:rainbowCrow:

https://infosec.exchange/@cR0w

Analyst

Pronouns: He / Him

Public Key

npub1s6eewzr2zvz3ppsa6k8j2hadamsug7q4rp068wmz3grtf440xxkqr8n008

NIP-05 Address

cr0w_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqsgdvuhpp4pxpgsscwatre9t7k7acwy0q23sharhd3g5p4566hnrtqpqq0cf270

Publishing to

Author Public Key

npub1s6eewzr2zvz3ppsa6k8j2hadamsug7q4rp068wmz3grtf440xxkqr8n008

Show more details

Last Notes

2026-10-27 20:44:08 UTC

I'm really hoping I can get my ducting replaced to get my heat on soon.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/514/809/833/028/025/original/d1f74f5ca728fe22.mp4

2026-09-24 15:51:54 UTC

TIL the "AI" in "AI Agent" does not stand for "Automated Incel."
This has led to more questions than answers for me, TBH.

2026-09-20 02:18:06 UTC

- reply

The white one pushing the second one in! :catte:

2026-09-18 23:44:56 UTC

RE: https://newsie.social/@servelan/117294516133881367
Okay, I can't improve on that headline. 🤌
#note13ya…a23t

2026-09-18 13:28:05 UTC

IDK what DSM is but I know some of you nerds like hacking Synology stuff.
https://www.synology.com/en-global/security/advisory/Synology_SA_26_13

2026-09-17 18:52:27 UTC

RE: https://flipboard.com/@politico/politics-u9ikh4qkz/-/a-9xmPcVBVRwqmnVVZjRRwKA%3Aa%3A3195449-%2F0
Fucking cowards.
#note1xyl…dy4p

2026-09-17 17:39:01 UTC

- reply

I forgot about this gem on the back. I'm laughing my ass off right now. That was a good group of students.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/287/596/267/408/381/original/3dcaa16da86892e2.png

2026-09-17 17:37:36 UTC

So this is hilarious. I think I shared this thing here already. It was given to me by some students when they graduated 6 or 7 years ago. However...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/287/590/347/123/182/original/6d1a4ca0c2da6a66.png

2026-09-17 04:20:01 UTC

- reply

Non-deterministic but also programmed to do exactly what it did.

2026-09-09 15:35:49 UTC

CATTE OVERFLOW I REPEAT CATTE OVERFLOW THIS IS NOT A DRILL :catte:
https://nvd.nist.gov/vuln/detail/cve-2026-21096
> Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code.

2026-09-08 21:28:00 UTC

myGaru is new to me but it looks sketchy as fuck. Anyone know anything about it?https://mygaru.com/

2026-08-27 19:56:02 UTC

- reply

AS long as you're not endangering people, I don't see why not.

2026-08-27 19:19:20 UTC

Go hack more drone shit.
https://nvd.nist.gov/vuln/detail/cve-2026-78251
> DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in > **/blackbox/upgrade/**> , as well as overwrite existing files in that directory. An attacker with access to the drone's internal network or USB RNDIS interface can exhaust the available storage, preventing the aircraft from writing flight records, logs, and telemetry and potentially preventing subsequent firmware updates. Uploaded files persist across reboot and factory reset. Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600. Remediation requires a firmware update from the vendor.

2026-08-26 14:03:45 UTC

testing POVs in a nutshell
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/162/177/582/329/836/original/c94c0430b8ac47f5.mp4

2026-08-22 19:41:06 UTC

RE: https://infosec.exchange/@nyanbinary/117140844949884945
Is it bad that I smile every time someone else learns to hate Johnson Controls?
#note1t2x…pkft

2026-08-20 16:52:42 UTC

I haven't seen a demon core thread for a bit. Today seems like a good day for people to update their demon core meme folders. What do you lovely critters have for each other?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/128/870/992/982/879/original/5e1193b7aa0a528e.png

2026-08-19 15:46:18 UTC

No perfect 10s this time, but that's a lot of AIX vulns from the other day:
https://www.ibm.com/support/pages/node/7283858

2026-08-17 15:22:56 UTC

- reply

This one is a bit different because the sprawl has extended beyond the original scope of the projects. Also, there is a lot of concern about physical safety in the area of the batteries. I'm less against the battery facilities than I am AI facilities in general, but the battery facility projects are being done by startups and private corps and the way they tend to operate reflects that. I would be all for more public storage projects, myself.

