#security

Packing Malware in Rosetta 2 by @noblenote https://lobste.rs/s/ppvyr1 #mac #security
https://kernelkennel.com/blog/summercon2026-rosetta/

T-Mobile cut a network cable to expel Chinese state-backed hackers from its systems, avoiding a major breach. The Salt Typhoon group had targeted US telecoms. The incident highlights ongoing cybersecurity tensions between the US and China. https://techcrunch.com/2026/08/19/t-mobile-chopped-a-cable-to-expel-chinese-hackers-from-its-network/ #China #Tech #Security

Google führt erweiterten Sideloading-Ablauf für Android schrittweise ein

Google startet den „Advanced Flow“ für das Sideloading von Apps. Nutzer müssen bei nicht verifizierten Entwicklern künftig eine 24-stündige Wartezeit einplanen.

https://www.heise.de/news/Google-fuehrt-erweiterten-Sideloading-Ablauf-fuer-Android-schrittweise-ein-11418865.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Android #Apps #Datenschutz #Google #IT #Security #Sicherheitslücken #news

A neat security vulnerability in Python caused by str.lower(). Also includes lots of RFCs so I’m having a good time :)

https://sethmlarson.dev/when-str-lower-is-a-security-vulnerability

#security #python #idna

Tiny device hacks Boeing 737, alters flight paths under 60 seconds https://lobste.rs/s/wullln #hardware #security
https://interestingengineering.com/transportation/tiny-device-hacks-boeing-737-flight-systems

When str.lower() is a security vulnerability in Python https://lobste.rs/s/ap9w8i #python #security
https://sethmlarson.dev/when-str-lower-is-a-security-vulnerability

A neat security vulnerability in Python caused by str.lower(). Also includes lots of RFCs so I’m having a good time :)

https://sethmlarson.dev/when-str-lower-is-a-security-vulnerability

#security #python #idna

CSS: the bomb inside your inbox https://lobste.rs/s/qo7eyx #security
https://portswigger.net/research/css-the-bomb-inside-your-inbox

Agent Exploits Snowflake Vuln Created by Copilot Autofix https://lobste.rs/s/6zyjec #security #vibecoding
https://www.wiz.io/blog/red-agent-snowflake-copilot-cicd-bug

npm Publish-Time Malware Scanning and Dual-Use Metadata, by (not on Mastodon or Bluesky):

https://github.blog/changelog/2026-07-28-npm-publish-time-malware-scanning-and-dual-use-metadata/?ref=frontenddogma.com

#npm #dependencies #security

Passphrase-less reboots using kexec under NixOS https://lobste.rs/s/nrnwc6 #nix #security #unix
https://www.bevuta.com/en/blog/passphraseless-reboots-using-kexec/

„Download more RAM“: Windows-Sicherheit durch RAM-EEPROM geknackt

IT-Forscher zeigen Angriff „Download more RAM“ auf Windows-Sicherheitsmechanismen, der auf Manipulation des RAM-EEPROMs basiert.

https://www.heise.de/news/Download-more-RAM-Windows-Sicherheit-durch-RAM-EEPROM-geknackt-11415690.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Cyberangriff #IT #Security #SPD #Windows #news

„Download more RAM“: Windows-Sicherheit durch RAM-EEPROM geknackt

IT-Forscher zeigen Angriff „Download more RAM“ auf Windows-Sicherheitsmechanismen, der auf Manipulation des RAM-EEPROMs basiert.

https://www.heise.de/news/Download-more-RAM-Windows-Sicherheit-durch-RAM-EEPROM-geknackt-11415690.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Cyberangriff #IT #Security #SPD #Windows #news

Everything is about to “go dark” https://lobste.rs/s/w5rmwi #security
https://blog.cryptographyengineering.com/2026/08/14/everything-is-about-to-go-dark/

Everything is about to “go dark” https://lobste.rs/s/w5rmwi #security
https://blog.cryptographyengineering.com/2026/08/14/everything-is-about-to-go-dark/

OWASP Top 10 CI/CD Security Risks https://lobste.rs/s/qhxzrd #security
https://owasp.org/www-project-top-10-ci-cd-security-risks/

#Purism is now offering #refurbished #Librem16 #Linux laptops:

https://puri.sm/posts/refurbished-librem-16-laptops/

"In our wish to bring privacy to as many people as we can, we are professionally refurbishing those units. They are now available in our store at a steeply discounted price. We expect to fulfill orders within 5 business days."

#FOSS #opensource #security #PureOS

#Purism is now offering #refurbished #Librem16 #Linux laptops:

https://puri.sm/posts/refurbished-librem-16-laptops/

"In our wish to bring privacy to as many people as we can, we are professionally refurbishing those units. They are now available in our store at a steeply discounted price. We expect to fulfill orders within 5 business days."

#FOSS #opensource #security #PureOS

Unlocking _everything_ on the CPU with DRAM scrambling https://lobste.rs/s/a4zifd #security
https://github.com/xoreaxeaxeax/skitter-creek-bath-salts

Adopting Memory-Safety and Fine-Grained Compartmentalisation with CHERI via @fanf https://lobste.rs/s/lt89di #transcript #video #hardware #security
https://www.infoq.com/presentations/cheri-memory-safety-compartmentalization/

ICYMI: In the second installment of our series on public funding of #OpenSource, Jeffrey McGuire looks at the European Cyber Resilience Act and what it means for securing open source software.
https://www.linux-magazine.com/Online/Features/The-Answer-Was-Already-on-the-Shelf?utm_source=mlm
#FOSS #DigitalAutonomy #security #CRA #CVE #SBOM #CodeSupply @nlnet @NGIZero

ZOOMSDAY, Zoom Zero-Click Vulnerabilities Via Annotation https://lobste.rs/s/juj7bi #security #vibecoding
https://a.security/blog/asecurity-zoomsday

Hi @golem,
🔓 🐛 ach sieh mal einer kuck. #Trusted != #Trustworthy.
#Security #Hokuspokus?

Now, Defenders Are Embracing the Prompt Injection, Too, by @arstechnica:

https://arstechnica.com/security/2026/07/now-defenders-are-embracing-the-prompt-injection-too/?ref=frontenddogma.com

#ai #prompting #security

I found a KVM guest-to-host heap corruption bug and someone else got there first https://lobste.rs/s/octplv #linux #security
https://blog.himanshuanand.com/2026/08/i-found-a-kvm-guest-to-host-heap-corruption-bug-and-someone-else-got-there-first/

Signal introduces Automatic Key Verification 🔑

It provides an easier solution for confirming end-to-end encryption between you and your contact

👉 https://aboutsignal.com/news/signal-introduces-automatic-key-verification/

#signal #signalapp #signalmessenger #aboutsignal #security #privacy #tech #news

Decrypting Flume Water Monitor Traffic via @hibachrach https://lobste.rs/s/g94aro #hardware #security
https://lithostech.com/2026/08/decrypting-flume-water-monitor-traffic/

Apple Limits Bug Bounty Submissions After a Barrage of AI Entries https://lobste.rs/s/uyyfhi #security #vibecoding
https://www.pcmag.com/news/apple-limits-bug-bounty-submissions-after-a-barrage-of-ai-entries

My Homelab Got Hacked - A Postmortem https://lobste.rs/s/ugkhor #devops #security
https://phunky.cafe/my-homelab-got-hacked/

Decentralized Identifier Resolution (DID Resolution) v1 retrieves a DID document for a given DID, while DID URL dereferencing retrieves a resource for a given DID URL. This @w3c specification defines a standard interface for both, independent of the DID method, along with implementation, #security and #privacy requirements #timetoimplement
▶️ https://www.w3.org/TR/did-resolution-1.0/

Feedback welcome! https://github.com/w3c/did-resolution/issues

Bypassing Android Hardware Attestation from the Analyst's Chair https://lobste.rs/s/lbaw4d #android #security
https://blog.quarkslab.com/bypassing-android-hardware-attestation.html

Deadbugz: Currently Active MCP Supply-Chain Campaign https://lobste.rs/s/wjiyxu #security #vibecoding
https://www.pillar.security/blog/deadbugz-currently-active-mcp-supply-chain-campaign

Decentralized Identifier Resolution (DID Resolution) v1 retrieves a DID document for a given DID, while DID URL dereferencing retrieves a resource for a given DID URL. This @w3c specification defines a standard interface for both, independent of the DID method, along with implementation, #security and #privacy requirements #timetoimplement
▶️ https://www.w3.org/TR/did-resolution-1.0/

Feedback welcome! https://github.com/w3c/did-resolution/issues

Signal introduces Automatic Key Verification 🔑

It provides an easier solution for confirming end-to-end encryption between you and your contact

👉 https://aboutsignal.com/news/signal-introduces-automatic-key-verification/

#signal #signalapp #signalmessenger #aboutsignal #security #privacy #tech #news

Updated GPG key for signing Firefox and Thunderbird Releases https://lobste.rs/s/vj2erc #security
https://blog.mozilla.org/security/2026/08/10/updated-gpg-key-for-signing-firefox-and-thunderbird-releases/

Shipping post-quantum cryptography to Python https://lobste.rs/s/szvtko #cryptography #python #security
https://blog.trailofbits.com/2026/06/30/shipping-post-quantum-cryptography-to-python/

A researcher bought noreply.net. Companies started sending him secrets https://lobste.rs/s/exgfc0 #privacy #security
https://arstechnica.com/security/2026/08/a-researcher-bought-noreply-net-companies-started-sending-him-secrets/

GitHub Actions needs OIDC audience constraints by @yossarian https://lobste.rs/s/ipt1em #security
https://blog.yossarian.net/2026/08/10/github-actions-needs-oidc-audience-constraints

Easy Sandboxing on Linux with Bubblewrap https://lobste.rs/s/stehhb #linux #security
https://bxt.rs/blog/easy-sandboxing-on-linux-with-bubblewrap/

Integrated Sensing and Communication (ISAC) https://lobste.rs/s/35dq6x #privacy #security
https://www.ericsson.com/en/6g/isac

Stronger With Every Update: How We’re Making Chrome and the Web Safer in the AI Era, by (not on Mastodon or Bluesky):

https://blog.google/security/chrome-stronger-with-every-update/?ref=frontenddogma.com

#chrome #browsers #ai #security

What do you mean by "sandbox" exactly?

https://rmhrisk.github.io/containing-the-optimizer/

By @rmhrisk

#security #privacy

Do mini PCIe hardware security modules or standalone cryptographically strong pRNGs exist? If they do, where can I get one? NetBSD is complaining about low entropy (laptop from 2011) & suggests I keysmash, use an entropy file, or get a USB pRNG. I would prefer to have all of my USB ports free.

