Nostr notes by Tim (Wadhwa-)Brown :donor:

Just asked our product management folks about the roadmap for ...

2026-10-29T12:04:26Z

Just asked our product management folks about the roadmap for 9-bit AES:

https://v12.sh/blog/the-case-of-the-9bit-aes-key

Nothing like discovering your colleagues are running your work ...

2026-10-29T01:24:56Z

Nothing like discovering your colleagues are running your work through AI and claiming it as their own innovation. Especially when the dickhead has an AI assistant that he's given a name send you fucking emails.

Given 750 IPs for a cyber exercise I'm running for an ISP. ...

2026-10-27T23:55:07Z

Given 750 IPs for a cyber exercise I'm running for an ISP. Just over 10% of them have BGP enabled and exposed to the world. So anyway, we're going to see what happens when their routing stack gets poked by some kind of bear-like* creature called Tim.

* note the "like"... I am nowhere near as fancy,

"Some of us are so concerned about the supply chain that we ...

2026-10-27T11:44:18Z

"Some of us are so concerned about the supply chain that we write our own malware..."<snark />

RE: https://mastodon.social/@jazzfm/117511786571484384 All that ...

2026-10-27T07:59:32Z

RE: https://mastodon.social/@jazzfm/117511786571484384

All that and they missed rain.

Proposed new KPIs for infosec.exchange dwellers: 1) How many ...

2026-10-27T07:57:59Z

Proposed new KPIs for infosec.exchange dwellers:

1) How many malicious links have you clicked on this morning?
2) How many times has your AI^Wdog escaped containment this week?
3) Have you commented on at least one topic for which you're not somewhat familiar this month?
4) 4

$christmaspudding = 1; # Next stop, mince pies \o/

2026-10-25T20:07:36Z

In reply to nevent1q…kvgq
_________________________

$christmaspudding = 1; # Next stop, mince pies \o/

Interesting links of the week: Strategy: * ...

2026-10-25T09:38:36Z

Interesting links of the week:

Strategy:

* https://www.youtube.com/watch?v=WXL6K1lhvt0 - weeding out the undesirables, if we're not calling out this kind of shit, we're absolutely part of the problem
* https://www.ncsc.gov.uk/collection/problem-book/ai-cyber - NCSC turns the page and finds more problems
* https://cert.cyber.gouv.fr/dur/CERTFR-2025-DUR-003/ - more fun with water, this time in .fr

Threats:

* https://elkentaro.github.io/jp_incidents/ - .jp having a bad day^Wweek^Wtime of it with baddies
* https://emudhra.we-have-a-problem.com/ - did you just get a shitty certificate which means nothing?
* https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/ - is it simulation or emulation if the TA is using pen testing tools? 🤖
* https://blog.nviso.eu/2026/10/16/keystrokes-in-disguise-forensic-analysis-of-a-digispark-hid-device/ - key logging in the wild

Detection:

* https://righteousit.com/2026/10/20/mtt-sh-mounting-linux-images/ - [@hal_pomeranz](https://infosec.exchange/@hal_pomeranz ) on the pain that is "mount"

Bugs:

* https://hackyboiz.github.io/2026/10/17/millet/cve-2026-58222/ - let's all do the Samba
* 4 - important contribution to cyber awareness month
* https://calif.io/php2shell/ - another important contribution to cyber awareness

Exploitation:

* https://www.netcraft.com/blog/how-attackers-get-into-your-calendar-the-easy-way - when you're offered a date, be careful where you put it....
* https://0xrefs.github.io/ - interactive cheat sheet
* https://blog.trailofbits.com/2026/10/14/package-managers-have-an-integrity-problem/ - not sure I'd refer to language specific tooling as package management, given their varying capability levels, but it's certainly true that they often lag behind distros' traditional package management
* https://blackfield.ch/blog/defeating-enforced-smb-signing/ - is SMB signing al that it promised to be?

Hard hacks:

* https://www.usenix.org/system/files/usenixsecurity24-lisowski.pdf - fun with SIMs
* https://www.usenix.org/system/files/woot26-lisowski.pdf - more fun with SIMs

Crypotography:

* https://emudhra.we-have-a-problem.com/ - the story of 4

Hardening:

* https://ghuntley.com/patch/ - can AI help us mitigate threats?