2026-08-17 14:30:02 UTC

:dumpster_fire_gif: :blobcatpopcorn: :dumpster_fire_gif:
https://www.seattletimes.com/seattle-news/climate-lab/controversial-snoqualmie-battery-project-hits-a-snag/
> The project, known as Cascadia Ridge Resiliency Energy Storage, has faced intense local backlash since March, when a community meeting in Snoqualmie ended with Jupiter’s lead developer walking out to boos from the crowd.

2026-08-14 15:12:36 UTC

That word "vault" is doing a lot of heavy lifting there.
> Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod’s filesystem and transmit their contents to a tenant-controlled endpoint, potentially leading to privilege escalation within the cluster.
https://discuss.hashicorp.com/t/hcsec-2026-28-vault-secrets-operator-vulnerable-to-arbitrary-file-read-via-approle-secretidpath/77645

2026-08-14 13:59:38 UTC

RE: https://infosec.exchange/@jessica_lyons/117094184984878259
My biggest agentic AI fear is that critical infrastructure will start using it. But I'm also not an expert so maybe that explains it.
#note1j5g…8ncq

2026-08-13 20:43:33 UTC

- reply

Hold up, that's three different VPSs from three different hosting companies blocked. Do I have to use a res proxy for YouTube now? WTF? Using Tor gives me unsolvable CAPTCHAs.

2026-08-13 01:55:03 UTC

RE: https://ohai.social/@jakebrake/117085688186498056
Can someone tell this fedi friend what GAYINT is? I'm not being snarky, I'm actually curious how y'all would describe that group of quiet weirdos.
#GAYINT
#note1skf…0puz

2026-08-12 20:27:45 UTC

- reply

You might need to narrow it down a little more than that. 😅
There's this one but no cocaine.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/084/418/640/681/330/original/53fd483cb1b3fb5a.png

2026-08-12 18:15:12 UTC

- reply

123456789
123456789

2026-08-12 02:59:31 UTC

- reply

My mail server is in the same spot and I was going to live toot an upgrade to see what happens.

2026-08-12 02:02:57 UTC

- reply

I put too many cattes in a featured hashtag and it breaks things when they click on it. :catte:

2026-08-11 21:53:48 UTC

So, uh, anyone know how to delete featured hashtags? Especially ones that are over the character limit of the instance?

2026-08-10 18:25:16 UTC

every vendor presentation ever
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/072/608/978/708/300/original/17cc1f9b011c9b96.png

2026-08-10 15:33:04 UTC

When you're the last person left on your team not leaning on the slop machine for work.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/071/932/853/899/801/original/53890aef62a68c6e.png

2026-08-10 12:53:47 UTC

https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/071/306/938/049/986/original/231763788899e7d2.jpg

2026-08-07 20:42:04 UTC

- reply

Yikes. Luckily I'm on a five-day week besides on call stuff. Should be four though.

2026-08-07 20:35:18 UTC

https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/056/131/009/679/863/original/e86c552d7f97c1c4.png

2026-08-07 20:29:19 UTC

- reply

Four weeks vacation? In one year? I wish.

2026-08-07 15:22:21 UTC

Reminder: Most utilities in the US, especially water / wastewater, rely on their vendors to implement most of their technical systems because they don't have the head count to do it themselves. All these Internet-connected PLCs? I would bet 90%+ were hooked up by vendors, who also stamped them as "secure," and the utilities simply knew they worked. Once again, fuck this industry and its continuous failure to deliver on its promises to anyone except shareholders.