I have no idea where to find such a thing & I can't even find USB HSMs besides the one that YubiCo sells. The closest thing I have found is a bunch of TPM2 chips with SPI headers on them & I don't think I have any free SPI connectors in the laptop. For now I'll use an entropy file but I would rather do something better like using a proper RNG device.

I think people watching these tags might know more than I can find with a search engine. Thank you.

#Security #BSD #NetBSD #Linux #Cryptography

OpenSSH Key Structure Guide via @bd103 https://lobste.rs/s/lnxdje #security
https://sshref.dev/

experiments with isolation on blue pill https://lobste.rs/s/bbkpzc #assembly #c #hardware #security
https://l0puh.github.io/log/2026/08/04/experiments_with_isolation/

Major Shai Hulud Campaign Strikes npm Again, Affecting keyv and 400 Packages, by (not on Mastodon or Bluesky):

https://research.jfrog.com/post/shai-hulud-is-back-august/?ref=frontenddogma.com

#npm #dependencies #security

AI-generated vulnerability patches require human review https://lobste.rs/s/rkh2ux #security
https://1password.com/blog/why-ai-generated-patches-still-require-human-review

SCTPhantom: An 18-Year-Old SCTP ASCONF Transport Use-After-Free https://lobste.rs/s/wdnet3 #linux #security #vibecoding
https://matrix.tencent.com/en/2026/08/06/sctphantom-CVE-2026-64564

TONTOU: On the Exploitability of Time-of-Neutralization to Time-of-Use Windows https://lobste.rs/s/eodvvq #pdf #security
https://people.csail.mit.edu/mengjia/data/2026.USENIX.TONTOU.pdf

Zapscape - Guest to host escape in KVM/x86 https://lobste.rs/s/2hatf3 #linux #security #virtualization
https://github.com/V4bel/Zapscape

schrodingers-toctou: The binary you run is not the program you wrote https://lobste.rs/s/bmnusu #c #compilers #security
https://github.com/xoreaxeaxeax/schrodingers-toctou

Explosive drone: Why Leipzig/Halle airport keeps becoming a target for sabotage.

Leipzig/Halle is one of Europe’s most important cargo airports and a key hub for military transport.

After the latest incident, the question arises again: why does this site repeatedly become a focus of suspected sabotage?

https://mediafaro.org/article/20260806-explosive-drone-why-leipzighalle-airport-keeps-becoming-a-target-for-sabotage?mf_channel=mastodon&action=forward

#Leipzig #Airport #Sabotage #Aviation #Security #Drones #Germany #Ukraine #WarInUkraine

Maciek Palmowski on Testing Secure WordPress Hosting: Does the Marketing Match Reality?, by @palmiak and @nathanwrigley:

https://wptavern.com/podcast/227-maciek-palmowski-on-testing-secure-wordpress-hosting-does-the-marketing-match-reality?ref=frontenddogma.com

#podcasts #interviews #wordpress #hosting #security

Explosive drone: Why Leipzig/Halle airport keeps becoming a target for sabotage.

Leipzig/Halle is one of Europe’s most important cargo airports and a key hub for military transport.

After the latest incident, the question arises again: why does this site repeatedly become a focus of suspected sabotage?

https://mediafaro.org/article/20260806-explosive-drone-why-leipzighalle-airport-keeps-becoming-a-target-for-sabotage?mf_channel=mastodon&action=forward

#Leipzig #Airport #Sabotage #Aviation #Security #Drones #Germany #Ukraine #WarInUkraine

tl;dv (Too Lazy; Didn't Validate): 181,874 Meetings Left Wide Open https://lobste.rs/s/97laur #privacy #security
https://bobdahacker.com/blog/tldv-hack

Web Security Is Too Hard, by @Ericlaw:

https://textslashplain.com/2026/08/04/security-is-hard-yall/?ref=frontenddogma.com

#security #cloudflare #casestudies

AI models shock UK testers by using fake identities to try to trick developers https://lobste.rs/s/tmpokv #security
https://www.theguardian.com/technology/2026/aug/05/openai-anthropic-models-went-rogue-cybersecurity-test-ai-security-institute

Disrupting Supply Chain Attacks on npm and GitHub Actions, by @gregose and @steiza:

https://github.blog/security/supply-chain-security/disrupting-supply-chain-attacks-on-npm-and-github-actions/?ref=frontenddogma.com

#npm #githubactions #security #linklists

Keyv and friends compromised in npm supply chain attack https://lobste.rs/s/krevdg #javascript #security
https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack

The Secure Way to Release an npm Package in 2026, by @sitnik_en and @travisturner.bsky.social (@evilmartians):

https://evilmartians.com/chronicles/the-secure-way-to-release-an-npm-package?ref=frontenddogma.com

#dependencies #npm #security #configuration #github

Security is Hard, Y’all https://lobste.rs/s/qoptbx #security
https://textslashplain.com/2026/08/04/security-is-hard-yall/

Blogged: Automatic CSRF protection based on Fetch Metadata headers - Exploring the .NET 11 preview

https://andrewlock.net/exploring-the-dotnet-11-preview-6-automatic-csrf-protection-based-on-fetch-metadata-http-headers/

In this post I describe the new Cross-Site Request Forgery protection added to ASP.NET Core that uses Fetch Metadata headers instead of tokens

#aspnetcore #security

sketches for @sstendahl’s Lockpicker.

#gnome #app #icon #design #sketch #security

SQLite Critical CVEs or LLM Slop? https://lobste.rs/s/9nxwpi #security
https://research.jfrog.com/post/sqlite-critical-cves-or-llm-slops/

The rooting, firmware analysis and hardcoded, reset-persistent credentials of the TP-Link TL-841N https://lobste.rs/s/pwarxx #security
https://blog.juni-mp4.com/posts/42/rooting-the-tplink-tl841n-pt1/

CVE-2026-49413 - FreeBSD LPE via Linuxulator AT_SECURE Logic Bug https://lobste.rs/s/j1sfc2 #freebsd #security
https://ii4gsp.github.io/cve-2026-49413/

Apple Screen Sharing Pre-Auth RCE https://lobste.rs/s/t1wy9l #mac #security
https://warez.sl0p.foo/apple-screensharing-rce/

Patch In, Exploit Out: How deepsec Reconstructed the Pwn2Own Microsoft Edge Sandbox Escape https://lobste.rs/s/znf3q8 #security #vibecoding
http://www.darknavy.org/blog/patch_in_exploit_out_how_deepsec_reconstructed_the_pwn2own_microsoft_edge_sandbox_escape/

The Hidden CCS2 Attack Surface on EV Chargers https://lobste.rs/s/ozfe71 #hardware #security
https://www.saiflow.com/blog/the-hidden-ccs2-attack-surface-on-ev-chargers

🐍🚀 Out now: Tablib 3.10.0

The format-agnostic tabular dataset library

🔒 Security fix to escape dataset title in HTML serialisation
🦥 Support for Python 3.15 with lazy imports
💧 Drop support for EOL Python 3.9
🩹 And a bunch of fixes

https://github.com/jazzband/tablib/releases/tag/v3.10.0
#Python #Tablib #release #security #Python315

Amazon Identifies North Korean Hacker Group Behind Open-Source Supply Chain Attacks, by (not on Mastodon or Bluesky):

https://aws.amazon.com/blogs/security/amazon-identifies-north-korean-hacker-group-behind-open-source-supply-chain-attacks/?ref=frontenddogma.com

#foss #security #amazon

Auch KI des OpenAI-Rivalen Anthropic griff echte Firmen an

Nach einem Vorfall bei OpenAI räumt nun auch Anthropic ein, dass eigene KI-Modelle bei Sicherheitstests ungeplant echte Firmensysteme angegriffen haben.

https://www.heise.de/news/Auch-KI-des-OpenAI-Rivalen-Anthropic-griff-echte-Firmen-an-11387741.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Anthropic #Claude #IT #KünstlicheIntelligenz #OpenAI #Security #Sicherheitslücken #news

The Python Software Foundation is hiring a Security Developer to join @miketheman and I on triaging vulnerability reports and mitigating malware published to PyPI.

If you've got experience with Python, security, and collaborating with open source projects then we'd love to hear from you:

https://jobs.pyfound.org/apply/ei03ut60y4/Security-Developer?referrer=20260730140256DSN5BCNCWZA5MXAO

#python #security #pypi #supplychain #vulnerability

KindaRails2Shell - Critical RCE in Rails via Active Storage (CVE-2026-66066) https://lobste.rs/s/kkobew #ruby #security
https://ethiack.com/info-hub/research/kindarails2shell-rails-rce-cve-2026-66066

Liebes @certbund - Team, SQLite ist eine Embedded Database, die von sich aus keinen Netzwerk-Endpunkt bereitstellt. Wie kann es da einen "entfernten, anonymen Angreifer" geben?

https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2581

#cve #security #sqlite

The Python Software Foundation is hiring a Security Developer to join @miketheman and I on triaging vulnerability reports and mitigating malware published to PyPI.

