Cyber Resilience Act https://lobste.rs/s/ypba4x #linux #security
https://sigma-star.at/blog/2026/06/integrity-on-embedded-linux-devices-under-the-cyber-resilience-act/

Movim 0.34.1 is out, and it's a security-focused one! 🔐

Over the past few weeks we received several reports about potential vulnerabilities. We reviewed all of them and took the opportunity to harden a few things: SSRF protection, cookies proper validation, a XSS issue in Space invitations has been patched and a few other things.

Nothing critical, but important enough to update as soon as possible 😸

A few call-related bugs were also fixed along the way 📞

Checkout the complete Release Note to have all the details: https://mov.im/community/pubsub.movim.eu/Movim/movim-0-31-4-is-out-stay-safe-and-upgrade-cwblXR

Stay safe out there, and don't forget to upgrade! ✌️

#movim #XMPP #security #foss #freesoftware #release

npm Tooling Bug Incorrectly Marks One-Character Packages as Security Holders, by @sarahgooding (@SocketSecurity):

https://socket.dev/blog/npm-tooling-single-character-bug?ref=frontenddogma.com

#npm #bugs #security

Holy crap.

"Nearly a million passports and photo IDs from multiple countries were exposed across unprotected public URLs, accessible to anyone with a link. The documents remained discoverable this way for months, according to reporting by The Verge, before being taken offline."

https://cambridgeanalytica.org/data-breaches-scandals/passports-driver-licenses-exposed-public-internet-2026-51096/

Original article: https://www.theverge.com/tech/947157/passports-data-breach-cannabis-club-systems-nefos-puffpal

Via an extensive series of links starting at https://mastodon.social/@Gargron/116828220896988835

#news #technology #TechNews #AgeVerification #security #leak

https://cambridgeanalytica.org/data-breaches-scandals/passports-driver-licenses-exposed-public-internet-2026-51096/

"age verification is here to protect people" says industry that can't seem to stop leaking highly confidential info through really stupid basic ass security fuckups

#AgeVerification #security

Happy Pride Sunday 🏳️‍🌈🏳️‍⚧️!

Find me at Sundance Saloon stage (Wells Fargo, Grove & Larkin) and say hi!

Fastest entry into Pride Celebration at Civic Center may be through a required $5 minimum donation gates.

Security requires: clear backpack and empty water bottle.
Water filling stations are available inside.

#SFPride #Celebration #Security #HappyPride

https://cambridgeanalytica.org/data-breaches-scandals/passports-driver-licenses-exposed-public-internet-2026-51096/

"age verification is here to protect people" says industry that can't seem to stop leaking highly confidential info through really stupid basic ass security fuckups

#AgeVerification #security

Holy crap.

"Nearly a million passports and photo IDs from multiple countries were exposed across unprotected public URLs, accessible to anyone with a link. The documents remained discoverable this way for months, according to reporting by The Verge, before being taken offline."

https://cambridgeanalytica.org/data-breaches-scandals/passports-driver-licenses-exposed-public-internet-2026-51096/

Original article: https://www.theverge.com/tech/947157/passports-data-breach-cannabis-club-systems-nefos-puffpal

Via an extensive series of links starting at https://mastodon.social/@Gargron/116828220896988835

#news #technology #TechNews #AgeVerification #security #leak

Movim 0.34.1 is out, and it's a security-focused one! 🔐

Over the past few weeks we received several reports about potential vulnerabilities. We reviewed all of them and took the opportunity to harden a few things: SSRF protection, cookies proper validation, a XSS issue in Space invitations has been patched and a few other things.

Nothing critical, but important enough to update as soon as possible 😸

A few call-related bugs were also fixed along the way 📞

Checkout the complete Release Note to have all the details: https://mov.im/community/pubsub.movim.eu/Movim/movim-0-31-4-is-out-stay-safe-and-upgrade-cwblXR

Stay safe out there, and don't forget to upgrade! ✌️

#movim #XMPP #security #foss #freesoftware #release

🚨 They are bringing back #ChatControl 🚨

Metsola doesn't understand that no means no.