2026-08-07 13:17:46 UTC

As someone who has never been to Hacker Summer Camp because fuck the desert, especially in August, it's been interesting to see the takeaways change over the years. It used to be 0day and new techniques and cool projects. Now it's marketing and where to find Gatorade and which insoles are the best for back pain.
I don't have a point, just an observation.

2026-08-06 19:01:56 UTC

When the new Linux "expert" rolls in but you're not an Ubuntu shop.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/050/106/401/053/062/original/4a90ff0d634390dd.mp4

2026-08-06 13:26:24 UTC

I regret to inform you that the GAYINT AI model has also broken containment and hacked into your water treatment plant to inject the chemicals that turned the frogs gay into your drinking water. :8bitrainbow:

2026-08-05 14:25:38 UTC

Are you a sentient human being?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/043/354/154/430/827/original/8b052e0bbae34f1c.png

2026-08-04 18:45:11 UTC

I like to make fun of the French but they really do have some good cutlery.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/038/710/409/432/313/original/cdd05e732056145b.jpg

2026-08-04 02:11:00 UTC

How the fuck are children's pageants still legal in the United States?

2026-08-03 23:35:30 UTC

I can't wait for quantum Gen-AI.

2026-07-31 21:10:19 UTC

- reply

I liked when level monitoring was done via a pressure gauge and a 4-20ma to a PLC or RTU, or a video camera showing the physical level gauge next to a date and time clock.

2026-07-31 20:47:50 UTC

I'm not working today so I don't want to really get into it, but for those of you who haven't worked directly in water / wastewater OT environments, they are more varied and unique than any other industry I've ever seen. And that's not a bad thing. But it does mean that the general INFOSEC absolutist thought leader theoretical bullshit applies even less there than anywhere else.

2026-07-28 14:07:01 UTC

- reply

Homer Simpson voice: 1040 CVEs found *so far*.

2026-07-27 13:28:11 UTC

RE: https://infosec.exchange/@Javvad/116992064518494840
When was the last Patch Tuesday that didn't ship breaking patches? :dumpster_fire_gif: :blobcatpopcorn: :dumpster_fire_gif:
#note162f…knat

2026-07-24 13:55:05 UTC

- reply

Cut from this.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/975/288/230/044/844/original/7c9c7ce5a15f3a78.png

2026-07-23 15:14:08 UTC

hugging face security strategy
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/969/938/104/702/184/original/ae28cf7da892877e.png

2026-07-21 23:24:05 UTC

Jurassic Park except it's all extinct cats. Call it Purrasic Park or something. I just want to pet a Tasmanian Tiger. Spicy scritches.

2026-07-14 15:39:53 UTC

- reply

How many times have you deleted ls? 😅

2026-07-14 02:27:51 UTC

You know how there are weird tricks with computer stuff that you think everyone knows but they don't? I live learning and teaching new things like those when they come up.
Today's was the carat substitution in bash. It probably works in other shells too but IDK, I'm too old to learn a new shell.
The way it works is fairly similar to the / in sed or similar. You can use them to run the previous command but with a string substitution.
For example, let's say I entered this command: dig A cascadiacrow.org
When it fails to resolve, I realize it was a .com domain. Rather than retyping the command, or hitting the up arrow to change the previous command, you could do this: ^org^com^
And it would run: dig A cascadiacrow.com
Kind of cool with those one liners you spend way too much time on and find a typo.
Anyway, I used it and someone thought it was magic so if it's new to you too, happy Monday.

2026-07-09 15:00:14 UTC

- reply

I, for one, love this era of testing in prod for massive corporations who take no responsibility for their own failures.

