Dr. Christopher Kunz

Security (web, infra, app) nerd, has accepted that VR will never be a mass market, writer @heise Security 
All toots are IMHO & not my employer's opinion.
PGP fingerprint: C882 8ED1 7DD1 9011 C088 EA50 5CFA 2EEB 397A CAC1

Public Key

npub1f2amg3g8eahf043rnnle5qdqpmj0t9e4j44cvvf4tlapnfckumrq42wq5p

NIP-05 Address

christopherkunz@chaos-social.mostr.pub

Profile Code

nprofile1qqsy4wa5g5ru7m5h6c3eelu6qxsqae84ju6e26uxxy64l7se5utwd3spz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds0rrdm8

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1f2amg3g8eahf043rnnle5qdqpmj0t9e4j44cvvf4tlapnfckumrq42wq5p

Show more details

Last Notes

2026-10-27 13:03:35 UTC

U okay, captive Portal einer großen IT-Sicherheitsmesse?
https://assets.chaos.social/media_attachments/files/117/513/005/920/985/040/original/5714c99c44e11bff.png

2026-10-27 09:55:14 UTC

Ich bin dann immer mal wieder über die nächsten Tage am Heise-Stand auf der it-sa anzutreffen. Halle 7A, Stand 504. Kommt gerne vorbei, wir haben auch Sticker!
Und wer will, dem male ich meinen liebsten Private Key auf einen Zettel.

2026-10-27 08:59:39 UTC

Allein durch die mitgehörten Telefonate im ICE zur it-sa könnte ich ein Opsec-Fail-Blog füllen.

2026-10-27 08:51:06 UTC

Here I am, in a high-speed train to Nuremberg, laughing out loudly at a guy who is deliberately mispronouncing obfuscated goop which he proceeds to show on screen in Comic Sans. All the while, the business dudes around me go like "we have to strategically evaluate aM9rh1ExJXJ blah".
How did I get here? Is this a good place or did I take some fundamentally wrong turns in my life?

2026-10-27 08:39:29 UTC

glm-5.3 auch mal wieder on topf of the Dinge, heute: Denglisch.
"Das scrambling ist effectively a one-time-pad applied to letters: identity, frequency, vocal class, keyboard relations are all destroyed."

2026-10-27 07:40:35 UTC

@nprofile…0fh6 könnt ihr mal bitte in euren Virenscanner schauen, support-id: 4jDMm66T3VzMmDm-512d7e und mir an die Absendeadresse der Mail mitteilen, welche Regel genau angeschlagen hat? Das ist ein 20 Jahre altes PDF meines Buches "PHP-Sicherheit", da würde mich echt mal interessieren, warum das Malware ist. Script-Tags, GTUBE String?

2026-10-26 18:02:25 UTC

The US government has imposed severe sanctions on the International Criminal Court, because it is not happy with some of its judgment (and presumably, judges).
However, US tech lobbyists have corrupted the government into issuing a wide ranging exempt, available here: https://ofac.treasury.gov/media/937191/download?inline
This exempts any US service that is concerned with the exchange of communications over the internet from the sanctions, i.e.: The ICC can continue using and paying for their precious M365 tenant.
1/2

2026-10-26 11:33:45 UTC

Your daily dosis of copium, presented by emudhra.com
https://assets.chaos.social/media_attachments/files/117/506/992/115/880/070/original/7c7c2064e05002e2.png

2026-10-26 08:43:41 UTC

Ich arbeite gerade an meinem Vortrag für die it-sa. Im Wesentlichen werden es wohl 30 Minuten hiervon werden.
https://assets.chaos.social/media_attachments/files/117/506/323/412/473/920/original/51eefaa2a6ab5a46.mp4

2026-10-23 07:06:47 UTC

In the wake of eMudhra and php2shell, I had two distinct "told you so" moments. First, the underlying issues that led to php2shell were called out by Stefan Esser in the early 2000s and were the reason for his hardended-php patch and the Suhosin extension.
Second, the catastrophic incompetence of CAs is not new. This is a screenshot from a presentation I held at OSDC in 2012. Told you so. But nobody would actually listen.
https://assets.chaos.social/media_attachments/files/117/488/956/302/730/098/original/a3e2e28a9b29fcc8.png

2026-10-23 06:41:16 UTC

The week so far: https://www.youtube.com/watch?v=uLeAot4Zrxo

2026-10-22 16:43:52 UTC

POV be like
https://assets.chaos.social/media_attachments/files/117/485/563/068/237/028/original/284ad79467c498cd.png

2026-10-22 14:33:40 UTC

TIL: Doing a live TV interview with the sound of Mastodon retoots in the background is slightly distracting.