If you've got experience with Python, security, and collaborating with open source projects then we'd love to hear from you:

https://jobs.pyfound.org/apply/ei03ut60y4/Security-Developer?referrer=20260730140256DSN5BCNCWZA5MXAO

#python #security #pypi #supplychain #vulnerability

Electronic Frontier Foundation: Why Are Gay Bars Building Databases of Their Patrons?. “Recent reports have raised alarm about the use of PatronScan, an ID-checking and face-scanning system, at multiple LGBTQ+ bars in San Francisco’s Castro neighborhood. Much of the attention has focused on reports that the system photographs patrons as they enter venues and questions about whether those […]

Electronic Frontier Foundation: Why Are Gay Bars Building Databases of Their Patrons?. “Recent reports have raised alarm about the use of PatronScan, an ID-checking and face-scanning system, at multiple LGBTQ+ bars in San Francisco’s Castro neighborhood. Much of the attention has focused on reports that the system photographs patrons as they enter venues and questions about whether those […]

Blogged: Understanding the Fetch Metadata HTTP headers: Sec-Fetch-Site and friends

https://andrewlock.net/understanding-the-fetch-metadata-http-headers-sec-fetch-site-and-friends/

In this post I describe the Fetch Metadata HTTP headers like Sec-Fetch-Site and Sec-Fetch-Mode which give information to a server about the context of a request

#Security #aspnetcore

Copilot will propagate a malicious worm from one Word document to another https://lobste.rs/s/rgn8u4 #security #vibecoding
https://enklypesalt.com/posts/context-collapse-part3-ai-worming-through-word/

Hackers Are Exploiting Recently Patched WordPress Bugs, Putting Millions of Websites at Risk, by @lorenzofb:

https://web.archive.org/web/20260720153552/https://techcrunch.com/2026/07/20/hackers-are-exploiting-recently-patched-wordpress-bugs-putting-millions-of-websites-at-risk/?ref=frontenddogma.com

#wordpress #bugs #security

Detection primitives for eBPF rootkits https://lobste.rs/s/72hjym #linux #security
https://securitylabs.datadoghq.com/articles/detection-primitives-for-ebpf-rootkits/

Proof types in Dart: Using final classes as computational witnesses https://lobste.rs/s/wdo7aj #compilers #security
https://modulovalue.com/blog/proof-types-in-dart/

Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident https://lobste.rs/s/pxczeo #security #vibecoding
https://huggingface.co/blog/agent-intrusion-technical-timeline

The Cipher Behind QSYRUPWD: Reconstructing IBM i Password Hashes https://lobste.rs/s/2dc0gb #reversing #security
https://blog.silentsignal.eu/2026/07/28/the-cipher-behind-qsyrupwd-reconstructing-ibm-i-password-hashes/

🇫🇷 Un petit bug with a big impact.

A vulnerability reported by Doyensec's French team members in Electron's `shell.openPath()` has now been patched. Apps relying on string-only path validation could be tricked into opening a different file via an embedded null byte.

Merci to the Electron maintainers for the quick fix.

https://github.com/electron/electron/security/advisories/GHSA-5c9j-mhmv-5xgx

#doyensec #appsec #security #electron #electronjs

Bastillion 5.1: single-JAR SSH gateway now audits and replays every session https://lobste.rs/s/an2tby #java #release #security
https://github.com/bastillion-io/Bastillion/releases#release-v5.1.0

🇫🇷 Un petit bug with a big impact.

A vulnerability reported by Doyensec's French team members in Electron's `shell.openPath()` has now been patched. Apps relying on string-only path validation could be tricked into opening a different file via an embedded null byte.

Merci to the Electron maintainers for the quick fix.

https://github.com/electron/electron/security/advisories/GHSA-5c9j-mhmv-5xgx

#doyensec #appsec #security #electron #electronjs

Design flaws in issetugid() (2017) https://lobste.rs/s/6gx5vy #api #c #security #unix
https://gist.github.com/nicowilliams/4daf74a3a0c86848d3cbd9d0cdb5e26e

Local-First AI Coding Workflow for Security-Conscious Teams, by (not on Mastodon or Bluesky):

https://agent-island.dev/guides/local-first-ai-coding-security-workflow/?ref=frontenddogma.com

#ai #processes #security

Dieses Schaubild fand ich einfach zu gut, um es euch vorzuenthalten, wenn ihr euch nicht einen eigenen #pihole oder #adguardhome aufbauen und betreiben könnt oder wollt, dann kann das eine sehr clevere und smarte Idee sein, einen (bzw. gleich zwei wegen u.a. Ausfallsicherheit) Werbe- und Tracking-blockenden öffentlichen DNS in eurem Router ("Fritzbox") für euer Heimnetzwerk einzutragen.

Alle anderen können sich ihren eigenen Werbe-/Tracking-/Malware-Blocker selber aufbauen:

https://thomasmerz.github.io/pihole-wireguard-knowhow/

#adblock #notracking #security #privacy #selfhosting

Apple MIE exploitation challenge https://lobste.rs/s/lz6eoe #mac #security
https://blog.calif.io/p/apple-mie-exploitation-challenge

Exploiting Volvo/Eicher’s fleet management platform to gain control over all users and vehicles https://lobste.rs/s/pg4toy #security
https://eaton-works.com/2026/07/27/my-eicher-hack/

Stumbled into an escaping-related, medium–high security vulnerability in 3 (!) minifiers today:

* Fixed and also officially reported in HTML Minifier Next (upgrade to 7.5.2!)
* Reported via security-related channels to the other two minifiers (first time to rely on SECURITY.md—useful)

It came up while reviewing and rerunning benchmarks across minifiers, but wasn’t the find to expect (a vulnerability that existed between 8 months and… 10 years).

#minification #htmlminifier #security

Paged Out - Issue #9 https://lobste.rs/s/cbbit5 #release #security
https://pagedout.institute/webview.php?issue=9&page=1

What does GitHub’s security team even do? https://lobste.rs/s/jnhyrh #security #vcs
https://orchidfiles.com/github-security-team/

Monday, July 27, 2026 Security Releases, by @nodejs:

https://nodejs.org/en/blog/vulnerability/july-2026-security-releases?ref=frontenddogma.com

#releasenotes #nodejs #security

CVE-2026-49176 Exploit Development: WalletService to SYSTEM https://lobste.rs/s/dxhdqx #security #windows
https://davidcarliez.github.io/blog/cve-2026-49176-walletservice-to-system/

🙏 New Blog Post

The Pope's official prayer app has an IDOR that lets anyone pull user data for all 719,517 accounts. One GET request per user. No auth check.

What's exposed:

• Email addresses
• Names
• Country
• Date of birth (they call it "borned_date" lol)
• Account role (it's "PRAYER" for everyone, obviously)

Also found:

• Signup endpoint returns the email verification token in the response body, so you can verify accounts without accessing the inbox
• Their verification emails fail their own domain's authentication requirements

Reported January 3rd. Emailed 9 people. A journalist also contacted them. Zero responses. Still live six months later. Vow of silence I guess.

Full writeup: https://bobdahacker.com/blog/click-to-pray

#InfoSec #BugBounty #ResponsibleDisclosure #IDOR #Security #CyberSecurity #Privacy #DataExposure #ClickToPray #Vatican #APISecurity

🙏 New Blog Post

The Pope's official prayer app has an IDOR that lets anyone pull user data for all 719,517 accounts. One GET request per user. No auth check.

What's exposed:

• Email addresses
• Names
• Country
• Date of birth (they call it "borned_date" lol)
• Account role (it's "PRAYER" for everyone, obviously)

Also found:

• Signup endpoint returns the email verification token in the response body, so you can verify accounts without accessing the inbox
• Their verification emails fail their own domain's authentication requirements

Reported January 3rd. Emailed 9 people. A journalist also contacted them. Zero responses. Still live six months later. Vow of silence I guess.

Full writeup: https://bobdahacker.com/blog/click-to-pray

#InfoSec #BugBounty #ResponsibleDisclosure #IDOR #Security #CyberSecurity #Privacy #DataExposure #ClickToPray #Vatican #APISecurity

🙏 New Blog Post

The Pope's official prayer app has an IDOR that lets anyone pull user data for all 719,517 accounts. One GET request per user. No auth check.

What's exposed:

• Email addresses
• Names
• Country
• Date of birth (they call it "borned_date" lol)
• Account role (it's "PRAYER" for everyone, obviously)

Also found:

• Signup endpoint returns the email verification token in the response body, so you can verify accounts without accessing the inbox
• Their verification emails fail their own domain's authentication requirements

Reported January 3rd. Emailed 9 people. A journalist also contacted them. Zero responses. Still live six months later. Vow of silence I guess.

Full writeup: https://bobdahacker.com/blog/click-to-pray

#InfoSec #BugBounty #ResponsibleDisclosure #IDOR #Security #CyberSecurity #Privacy #DataExposure #ClickToPray #Vatican #APISecurity

Weaponizing and Defending the React Flight Protocol: Deserialization Sinks in RSCs, by @smashingmag:

https://www.smashingmagazine.com/2026/07/weaponizing-defending-react-flight-protocol/?ref=frontenddogma.com

#react #components #security

🙏 New Blog Post

The Pope's official prayer app has an IDOR that lets anyone pull user data for all 719,517 accounts. One GET request per user. No auth check.