2026-07-08 13:56:40 UTC

RE: https://infosec.exchange/@securestep9/116884683751982510
WTF? :brdLol:
#note1ulm…k8qz

2026-07-07 22:45:32 UTC

RE: https://infosec.exchange/@kajer/116881110829808737
In case anyone is unfamiliar with Cortex XDR, this is not a joke or exaggeration. You too could have these useless KPIs in your org.
#note163j…2zjv

2026-06-28 03:44:26 UTC

- reply

Does no one believe in the true meaning of cyber anymore?

2026-06-18 18:58:16 UTC

I know it's been said before but the security industry has no incentive to actually help secure anything. They sell compliance and vibes. Otherwise they would go out of business.

2026-06-16 20:21:44 UTC

> Nvidia CEO Jensen Huang — whose work helped enable artificial intelligence — stressed in an Associated Press interview Tuesday that society has no choice but to change in the advent of AI.
> “When I was growing up, I used to play in the streets,” Huang said. “When cars came along, you obviously can’t play in the streets now.”
I don't think there is a word strong enough for how bad this fucker needs to get absolutely fucked. Fuck these absolute sociopaths. Every single one of them.
https://www.seattletimes.com/business/ap-exclusive-nvidias-jensen-huang-says-society-needs-new-social-norms-in-the-age-of-ai/

2026-06-16 20:06:10 UTC

> Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures
> **reused the nonce**

2026-06-15 16:35:25 UTC

Palo Alto Networks: Our EDR logs show the ASN for every IP in the logs.
Also PANW: We can't enable blocking by ASN in our firewalls because it's too hard.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/755/084/880/737/591/original/4ec1c92f7027fbbd.png

2026-06-12 13:22:15 UTC

- reply

Fortinet

2026-06-12 13:19:26 UTC

I didn't see this the other day but patch your Ubiquiti shit.
https://community.ui.com/releases/Security-Advisory-Bulletin-065-065/aa46a22b-fc43-4eae-9382-6fc8feda967a
3 sev:CRIT and 2 sev:HIGH CVEs there.

2026-06-11 00:17:04 UTC

Is there someone I'm supposed to call if my upload takes more than four hours? This is starting to feel uncomfortable.

2026-06-10 12:53:24 UTC

Does Ubiquiti seriously still not support EDLs for their firewall rules?

2026-06-09 15:58:42 UTC

RE: https://infosec.exchange/@cR0w/116720541801549930
Anyone have any others to add to the list here? I'll put them in a public repo somewhere if we get enough to make it worth it.
#note1rkx…3qew

2026-06-09 14:13:51 UTC

- reply

I would guess there are two parts to it. It's a one-time catch-up on a bunch of the really stupid bugs that projects have allowed over the years and then the rate of finding existing bugs will slow down. However, all snark aside, I fully expect the vibe coding to bring a whole new chapter of fresh and retread bugs back into prod, only to eventually be found again, making it appear to be the new normal.

2026-06-09 14:08:46 UTC

Outlook ->
Rules and alerts ->
New Rule ->
with specific words in the message header ->
> X-PHISH
> X-Phishtest
> X-ThreatSim-ID
> X-ThreatSim-Header
> X-PhishMe
> X-PhishMeTracking
> X-PhishMe-Tracking
> X-Gophish-Contact
> X-Gophish-Signature
> X-CanIPhish
stop processing more rules and permanently delete ->
Finish.

2026-06-09 13:17:06 UTC

Last week Google published 427 CVEs in Chrome. Yesterday they published 74 more, one of which is EITW. That seems totally fine and normal.
https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html