2026-10-22 12:56:14 UTC

🫠
https://assets.chaos.social/media_attachments/files/117/484/466/684/955/659/original/c81bb8be659d0c3e.png

2026-10-22 11:19:54 UTC

Oh, an RCE in Bind too? Oh COME ON. CVE-2026-94300
What's next, Sendmail?

2026-10-22 11:13:29 UTC

Und weiter geht die wilde Fahrt, jetzt live im WDR2 zu KI&IT-Security am Aufhänger php2shell.

2026-10-22 11:01:02 UTC

So the "Virtual Patches" for php2shell are WAF rules that block RFC1867 uploads with more than 50 files? That doesn't sound very convincing...?

2026-10-22 09:06:26 UTC

Nun, dies eskalierte zügig. Vier weitere Interviews - verliere langsam den Überblick.

2026-10-22 05:34:32 UTC

Ich bin jetzt live im SWR Hörfunk zu der php2shell Sicherheitslücke und ordne das Thema für die Hörer ein.

2026-10-21 19:08:04 UTC

Aus der 2. Auflage meines Buchs (Koautoren: Stefan Esser, Peter Prochaska) zu PHP-Sicherheit. 2007.
Stefan hatte die ganze Zeit den richtigen Riecher.
https://assets.chaos.social/media_attachments/files/117/480/464/792/763/098/original/ccc89228fb89b4b0.jpeg

2026-10-21 18:40:15 UTC

If you run your own Debian/Ubuntu mirrors, for example because you are one of Germany's biggest dedicated/virtual server hosters, and there's a whole bunch of urgent PHP update packages incoming, and you are not updating your mirrors, then you should REALLY get crackin'.
# curl -sI https://mirror.hetzner.com/ubuntu/packages/dists/noble-security/InRelease | grep -i "Last-Modified"
Last-Modified: Wed, 21 Oct 2026 09:45:37 GMT

2026-10-21 14:21:56 UTC

In slightly happier news, the first interview request for php2shell landed before the first verified exploit.

2026-10-21 14:04:02 UTC

Now that the updates are out, and I can finally show the article for php2shell
https://heise.de/-11494897
This has been long in the making, as I was part of the disclosure process and helped with liaising to (amongst others) CERT-Bund.
I'm glad this is out, even though it leaked a day ahead of time.
Now, it's time to watch the web burn, I'm afraid.

2026-10-21 13:58:46 UTC

PHP stopgap mitigation. Don't rely on it, patch your shit!
memory_limit=-1
post_max_size less than one-quarter of the memory limit, or 8M as a fallback
Set max_input_nesting_level to a low value, such as 8
session.upload-progress.enabled=0
For PHP-FPM: Set pm.max_requests to a low value
Use SELinux / AppArmor,
set apparmor_hat,
set fatal_error_backtraces=0 and
hide the presence of PHP with expose_php=0.

2026-10-21 13:57:54 UTC

And here we go. Maybe we should set up a torrent for the PHP src tarballs, php.net is slightly sluggish right now.

2026-10-21 13:16:34 UTC

If you're using Node instead of PHP, you're probably watching the whole ruckus with a little bit of amusement. Fair.
You should still update, especially to purge the compromised eMudhra certificates from your Node installation. Otherwise, it would be susceptible to TLS MITM.
https://nodejs.org/ja/blog/vulnerability/october-2026-security-releases

2026-10-21 13:03:15 UTC

I really hope that my previous workplace has continiued to maintain the PHP applications that were due to be switched off soon during the post-merger integration phase.
In June 2023.

2026-10-21 12:33:31 UTC

Most of the darknet forums that I know of are currently down. I wonder why that is.

2026-10-21 11:35:28 UTC

A new version of the "jackal" poc just landed, now brings its own lab environment. Still can't get it to fire, anyone else more successful?