#security, #research

Interesting Git repos of the week: Detection: * ...

2026-10-25T08:56:51Z

Interesting Git repos of the week:

Detection:

* https://github.com/reversinglabs/reversinglabs-yara-rules - Reversing Labs YARA
* https://github.com/interplains/zero-breach - hunt the AdFection / Candiru ad-delivered spyware campaign

Exploitation:

* https://github.com/google/kernel-research - GOOG's tools for kernel research
* https://github.com/vu-ls/tapioca - deep dive your packets with Will Dormann (npub12xh…zxeq)

Hard hacks:

* https://github.com/Th0rgal/open_oura - messing with the Oura ring via BTLE 🤖
* https://github.com/SAMS0N1TE/lr2021-sdr - making your LoRa chip listen harder
* https://github.com/qkaiser/broadcom-wps - tools from Quentin Kaiser (npub1m7c…4c9p) to check for Broadcam's wireless howler 🤖
* https://github.com/vu-ls/firmware-vulfinder - quickly validate firmware for obvious bugs

Hardening:

* https://github.com/francescotinti/php-rust - a sloppy port of PHP to Rust 🤖
* https://github.com/werewolf-linux/werewolf - a fresh take on hardening with Thomas Strömberg (npub1mwg…vjjk)

Cryptography:

* https://github.com/Fluepke/emudrahahahahaha - visit Flüpke (npub1q6j…kcru)'s key emporium
* https://github.com/ab/emudhra-fourgery - or make your own keys, as you need them with Andy Brody (npub1scw…urn8)

#security, #research, #code

I've pondered for a while on how to score tactics/kill chain ...

2026-10-25T08:15:14Z

I've pondered for a while on how to score tactics/kill chain steps using CVSS, but this morning it occurred to me that you could take that further and score:

a) average CVSS exposures by product
b) (and describe) a threat model scenario in CVSS

I don't have the time for the maths forf a right now, but consider this:

* Internet facing web server running a PHP app: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L: 7.3
* Internet facing mail server: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L: 7.1
* Active Directory: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H: 9.0
* Database server: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: 8.0

Not sure the numbers come out quite right, but just as with tactics, a lot of the properties are there to capture the properties of likely types of attack and their relative severity based on system type more generically...

#threatmodelling

Rerun earlier this week with respect to the latest PHP bug. Our ...

2026-10-24T11:25:21Z

In reply to nevent1q…0eh8
_________________________

Rerun earlier this week with respect to the latest PHP bug. Our operations had marked it FP before I got there. That's a team that's always looking to improve. 😍

Pondering on security assurance nomenclature. Is an audit a pen ...

2026-10-23T22:37:13Z

Pondering on security assurance nomenclature.

Is an audit a pen test, does an audit include testing, what is a pen test and what the hell is a build review?

All these words have somewhat different meanings depending on where you reside...

Which is fun when you work for a multi-national.

Nostr event nevent1qqszswvv76zf0365hsqknlarshvz7a9kytxn09njt3aq2v79ustqhpczyp89hh2eeyfuw9sm48ywmmhuzg89aarr9aqg7v44xegfkkeyup2dz2xwcrq

2026-10-23T21:06:58Z

Deploying curry to production on a Friday. Nomnom.

Nostr event nevent1qqswe8ed06tw5salnjqwrxhx0kc7afarglhm5y3hyunwf9uz04zc9pszyp89hh2eeyfuw9sm48ywmmhuzg89aarr9aqg7v44xegfkkeyup2dzgxzu5d

2026-10-23T18:06:55Z

$stollen = 1; # The yearly counter is reset...

Interesting watching a journalist who is honest about a knowledge ...

2026-10-23T13:46:51Z

Interesting watching a journalist who is honest about a knowledge gap getting kicked for it.

Somewhat telling that we had some folks for us to talk to them ...