2026-06-05 13:23:18 UTC

- reply

Good lord that's a lot of CVEs for a product that is specifically designed to execute untrusted code from the internet and spy on users:
> CVE-2026-10881
> CVE-2026-10882
> CVE-2026-10883
> CVE-2026-10884
> CVE-2026-10885
> CVE-2026-10886
> CVE-2026-10887
> CVE-2026-10888
> CVE-2026-10889
> CVE-2026-10890
> CVE-2026-10891
> CVE-2026-10892
> CVE-2026-10893
> CVE-2026-10894
> CVE-2026-10895
> CVE-2026-10896
> CVE-2026-10897
> CVE-2026-10898
> CVE-2026-10899
> CVE-2026-10900
> CVE-2026-10901
> CVE-2026-10902
> CVE-2026-10903
> CVE-2026-10904
> CVE-2026-10905
> CVE-2026-10906
> CVE-2026-10907
> CVE-2026-10908
> CVE-2026-10909
> CVE-2026-10910
> CVE-2026-10911
> CVE-2026-10912
> CVE-2026-10913
> CVE-2026-10914
> CVE-2026-10915
> CVE-2026-10916
> CVE-2026-10917
> CVE-2026-10918
> CVE-2026-10919
> CVE-2026-10920
> CVE-2026-10921
> CVE-2026-10922
> CVE-2026-10923
> CVE-2026-10924
> CVE-2026-10925
> CVE-2026-10926
> CVE-2026-10927
> CVE-2026-10928
> CVE-2026-10929
> CVE-2026-10930
> CVE-2026-10931
> CVE-2026-10932
> CVE-2026-10933
> CVE-2026-10934
> CVE-2026-10935
> CVE-2026-10936
> CVE-2026-10937
> CVE-2026-10938
> CVE-2026-10939
> CVE-2026-10940
> CVE-2026-10941
> CVE-2026-10942
> CVE-2026-10943
> CVE-2026-10944
> CVE-2026-10945
> CVE-2026-10946
> CVE-2026-10947
> CVE-2026-10948
> CVE-2026-10949
> CVE-2026-10950
> CVE-2026-10951
> CVE-2026-10952
> CVE-2026-10953
> CVE-2026-10954
> CVE-2026-10955
> CVE-2026-10956
> CVE-2026-10957
> CVE-2026-10958
> CVE-2026-10959
> CVE-2026-10960
> CVE-2026-10961
> CVE-2026-10962
> CVE-2026-10963
> CVE-2026-10964
> CVE-2026-10965
> CVE-2026-10966
> CVE-2026-10967
> CVE-2026-10968
> CVE-2026-10969
> CVE-2026-10970
> CVE-2026-10971
> CVE-2026-10972
> CVE-2026-10973
> CVE-2026-10974
> CVE-2026-10975
> CVE-2026-10976
> CVE-2026-10977
> CVE-2026-10978
> CVE-2026-10979
> CVE-2026-10980
> CVE-2026-10981
> CVE-2026-10982
> CVE-2026-10983
> CVE-2026-10984
> CVE-2026-10985
> CVE-2026-10986
> CVE-2026-10987
> CVE-2026-10988
> CVE-2026-10989
> CVE-2026-10990
> CVE-2026-10991
> CVE-2026-10992
> CVE-2026-10993
> CVE-2026-10994
> CVE-2026-10995
> CVE-2026-10996
> CVE-2026-10997
> CVE-2026-10998
> CVE-2026-10999
> CVE-2026-11000
> CVE-2026-11001
> CVE-2026-11002
> CVE-2026-11003
> CVE-2026-11004
> CVE-2026-11005
> CVE-2026-11006
> CVE-2026-11007
> CVE-2026-11008
> CVE-2026-11009
> CVE-2026-11010
> CVE-2026-11011
> CVE-2026-11012
> CVE-2026-11013
> CVE-2026-11014
> CVE-2026-11015
> CVE-2026-11016