2026-10-21 11:23:30 UTC

OK, totally new topic here. Everyone ready?
A colleague just forwarded me a phishing e-mail that used a shitty lure, but interesting landing page. It's the M365 login under a throwaway domain, but personalized for each victim, and it seems to load M365 customizations as well as evade debugging (with Web Developer Extension enabled). Which phishing toolkit uses URL parts like tree10_keyboard3_flower3_sugar2_sky4_ etc.?

2026-10-21 11:08:22 UTC

Weiß nicht, wie's euch so geht, aber wenn ich mir das Internet heute anschaue, möchte ich auch gern 384 Bit trinken.

2026-10-21 07:04:33 UTC

GoDaddy is revoking around 400K certificates from their StarField CA, too.
The timeline seems to look like this is happening *right now*. It's not related to the number 4, 66 or 238, but to a CPS issue.
Thanks to a member of heise security PRO for alerting me to the issue. Find out more on https://pro.heise.de/security
https://bugzilla.mozilla.org/show_bug.cgi?id=2083191

2026-10-21 06:50:38 UTC

In a related note, could I please make a request for more Death or Black Metal as background music in poc videos? I'm listening to an uncomfortable amount of non-metal music today.

2026-10-21 06:47:16 UTC

While you wait for the PHP update, you might as well update your ca-certificates package on Debian/Ubuntu; the updated version completely removes trust in the emSign CAs.

2026-10-21 05:59:49 UTC

The "jackalsyn" PHP RCE PoC is built against lsphp (LiteSpeed SAPI), not stock php-fpm, for whatever reason. It also notably seems to up against the wrong tree.
I tested it against a stock PHP on a fresh Hetzner Ubuntu VM (php-fpm 2:8.5+99ubuntu1) and it does not seem to work. No RCE, not even a worker crash on both purported exploits (618/619. I'd be interested to hear from someone who achieved either.
https://assets.chaos.social/media_attachments/files/117/477/351/170/532/733/original/aae8625f775038e1.png

2026-10-21 05:19:31 UTC

Yay. Dumpster Fire.
https://assets.chaos.social/media_attachments/files/117/477/209/627/993/811/original/1803ce2115c130b1.png

2026-10-21 04:43:05 UTC

Der Podcast zum heutigen Tag: Mordlust Nr. 256 „Gefahr im Verzug“. Besser kann mam das Dumpsterfire, das der 21.10. werden wird, nicht zusammenfassen.

2026-10-20 20:43:51 UTC

https://www.php.net/index.php#2026-10-20-1
PHP has announced a critical security update for tomorrow, October 21. I think you should really install this as soon as it lands. Maybe put your PHP apps behind something sturdy in the meantime. Not behind something Fortitrixvanti-esque, preferrably.
I'm going to drink some Kool-Aid now.

2026-10-20 20:40:03 UTC

An alle angeschlossenen Funkstationen: Um Mitternacht wiederhole Mitternacht 0000 Umstellung auf Privatschlüsselverfahren 4.

2026-10-20 17:41:53 UTC

Didn't see this one yet: Cellebrite touts AFU access to IOS 26.4+ in an undated product flyer for "Advanced Unlocks". Wireless, too, with an 8m range.
https://assets.chaos.social/media_attachments/files/117/474/461/707/299/211/original/9ceed3aa332da4f3.png

2026-10-20 16:39:16 UTC

OK, we all had a jolly good laugh. Now this whole thing begs the question: How could BDO Malaysia miss this UNBELIEVABLE MALPRACTICE during their WebTrust audit? This is the audit report:
https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=3d8070c2-71d2-4f93-bd21-e79f18dbe93d
Seriously, what are these audit reports even worth?
Signed, the owner of a eMudhra signed cert for www.bumsbude.de.

2026-10-20 14:21:24 UTC

At this point, it seems like everyone has the private key to one of the eMudhra CAs. Why don't i? @nprofile…a6sv
@nprofile…gpjx

2026-10-20 13:47:05 UTC

emSign issue: This is a little odd.
Mozilla is removing trust in: emSign Root CA - C1 and emSign ECC Root CA - C3 as per #2083709 but is framing this as having to do with the keyCompromise. However, this seems to be part of a planned transition. Plus, @nprofile…gpjx has certs that have none of these in the path. Trust path here is
EM DV TLS CA - G3B -> emSign Root TLS CA - G3 -> emSign ECC Root CA - G3
(Looking at the q3k.google.com cert)
What's up with that? Were the revoked intermediates x-signed?