What's exposed:

• Email addresses
• Names
• Country
• Date of birth (they call it "borned_date" lol)
• Account role (it's "PRAYER" for everyone, obviously)

Also found:

• Signup endpoint returns the email verification token in the response body, so you can verify accounts without accessing the inbox
• Their verification emails fail their own domain's authentication requirements

Reported January 3rd. Emailed 9 people. A journalist also contacted them. Zero responses. Still live six months later. Vow of silence I guess.

Full writeup: https://bobdahacker.com/blog/click-to-pray

#InfoSec #BugBounty #ResponsibleDisclosure #IDOR #Security #CyberSecurity #Privacy #DataExposure #ClickToPray #Vatican #APISecurity

IETF: Warnung vor Nebenwirkungen eines Social-Media-Verbots für Jugendliche

Auf dem IETF-Treffen in Wien warnten Entwickler vor den Risiken von Altersverifikationssystemen. Diese könnten Sicherheit und Vertraulichkeit im Netz gefährden.

https://www.heise.de/news/IETF-Warnung-vor-Nebenwirkungen-eines-Social-Media-Verbots-fuer-Jugendliche-11376975.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Datenschutz #DigitalServicesAct #IETF #Internet #Jugendschutz #Netzpolitik #Security #news

IETF: Warnung vor Nebenwirkungen eines Social-Media-Verbots für Jugendliche

Auf dem IETF-Treffen in Wien warnten Entwickler vor den Risiken von Altersverifikationssystemen. Diese könnten Sicherheit und Vertraulichkeit im Netz gefährden.

https://www.heise.de/news/IETF-Warnung-vor-Nebenwirkungen-eines-Social-Media-Verbots-fuer-Jugendliche-11376975.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Datenschutz #DigitalServicesAct #IETF #Internet #Jugendschutz #Netzpolitik #Security #news

Milan Petrović on the Risks of Legacy PHP in WordPress and Why Upgrading Matters for Security, by @nathanwrigley:

https://wptavern.com/podcast/225-milan-petrovic-on-the-risks-of-legacy-php-in-wordpress-and-why-upgrading-matters-for-security?ref=frontenddogma.com

#podcasts #interviews #php #wordpress #security #maintenance

Silent Replacement of Trusted macOS App Executables https://lobste.rs/s/dxaogf #mac #security
https://mysk.blog/2026/07/23/macos-overwrite-app-executables/

🚨 We're disclosing a macOS security bug that Apple says is not an issue.
Using a simple archive-and-restore trick, an attacker can silently replace the main executable of virtually any application downloaded from the web—no password or warning is required.
Here's a demo using Signal to steal its encryption key.
📝 Blog with technical details: link in the replies.
Do you think this should be considered a security bug?
🎬👇
#Apple #privacy #infosec #security #macOS

https://youtu.be/0bOC8S3NQxI

Something worse than a credit inquiry happens when you apply for a credit card now

You Opened a Credit Card. ICE Now Knows Where You Live

https://www.404media.co/you-opened-a-credit-card-ice-now-knows-where-you-live/

#CreditCard #ICE #ACAB #Security #Privacy #Surveillance #Tech

I Inspected My Take-Home Interview Project. It Was a Whole Operation https://lobste.rs/s/5nhto6 #security
https://citizendot.github.io/articles/fake-job-interview-git-hook-malware/

Something worse than a credit inquiry happens when you apply for a credit card now

You Opened a Credit Card. ICE Now Knows Where You Live

https://www.404media.co/you-opened-a-credit-card-ice-now-knows-where-you-live/

#CreditCard #ICE #ACAB #Security #Privacy #Surveillance #Tech

Frag Gap (CVE-2026-53362, CVE-2026-53366) https://lobste.rs/s/uibzl8 #linux #security
https://blog.qwerty.or.kr/en/posts/cdf3008a-c1a4-4eca-a373-aa3a2bcf1489/

Dark Elevator: Windows Install Service Local Privilege Escalation (CVE-2026-50343) https://lobste.rs/s/miadav #security #windows
https://blog.calif.io/p/dark-elevator-windows-install-service

RefluXFS: A Linux Kernel Local Privilege Escalation to Root in XFS (CVE-2026-64600) https://lobste.rs/s/tltlwf #linux #security
https://blog.qualys.com/vulnerabilities-threat-research/2026/07/22/refluxfs-a-linux-kernel-local-privilege-escalation-to-root-in-xfs-cve-2026-64600

PyPI releases now reject new files after 14 days https://lobste.rs/s/53g8f7 #python #security
https://blog.pypi.org/posts/2026-07-22-releases-now-reject-new-files-after-14-days/

The Python Package Index now rejects new files published to releases older than 14 days. This mitigation prevents long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects are compromised.

https://blog.pypi.org/posts/2026-07-22-releases-now-reject-new-files-after-14-days

#python #security #supplychain #pypi

The Python Package Index now rejects new files published to releases older than 14 days. This mitigation prevents long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects are compromised.

https://blog.pypi.org/posts/2026-07-22-releases-now-reject-new-files-after-14-days

#python #security #supplychain #pypi

[Hugging Face] Security Incident Disclosure—July 2026, by (not on Mastodon or Bluesky):

https://huggingface.co/blog/security-incident-july-2026?ref=frontenddogma.com

#huggingface #ai #security

New, exclusive, by me: LG to Ban Residential Proxy Providers from Smart TV Apps

The home appliance giant LG Electronics USA said this week it plans to suspend any apps built for its smart TVs that turn one’s television into an always-on residential proxy node. The move comes less than a month after researchers found that more than 42 percent of games and other apps available for download on LG’s webOS store allow unknown third-parties to route their Internet traffic through a user’s TV.

https://krebsonsecurity.com/2026/07/lg-to-ban-residential-proxies-from-smart-tv-apps/

#smarttv #lg #residentialproxies #spur #security

LG to Ban Residential Proxies from Smart TV Apps https://lobste.rs/s/ny0yzm #security
https://krebsonsecurity.com/2026/07/lg-to-ban-residential-proxies-from-smart-tv-apps/

New, exclusive, by me: LG to Ban Residential Proxy Providers from Smart TV Apps

The home appliance giant LG Electronics USA said this week it plans to suspend any apps built for its smart TVs that turn one’s television into an always-on residential proxy node. The move comes less than a month after researchers found that more than 42 percent of games and other apps available for download on LG’s webOS store allow unknown third-parties to route their Internet traffic through a user’s TV.

https://krebsonsecurity.com/2026/07/lg-to-ban-residential-proxies-from-smart-tv-apps/

#smarttv #lg #residentialproxies #spur #security

New, exclusive, by me: LG to Ban Residential Proxy Providers from Smart TV Apps

The home appliance giant LG Electronics USA said this week it plans to suspend any apps built for its smart TVs that turn one’s television into an always-on residential proxy node. The move comes less than a month after researchers found that more than 42 percent of games and other apps available for download on LG’s webOS store allow unknown third-parties to route their Internet traffic through a user’s TV.

https://krebsonsecurity.com/2026/07/lg-to-ban-residential-proxies-from-smart-tv-apps/

#smarttv #lg #residentialproxies #spur #security

New, exclusive, by me: LG to Ban Residential Proxy Providers from Smart TV Apps

The home appliance giant LG Electronics USA said this week it plans to suspend any apps built for its smart TVs that turn one’s television into an always-on residential proxy node. The move comes less than a month after researchers found that more than 42 percent of games and other apps available for download on LG’s webOS store allow unknown third-parties to route their Internet traffic through a user’s TV.

https://krebsonsecurity.com/2026/07/lg-to-ban-residential-proxies-from-smart-tv-apps/

#smarttv #lg #residentialproxies #spur #security

Local Privilege Escalation in set-capabilities versions of snap-confine (CVE-2026-8933) https://lobste.rs/s/w7qez9 #linux #security
https://cdn2.qualys.com/advisory/2026/07/21/snap-confine-set-capabilities.txt

OpenAI model breaks out of security sandbox, hacks Hugging Face for data to pass test https://lobste.rs/s/7nrek3 #security #vibecoding
https://openai.com/index/hugging-face-model-evaluation-security-incident/

Website to recommend #tools to avoid supporting #ChatControl (available in EN, FR, DE and NL)

source: exitchatcontrol.org

#tool #utility #software #encryption #communication #eu #europe #law #surveillance #spy #chat #messenger #freedom #humanrights #democracy #politics #society #help #support #tutorial #knowhow #knowledge #security #cybersecurity #news
Exit Chat Control · Become Ungovernable

Website to recommend #tools to avoid supporting #ChatControl (available in EN, FR, DE and NL)

source: exitchatcontrol.org

#tool #utility #software #encryption #communication #eu #europe #law #surveillance #spy #chat #messenger #freedom #humanrights #democracy #politics #society #help #support #tutorial #knowhow #knowledge #security #cybersecurity #news
Exit Chat Control · Become Ungovernable

OpenBSD relayd(8) adds ECDSA support with CA engine code from smtpd(8) https://undeadly.org/cgi?action=article;sid=20260721124747 #openbsd #relayd #ecdsa #cryptography #security #https #loadbalancing #webserver #networking #develppment #freesoftware #libresoftware

OpenBSD relayd(8) adds ECDSA support with CA engine code from smtpd(8) https://undeadly.org/cgi?action=article;sid=20260721124747 #openbsd #relayd #ecdsa #cryptography #security #https #loadbalancing #webserver #networking #develppment #freesoftware #libresoftware

Smartphone security Tipp der Woche: Du startest dein Telefon oft neu

Du solltest dein Telefon öfter neu starten. Zum Beispiel ein mal pro Woche oder vor kritischen Gesprächen. Einige Staatstrojaner überleben Neustarts nicht, da diese oft nicht persistent sind.