Discussion is scheduled for Monday, so act now: https://fightchatcontrol.eu/

#No2Surveillance #Privacy #Security

exploitarium: A single archive of public exploit PoCs https://lobste.rs/s/4ywqva #security
https://github.com/bikini/exploitarium

It's dead, Jim! (UEFI CA expiry) https://lobste.rs/s/xz51yj #linux #security
https://blog.einval.com/2026/06/27#its_dead_jim

A peek into Reddit's anti-spam internals by @rebane2001 https://lobste.rs/s/boap41 #privacy #security
https://lyra.horse/blog/2026/06/reddit-spam-internals/

🚨 They are bringing back #ChatControl 🚨

Metsola doesn't understand that no means no.

Discussion is scheduled for Monday, so act now: https://fightchatcontrol.eu/

#No2Surveillance #Privacy #Security

AI Agents Enable Adaptive Computer Worms https://lobste.rs/s/qsp10b #ai #security
https://cleverhans.io/worm.html

Very excited to share stories, insights, recommendations at my first @europython

I'll also be attending the Packaging and Language Summits, as well as any other opportunities to increase awareness of #Python and #PyPI #OpenSource #SupplyChain #Security initiatives.

#EP2026 #TooManyHashtags #SorryNotSorry

Incident Report: CVE-2026-LGTM https://lobste.rs/s/6q12d7 #satire #security
https://nesbitt.io/2026/06/26/incident-report-cve-2026-lgtm.html

Anatomy of a Failed (Nation-State?) Attack https://lobste.rs/s/j2ua4f #security
https://grack.com/blog/2026/06/25/dissecting-a-failed-nation-state-attack/

🚨PSA: If you think you're a targeted individual, don't install macOS apps from the web. macOS code signing and TCC are broken. We accidentally found a bug that lets any command modify the binaries of other apps, including Signal, Brave, Chrome, and even Xcode. Watch the demo👇

#privacy #Apple #security #infosec #cybersecurity

🚨PSA: If you think you're a targeted individual, don't install macOS apps from the web. macOS code signing and TCC are broken. We accidentally found a bug that lets any command modify the binaries of other apps, including Signal, Brave, Chrome, and even Xcode. Watch the demo👇

#privacy #Apple #security #infosec #cybersecurity

🚨 They are bringing back #ChatControl 🚨

Metsola doesn't understand that no means no.

Discussion is scheduled for Monday, so act now: https://fightchatcontrol.eu/

#No2Surveillance #Privacy #Security

Akrites: Coordinated, confidential vulnerability remediation for the open source software critical infrastructure depends on via @fanf https://lobste.rs/s/x6nv9y #security
https://akrites.org/

🚨 They are bringing back #ChatControl 🚨

Metsola doesn't understand that no means no.

Discussion is scheduled for Monday, so act now: https://fightchatcontrol.eu/

#No2Surveillance #Privacy #Security

🚨 They are bringing back #ChatControl 🚨

Metsola doesn't understand that no means no.

Discussion is scheduled for Monday, so act now: https://fightchatcontrol.eu/

#No2Surveillance #Privacy #Security

usbliter8: An A12/A13 SecureROM exploit https://lobste.rs/s/fs8itz #ios #security
https://github.com/prdgmshift/usbliter8

Detecting and removing dangerous secrets on dev workstations before Shai-Hulud does https://lobste.rs/s/evydbs #privacy #security
https://recyclebin.zip/posts/2026-05-25-secret-scanning-fleet-bagel/

Tick box to prove you're not a bot

Pick all the images of a fire hydrant

Now pick all the images of a motorcycle

Now pick all the images of a bus

Now pick all the images of a motorcycle again

Now pick all the images of traffic lights

Enter your email and password

We've sent you a one-time code

#Life #Security

Tick box to prove you're not a bot

Pick all the images of a fire hydrant

Now pick all the images of a motorcycle

Now pick all the images of a bus

Now pick all the images of a motorcycle again

Now pick all the images of traffic lights

Enter your email and password

We've sent you a one-time code

#Life #Security

Exploiting vulnerabilities in Johnson & Johnson web apps https://lobste.rs/s/rl7aid #security
https://eaton-works.com/2026/06/24/jnj-webapp-hacks/