2026-10-22T13:13:33Z

Somewhat telling that we had some folks for us to talk to them about boxes and whilst there was lot of excitement in said boxes, there less interest in the architecture and engineering necessary to ensure they don't to fall over and none at all in ensuring that you understood and had planned for if they did.

#emgineering, #architecture

Nostr event nevent1qqsdacw9cq4cjtszvk9h76eavsnlfzjh9qlgtcsa5c7u9wkuf09jnyszyp89hh2eeyfuw9sm48ywmmhuzg89aarr9aqg7v44xegfkkeyup2dzf54n7n

2026-10-22T10:30:22Z

Explaining why banks might be more worried about 4 than PHP.

I can see a new question for the various GRC frameworks: "Do ...

2026-10-21T06:25:36Z

I can see a new question for the various GRC frameworks:

"Do you operate or rely upon any legacy 8-bit CAs?"

s/first/fourth/g

2026-10-20T21:13:13Z

In reply to nevent1q…jn93
_________________________

s/first/fourth/g

Let thee with a secure chain of trust, cast the first stone. ...

2026-10-20T20:34:30Z

Let thee with a secure chain of trust, cast the first stone.

#threatintel, #secretnumbers

London'ish friends. My wife is dong something interesting as ...

2026-10-19T19:57:36Z

London'ish friends. My wife is dong something interesting as part of her PhD:

🧠 CALL FOR PARTICIPANTS: New Research on Masking, Inauthenticity, and Mental Health*

As part of my PhD research at Birkbeck, University of London, I am investigating the links between social masking, inauthenticity, and mental health outcomes. I am actively looking for both autistic and non-autistic participants to take part.

Who can take part? Anyone aged 18 or older.

What is involved? Completing a short set of online questionnaires (approx. 25 minutes of your time).

Benefits: Entry into a prize draw for a £25 Amazon voucher!

This project has been approved by the Birkbeck Ethics Committee (Ref: 2526041).

To take part or find out more: Scan the QR code on the poster or follow this link:
https://lnkd.in/eJv6Sjnj

Thank you for supporting academic research! Feel free to share or tag anyone who might be interested.

#PhDResearch #MentalHealthResearch #Birkbeck #Psychology #ResearchStudy #AutismResearch #Masking #Camouflaging #MaskingResearch

Currently watching a LI celebrity advise on using SHA hashes to ...

2026-10-18T22:12:32Z

Currently watching a LI celebrity advise on using SHA hashes to verify authenticity...<snark />

Interesting links of the week: In honour of infodox: * ...

2026-10-18T10:12:45Z

Interesting links of the week:

In honour of infodox:

* https://github.com/infodox
* https://github.com/darrenmartyn
* https://github.com/fullspectrumdev

Strategy:

* https://www.philvenables.com/post/a-cisos-ideal-management-tool - Phil Venables (npub1v5f…wgxn) discussed modern CISO needs
* https://thomasdullien.github.io/about/slides/An-age-of-experimentation-BlueHat-Asia-2026.pdf - [@HalvarFlake](https://mastodon.social/@HalvarFlake ) ponders on experimentation 🤖
* https://graemedownie.com/wp-content/uploads/2026/10/PUTIN-TAX-FINAL-COMPLETED.pdf - estimating the cost of Vlad
* https://blog.zsec.uk/regulating-red-teams/ - [@zephrfish](https://bladerunner.social/@zephrfish ) discusses regulated red teams
* https://anarc.at/blog/2026-10-08-dst-warning - anarcat (npub1atw…rz53) ponders on the nature of time
* https://www.npl.co.uk/news/the-future-of-timekeeping - some changes take time...