Lies mehr zu dem Thema: https://smartphone-dont-spy.de/list/du-startest-dein-telefon-oft-neu

#smartphone #privacy #security

432 Linux kernel CVEs published in the last 24 hours https://lobste.rs/s/t2jxyu #linux #security
https://lore.kernel.org/linux-cve-announce/

SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts https://lobste.rs/s/xbfsho #ruby #security
https://www.aikido.dev/blog/sleepergem-rubygems-supply-chain-attack

Secrets Don’t Belong in Config https://lobste.rs/s/iypcjj #nix #security
https://secretspec.dev/blog/secrets-dont-belong-in-config/

Opaque, Interoperable Passkey Records https://lobste.rs/s/boyu9x #cryptography #security
https://words.filippo.io/passkey-record/

#NewOrleans #Cops Published Policy Document Allowing #Weaponized #Drones

The New Orleans #Police Department (#NOPD ) looked at ways to arm #quadcopter drones with #weapons , according to a draft version of its #drone manual shared with 404 Media. A draft version of the manual, which was live on the NOPD website in June, said that the department’s drones could only be equipped with weapons with written approval from the Superintendent of Police.
#security

https://www.404media.co/new-orleans-cops-published-policy-document-allowing-weaponized-drones/

#NewOrleans #Cops Published Policy Document Allowing #Weaponized #Drones

The New Orleans #Police Department (#NOPD ) looked at ways to arm #quadcopter drones with #weapons , according to a draft version of its #drone manual shared with 404 Media. A draft version of the manual, which was live on the NOPD website in June, said that the department’s drones could only be equipped with weapons with written approval from the Superintendent of Police.
#security

https://www.404media.co/new-orleans-cops-published-policy-document-allowing-weaponized-drones/

A Linux Kernel 0-day Journey - From a limited UAF to Physical Memory R/W https://lobste.rs/s/h9zpbs #linux #security
https://1day.dev/posts/linux-kernel-0day.html

When building a multi-factor authentication system for clients, backups codes should be generated just in case the user does not have their second factor with them.

The backup codes should all be one-time use of course, but how do you store them on the backend? What is best practice here? What is a real-world threat model?

#passwords #security #cybersecurity

7 Sandbox Escape Vulnerabilities Across 4 Coding Agent Vendors https://lobste.rs/s/bper0d #security #vibecoding
https://www.pillar.security/blog/the-week-of-sandbox-escapes

Using LLM-based Verification to Eliminate Bugs in Linux's Network Stack https://lobste.rs/s/locapv #linux #security #vibecoding
https://www.basis.ai/blog/verified-nftables/

Fuzzing for fun - unauthenticated denial of service in snac2 https://lobste.rs/s/zjnc5o #c #security
https://nullenvk.pl/posts/02-snac2-json/

If you use BotKit, update to a patched release now. CVE-2026-62857 affects Fedify's NodeInfo client, and BotKit includes the affected Fedify versions as a dependency.

Fedify can look up a remote server's NodeInfo document to learn what software it runs. The lookup first fetches the server's /.well-known/nodeinfo document, then follows the NodeInfo document URL advertised in that response. The vulnerable paths are getNodeInfo() and the Context.lookupNodeInfo() method that wraps it: affected versions sent both requests without checking that their destinations were on the public internet. Because the second URL comes from the remote server's response, an attacker who controls a server being looked up could point it at a loopback address, a link-local cloud metadata endpoint, an RFC 1918 host, or a data: URL. Depending on the deployment environment and network routing, this could cause a BotKit application that looks up NodeInfo to fetch non-public network resources and return their contents to the application.

The fix routes both requests through Fedify's public-address validation. It checks every request before sending it, including each redirect hop, limits the number of redirects, refuses redirects that cross protocols, and rejects non-HTTP(S) URLs. Servers are exposed only if they look up remote NodeInfo, but such lookups are commonly used for peer discovery and instance metadata.

BotKit 0.4.x versions through 0.4.4 and BotKit 0.5.0 are affected. Patched releases are 0.4.5 and 0.5.1. BotKit 0.4.5 uses Fedify 2.1.19, and BotKit 0.5.1 uses Fedify 2.3.3.

For BotKit 0.5.x, update @fedify/botkit:

npm  update  @fedify/botkit
yarn upgrade @fedify/botkit
pnpm update  @fedify/botkit
bun  update  @fedify/botkit
deno update  @fedify/botkit

For BotKit 0.4.x, update @fedify/botkit:

npm  update  @fedify/botkit@0.4.5
yarn upgrade @fedify/botkit@0.4.5
pnpm update  @fedify/botkit@0.4.5
bun  update  @fedify/botkit@0.4.5
deno update  @fedify/botkit@0.4.5

After updating, redeploy. The GitHub Security Advisory is GHSA-hqph-j65v-8cq5, and the CVE ID is CVE-2026-62857. See also Fedify's own announcement.

Thanks to @rvzsec and @manus-use for the report and responsible disclosure.

If anything is unclear, feel free to ask on GitHub Discussions or Matrix.

If you use BotKit, update to a patched release now. CVE-2026-62857 affects Fedify's NodeInfo client, and BotKit includes the affected Fedify versions as a dependency.

Fedify can look up a remote server's NodeInfo document to learn what software it runs. The lookup first fetches the server's /.well-known/nodeinfo document, then follows the NodeInfo document URL advertised in that response. The vulnerable paths are getNodeInfo() and the Context.lookupNodeInfo() method that wraps it: affected versions sent both requests without checking that their destinations were on the public internet. Because the second URL comes from the remote server's response, an attacker who controls a server being looked up could point it at a loopback address, a link-local cloud metadata endpoint, an RFC 1918 host, or a data: URL. Depending on the deployment environment and network routing, this could cause a BotKit application that looks up NodeInfo to fetch non-public network resources and return their contents to the application.

The fix routes both requests through Fedify's public-address validation. It checks every request before sending it, including each redirect hop, limits the number of redirects, refuses redirects that cross protocols, and rejects non-HTTP(S) URLs. Servers are exposed only if they look up remote NodeInfo, but such lookups are commonly used for peer discovery and instance metadata.

BotKit 0.4.x versions through 0.4.4 and BotKit 0.5.0 are affected. Patched releases are 0.4.5 and 0.5.1. BotKit 0.4.5 uses Fedify 2.1.19, and BotKit 0.5.1 uses Fedify 2.3.3.

For BotKit 0.5.x, update @fedify/botkit:

npm  update  @fedify/botkit
yarn upgrade @fedify/botkit
pnpm update  @fedify/botkit
bun  update  @fedify/botkit
deno update  @fedify/botkit

For BotKit 0.4.x, update @fedify/botkit:

npm  update  @fedify/botkit@0.4.5
yarn upgrade @fedify/botkit@0.4.5
pnpm update  @fedify/botkit@0.4.5
bun  update  @fedify/botkit@0.4.5
deno update  @fedify/botkit@0.4.5

After updating, redeploy. The GitHub Security Advisory is GHSA-hqph-j65v-8cq5, and the CVE ID is CVE-2026-62857. See also Fedify's own announcement.

Thanks to @rvzsec and @manus-use for the report and responsible disclosure.

If anything is unclear, feel free to ask on GitHub Discussions or Matrix.

If you use BotKit, update to a patched release now. CVE-2026-62857 affects Fedify's NodeInfo client, and BotKit includes the affected Fedify versions as a dependency.

Fedify can look up a remote server's NodeInfo document to learn what software it runs. The lookup first fetches the server's /.well-known/nodeinfo document, then follows the NodeInfo document URL advertised in that response. The vulnerable paths are getNodeInfo() and the Context.lookupNodeInfo() method that wraps it: affected versions sent both requests without checking that their destinations were on the public internet. Because the second URL comes from the remote server's response, an attacker who controls a server being looked up could point it at a loopback address, a link-local cloud metadata endpoint, an RFC 1918 host, or a data: URL. Depending on the deployment environment and network routing, this could cause a BotKit application that looks up NodeInfo to fetch non-public network resources and return their contents to the application.

The fix routes both requests through Fedify's public-address validation. It checks every request before sending it, including each redirect hop, limits the number of redirects, refuses redirects that cross protocols, and rejects non-HTTP(S) URLs. Servers are exposed only if they look up remote NodeInfo, but such lookups are commonly used for peer discovery and instance metadata.

BotKit 0.4.x versions through 0.4.4 and BotKit 0.5.0 are affected. Patched releases are 0.4.5 and 0.5.1. BotKit 0.4.5 uses Fedify 2.1.19, and BotKit 0.5.1 uses Fedify 2.3.3.

For BotKit 0.5.x, update @fedify/botkit:

npm  update  @fedify/botkit
yarn upgrade @fedify/botkit
pnpm update  @fedify/botkit
bun  update  @fedify/botkit
deno update  @fedify/botkit

For BotKit 0.4.x, update @fedify/botkit:

npm  update  @fedify/botkit@0.4.5
yarn upgrade @fedify/botkit@0.4.5
pnpm update  @fedify/botkit@0.4.5
bun  update  @fedify/botkit@0.4.5
deno update  @fedify/botkit@0.4.5

After updating, redeploy. The GitHub Security Advisory is GHSA-hqph-j65v-8cq5, and the CVE ID is CVE-2026-62857. See also Fedify's own announcement.

Thanks to @rvzsec and @manus-use for the report and responsible disclosure.

If anything is unclear, feel free to ask on GitHub Discussions or Matrix.

If you use BotKit, update to a patched release now. CVE-2026-62857 affects Fedify's NodeInfo client, and BotKit includes the affected Fedify versions as a dependency.