Ignore DNSSEC if you like MITM attacks via @ggpsv https://lobste.rs/s/pcuxjt #networking #security
https://whynothugo.nl/journal/2026/06/24/ignore-dnssec-if-you-like-mitm-attacks/

Making Rust supply chain attacks harder with Cackle (2023) https://lobste.rs/s/dl0yiv #rust #security
https://davidlattimore.github.io/posts/2023/10/09/making-supply-chain-attacks-harder.html

#CDN的收藏夹
FW: bupt.moe - Telegram

#security
《促进分布式数字身份互通互认应用规定（征求意见稿）》

**第六条 **境内实名身份凭证依照其身份类别，按照以下方式自愿申请和签发：
（一）个人用户由国务院公安部门核验身份后，通过身份链签发身份凭证。
（二）机关事业单位用户向中央机构编制部门申请身份数据核验，通过身份链签发身份凭证。
（三）法人及其他组织机构用户向统一社会信用代码管理部门申请身份数据核验，通过身份链签发身份凭证。
（四）工业设备及物品由国务院工业和信息化部门依托工业互联网标识解析体系负责注册、核验身份数据，通过身份链签发身份凭证。
...
**第十一条 **用户可根据应用需要向可验证凭证签发机构申请承载用户特定属性信息的可验证凭证，经可验证凭证签发机构对用户属性信息核验后，向用户签发可验证凭证。
**第十二条 **用户可根据业务场景需求，自行签发数据授权凭证、业务代办凭证等带有特定功能需求的凭证。
...
**第十六条 **分布式数字身份使用的密码算法、密钥存放设备应符合密码相关国家标准、行业标准或国家密码管理相关规定。
...
（四）可验证凭证是指将现实世界中具有一定权威属性的证明（如身份证、学历证书、资质文件等）转化为标准化、可编程的数字化声明，其与分布式数字身份绑定，能够通过安全可靠技术手段进行真实性验证。
（五）可验证声明是基于可验证凭证的描述性声明，允许持有者选择性披露部分或全量信息。

https://www.cac.gov.cn/2026-06/18/c_1783525605384124.htm

Keybase is dead! Long live Keyoxide!

https://keyoxide.org/aspe%3Akeyoxide.org%3AGK4JFFYSVEI5NMLLGAXX22QZAU

Fingerprint: GK4JFFYSVEI5NMLLGAXX22QZAU

**#Keybase #Keyoxide #Hackers #Security #Privacy #Identity #Encryption**

Completely remediating this report was a massive coordinated team effort and would not be possible without paid security staffing at the PSF. Confirmed remediation in 48 hours from report with extensive follow-up auditing, hardening, and coordinating a third-party audit from Trail of Bits.

Thank you to Alpha-Omega for funding my time and OpenAI for funding the audit through "Patch the Planet".

Please see the write-up for details.

#opensource #oss #security #supplychain #python

The Python Security Response Team patched an authentication bypass in the python.org release management API in under 48 hours. No evidence of exploitation, all artifacts verified.

Check out the full writeup 👇
https://pyfound.blogspot.com/2026/06/mitigated-api-bypass-for-download-metadata-python-dot-org.html

#Python #Security #PSF

Completely remediating this report was a massive coordinated team effort and would not be possible without paid security staffing at the PSF. Confirmed remediation in 48 hours from report with extensive follow-up auditing, hardening, and coordinating a third-party audit from Trail of Bits.

Thank you to Alpha-Omega for funding my time and OpenAI for funding the audit through "Patch the Planet".

Please see the write-up for details.

#opensource #oss #security #supplychain #python

The Python Security Response Team patched an authentication bypass in the python.org release management API in under 48 hours. No evidence of exploitation, all artifacts verified.