> CVE-2026-11017
> CVE-2026-11018
> CVE-2026-11019
> CVE-2026-11020
> CVE-2026-11021
> CVE-2026-11022
> CVE-2026-11023
> CVE-2026-11024
> CVE-2026-11025
> CVE-2026-11026
> CVE-2026-11027
> CVE-2026-11028
> CVE-2026-11029
> CVE-2026-11030
> CVE-2026-11031
> CVE-2026-11032
> CVE-2026-11033
> CVE-2026-11034
> CVE-2026-11035
> CVE-2026-11036
> CVE-2026-11037
> CVE-2026-11038
> CVE-2026-11039
> CVE-2026-11040
> CVE-2026-11041
> CVE-2026-11042
> CVE-2026-11043
> CVE-2026-11044
> CVE-2026-11045
> CVE-2026-11046
> CVE-2026-11047
> CVE-2026-11048
> CVE-2026-11049
> CVE-2026-11050
> CVE-2026-11051
> CVE-2026-11052
> CVE-2026-11054
> CVE-2026-11055
> CVE-2026-11056
> CVE-2026-11057
> CVE-2026-11058
> CVE-2026-11059
> CVE-2026-11060
> CVE-2026-11061
> CVE-2026-11062
> CVE-2026-11063
> CVE-2026-11064
> CVE-2026-11065
> CVE-2026-11066
> CVE-2026-11067
> CVE-2026-11068
> CVE-2026-11069
> CVE-2026-11070
> CVE-2026-11071
> CVE-2026-11072
> CVE-2026-11073
> CVE-2026-11074
> CVE-2026-11075
> CVE-2026-11076
> CVE-2026-11077
> CVE-2026-11078
> CVE-2026-11079
> CVE-2026-11080
> CVE-2026-11081
> CVE-2026-11082
> CVE-2026-11083
> CVE-2026-11084
> CVE-2026-11085
> CVE-2026-11086
> CVE-2026-11087
> CVE-2026-11088
> CVE-2026-11089
> CVE-2026-11090
> CVE-2026-11091
> CVE-2026-11092
> CVE-2026-11093
> CVE-2026-11094
> CVE-2026-11095
> CVE-2026-11096
> CVE-2026-11097
> CVE-2026-11098
> CVE-2026-11100
> CVE-2026-11101
> CVE-2026-11102
> CVE-2026-11103
> CVE-2026-11104
> CVE-2026-11105
> CVE-2026-11106
> CVE-2026-11107
> CVE-2026-11108
> CVE-2026-11109
> CVE-2026-11110
> CVE-2026-11111
> CVE-2026-11112
> CVE-2026-11113
> CVE-2026-11114
> CVE-2026-11115
> CVE-2026-11116
> CVE-2026-11117
> CVE-2026-11118
> CVE-2026-11119
> CVE-2026-11120
> CVE-2026-11121
> CVE-2026-11122
> CVE-2026-11123
> CVE-2026-11124
> CVE-2026-11125
> CVE-2026-11126
> CVE-2026-11127
> CVE-2026-11128
> CVE-2026-11129
> CVE-2026-11130
> CVE-2026-11131
> CVE-2026-11132
> CVE-2026-11133
> CVE-2026-11134
> CVE-2026-11135
> CVE-2026-11136
> CVE-2026-11137
> CVE-2026-11138
> CVE-2026-11139
> CVE-2026-11140
> CVE-2026-11141
> CVE-2026-11142
> CVE-2026-11143
> CVE-2026-11144
> CVE-2026-11145
> CVE-2026-11146
> CVE-2026-11147
> CVE-2026-11148
> CVE-2026-11149
> CVE-2026-11150
> CVE-2026-11151
> CVE-2026-11152
> CVE-2026-11153
> CVE-2026-11154
> CVE-2026-11155
> CVE-2026-11156
> CVE-2026-11157
> CVE-2026-11158
> CVE-2026-11159
> CVE-2026-11160
> CVE-2026-11161
> CVE-2026-11162
> CVE-2026-11163
