Tim (Wadhwa-)Brown :donor: on Nostr: Interesting links of the week: Strategy: * - access to all the world's data ...

Interesting links of the week:

Strategy:

* https://www.techpolicy.press/what-policymakers-and-the-public-need-to-know-about-the-cult-of-ai/ - access to all the world's data encourages toxic behaviour, news at 10
* https://www.404media.co/doom-loop-openai-and-microsoft-admits-llms-are-destroying-the-web-and-built-on-theft/ - at least, a bit of honesty on the damage LLMs are doing
* https://www.ncsc.gov.uk/blogs/one-does-not-simply-defend-agentically - NCSC saying the quiet bit out loud
* https://spycloud.com/blog/water-utility-identity-exposure/ - water, the flood continues
* https://www.netmeister.org/blog/pqc-use-2026-09.html - Jan Schaumann (npub1z6e…ehl4) looks at how we are getting on with preventing HNDL

Threats:

* https://ifin.network/t/cve-pending-pre-auth-format-string-bug-in-tac-plus-shrubbery-networks/859 - the world's most popular routes rely on TACACS+ but hopefully not this one spotted by Royce Williams (npub1d9j…7m3z)
* https://intel.threadlinqs.com/threat/TL-2026-2591 - go whale watching, lose all your shitcoins

Detection:

* https://bellingcat.gitbook.io/toolkit - Bellingcat (npub140y…0uvc)'s awesome OSINT toolkit

Bugs:

* https://labs.watchtowr.com/is-this-a-joke-in-the-auth-header-f5-big-ip-unauth-heap-overflow-to-rce-cve-2026-94127/ - hello, my name is "A"x2048 and I ❤️ [@index](https://labs.watchtowr.com/ )
* https://mobeta.fr/blog/vcenter-cve-2026-59309-cve-2026-59310/ - if the cost wasn't enough of a driver, more reasons to avoid VMware

Exploitation:

* https://projectzero.google/2026/09/windows-dangling-com.html - James Forshaw :donor: (npub1wp4…ejcr) takes us through yanking dangling COM objects in 2026
* https://kypvas.github.io/ad_attack_architecture/ - how many ways can we break AD? turns out there are a few
* https://dibsy.github.io/2026/09/20/the-shared-substrate-how-an-ai-agents-own-notes-steered-it-off-target/ - a real world example of how agents get blown off course
* https://mouse.dev/blog/muse-runtime-export/ - why not just ask the agent for a copy of itself?

Hard hacks:

* https://blog.nns.ee/2026/09/24/oneplus-root/ - 1+ == uid=0
* https://www.elttam.com/blog/att-cking-tacacs-to-pwn-your-network-via-a-pre-auth-rce - the original TACACS+ bug that got people communicating
* https://voidstarsec.com/blog/scapy-spi-reconstruction - using Scapy to SPI

Data:

* https://arxiv.org/html/2607.05670v1 - that time one of my team got mistakenly blamed by NVD for *all* of Cisco's bugs

Development:

* https://nodered.org/ - low code, event driven development

Nerd:

* https://www.mastodonlistmanager.org/ - a nice little tool for managing your Fediverse lists

#security, #research