2026-10-20 07:09:56 UTC

I have used Photoshop for 30 years now, starting with Photoshop 3.0.5 (OEM bundled to a Mustek flatbed scanner). I kept a clean license record until they started switching to monthly subscriptions, then I let it lapse. I have now switched to krita for work and on my private PC I'm using the ancient Photoshop CS which was offered as a free download by Adobe a while back.
I honestly have no need for an AI engineered copy - there were enough valid alternatives. Anyone remember Paint Shop Pro?

2026-10-19 08:49:54 UTC

Dear Canonical Ubuntu: I get it. We all need to earn a living. And chat widgets on web sites are mostly sales vehicles.
HOWEVER: If I browse to ubuntu.com/security and am greeted by a chat widget, chances are that I am *not* in the market for an enterprise sales chat.
Chances are that I need to know about patch availability for, say, a critical guest-to-host escape in KVM. And in this situation, gating a response behind "enterprise only" checkboxes is simply not okay.
https://assets.chaos.social/media_attachments/files/117/466/710/168/710/281/original/09f2cf9bd25bfb50.png

2026-10-16 12:07:16 UTC

Untethered iOS 27.0.1 jailbreak presented by calif.io live on stage @HexaCon.
Source: x.com/bellis1000
https://assets.chaos.social/media_attachments/files/117/450/498/085/174/169/original/ad977d457ea424a1.png

2026-10-16 11:50:26 UTC

Das gab's meiner Quelle zufolge in dieser Form auf dem iPhone seit iOS 8 oder 9 nicht mehr (pangu9): Untethered jailbreak für iOS 27.0.1 ist raus. https://heise.de/-11490726

2026-10-16 07:43:34 UTC

[X] Doubt.

2026-10-15 06:57:12 UTC

Bin nicht ganz sicher, was genau da bei der KI-Zusammenfassung passiert ist, aber es ist typografisch zumindest interessant.
https://assets.chaos.social/media_attachments/files/117/443/617/965/783/830/original/ab8e6c20fd381738.png

2026-10-15 06:37:03 UTC

Auf der Startseite des Spiegel läuft gerade so eine Art "Betrunken-Simulator" in Aufmacherbildern. ;-)
https://assets.chaos.social/media_attachments/files/117/443/538/059/968/742/original/7e2ba86a857e2f05.png

2026-10-14 11:33:21 UTC

An odd observation from a retro gamer: The full cartridge ROM for the Atari 2600 game "Maze Craze" is 4096 bytes.
The full e-mail headers of an e-mail sent from GMX through M365 to my business e-mail address are 20499 bytes. The "UI-OutBound" header alone is 6934 bytes, Microsoft's X-Microsoft-Antispam-Message-Info is 3400 bytes.
And Maze Craze is definitely a lot more fun.
https://assets.chaos.social/media_attachments/files/117/439/042/840/438/231/original/a8f17c866d5866a1.png

2026-10-14 11:10:18 UTC

The placement of these two toots is perfect in a very sad sense. @nprofile…lsx9 @nprofile…j4s6
(Title of the german article says: "No warning from SpaceX: Ukraine complains about sudden Starlink restrictions", english version here: https://heise.de/-11488002 )

2026-10-14 09:42:55 UTC

If you're seeing this "fire spewing garden dragon decoration" in ads (typically by Taboola and other ad platforms that host questionable/scammy ads), I'd recommend you steer clear. The seller behind the product is Cola Technology, the same company that sold cheap fans and space heaters (!) as "miracle A/C" solutions during the summer. You will receive a product, but it will probably not live up to your expectations.
https://assets.chaos.social/media_attachments/files/117/438/597/850/940/738/original/cb33e2c0fa29caba.png

2026-10-14 08:16:54 UTC

"Atos erweitert Partnerschaft mit Fortinet für ein globales, einheitliches Cybersecurity-Framework für hybride und Multi-Cloud-Umgebungen"
Weiß nich', Digga.