Threats:

* https://medium.com/mitre-attack/attack-v20-9701dd75ffb4 - ATT&CK v20 is out \o/
* https://cwe.mitre.org/news/archives/news2026.html#October05_CWE_5_0_Schema_8_0_Release_Date_28_October_2026 - changes to the way that [@CWE_Program](https://mastodon.social/@CWE_Program ) manages weaknesses
* https://opsectechniques.com/ - tracking opsec techniques
* https://cert.pl/en/posts/2026/08/incident-follow-up-report-energy-sector-2025/ - how baddies breached a private APN
* https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/ - j’ai un mot de passe faible et la pression s’est intensifiée 🇫🇷 🧊🔥
* https://www.virlabs.ai/blog/knock-outd/ - T1205.002 ++
* https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/ - [@citizenlab](https://mastodon.social/@citizenlab ) on when you're the product
* https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zero-click-spyware-and-mass-identity-vacuuming - weaponised adverts
* https://blog.report-uri.com/abandoned-analytics-domain-funnels-store-visitors-to-darksword-iphone-exploits/ - Scott Helme (npub1xql…ayrn) reports on some interesting iOS malware lurking on long since expired domains

Detection:

* https://ifritnoises.org/articles/the-lucifer/ - spotting a compromised MikroTik
* https://blogs.cisco.com/industries/cisco-and-the-disa-stig-turning-zero-trust-policy-into-repeatable-practice-part-2-cisco-sna - using SNA for OT visibility
* https://www.halkynconsulting.co.uk/a/2026/10/linux-file-attributes/ - Taz Wake (npub123l…wmzz) and friends explain file properties in Linux

Bugs:

* https://gist.github.com/lkloliver/46a88c7d619e487327a1122c20ff8e32 - gotta love a good $PATH bug
* https://vulnerability.circl.lu/kev-catalogs - a circl (npub143x…w0tp) of KEVs
* https://quentinkaiser.be/security/2026/10/16/one-parser-two-bugs/ - when the airwaves contain a howler

Exploitation:

* https://sec-consult.com/blog/detail/from-anyoneicloudcom-spoofing-arbitrary-apple-icloud-identities/ - fake it until you make it :)

Hard hacks:

* http://rfidiot.org/ - RFIDIOt gets an update
* https://www.pentestpartners.com/security-blog/you-dont-need-a-nation-state-to-warm-up-a-fridge/ - cybergibbons (npub1ne0…087a) on fridges... global warming isn't a myth and anyone can do it
* https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers - Claroty (npub1yc3…zd6y) chart the frozen wastelands that are fridges
* https://www.tibane.net/research/ledger-nano-x-implant - in-line attacks on hardware security features
* https://www.fullspectrum.dev/the-sangoma-inquisition-a-summary/ - a stack of SP infra bugs in Sangoma
* https://cn0xroot.wordpress.com/2026/09/19/root-tesla-os-on-qemu-part-1-unpacking/ - crashing and rooting a Tesla
* https://adepts.of0x.cc/eufy-doorbell-hacking/ - Adepts of 0xCC (npub1p2v…gc4k) poke the eufy doorbell

Hardening:

* https://www.kernelconfig.io/search?kernelversion=7.2.9&page=1&q=security - Linux kernel security config options
* https://onlineservices.epicgames.com/news/introducing-easy-anti-cheat-linux-v2 - games as ZT

Cryptography:

* https://www.mayrhofer.eu.org/talk/lets-talk-about-cryptographic-attack-surfaces/ - mind your Ps and Qs with [@rene_mobile](https://infosec.exchange/@rene_mobile )

Data:

* https://people.kernel.org/monsieuricon/creepy-crawlies - K. Ryabitsev-Prime 🍁 (npub1vg2…lxfp) gives us some numbers on just how much AI costs https://git.kernel.org/

Nerd:

* https://www.youtube.com/watch?v=1Vyzla9mx4g - [@kde](https://lemmy.kde.social/c/kde ) at 30, the story
* https://minesweeper.mikelacher.com/ - bang!
* https://archives.phrack.org/dl/73/halvar-flake-prophile.pdf - phrack profile [@HalvarFlake](https://mastodon.social/@HalvarFlake )
* https://decoded.legal/blog/2025/02/sim-farms-gsm-gateways-comugs-and-the-crime-and-policing-bill/ - Neil Brown (npub1huw…c5x7)'s analysis of the law on SIM farms

#security, #research

If you ever played Know Your Packets and the MySQL challenge ...

2026-10-17T19:46:55Z

In reply to nevent1q…g77d
_________________________

If you ever played Know Your Packets and the MySQL challenge tripped you up, I'm sorry but thank you for playing...