Check out the full writeup 👇
https://pyfound.blogspot.com/2026/06/mitigated-api-bypass-for-download-metadata-python-dot-org.html

#Python #Security #PSF

Vulnerability Reports Are Not Special Anymore https://lobste.rs/s/bcjwwn #security
https://words.filippo.io/vuln-reports/

Just reminding you all that #KeePassXC allows contributions from LLMs. https://keepassxc.org/blog/2025-11-09-about-keepassxcs-code-quality-control/ #KeePass #AI #LLM #Security #InfoSec

Forward to Hell? On Misusing Transparent DNS Forwarders For Amplification Attacks https://lobste.rs/s/ozr1zf #networking #security
https://labs.ripe.net/author/mkoch/forward-to-hell-on-misusing-transparent-dns-forwarders-for-amplification-attacks/

Mark-of-the-web and pinning installers to sites https://lobste.rs/s/z4vrld #security #web
https://blog.randomoracle.io/2026/06/20/mark-of-the-web-and-pinning-installers-to-sites/

Anthropic’s Fable and the State of AI, by @schneier.com:

https://www.schneier.com/blog/archives/2026/06/anthropics-fable-and-the-state-of-ai.html?ref=frontenddogma.com

#ai #security #anthropic #foss

#Meta Lobbies #Congress For Protection From Child-Harm #Lawsuits

Meta has lobbied the U.S. Congress for legal immunity from child-harm claims tied to social media products such as #Instagram , as it faces thousands of lawsuits from young users and their families, according to a source familiar with the matter and proposed legislative language reviewed by Reuters. If adopted by lawmakers and passed into law as part of the #KidsOnlineSafetyAct (#KOSA ) under consideration in the U.S. Senate, such a provision could undermine thousands of lawsuits against Meta and other online platforms over harms to #children.
#socialmedia #security #privacy #childharm

https://tech.slashdot.org/story/26/06/18/2342227/meta-lobbies-congress-for-protection-from-child-harm-lawsuits?utm_source=rss1.0mainlinkanon&utm_medium=feed

#Meta Lobbies #Congress For Protection From Child-Harm #Lawsuits

Meta has lobbied the U.S. Congress for legal immunity from child-harm claims tied to social media products such as #Instagram , as it faces thousands of lawsuits from young users and their families, according to a source familiar with the matter and proposed legislative language reviewed by Reuters. If adopted by lawmakers and passed into law as part of the #KidsOnlineSafetyAct (#KOSA ) under consideration in the U.S. Senate, such a provision could undermine thousands of lawsuits against Meta and other online platforms over harms to #children.
#socialmedia #security #privacy #childharm

https://tech.slashdot.org/story/26/06/18/2342227/meta-lobbies-congress-for-protection-from-child-harm-lawsuits?utm_source=rss1.0mainlinkanon&utm_medium=feed

"Mythos" at Home, and It's Called AISLE via @daveliepmann https://lobste.rs/s/cuh3be #security #vibecoding
https://stanislavfort.substack.com/p/mythos-at-home-and-its-called-aisle

Upcoming Breaking Changes for npm v12, by (not on Mastodon or Bluesky):

https://github.blog/changelog/2026-06-09-upcoming-breaking-changes-for-npm-v12/?ref=frontenddogma.com

#npm #security

#Podcast : The Government Wants to End #Anonymity on #Phones
#privacy #security

https://www.404media.co/podcast-the-government-wants-to-end-anonymity-on-phones/

#Podcast : The Government Wants to End #Anonymity on #Phones
#privacy #security

https://www.404media.co/podcast-the-government-wants-to-end-anonymity-on-phones/

I discovered a large-scale malware distribution on GitHub https://lobste.rs/s/pc7tnx #security
https://orchidfiles.com/github-repositories-distributing-malware/

Today I released Lockpicker.

Lockpicker is essentially a GUI frontend to hashcat. Recover a password from its hash straight from a modern GNOME-native interface without the hassle of dealing with hashcat syntax.

Early release. It still has a few rough edges UI-wise, where I probably want to do a pretty major overhaul eventually. I also need to redo the logo properly. But it works quite well, comes with OpenCI GPU acceleration.

https://flathub.org/en/apps/se.sjoerd.lockpicker

#GNOME #OpenSource #security #Flathub

Today I released Lockpicker.