Fedify can look up a remote server's NodeInfo document to learn what software it runs. The lookup first fetches the server's /.well-known/nodeinfo document, then follows the NodeInfo document URL advertised in that response. The vulnerable paths are getNodeInfo() and the Context.lookupNodeInfo() method that wraps it: affected versions sent both requests without checking that their destinations were on the public internet. Because the second URL comes from the remote server's response, an attacker who controls a server being looked up could point it at a loopback address, a link-local cloud metadata endpoint, an RFC 1918 host, or a data: URL. Depending on the deployment environment and network routing, this could cause a BotKit application that looks up NodeInfo to fetch non-public network resources and return their contents to the application.

The fix routes both requests through Fedify's public-address validation. It checks every request before sending it, including each redirect hop, limits the number of redirects, refuses redirects that cross protocols, and rejects non-HTTP(S) URLs. Servers are exposed only if they look up remote NodeInfo, but such lookups are commonly used for peer discovery and instance metadata.

BotKit 0.4.x versions through 0.4.4 and BotKit 0.5.0 are affected. Patched releases are 0.4.5 and 0.5.1. BotKit 0.4.5 uses Fedify 2.1.19, and BotKit 0.5.1 uses Fedify 2.3.3.

For BotKit 0.5.x, update @fedify/botkit:

npm  update  @fedify/botkit
yarn upgrade @fedify/botkit
pnpm update  @fedify/botkit
bun  update  @fedify/botkit
deno update  @fedify/botkit

For BotKit 0.4.x, update @fedify/botkit:

npm  update  @fedify/botkit@0.4.5
yarn upgrade @fedify/botkit@0.4.5
pnpm update  @fedify/botkit@0.4.5
bun  update  @fedify/botkit@0.4.5
deno update  @fedify/botkit@0.4.5

After updating, redeploy. The GitHub Security Advisory is GHSA-hqph-j65v-8cq5, and the CVE ID is CVE-2026-62857. See also Fedify's own announcement.

Thanks to @rvzsec and @manus-use for the report and responsible disclosure.

If anything is unclear, feel free to ask on GitHub Discussions or Matrix.

6 Security Settings Every GitHub Maintainer Should Enable This Week, by (not on Mastodon or Bluesky):

https://github.blog/security/6-security-settings-every-github-maintainer-should-enable-this-week/?ref=frontenddogma.com

#github #security #configuration #documentation

OpenSSL HollowByte: A DoS Hiding in 11 Bytes https://lobste.rs/s/tvpnsm #security
https://sec.okta.com/articles/2026/06/openssl-hollowbtye-a-dos-hiding-in-11-bytes/

wp2shell: Pre Authentication RCE in WordPress Core https://lobste.rs/s/aipvbn #security #web
https://wp2shell.com/

If you use Fedify, update to a patched release now. CVE-2026-62857 affects Fedify's NodeInfo client. An attacker who runs any instance your server looks up could cause that server to fetch non-public network destinations and return their contents to your application, depending on the deployment environment and network routing.

Fedify can look up a remote instance's NodeInfo document to learn what software it runs. The lookup happens in two steps: it fetches the instance's /.well-known/nodeinfo document, then follows the NodeInfo document URL that response advertises. The vulnerable path is getNodeInfo(), along with the Context.lookupNodeInfo() method that wraps it: affected versions sent both requests without validating the destination against public-network expectations. Because that second URL comes straight out of the remote server's response body, the instance being looked up fully controls it, and could point it at a loopback address, a link-local metadata endpoint, an RFC 1918 host, or a data: URL. Servers are exposed only if they look up NodeInfo, but that lookup is routine for peer discovery and instance metadata.

The fix routes both requests through the same public-address validation Fedify already applied to WebFinger lookups and remote document loading. Every request is now checked before it is sent, including each redirect hop, so a public URL cannot bounce a request to an internal address. Redirects are followed with a cap and are refused if they cross protocols, and non-HTTP(S) URLs such as data: are rejected outright.

These are patch releases, so they tighten behavior without adding new API. If you deliberately look up NodeInfo on a private or intranet address, such as in a closed federation or a test environment, these releases will now refuse it. An allowPrivateAddress opt-out is coming in 2.4.0.

Current patched releases are 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2. The GitHub Security Advisory is GHSA-hqph-j65v-8cq5, and the CVE ID is CVE-2026-62857.

Update @fedify/fedify:

npm  update  @fedify/fedify
yarn upgrade @fedify/fedify
pnpm update  @fedify/fedify
bun  update  @fedify/fedify
deno update  @fedify/fedify

After updating, redeploy. If you run other Fedify-based servers, update those too.

Thanks to @rvzsec and @manus-use for the report and responsible disclosure.

If anything is unclear, ask below.

If you use Fedify, update to a patched release now. CVE-2026-62857 affects Fedify's NodeInfo client. An attacker who runs any instance your server looks up could cause that server to fetch non-public network destinations and return their contents to your application, depending on the deployment environment and network routing.

Fedify can look up a remote instance's NodeInfo document to learn what software it runs. The lookup happens in two steps: it fetches the instance's /.well-known/nodeinfo document, then follows the NodeInfo document URL that response advertises. The vulnerable path is getNodeInfo(), along with the Context.lookupNodeInfo() method that wraps it: affected versions sent both requests without validating the destination against public-network expectations. Because that second URL comes straight out of the remote server's response body, the instance being looked up fully controls it, and could point it at a loopback address, a link-local metadata endpoint, an RFC 1918 host, or a data: URL. Servers are exposed only if they look up NodeInfo, but that lookup is routine for peer discovery and instance metadata.

The fix routes both requests through the same public-address validation Fedify already applied to WebFinger lookups and remote document loading. Every request is now checked before it is sent, including each redirect hop, so a public URL cannot bounce a request to an internal address. Redirects are followed with a cap and are refused if they cross protocols, and non-HTTP(S) URLs such as data: are rejected outright.

These are patch releases, so they tighten behavior without adding new API. If you deliberately look up NodeInfo on a private or intranet address, such as in a closed federation or a test environment, these releases will now refuse it. An allowPrivateAddress opt-out is coming in 2.4.0.

Current patched releases are 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2. The GitHub Security Advisory is GHSA-hqph-j65v-8cq5, and the CVE ID is CVE-2026-62857.

Update @fedify/fedify:

npm  update  @fedify/fedify
yarn upgrade @fedify/fedify
pnpm update  @fedify/fedify
bun  update  @fedify/fedify
deno update  @fedify/fedify

After updating, redeploy. If you run other Fedify-based servers, update those too.

Thanks to @rvzsec and @manus-use for the report and responsible disclosure.

If anything is unclear, ask below.

If you use Fedify, update to a patched release now. CVE-2026-62857 affects Fedify's NodeInfo client. An attacker who runs any instance your server looks up could cause that server to fetch non-public network destinations and return their contents to your application, depending on the deployment environment and network routing.

Fedify can look up a remote instance's NodeInfo document to learn what software it runs. The lookup happens in two steps: it fetches the instance's /.well-known/nodeinfo document, then follows the NodeInfo document URL that response advertises. The vulnerable path is getNodeInfo(), along with the Context.lookupNodeInfo() method that wraps it: affected versions sent both requests without validating the destination against public-network expectations. Because that second URL comes straight out of the remote server's response body, the instance being looked up fully controls it, and could point it at a loopback address, a link-local metadata endpoint, an RFC 1918 host, or a data: URL. Servers are exposed only if they look up NodeInfo, but that lookup is routine for peer discovery and instance metadata.

The fix routes both requests through the same public-address validation Fedify already applied to WebFinger lookups and remote document loading. Every request is now checked before it is sent, including each redirect hop, so a public URL cannot bounce a request to an internal address. Redirects are followed with a cap and are refused if they cross protocols, and non-HTTP(S) URLs such as data: are rejected outright.

These are patch releases, so they tighten behavior without adding new API. If you deliberately look up NodeInfo on a private or intranet address, such as in a closed federation or a test environment, these releases will now refuse it. An allowPrivateAddress opt-out is coming in 2.4.0.

Current patched releases are 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2. The GitHub Security Advisory is GHSA-hqph-j65v-8cq5, and the CVE ID is CVE-2026-62857.

Update @fedify/fedify:

npm  update  @fedify/fedify
yarn upgrade @fedify/fedify
pnpm update  @fedify/fedify
bun  update  @fedify/fedify
deno update  @fedify/fedify

After updating, redeploy. If you run other Fedify-based servers, update those too.

Thanks to @rvzsec and @manus-use for the report and responsible disclosure.

If anything is unclear, ask below.

If you use Fedify, update to a patched release now. CVE-2026-62857 affects Fedify's NodeInfo client. An attacker who runs any instance your server looks up could cause that server to fetch non-public network destinations and return their contents to your application, depending on the deployment environment and network routing.

Fedify can look up a remote instance's NodeInfo document to learn what software it runs. The lookup happens in two steps: it fetches the instance's /.well-known/nodeinfo document, then follows the NodeInfo document URL that response advertises. The vulnerable path is getNodeInfo(), along with the Context.lookupNodeInfo() method that wraps it: affected versions sent both requests without validating the destination against public-network expectations. Because that second URL comes straight out of the remote server's response body, the instance being looked up fully controls it, and could point it at a loopback address, a link-local metadata endpoint, an RFC 1918 host, or a data: URL. Servers are exposed only if they look up NodeInfo, but that lookup is routine for peer discovery and instance metadata.

The fix routes both requests through the same public-address validation Fedify already applied to WebFinger lookups and remote document loading. Every request is now checked before it is sent, including each redirect hop, so a public URL cannot bounce a request to an internal address. Redirects are followed with a cap and are refused if they cross protocols, and non-HTTP(S) URLs such as data: are rejected outright.