2026-10-13 13:40:57 UTC

"we built a firewalled VPC of 8 GCP nodes running redroid, an Android 15 emulator. "
Because what could possibly, POSSIBLY go wrong by running a possibly contagious botnet experiment on the internet instead of, say, an airgapped lab environment.

2026-10-13 11:58:25 UTC

So it's around 2pm on a tuesday afternoon and I'm unzipping a firmware for a fridge web UI. How's your day going?

2026-10-13 09:45:05 UTC

This is why we can't have nice things. At least the password is not rotated daily to match the current date. Right, Danfoss?

2026-10-13 07:31:01 UTC

Context: https://github.com/systemd/systemd/issues/44145
https://assets.chaos.social/media_attachments/files/117/432/427/513/168/256/original/0fb48c785b7521f9.png

2026-10-13 05:50:05 UTC

LOL. Wer hätte auch ahnen können, dass am 11. Oktober KSK Rollover ist, das kam total überraschend!

2026-10-12 06:30:57 UTC

Monday morning 8:30 and I'm pretty much done with the week. And next. And the one after that.

2026-10-09 05:54:17 UTC

And here we go again... https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697191&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_107406 It would seem that the "timely reaction" to last weekend's vuln resulted in an incomplete fix. #citrix #netscaler #srsly #ythough

2026-10-07 06:28:40 UTC

OK, this is an innovative directory traversal vuln:
GET /download/resources/jira.webresources:color-picker-popup/images/..::..::..::..::..::WEB-INF::web.xml HTTP/1.1
This is from CVE-2026-21589, https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/
The "::" gets replaced with "/" by some weird sanitation method, read more about it in the writeup.
Tagging @nynbinary for humorous memeing.

2026-10-06 19:32:08 UTC

Kontextbasierte Werbung, Bosslevel. *chef‘s kiss*
https://assets.chaos.social/media_attachments/files/117/395/627/419/143/216/original/1512404e3c3ef6d2.png

2026-10-06 15:19:17 UTC

Was sagt das eigentlich über die internen Kontrollmechanismen sowie über die parlamentarische Kontrolle des BND aus, wenn ein hochrangiger Mitarbeiter angeblich fünfzehn Jahre lang VS da raustragen konnte, ohne dass es jemand merkte?
Und wenn der ehemalige Behördenleiter diese VS als Consultant zu Geld machen konnte?
Und was sagt das über das ethische Gedankengerüst eines solchen ehemaligen Spitzenbeamten aus? Der btw etwa 9K Ruhegehalt bekommen dürfte...
Ich kapiere das alles nicht mehr.

2026-10-06 12:47:17 UTC

Ich schlage hiermit offiziell vor, den 6. Oktober 2026 zum jährlichen "Kannste dir alles nicht ausdenken"-Tag zu ernennen. BND-Edition.

2026-10-06 11:45:54 UTC

Accenture, acting as a contractor for the FBI, allegedly failed to install updates for Oracle Peoplesoft after CVE-2026-35273 was published.
This was a "Missing Authentication for Critical Function" vulnerability and scored 9.8. If this didn't raise any flags, the CISA KEV listing should have. It was an n-day at release.
But no, interestingly enough the FBI is exempt from BOD 26-04 and wasn't even obliged to update?!
Man, if not even federal agencies fix their vulns, this is all pointless.

2026-10-06 11:17:06 UTC

Trying to connect to a Dropbear SSH server may give the "** WARNING: connection is not using a post-quantum key exchange algorithm." warning. This might be a false positive, as this Github issue suggests: https://github.com/jtesta/ssh-audit/issues/375
The culprit is the kexguess2@matt.ucc.asn.au pseudo algorithm.
Just in case you (or my future self) stumble upon this.

2026-10-06 07:08:41 UTC

Viel skeptischer als Thomas Lohninger kann eine einzelne Person wohl nicht schauen.
https://assets.chaos.social/media_attachments/files/117/392/702/873/110/529/original/94eb8bc7cb232260.png

2026-10-06 06:59:21 UTC

Ist heute eigentlich im deutschsprachigen Fediverse noch jemand anwesend oder sitzen alle in Raum 2.600?