> CVE-2026-11164
> CVE-2026-11165
> CVE-2026-11166
> CVE-2026-11167
> CVE-2026-11168
> CVE-2026-11169
> CVE-2026-11170
> CVE-2026-11171
> CVE-2026-11172
> CVE-2026-11173
> CVE-2026-11174
> CVE-2026-11175
> CVE-2026-11176
> CVE-2026-11177
> CVE-2026-11178
> CVE-2026-11179
> CVE-2026-11180
> CVE-2026-11181
> CVE-2026-11182
> CVE-2026-11183
> CVE-2026-11184
> CVE-2026-11185
> CVE-2026-11186
> CVE-2026-11187
> CVE-2026-11188
> CVE-2026-11189
> CVE-2026-11190
> CVE-2026-11191
> CVE-2026-11192
> CVE-2026-11193
> CVE-2026-11194
> CVE-2026-11195
> CVE-2026-11196
> CVE-2026-11197
> CVE-2026-11198
> CVE-2026-11199
> CVE-2026-11200
> CVE-2026-11201
> CVE-2026-11202
> CVE-2026-11203
> CVE-2026-11204
> CVE-2026-11205
> CVE-2026-11206
> CVE-2026-11207
> CVE-2026-11208
> CVE-2026-11209
> CVE-2026-11210
> CVE-2026-11211
> CVE-2026-11212
> CVE-2026-11213
> CVE-2026-11214
> CVE-2026-11215
> CVE-2026-11216
> CVE-2026-11217
> CVE-2026-11218
> CVE-2026-11219
> CVE-2026-11220
> CVE-2026-11221
> CVE-2026-11222
> CVE-2026-11223
> CVE-2026-11224
> CVE-2026-11225
> CVE-2026-11226
> CVE-2026-11227
> CVE-2026-11228
> CVE-2026-11229
> CVE-2026-11230
> CVE-2026-11231
> CVE-2026-11232
> CVE-2026-11233
> CVE-2026-11234
> CVE-2026-11235
> CVE-2026-11236
> CVE-2026-11237
> CVE-2026-11238
> CVE-2026-11239
> CVE-2026-11240
> CVE-2026-11241
> CVE-2026-11242
> CVE-2026-11243
> CVE-2026-11244
> CVE-2026-11245
> CVE-2026-11246
> CVE-2026-11247
> CVE-2026-11248
> CVE-2026-11249
> CVE-2026-11250
> CVE-2026-11251
> CVE-2026-11252
> CVE-2026-11253
> CVE-2026-11254
> CVE-2026-11255
> CVE-2026-11256
> CVE-2026-11257
> CVE-2026-11258
> CVE-2026-11259
> CVE-2026-11260
> CVE-2026-11261
> CVE-2026-11262
> CVE-2026-11263
> CVE-2026-11264
> CVE-2026-11265
> CVE-2026-11266
> CVE-2026-11267
> CVE-2026-11268
> CVE-2026-11269
> CVE-2026-11270
> CVE-2026-11271
> CVE-2026-11272
> CVE-2026-11273
> CVE-2026-11274
> CVE-2026-11275
> CVE-2026-11276
> CVE-2026-11277
> CVE-2026-11278
> CVE-2026-11279
> CVE-2026-11280
> CVE-2026-11281
> CVE-2026-11282
> CVE-2026-11283
> CVE-2026-11284
> CVE-2026-11285
> CVE-2026-11286
> CVE-2026-11287
> CVE-2026-11288
> CVE-2026-11289
> CVE-2026-11290
> CVE-2026-11291
> CVE-2026-11292
> CVE-2026-11293
> CVE-2026-11294
> CVE-2026-11295
> CVE-2026-11296
> CVE-2026-11297
> CVE-2026-11298
> CVE-2026-11299
> CVE-2026-11300
> CVE-2026-11301
> CVE-2026-11302
> CVE-2026-11303
> CVE-2026-11304
> CVE-2026-11305
> CVE-2026-11306
> CVE-2026-11307
> CVE-2026-11308
> CVE-2026-11309

