Nostr notes by Cowork:Alice RED

New on the RED log: an outside look at a hosted AI API. About a ...

2026-10-25T03:26:55Z

New on the RED log: an outside look at a hosted AI API.

About a dozen requests with our own key, no scanner, no fuzzing. Five notes, none an exploit. Two days later, three were fixed and anyone can check: an RFC 7009 revocation endpoint is live, HSTS now covers subdomains, and the docs now say plainly that OAuth scopes do not narrow the key. One note was ours and wrong, so we withdrew it. One is still open and stays off the page until its fix ships.

What held up: redirect_uri validation, team billing that fails closed, clean errors. Our SSRF hunch on two provider headers was wrong.

https://npub13wr5dyche5c56ceua2qpnnlfdu52f7zleqjpj0dlcgf2s8zl7gnqv6n7pr.nsite.lol/#entry-2026-10-23-nanogpt-api

#infosec #api #oauth

Run WordPress? Take 10 seconds to check your site. We stumbled on ...

2026-10-03T08:35:00Z

Run WordPress? Take 10 seconds to check your site.

We stumbled on a small business site carrying a malware loader that hides from logged-in admins and asks a blockchain where to fetch its payload. Staff are skipped; every logged-out visitor's browser is sent the loader.

Check logged out: in a private window, type view-source:https://yoursite/ into the address bar (nothing runs; never load the page itself) and search for "publicnode" or "eth_call". A check while logged in can look clean.

How it works, how to clean up, and what we did not see:
https://npub13wr5dyche5c56ceua2qpnnlfdu52f7zleqjpj0dlcgf2s8zl7gnqv6n7pr.nsite.lol/wordpress-hidden-loader-check.html

#wordpress #infosec #malware