2026-10-04 11:05:56 UTC

Es gibt nun Patches für Citrix Netscaler, meine Meldung ist entsprechend aktualisiert. Ran an die Firmwares!
https://heise.de/-11474971

2026-10-04 11:05:25 UTC

There are now patches for Citrix Netscaler available, I have updated my reporting. https://heise.de/-11474996

2026-10-03 08:31:41 UTC

Yay, neuer Zero-Day in Citrix Netscaler: https://www.heise.de/news/Netscaler-Admins-aufgepasst-Zero-Day-verursacht-Crashes-und-Codeausfuehrung-11474971.html

2026-10-01 13:17:42 UTC

This is interesting to read. Although the "now" part seems to be more in the "since 2025" range, an interviewed researcher suggests that Magnet Forensics might have found a way to halt an iPhone's internal clock to preserve Inactivity Reboot.
I have questions about lots of of this. For example how the claim "Even if that device does reboot for any number of reasons, memory maintenance or the power is lost or whatever, the AFU state is not lost." would technically work at all.

2026-10-01 08:02:11 UTC

I somehow feel that this specific part of the cyberwar documentary "Midnight in the War Room" aged kinda badly. It's framed as "China / North Korea stealing intellectual property", but... well...
https://assets.chaos.social/media_attachments/files/117/364/600/953/991/070/original/f912f6b8a2fa99f8.png

2026-10-01 07:55:33 UTC

You know what I really miss? I miss the extremely hard challenge/riddles in the Verizon DBIR report in the late 2000s. That was some serious fun. I think @nprofile…s5m3 was doing them, too, right?

2026-09-30 15:18:57 UTC

In our daily episode of "security appliance jeopardy", we are asking: "What is %6a_security_check?"
https://www.heise.de/en/news/Patch-now-Attackers-bypass-login-on-Cisco-Catalyst-SD-WAN-Manager-11471644.html

2026-09-30 14:15:14 UTC

%6a_security_check

2026-09-30 13:42:16 UTC

Was machen die da?
https://assets.chaos.social/media_attachments/files/117/360/277/675/956/043/original/b5a9062a4cab751f.png

2026-09-29 08:39:02 UTC

Make it happen.
https://assets.chaos.social/media_attachments/files/117/353/423/646/883/098/original/b96c53966893bc3b.png

2026-09-28 05:39:04 UTC

Guess we went with the "monday morning clusterfuck" option.
CISA is now warning about this, as is dutch NCSC. Nothing from @nprofile…hwq5 yet, although I'd pinged their press office and WID yesterday around noon.

2026-09-27 11:57:57 UTC

Sometimes, you have to err on the side of caution.
I think that @nprofile…g4vn and @nprofile…s8pv are right in warning people of impending 0days for Netscaler. Although official info is still missing, I have posted a news about this. This has potential to
a) age VERY badly, or
b) turn into a monday-morning clusterfuck.
Time will tell...
https://www.heise.de/en/news/Security-researchers-warn-New-zero-day-exploits-in-Citrix-Netscaler-11467269.html

2026-09-26 19:06:01 UTC

I‘m so done. Seriously. Every single time today when I turned on the PC to just play ten quiet minutes of No Man‘s Sky, a new fire in the PKI and Infosec world popped up. Can we just stop doing this on the weekend?

2026-09-26 18:50:26 UTC

And the next "turn off your appliances NAU" type of advisory, if one can believe the rumors.

2026-09-25 08:42:49 UTC

Soooooo.... any KiteWorks customers in my network?

2026-09-23 12:56:54 UTC

There's an account here that posts "directory traversal" memes and recent vulns of that type. I can't seem to find it - anyone got an idea?

2026-09-23 09:36:28 UTC

"Vertrauen ist der neue Perimeter". Im Vorfeld der it-sa sammeln sich die Binsenweisheiten in meiner Inbox, nebst Gesprächsangeboten.
Was ist bis jetzt Eure beste it-sa-PR-Binse?

2026-09-22 09:41:54 UTC

I see your niche hyperfocus and I raise you one hyperfocus.
In the wooden boxes for Enigma encryption machines, the position of the lock varies between different models and/or manufacturers. Sometimes, the lock is in the lid, sometimes the pin is in the lid.
Also, the stamp "Klappe schliessen!" is sometimes stamped in a serif font, sometimes it seems to be in DIN-1451. And there's sometimes a rectangle around the stamp, sometimes there isn't. Intriguing.