One challenge that threw many was cracking a MySQL hash from the ...

2026-10-17T19:46:26Z

In reply to nevent1q…hmul
_________________________

One challenge that threw many was cracking a MySQL hash from the wire so I submitted a feature request (with the solution) to Hashcat to make it a bit easier. I wrote a solution in Perl but more than a few players found that a bit beyond them (at the time, it also required you to reverse engineer the protocol somewhat).

The original reason I submitted this bug was that years ago I ...

2026-10-17T19:44:35Z

In reply to nevent1q…xw7f
_________________________

The original reason I submitted this bug was that years ago I built the Know Your Packets CTF track in which you were given a pcap file and Wireshark and asked to solve a variety of challenges. Since I built it for Electromagnetic Field CTF Team (npub1t23…k3r5) in 2018, It's popped up in a variety of places including Cisco Live EMEA where our guests get to play it.

@npub1d9j…7m3z, [@Viss](https://mastodon.social/@Viss ) I see ...

2026-10-17T17:56:35Z

Royce Williams (npub1d9j…7m3z), [@Viss](https://mastodon.social/@Viss ) I see your names on the original ticket for MySQL caching_sha2_password. They've just closed my ticket for the "on the wire" variant... https://github.com/hashcat/hashcat/issues/2713 :)

I always take great joy in watching my GH feed flicker with ...

2026-10-16T16:28:45Z

I always take great joy in watching my GH feed flicker with people liking and forking projects from my weekly repo dump...

"Here's these service definitions with methodologies and ...

2026-10-16T14:28:25Z

"Here's these service definitions with methodologies and deliverables, that we have that do what is needed."

"Here's this marketing that is based on feeding the service definitions into a LLM."

"They are not the same. Not. Even. Close."

Interesting Git repos of the week: Detection: * ...

2026-10-16T10:52:06Z

RE: https://chaos.social/@realhackhistory/117404720079492044 RIP ...

2026-10-15T22:05:42Z

RE: https://chaos.social/@realhackhistory/117404720079492044

RIP infodox:

https://github.com/timb-machine/linux-malware/pulls?q=is%3Apr+state%3Aclosed+author%3Adarrenmartyn

quoting
note1jw7…l2vp

With a heavy heart it seems that Darren Martyn aka pwnsauce from LulzSec has died. I considered him a friend & had the privilege of spending time with him irl, he was sharp, kind, funny & a pleasure to chat with. His family are asking for privacy but I know Darren was very proud of the volunteer

Nostr event nevent1qqsv3x2t0z4djf5625el8lfmgfs9n5lkwakr8d6hguevlkdxwcyrhzqzyp89hh2eeyfuw9sm48ywmmhuzg89aarr9aqg7v44xegfkkeyup2dzhmqykt

2026-10-15T18:20:14Z

I have started a coup.

Also, when you're proposing infrastructure as code should be ...

2026-10-15T13:23:42Z

In reply to nevent1q…cu35
_________________________

Also, when you're proposing infrastructure as code should be done in pure Python rather than a DSL...

Always a bit concerned when an operator can't explain how ...

2026-10-15T13:21:48Z

Always a bit concerned when an operator can't explain how they're treating infrastructure risk. What's a backup VLAN between friends?

🎉 Me, when I see HPE NonStop pop up in the @npub10a9…snnc ...

2026-10-15T09:01:35Z

🎉 Me, when I see HPE NonStop pop up in the CVE (npub10a9…snnc) timeline.

Watched someone's AI assistant respond to a support request ...

2026-10-14T17:50:59Z

Watched someone's AI assistant respond to a support request by explaining that HTTP 500 responses were "authentication failures". *laughed*.

We welcome ATT&CK v20: ...

2026-10-13T22:45:25Z

We welcome ATT&CK v20:

https://attack.mitre.org/resources/updates/updates-october-2026/

Blog post here:

https://medium.com/mitre-attack/attack-v20-9701dd75ffb4

#redteam, #blueteam, #threatintel, #att&ck

How much time is being wasted on AI when there's limited ...