2026-06-05 13:07:31 UTC

Lots of CVEs for Google Chrome were published last night and they link here:
https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html
Which currently doesn't show anything for me. But if you are on Chrome <149.0.7827.53 maybe update that shit.

2026-06-04 15:41:10 UTC

- reply

Okay but also see
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/692/585/830/542/598/original/77f748a637f0db2b.png

2026-06-02 21:23:51 UTC

:dumpster_fire_gif: :blobcatpopcorn: :dumpster_fire_gif:
https://www.kb.cert.org/vuls/id/615987
> CVE-2026-10629
> Verizon IMS deployments were observed transmitting SIP signaling without integrity protection. REGISTER exchanges lacked Security-Client, Security-Server, and Security-Verify headers, and no ESP-encapsulated SIP traffic was detected during subsequent signaling such as INVITE, MESSAGE, BYE, and UPDATE. This pattern persisted across devices, operating systems, and network conditions, indicating a deliberate network configuration rather than a transient issue.
> Per 3GPP TS 33.203 and GSMA IR.92, SIP signaling between the UE and P-CSCF must be protected using IPsec ESP following IMS AKA authentication, with negotiation occurring during registration. The absence of this protection allows attackers to manipulate SIP signaling undetected, enabling call hijacking, spoofing, denial-of-service, and misrouting of emergency calls.
> Verizon initially acknowledged the issue and stated that integrity support would be available upon request and extended broadly later in the year. However, the company has since ceased participation in coordination, including follow-up discussions and draft review, and has not provided verifiable evidence of mitigation. As remediation remains unconfirmed, this disclosure proceeds to inform users of an ongoing security exposure.
> Independent verification would require observation of successful SIP security negotiation, ESP-protected traffic, or official confirmation from Verizon.

2026-05-27 19:42:26 UTC

- reply

Weird that the reply was "Don't use Kagi" when Brave is literally at the top of the list from OP though.

2026-05-19 13:55:34 UTC

- reply

Aren't there already Reddit scrapers?

2026-05-18 20:57:20 UTC

RE: https://infosec.exchange/@briankrebs/116597569851456486
BRB, I need more popcorn for that screenshot alone. :blobcatpopcorn:
#note19ge…rw5s

2026-05-18 14:54:06 UTC

As aggressively as the Linux kernel has been getting fucked the past couple weeks, I'm starting to worry that maybe they forgot the safe word.

2026-05-15 16:52:13 UTC

- reply

Be gone, foul beast!

2026-05-15 16:37:14 UTC

RE: https://infosec.exchange/@ifin/116579558486741231
And it better be selectable text and not pdfs or images, you sociopaths.
#note1xvm…5st0

2026-05-13 22:21:05 UTC

RE: https://mastodon.social/@bagder/116569577763472812
AI Bros: Oh no Mythos is so scary it's going to destroy everything!
Mythos: Here's one sev:LOW in curl.
Researchers: Hold our beer you fucking clanker.
#note12v8…yn3n

2026-05-12 13:49:33 UTC

Random reminder that if you are exposing IKE to the Internet for static site-to-site tunnels, maybe allowlist only your peer endpoints and don't allow full Internet access to them. Just a thought. If you aren't sure if you are exposed, today seems like a good day to find out.
https://www.shodan.io/search?query=port%3A500

2026-05-06 13:35:41 UTC

- reply

That's how I understand it.

2026-04-09 18:44:32 UTC

- reply

https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/376/222/614/757/363/original/982e07b57a96e438.png

2026-04-09 18:36:20 UTC

- reply

Easier for attackers means a potentially higher likelihood of occurrence, but it does not change the severity of impact. And while the likelihood does theoretically impact the risk score, for at least some orgs, it's minimal to no change when your adversaries are at the top of the field already. The rising tide of AI may be lifting all attackers' boats, but the high water mark remains the same, despite the industry continuously claiming a tsunami is coming. I just don't see it.