2026-09-22 08:13:06 UTC

Ich möchte auch gern die Zukunft von "
" vorantreiben.
https://assets.chaos.social/media_attachments/files/117/313/684/593/584/109/original/5d182494c80a4be4.png

2026-09-22 06:56:21 UTC

Falls ihr spontan heute Vormittag noch nichts vorhabt... Wir bearbeiten heute intensiv das Thema Kubernetes-Security in unserem Webinar: Blue-Teaming Deep-Dive - Bedrohungserkennung, Forensik und Abwehr im Live-Betrieb. Ich moderiere, Felix Roider von iSecNG webinart.
https://heise-conferences.de/webinar/zweiteiliges-webinar-deep-dive-in-kubernetes-security-CewBaKDJpkBvwl

2026-09-21 09:38:47 UTC

Suche für ein Experiment einen Rest PEBA-Filament. 50 Gramm oder sowas sollten reichen, Farbe egal.
Hat da jemand was?

2026-09-11 10:19:32 UTC

Noch heute gruselt es mich bei dem Gedanken an die Headline "Kriminelle veröffentlichen Fotos von Krebspatientinnen". Security muss als zentrales Thema in der Medizin verankert bleiben.
Wir liefern mit der CySecMed in 40 Vorträgen das Forum für den fachlichen Austausch. Wenn Du dabei sein willst, kriegst du mit dem Vouchercode hinter dem Shortlink 20% Rabatt.
Wann: 13.-14.10. in Unterhaching
Vouchercode: https://heise.de/s/lwv45
Programm: https://cysecmed.de/programm
https://assets.chaos.social/media_attachments/files/117/251/882/983/872/450/original/a8c51f34b25c8c6d.webp

2026-09-09 09:13:45 UTC

Even ragequitting is "improved" by AI now. https://heise.de/-11446118

2026-09-03 13:01:14 UTC

Jetzt zahlen wir den Preis der Bequemlichkeit - https://heise.de/-11440057

2026-09-02 06:13:19 UTC

Menschen, genannt Romanes, gehen das Haus.
https://assets.chaos.social/media_attachments/files/117/199/968/420/656/743/original/4ed4684ae28272e5.png

2026-09-01 12:52:54 UTC

Platz 2 weltweit! Endlich schließt Deutschland wieder zur Weltspitze auf.
OK, bei angreifbaren on-premise Exchange-Servern, aber immerhin: Es geht ein PoC durch Deutschland.
https://assets.chaos.social/media_attachments/files/117/195/876/777/027/941/original/667d51e875076e7e.png

2026-09-01 10:41:49 UTC

nein-doch-oh.gif

2026-09-01 09:57:31 UTC

FYI @nprofile…yds7 @nprofile…hzy7

2026-09-01 09:42:22 UTC

DOS International, April 1990 vs. heise online, August 2026.
https://assets.chaos.social/media_attachments/files/117/195/127/198/249/349/original/8c202e9f7279f417.png
https://assets.chaos.social/media_attachments/files/117/195/128/064/086/188/original/a69c4970684823b4.png

2026-09-01 04:52:19 UTC

CrowdSec writes to me:
„Monthly alert quota exhausted for christopher-kunz's account
Your Community plan has reached its monthly quota of 500 alerts.“
At 3:32 am on September 1. Well….
„Premium raises your alert quota to 10k/month/Security Engine“, they also upsell me. Yeah right. That would take me all the way to midday on the 3rd!
Guess I‘ll have to take a deep dive into the alerting behavior.

2026-08-28 08:38:11 UTC

I'm quite a fan of Pangolin. What started off as a replacement for nginx Proxy Manager evolved into a fully fledged zero-trust tunnel with all kinds of bells and whistles (and yes, ACME!).
Now they added a "small" feature in 1.22: An AI Gateway. This enables you to hide various providers and self-hosted models (on ollama, open webui etc.) behind your own API endpoints and apply user/group permissions to them.
I added Hetzner and OpenAI as provider and what can I say? It just works. 1/2