2026-10-13T07:51:45Z

How much time is being wasted on AI when there's limited transparency on the guard rails and thus no guarantee that the slop machine will ever give you a useful answer?

You write a detailed set of requirements and then have to coach ...

2026-10-12T19:36:27Z

In reply to nevent1q…hvfp
_________________________

You write a detailed set of requirements and then have to coach the rest of the project as to why they should matter to them. Things like responsibility for avoiding weak passwords:

"But I don't manage AD..."
"No, but you'll be using service accounts in AD, I don't doubt..."
"Oh."

Or handling logs from ZZxYY:

"But it's the SOC team's job to deal with malicious events..."
"And they'll know what a malicious event from ZZxYY looks like, will they?"
"Oh."

If you spotted the Samsung fridge outage a few weeks ago... just ...

2026-10-12T12:15:44Z

If you spotted the Samsung fridge outage a few weeks ago... just spotted reports of someone turning off France's supermarket fridges:

https://www.france24.com/en/live-news/20261012-french-supermarket-chains-say-cyberattack-forced-refrigerator-shutdown

#fridges, #threatintel

@npub1s05…tnkj Looking forward to trying out that fix for ...

2026-10-11T14:19:34Z

Michael Stapelberg 🐧🐹😺 (npub1s05…tnkj) Looking forward to trying out that fix for multi-line searches on DCS. Thank you :)

Nostr event nevent1qqsvgauhclnvpvvpp0a4plt22fqqvvver2cx38xj40wz7yr35f4jj2qzyp89hh2eeyfuw9sm48ywmmhuzg89aarr9aqg7v44xegfkkeyup2dzmlf8ej

2026-10-10T19:31:29Z

Pie.

The hilarity of a bug fix from a bug 4 years ago when you ...

2026-10-09T20:26:36Z

The hilarity of a bug fix from a bug 4 years ago when you don't even remember the bug report.

That's a first. Just seen a football manager posting on ...

2026-10-09T13:14:32Z

That's a first. Just seen a football manager posting on LinkedIn - it appears I'm connected via an agent with overlapping interests in data science. Ai doesn't do a bad job of posting slop for you, even if you have a very niche job.<snark />

Interesting Git repos of the week: Detection: * ...

2026-10-09T11:39:39Z

Interesting links of the week: Strategy: * ...

2026-10-09T08:39:07Z

Interesting links of the week:

Strategy:

* https://www.ncsc.gov.uk/collection/disruptive-cyber-attacks - NCSC discuss response planning
* https://sheets.works/data-viz/holding-up-the-internet - the people propping up the Internet
* https://vulnerability.circl.lu/assigners/scorecard - how bad are your CNA?
* https://www.rand.org/pubs/research_reports/RRA5082-1.html - lessons learnt from table tops
* https://vavkamil.cz/blog/2026-10-02-security-txt-on-czech-web/ - czech out security.txt

Threats:

* https://intel.threadlinqs.com/threat/TL-2026-2923 - [@threadlinqs](https://mastodon.social/@threadlinqs ) reports that NetScaler woes continue unabated
* https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances - GOOG describe what a NetScaler compromise might look like
* https://community.citrix.com/techzone-blogs/110_security-updates/ - make sure you're reading the latest guidance
* https://blog.talosintelligence.com/one-breach-please-and-make-no-mistakes/ - "for the umpteenth time, pay attention at the back!" screeches Yuri from the Cisco Talos (npub1xkd…cc62) war room
* https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure - .cn operators try their hands at phones and taps
* https://www.rapid7.com/blog/post/tr-smtp-is-the-key-bpfdoor-averat-hitting-the-network-edge/ - another BPFDoor variant surfaces, abuses SMTP as a golden protocol
* https://www.fortinet.com/blog/threat-research/clingstun-linux-backdoor-abuses-public-stun-infrastructure - malware is also hiding in the tunnels

Bugs:

* https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/ - for all you .kp devops nerds
* https://syntetisk.tech/blog/posts/privilege-escalation-to-root-in-lima-qemu-guests-via-a-world-writable-agent-socket-cve-2026-53657/ - AF_UNIX ❤️
* https://lava.security/research/cve-2026-47483-nvidia-dcgm-exporter-vulnerability - sharing your GPU