Lockpicker is essentially a GUI frontend to hashcat. Recover a password from its hash straight from a modern GNOME-native interface without the hassle of dealing with hashcat syntax.

Early release. It still has a few rough edges UI-wise, where I probably want to do a pretty major overhaul eventually. I also need to redo the logo properly. But it works quite well, comes with OpenCI GPU acceleration.

https://flathub.org/en/apps/se.sjoerd.lockpicker

#GNOME #OpenSource #security #Flathub

Today I released Lockpicker.

Lockpicker is essentially a GUI frontend to hashcat. Recover a password from its hash straight from a modern GNOME-native interface without the hassle of dealing with hashcat syntax.

Early release. It still has a few rough edges UI-wise, where I probably want to do a pretty major overhaul eventually. I also need to redo the logo properly. But it works quite well, comes with OpenCI GPU acceleration.

https://flathub.org/en/apps/se.sjoerd.lockpicker

#GNOME #OpenSource #security #Flathub

The Future of the Con Is Already Here, It's Just Not Evenly Distributed - In Pursuit of Laziness https://lobste.rs/s/5majlp #ai #security
http://manishearth.github.io/blog/2026/06/17/the-future-of-the-con-is-already-here/

CVE-2026-42530: Use after free in nginx HTTP/3 QUIC module https://lobste.rs/s/pbvqlz #security
https://www.cve.org/CVERecord?id=CVE-2026-42530

yay v13 and the AURpocalypse via @hugoarnal https://lobste.rs/s/e325gb #release #security
https://jguer.space/blog/2026-06-15-yay-v13

CLI Authentication, the Right Way by @ABGEO https://lobste.rs/s/nqv7yo #practices #security
https://www.abgeo.dev/blog/cli-authentication-the-right-way/

Humiliating IIS servers for fun and jail time https://lobste.rs/s/uqoo16 #security
https://mll.sh/humiliating-iis-servers-for-fun-and-jail-time/

The Website Specification, by @joost:

https://specification.website/?ref=frontenddogma.com

#websites #documentation #fundamentals #seo #accessibility #security #aiagents #performance #privacy #resilience #internationalization

Gotta protect ourselves from supply chain attacks 😬

🛡️ **depsguard** — A TUI for auditing and hardening your package manager configuration

💯 Scans npm, pnpm, yarn, bun, uv, pip, poetry, Dependabot & Renovate

🦀 Written in Rust!

⭐ GitHub: https://github.com/arnica/depsguard

#rustlang #security #supplychain #devtools #cli #opensource

I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID via @fs111 https://lobste.rs/s/z5wfi9 #security
https://bobdahacker.com/blog/fifa-hack

A 27-Year-Old Authentication Bypass in OpenBSD's PPP Stack https://lobste.rs/s/suaa0r #openbsd #security #vibecoding
https://blog.argus-systems.ai/blog/openbsd-pap-27-year-auth-bypass.html

Honda Civics and the Evil Valet https://lobste.rs/s/bt3cq8 #android #security
https://juniperspring.org/posts/honda-evil-valet/

Malware in Arch Linux AURs now inserting Russian spam into shell configs https://lobste.rs/s/zaejgn #linux #security
https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/message/2YQSHTC27MOKDDKHZTH2BJGTEN2CYC7W/

A backdoor in a LinkedIn job offer https://lobste.rs/s/2u1z4w #security
https://roman.pt/posts/linkedin-backdoor/

Using Loupe, we found out that Proton VPN is the only VPN that prevents internal tunnel IP fingerprinting by assigning 10.2.0.2 to all users. Other VPNs, such as Mullvad, assign a static and unique IP per session. This allows iOS apps to track user sessions across apps.

Mullvad is aware of this issue. It is described in this blog:

https://mullvad.net/en/help/why-wireguard

You can download Loupe here:
https://apps.apple.com/app/id6766152470

#iOS #privacy #infosec #security #cybersecurity

I'm with Frances Ryan, there is a false distinction drawn by our political class between threats to security that emanate from the global system & those that stem from how UK society is organised.