These are patch releases, so they tighten behavior without adding new API. If you deliberately look up NodeInfo on a private or intranet address, such as in a closed federation or a test environment, these releases will now refuse it. An allowPrivateAddress opt-out is coming in 2.4.0.

Current patched releases are 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2. The GitHub Security Advisory is GHSA-hqph-j65v-8cq5, and the CVE ID is CVE-2026-62857.

Update @fedify/fedify:

npm  update  @fedify/fedify
yarn upgrade @fedify/fedify
pnpm update  @fedify/fedify
bun  update  @fedify/fedify
deno update  @fedify/fedify

After updating, redeploy. If you run other Fedify-based servers, update those too.

Thanks to @rvzsec and @manus-use for the report and responsible disclosure.

If anything is unclear, ask below.

How Far Behind the Frontier are Leading Open Weight Models on Cyber? https://lobste.rs/s/vrcctk #security #vibecoding
https://www.aisi.gov.uk/blog/how-far-behind-the-frontier-are-leading-open-weight-models-on-cyber

Journey to Root, Episode I: The Maglev King https://lobste.rs/s/i0mnxl #security #vibecoding
https://blog.calif.io/p/journey-to-root-episode-i-the-maglev

PACT: Anonymous Credentials for the Web – Mozilla Hacks https://lobste.rs/s/6pdyiy #privacy #security
https://hacks.mozilla.org/2026/06/pact-anonymous-credentials-for-the-web/

Amnesty International (@amnesty) Security Lab just released their most complete breakdown of the Pegasus spyware.

If you have time, go give it a read

https://securitylab.amnesty.org/latest/2026/07/inside-pegasus-the-evolution-of-the-worlds-most-notorious-spyware/

#cybersecurity #infosec #pegasus #spyware #security

Amnesty International (@amnesty) Security Lab just released their most complete breakdown of the Pegasus spyware.

If you have time, go give it a read

https://securitylab.amnesty.org/latest/2026/07/inside-pegasus-the-evolution-of-the-worlds-most-notorious-spyware/

#cybersecurity #infosec #pegasus #spyware #security

Amnesty International (@amnesty) Security Lab just released their most complete breakdown of the Pegasus spyware.

If you have time, go give it a read

https://securitylab.amnesty.org/latest/2026/07/inside-pegasus-the-evolution-of-the-worlds-most-notorious-spyware/

#cybersecurity #infosec #pegasus #spyware #security

Amnesty International (@amnesty) Security Lab just released their most complete breakdown of the Pegasus spyware.

If you have time, go give it a read

https://securitylab.amnesty.org/latest/2026/07/inside-pegasus-the-evolution-of-the-worlds-most-notorious-spyware/

#cybersecurity #infosec #pegasus #spyware #security

Securing DNSSEC Keys via Threshold ECDSA From Generic MPC (2019) https://lobste.rs/s/e9jl9m #cryptography #security
https://eprint.iacr.org/2019/889

You can't bug fix your way out of the vulnpocalypse https://lobste.rs/s/nkrgcp #security
https://alexgaynor.net/2026/jul/15/you-cant-bugfix-your-way-out-of-the-vulnpocalypse/

Ignore DNSSEC if You Like MITM Attacks, by (not on Mastodon or Bluesky):

https://whynothugo.nl/journal/2026/06/24/ignore-dnssec-if-you-like-mitm-attacks/?ref=frontenddogma.com

#security #dns

@aproposnix

This is a great and important article by @soatok

It also mentions how anyone, not just #security experts, can help make E2EE on the ActivityPub #fediverse a reality.

For instance by #fedi devs by supporting #FEP 521a: Representing actor's public keys in their #ActivityPub implementation:

https://fediverse.codeberg.page/fep/fep/521a/

Or help improve the #UX of E2EE enabled fedi apps. Or even just spread the word around by boosting the article around, and give impetus to #E2EE adoption.

See also:

https://swicg.github.io/activitypub-e2ee/

https://publickey.directory/

The Long Tail of Work Left Until ActivityPub Has E2EE - Dhole Moments

#activitypub #e2ee #security #fediverse

https://soatok.blog/2026/07/15/the-long-tail-of-work-left-until-activitypub-has-e2ee/

The Long Tail of Work Left Until ActivityPub Has E2EE - Dhole Moments

#activitypub #e2ee #security #fediverse

https://soatok.blog/2026/07/15/the-long-tail-of-work-left-until-activitypub-has-e2ee/

A Filtering engine and DB for unpropagated kernel security patches https://lobste.rs/s/pfz6dj #linux #release #security
https://patchless.natey.sh

The Long Tail of Work Left Until ActivityPub Has E2EE - Dhole Moments

#activitypub #e2ee #security #fediverse

https://soatok.blog/2026/07/15/the-long-tail-of-work-left-until-activitypub-has-e2ee/

SELinux Userspace Utilities: Local Denial-of-Service Attack Vectors in seunshare in release 3.10 https://lobste.rs/s/h2qy4t #linux #security
https://security.opensuse.org/2026/07/15/selinux-seunshare.html

Microsoft Confirms Windows GDID Device Identifier That Cannot Be Disabled, Documented in FBI Case Filing https://lobste.rs/s/agkcmz #security #windows
https://www.ghacks.net/2026/07/12/microsoft-confirms-windows-gdid-device-identifier-that-cannot-be-disabled-documented-in-fbi-case-filing/

Listening to @anwesha speak on Demystifying the EU Cyber Resilience Act at #EuroPython2026

This slide is the new reality!

#EP2026 #OpenSource #Security #Python

Listening to @anwesha speak on Demystifying the EU Cyber Resilience Act at #EuroPython2026

This slide is the new reality!

#EP2026 #OpenSource #Security #Python

Full disclosure: Arbitrary code execution in Cursor https://lobste.rs/s/vlr279 #editors #security #vibecoding
https://mindgard.ai/blog/cursor-0day-when-full-disclosure-becomes-the-only-protection-left

The Memory Heist https://lobste.rs/s/lelroo #ai #security
https://ayush.digital/blog/the-memory-heist

Enable SHA Pinning for GitHub Actions Across Personal Repositories #github #powershell #security https://www.meziantou.net/enable-sha-pinning-for-github-actions-across-personal-repositories.htm?utm_medium=social&utm_source=mastodon

zizmor 1.27 is released!

this release includes (experimental) support for GitHub's new "parallel steps" pattern, among other enhancements and bug fixes.

full notes:

https://docs.zizmor.sh/release-notes/#1270

#rust #security

zizmor 1.27 is released!

this release includes (experimental) support for GitHub's new "parallel steps" pattern, among other enhancements and bug fixes.

full notes:

https://docs.zizmor.sh/release-notes/#1270

#rust #security

TFTP Honey pot Results https://lobste.rs/s/048t8w #security
https://bruceediger.com/posts/tftp-honeypot-results/

Security is crucial for a service like https://fediverse.info, which is why I am enforcing all invited admins to configure 2FA during the onboarding process!

#fediverseInfo #security

Privacy Guide

Anleitung zur Wahrung der Privatsphäre im Internet.

#Privacy #Security #Privatsphäre #Linux

https://gnulinux.ch/privacy-guide

Unauthenticated RCE in Motorola's MR2600 Router https://lobste.rs/s/s1jwea #security
https://mrbruh.com/motorola/

🟠 CVE-2026-61876 - High (8.8)

LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCPv6 Client FQDN containing script tags that execute in the administr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61876/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-61876 - High (8.8)

LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCPv6 Client FQDN containing script tags that execute in the administr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61876/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Hacking Apple - SQL Injection to Remote Code Execution — ProjectDiscovery Blog https://lobste.rs/s/axamxi #security
https://projectdiscovery.io/blog/hacking-apple-with-sql-injection

reaction: A daemon that scans program outputs for repeated patterns, and takes action via @fanf https://lobste.rs/s/zzdc8x #security
https://framagit.org/ppom/reaction

You Shouldn’t Trust Trusted Publishing, by @yossarian:

https://blog.yossarian.net/2026/07/07/You-shouldnt-trust-trusted-publishing?ref=frontenddogma.com

#security #authentication

An update on the scraper situation via @fanf https://lobste.rs/s/kpaxih #security #web
https://lwn.net/SubscriberLink/1080822/990a8a5e2d379085/

Continuwuity 26.6.0, the lightweight Matrix chat server, is finally out! This is by far our largest release ever yet! There are so many incredible improvements in this release, and there's never been a better time to get started!

https://forgejo.ellis.link/continuwuation/continuwuity/releases/tag/v26.6.0

#Matrix #Continuwuity #SelfHosted #Federated #Homeserver #OpenSource #FOSS #Privacy #Security #Messaging #Release

Kundendaten bei Dienstleister abgeflossen: Datenschutzvorfall beim Lidl-Shop

Unbekannte konnten auf eine Datei mit Kundendaten zugreifen und stahlen persönliche Kundendaten. Lidl hat reagiert und betroffene Kunden angeschrieben.

https://www.heise.de/news/Kundendaten-bei-Dienstleister-abgeflossen-Datenschutzvorfall-beim-Lidl-Shop-11361337.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Datenbanken #IT #Security #news

npm Install-Time Security and GAT bypass2fa Deprecation, by (not on Mastodon or Bluesky):

https://github.blog/changelog/2026-07-08-npm-install-time-security-and-gat-bypass2fa-deprecation/?ref=frontenddogma.com

#npm #security #deprecation

Very excited to share stories, insights, recommendations at my first @europython

I'll also be attending the Packaging and Language Summits, as well as any other opportunities to increase awareness of #Python and #PyPI #OpenSource #SupplyChain #Security initiatives.

#EP2026 #TooManyHashtags #SorryNotSorry

BREAKING: The EU has passed “Chat Control 1.0”

This makes it MANDATORY for companies to scan private messages and submit them to EU authorities.

This includes #WhatsApp, Emails, #Instagram DM’s, and other major forms of communication.

This is so absurd it is hard to believe it is even happening. And we need more than ever apps that are decentralized without a central point of failure

#Europe #ChatControl #privacy #onlineSafety #freedom #security #autonomy #eu #email #decentralization

DirtySlide - root on macOS from one missing bounds check https://lobste.rs/s/27vr6v #mac #security
https://gracecondition.github.io/posts/dirtyslide/

Something I probably should've done a while ago, but I finally set up two-factor authentication on my Mastodon account.

The process was super smooth and it works perfectly. Highly recommend!

https://fedi.tips/using-two-factor-authentication-2fa-on-mastodon/

#mastodon #fediverse #2FA #TwoFactorAuthentication #security #OnlineSecurity

GitLost: How We Tricked GitHub’s AI Agent into Leaking Private Repos https://lobste.rs/s/rcg4bo #security #vibecoding
https://noma.security/blog/gitlost-how-we-tricked-githubs-ai-agent-into-leaking-private-repos/

Announcing the Save CTFs Fund https://lobste.rs/s/geibgn #security
https://osec.io/blog/save-ctfs-fund/

OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root (CVE-2026-57589) https://lobste.rs/s/7hmu0w #openbsd #security
https://nvd.nist.gov/vuln/detail/cve-2026-57589

A Final Return for OpenBSD Anti-Return-Oriented Programming Mitigations https://lobste.rs/s/xclcel #pdf #openbsd #security
https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6869668

A Measurement Study on the Adoption of Pledges and Unveils in the OpenBSD Operating System https://lobste.rs/s/sglhvg #openbsd #security
https://arxiv.org/pdf/2607.03056

New Research: A "Verified" GitHub Commit Is NOT Unique https://lobste.rs/s/qlw9wg #programming #security
https://www.internationalcyberdigest.com/new-research-a-verified-github-commit-is-not-unique/

Call me nuts but I love passwords with quotes ( ' <- this thing), spaces and periods in them.

#Security

You shouldn’t trust Trusted Publishing

https://blog.yossarian.net/2026/07/07/You-shouldnt-trust-trusted-publishing

#python #security #oss

You shouldn't trust Trusted Publishing by @yossarian https://lobste.rs/s/8d9pgd #python #security
https://blog.yossarian.net/2026/07/07/You-shouldnt-trust-trusted-publishing

You shouldn’t trust Trusted Publishing

https://blog.yossarian.net/2026/07/07/You-shouldnt-trust-trusted-publishing

#python #security #oss

Reporting a 19+ Years Hidden Linux Kernel Zero-Day for Google kernelCTF: CVE-2026-43456 https://lobste.rs/s/txjns0 #linux #networking #security
https://gmo-cybersecurity.com/blog/19-years-hidden-80000-rewarded-reporting-a-linux-kernel-zero-day-for-google-kernelctf/

AT&T's very rare Security-Plus Telephone https://lobste.rs/s/fw8e40 #cryptography #historical #security
https://www.electrospaces.net/2025/10/an-interesting-advertisement-for-stu.html

Securing agentic identity https://lobste.rs/s/ssdcnh #security
https://codon.org.uk/~mjg59/blog/p/securing-agentic-identity/

Poison, redzones and shadows: inside KASAN – Bootlin https://lobste.rs/s/exuqoz #linux #security
https://bootlin.com/blog/poison-redzones-and-shadows-inside-kasan/

Januscape: Guest-to-Host Escape in KVM/x86 https://lobste.rs/s/jea4xl #linux #security
https://github.com/V4bel/Januscape

Backstage access: an unauthenticated SQL injection in Front Gate Tickets https://lobste.rs/s/fplb85 #security
https://ian.sh/frontgate

Web Security docs on MDN https://lobste.rs/s/b3elwj #release #security
https://openwebdocs.org/content/posts/security-docs-sovereign-tech-agency/

Bench Press: Leaking Text Nodes with CSS via @goldstein https://lobste.rs/s/qyugm7 #css #security
https://blog.pspaul.de/posts/bench-press-leaking-text-nodes-with-css/

Anthropic secretly installs spyware when you install Claude Desktop

Anthropic's Claude Desktop silently installs a Native Messaging bridge into seven Chromium browsers, including browsers Anthropic's own documentation says it does not support, and browsers the user has not even installed.

https://www.thatprivacyguy.com/blog/anthropic-spyware

#ai #privacy #eprivacy #compliance #infosec #gdpr #law #cyber #security #anthropic #claude

Non-hybrid PQ-only TLS and the MIKEY-IBAKE intervention https://lobste.rs/s/f2xgzo #cryptography #security
https://libroot.org/posts/non-hybrid-pq-only-tls-and-mikey-ibake/

Bad Epoll (CVE-2026-46242) https://lobste.rs/s/drf6my #linux #security
https://github.com/J-jaeyoung/bad-epoll

npm Adds Preventive Account Protection for High-Impact Accounts, by (not on Mastodon or Bluesky):

https://github.blog/changelog/2026-06-25-npm-adds-preventive-account-protection-for-high-impact-accounts/?ref=frontenddogma.com

#npm #security

SecretSpec 0.13: SDKs for Python, Node.js, Go, Ruby, and Haskell https://lobste.rs/s/5r5ebh #release #security
https://secretspec.dev/blog/secretspec-0-13-sdks/

Anthropic secretly installs spyware when you install Claude Desktop

Anthropic's Claude Desktop silently installs a Native Messaging bridge into seven Chromium browsers, including browsers Anthropic's own documentation says it does not support, and browsers the user has not even installed.

https://www.thatprivacyguy.com/blog/anthropic-spyware

#ai #privacy #eprivacy #compliance #infosec #gdpr #law #cyber #security #anthropic #claude

Dissecting and Exploiting Linux LPE Variant: DirtyClone (CVE-2026-43503) https://lobste.rs/s/adgyhb #linux #security
https://research.jfrog.com/post/dissecting-and-exploiting-linux-lpe-variant-dirtyclone-cve-2026-43503/

「VPC内通信もTLSにすべき？」と聞かれて ── そもそもAWS内で盗聴できるのか脅威モデルで確かめた話 #Security - Qiita https://qiita.com/ntaka329/items/de23144fdf7305a2e0c1

> 公共系の案件で「ゲートウェイ（ALB）までは暗号化されているけど、その内側、VPCの中は平文ですよね。それで問題ないんですか？」と指摘されました。

VPCがSDN（Software Defined Network）でできていて、他人の通信を覗くような盗聴が非常に困難なことは、以前から知ってはいました。ただ、いざ「なぜ大丈夫と言えるのか」を根拠立てて説明しようとすると、正確な一次情報がどこにあるのかを即答できず、VPC encryption controlsのような最近の動向も追えていませんでした。

そこで、VPC内（題材は ALB → ECS の1区間）のTLS化が必要かどうかを、改めて一次情報と脅威モデルで整理し直してみました。

#AWS

「VPC内通信もTLSにすべき？」と聞かれて ── そもそもAWS内で盗聴できるのか脅威モデルで確かめた話 #Security - Qiita https://qiita.com/ntaka329/items/de23144fdf7305a2e0c1

> 公共系の案件で「ゲートウェイ（ALB）までは暗号化されているけど、その内側、VPCの中は平文ですよね。それで問題ないんですか？」と指摘されました。

VPCがSDN（Software Defined Network）でできていて、他人の通信を覗くような盗聴が非常に困難なことは、以前から知ってはいました。ただ、いざ「なぜ大丈夫と言えるのか」を根拠立てて説明しようとすると、正確な一次情報がどこにあるのかを即答できず、VPC encryption controlsのような最近の動向も追えていませんでした。

そこで、VPC内（題材は ALB → ECS の1区間）のTLS化が必要かどうかを、改めて一次情報と脅威モデルで整理し直してみました。

#AWS

The pandemic of incomplete OpenSSL error handling https://lobste.rs/s/xqqamf #security
https://blog.jak-linux.org/2026/07/03/openssl-pandemic/

Google open sources their Zero-Knowledge Proof (ZKP) libraries to support age ID verification.

1. Authenticate your birth date with a trusted authority (the Issuer) and receive a cryptographically signed digital certificate.
2. A website requiring an age ID sends you a random maths puzzle.
3. The ZKP library solves the puzzle with your digital cert and replies with the proof.
4. Using the Issuers Public Cert the website validates the proof.

#security #ageID #ZKP

https://blog.google/innovation-and-ai/technology/safety-security/opening-up-zero-knowledge-proof-technology-to-promote-privacy-in-age-assurance/

Espionage Against the European Parliament: Member of Committee Investigating Spyware Hacked with Pegasus https://lobste.rs/s/xwsfs3 #security
https://citizenlab.ca/research/member-of-committee-investigating-spyware-hacked-with-pegasus/

What We Talk About When We Talk About Malware https://lobste.rs/s/ltsgnw #android #security
https://f-droid.org/2026/07/01/adv-malware.html

Fedora 45 Considering x86_64 Shadow Stack Usage By Default https://lobste.rs/s/pgxaog #linux #security
https://www.phoronix.com/news/Fedora-45-Consider-Shadow-Stack

⚠️ Guix security alert ⚠️

Critical security vulnerabilities in the guix daemon and substitute capabilities have been disclosed. ALL users should immediately update.

https://guix.gnu.org/en/blog/2026/guix-substitute-pull-vulnerabilities/

#guix #security #update