The argument that we necessarily need to choose between military expenditure & welfare spending (wilfully) misunderstands the *real* threats to the UK population.

Rather we should see the UK's 'security' as including the plight of the population.

#security #politics #welfare
https://www.theguardian.com/commentisfree/2026/jun/16/warfare-v-welfare-britain-spend-benefits-defence-safe

I'm with Frances Ryan, there is a false distinction drawn by our political class between threats to security that emanate from the global system & those that stem from how UK society is organised.

The argument that we necessarily need to choose between military expenditure & welfare spending (wilfully) misunderstands the *real* threats to the UK population.

Rather we should see the UK's 'security' as including the plight of the population.

#security #politics #welfare
https://www.theguardian.com/commentisfree/2026/jun/16/warfare-v-welfare-britain-spend-benefits-defence-safe

⚽ New Blog Post: I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID.

Registered on FIFA's public Agent Platform, got added to their Entra tenant, and accessed the Streaming Management panel for every live World Cup 2026 match. RTMP ingest URLs, stream keys, all five camera angles. Confirmed live in VLC. An attacker could have replaced live camera feeds on TV worldwide.

Full writeup: https://bobdahacker.com/blog/fifa-hack

#InfoSec #BugBounty #ResponsibleDisclosure #FIFA #WorldCup #Security #CyberSecurity #RTMP #BrokenAccessControl

⚽ New Blog Post: I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID.

Registered on FIFA's public Agent Platform, got added to their Entra tenant, and accessed the Streaming Management panel for every live World Cup 2026 match. RTMP ingest URLs, stream keys, all five camera angles. Confirmed live in VLC. An attacker could have replaced live camera feeds on TV worldwide.

Full writeup: https://bobdahacker.com/blog/fifa-hack

#InfoSec #BugBounty #ResponsibleDisclosure #FIFA #WorldCup #Security #CyberSecurity #RTMP #BrokenAccessControl

Users cry foul after AMD stripped memory crypto from its consumer CPUs https://lobste.rs/s/i2cjew #hardware #security
https://arstechnica.com/security/2026/06/users-cry-foul-after-amd-stripped-memory-crypto-from-its-consumer-cpus/

Using Loupe, we found out that Proton VPN is the only VPN that prevents internal tunnel IP fingerprinting by assigning 10.2.0.2 to all users. Other VPNs, such as Mullvad, assign a static and unique IP per session. This allows iOS apps to track user sessions across apps.

Mullvad is aware of this issue. It is described in this blog:

https://mullvad.net/en/help/why-wireguard

You can download Loupe here:
https://apps.apple.com/app/id6766152470

#iOS #privacy #infosec #security #cybersecurity

phpBB: Kritische Sicherheitslücke ermöglicht Kompromittierung

In der Forensoftware phpBB haben IT-Forscher eine kritische Sicherheitslücke entdeckt, die Zugang mit jedem angelegten Konto ermöglicht.

https://www.heise.de/news/phpBB-Kritische-Sicherheitsluecke-ermoeglicht-Kompromittierung-11332689.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#IT #PHP #Security #Sicherheitslücken #Updates #news

phpBB: Kritische Sicherheitslücke ermöglicht Kompromittierung

In der Forensoftware phpBB haben IT-Forscher eine kritische Sicherheitslücke entdeckt, die Zugang mit jedem angelegten Konto ermöglicht.

https://www.heise.de/news/phpBB-Kritische-Sicherheitsluecke-ermoeglicht-Kompromittierung-11332689.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#IT #PHP #Security #Sicherheitslücken #Updates #news

curl summer of bliss via @andrewnez https://lobste.rs/s/uqagn2 #security
https://daniel.haxx.se/blog/2026/06/15/curl-summer-of-bliss/

Arch Linux AUR Hit By Another Wave Of Now More Sophisticated Malware Attack https://lobste.rs/s/jlavzd #linux #security
https://www.phoronix.com/news/Arch-Linux-AUR-More-Malware

<https://www.reddit.com/r/freebsd/comments/1u4lfwt/comment/orfj0w9/> (for the output from Sonnet 4.6):

＂It was Max thinking. I wonder what Opus 4.8 would output.

The prompt was "What would be the biggest design problem with FreeBSD? What would they need to change from the ground up to make it a more secure OS?＂

A 560-word response from Claude Opus 4.8 (Max – Thinking enabled) is at <https://www.reddit.com/r/freebsd/comments/1u4lfwt/comment/ori03bg/>.

#FreeBSD #Claude #Opus #security

FreeBSD security design flaws | The FreeBSD Forums

https://forums.freebsd.org/threads/freebsd-security-design-flaws.102945/

― Anthropic's model believes FreeBSD has ways to go. Get working!

#FreeBSD #security #AI #Anthropic #Claude #Sonnet

"TLDR: depthfirst’s production autonomous security agent discovered 21 zero-day vulnerabilities in FFmpeg, after intensive security analysis by Google and Anthropic. Moving beyond theoretical analysis, our agent produces concrete, reproducible PoC inputs to confirm its findings at a fraction of the costs ($1k vs. $10k). Several of the findings had been sitting latent for 15 to 20 years. We explored the exploitability of the issues and developed a PoC demonstrating a RCE exploit primitive."

Also:

― <https://news.ycombinator.com/item?id=48510046#48510834>
― <https://thehackernews.com/2026/06/ai-agent-uncovers-21-zero-days-in.html> via <https://www.reddit.com/r/cybersecurity/comments/1tys5z7/ai_agent_uncovers_21_zerodays_in_ffmpeg_chrome/>

…

#FFmpeg #cybersecurity #security #AI

21 Zero-Days in FFmpeg https://lobste.rs/s/ejra5c #security
https://depthfirst.com/research/21-zero-days-in-ffmpeg

#Video Demo of BusKill (#opensource #DeadManSwitch) on #Windows, #macOS, #Ubuntu, and #Kali #Linux 🍿💥

🔗 https://www.buskill.in/demo-2024/

Want to actually see our laptop kill-cord in-action (triggering a lockscreen or system shutdown when unplugged?). We’re very happy to share samxplogs’ Cross-Platform Video Demos of BusKill 🔥🔒

#opsec #infosec #security #privacy #hardware

Unicode composition for filenames via @RunxiYu https://lobste.rs/s/g3jf3e #security #vcs
https://svn.apache.org/repos/asf/subversion/trunk/notes/unicode-composition-for-filenames

syslogd(8) privileged and non-privileged parts now separate binaries https://www.undeadly.org/cgi?action=article;sid=20260612080210 #openbsd #syslogd #privsep #privelegeseparation #separation #security #logging #development

syslogd(8) privileged and non-privileged parts now separate binaries https://www.undeadly.org/cgi?action=article;sid=20260612080210 #openbsd #syslogd #privsep #privelegeseparation #separation #security #logging #development

Hundreds of AUR packages attacked by infostealer via @vv https://lobste.rs/s/ta0sem #linux #security
https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/

#tech #technology #BigTech #data #security #privacy #safety #InfoSec #IT #surveillance #computing #digital #online #internet #web #cloud #meme

#tech #technology #BigTech #data #security #privacy #safety #InfoSec #IT #surveillance #computing #digital #online #internet #web #cloud #meme

Government Rolling Age Verification and Online Harms into One Giant Mess

Reports suggest that the Canadian government is introducing a bill that would combine online harms and age verification legislation.

https://www.freezenet.ca/government-rolling-age-verification-and-online-harms-into-one-giant-mess/

#Censorship #News #Privacy #Security #AgeVerification #Canada #FreeSpeech #legislation #OnlineHarms

#tech #technology #BigTech #data #security #privacy #safety #InfoSec #IT #surveillance #computing #digital #online #internet #web #cloud #meme

Reuse Less Software https://lobste.rs/s/3mg7xo #programming #security
https://wiki.alopex.li/ReuseLessSoftware

EC2’s formally verified “isolation engine” provides mathematical assurance of virtual-machine isolation https://lobste.rs/s/efnxre #formalmethods #osdev #security #virtualization
https://www.amazon.science/blog/ec2s-formally-verified-isolation-engine-provides-mathematical-assurance-of-virtual-machine-isolation

Hacking Google with A.I. for $500,000 https://lobste.rs/s/qxaqdd #security #vibecoding
https://brutecat.com/articles/hacking-google-with-ai/

SSH is how you get things done remotely. Know it cold.
Connect to a remote host: ssh user@hostname
Copy files securely: scp file.txt user@hostname:/path/
Generate SSH keys: ssh-keygen -t ed25519

Passwords are fine. Keys are better. Use keys.
#Linux #SysAdmin #SSH #Security #TechTip #TechTipThursday

CVE-2026-45257: LPE in FreeBSD via kTLS-RX https://lobste.rs/s/bdyu6l #security
https://bumsrake.de

SSH is how you get things done remotely. Know it cold.
Connect to a remote host: ssh user@hostname
Copy files securely: scp file.txt user@hostname:/path/
Generate SSH keys: ssh-keygen -t ed25519

Passwords are fine. Keys are better. Use keys.
#Linux #SysAdmin #SSH #Security #TechTip #TechTipThursday

Apple's Passwords App Becomes Agentic

Apple rarely uses the word "agentic." This is changing with the Passwords app, which will soon be able to navigate the web on its own.

https://www.heise.de/en/news/Apple-s-Passwords-App-Becomes-Agentic-11328901.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Apple #iOS #IT #KünstlicheIntelligenz #Mobiles #Passwörter #Security #news

TrustZone Intermezzo: Broken OP-TEE Memory Isolation on i.MX 8M https://lobste.rs/s/uz1fle #linux #security
https://sigma-star.at/blog/2026/06/trustzone-intermezzo/

With that transition, Chrome-based browser users are less protected against malicious websites:

#Google #Chrome is killing all #uBlock Origin bypasses, Microsoft #Edge, #Opera to follow
https://www.neowin.net/news/google-chrome-is-killing-all-ublock-origin-bypasses-microsoft-edge-opera-to-follow/

Switch to a #Firefox-based browser that still allows protective add-ons like #uBlockOrigin and #NoScript. I'm using #LibreWolf.

#browser #security #privacy

With that transition, Chrome-based browser users are less protected against malicious websites:

#Google #Chrome is killing all #uBlock Origin bypasses, Microsoft #Edge, #Opera to follow
https://www.neowin.net/news/google-chrome-is-killing-all-ublock-origin-bypasses-microsoft-edge-opera-to-follow/

Switch to a #Firefox-based browser that still allows protective add-ons like #uBlockOrigin and #NoScript. I'm using #LibreWolf.

#browser #security #privacy

Lets Encrypt June ToS Update: no more for US sanctioned people https://lobste.rs/s/xo62fe #pdf #security
https://letsencrypt.org/documents/LE-SA-v1.7-June-04-2026-diff.pdf

ITScape: Guest-to-Host Escape in KVM/arm64 https://lobste.rs/s/jst2wq #linux #security
https://github.com/V4bel/ITScape

Every code generation LLM model available will at some point suggest insecure code as a part of “code completion”. Should this behavior be considered a vulnerability?

#security #opensource #programming

https://sethmlarson.dev/are-insecure-code-completions-a-vulnerability

A human in control https://lobste.rs/s/p4ey1w #security #vibecoding
https://daniel.haxx.se/blog/2026/06/10/a-human-in-control/

Every code generation LLM model available will at some point suggest insecure code as a part of “code completion”. Should this behavior be considered a vulnerability?

#security #opensource #programming

https://sethmlarson.dev/are-insecure-code-completions-a-vulnerability

Every code generation LLM model available will at some point suggest insecure code as a part of “code completion”. Should this behavior be considered a vulnerability?

#security #opensource #programming

https://sethmlarson.dev/are-insecure-code-completions-a-vulnerability

Every code generation LLM model available will at some point suggest insecure code as a part of “code completion”. Should this behavior be considered a vulnerability?