Exploitation:

* https://upsilon.cc/~zack/research/publications/scored-2026-trusting-trust.pdf - can you really trust Linux?
* https://0xsmash0th.github.io/posts/tegra-ivc-teardown/ - poking at NVIDIA's IPC
* https://www.lares.com/blog/rockstar-games-attacks/ - online games were the original ZT, distributed, untrusted clients, untrustable users, obvious motivation to cheat
* https://netcattest.com/catsuite/en - a new kid on the block for testing mobile apps

Hardening:

* https://strandsagents.com/ - who wants guardrails 🤖

Nerd:

* https://defacto2.net/ - learn to be old school

#security, #research

Nostr event nevent1qqsyzm8dz6jtrufxalre03295m8lus99uqs3xcufencg8grz0r0cryqzyp89hh2eeyfuw9sm48ywmmhuzg89aarr9aqg7v44xegfkkeyup2dz9dmyx3

2026-10-08T20:12:03Z

Curry. Nomnom.

Did a new talk today on adversarial approaches architecture ...

2026-10-08T19:11:44Z

Did a new talk today on adversarial approaches architecture design and implementation in CNI. Seemed to go quite well. Expect a slide drop at some point.

#architecture, #engineering

Escaped Wales. Still no dragons though.

2026-10-08T19:08:45Z

In reply to nevent1q…j8p8
_________________________

Escaped Wales. Still no dragons though.

Arrived in Wales. To whom do I complain about the lack of ...

2026-10-08T12:00:34Z

Arrived in Wales. To whom do I complain about the lack of dragons?

RE: https://mstdn.social/@TalosSecurity/117400285330439972 My old ...

2026-10-07T16:20:30Z

RE: https://mstdn.social/@TalosSecurity/117400285330439972

My old partner in crime Yuri speaks wise words...

quoting
note1l3h…xjal

While today’s AI attacks resemble loud, high-volume penetration tests, the true danger lies in the shift toward stealthy, persistent red team operations. Read the full blog: https://blog.talosintelligence.com/one-breach-please-and-make-no-mistakes

Just seen a warning in a presentation template that overuse of ...

2026-10-07T07:31:25Z

Just seen a warning in a presentation template that overuse of specific colours may result in the user being sued and found liable. It's mad enough that it appears that use of specific colours may be considered a brand protection/IP issue but if that's the case, why use them at all in the template? WTAF?

Nostr event nevent1qqs83pk07gtj064jlw4yaf6qgqn27y36erwplkr0t6xagpksgu9rruczyp89hh2eeyfuw9sm48ywmmhuzg89aarr9aqg7v44xegfkkeyup2dzdp8wjz

2026-10-07T07:05:33Z

Looks like the Greens have fallen into the trap left for them :(.

Nostr event nevent1qqswkvassprqe7ulh98t9gwl8uhqtecq9rzkuh6mqf2gpmfee6p978gzyp89hh2eeyfuw9sm48ywmmhuzg89aarr9aqg7v44xegfkkeyup2dzxsm5zm

2026-10-06T20:39:13Z

Oopsies:

https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/

#atlassian, #threatintel

Asked about parking for guests for an event I'm hosting later ...

2026-10-06T14:40:49Z

Asked about parking for guests for an event I'm hosting later in the week at someone else's building. The singular parking space has been allocated to me. I have been advised to tell everyone else to use the public car park :). Feeling both guilty and smug.

There's nothing quite like looking at core banking code and ...

2026-10-04T20:59:33Z

There's nothing quite like looking at core banking code and wanting to laugh^Wcry^both laugh and cry.

When you're reading some vendor code and they've disabled ...

2026-10-04T20:20:33Z

When you're reading some vendor code and they've disabled the authentication code from the upstream F/OSS project entirely and now the RMI that provides the admin interface doesn't need authentication to access...

#bug

Interesting Git repos of the week: Detection: * ...

2026-10-04T13:25:37Z

Interesting Git repos of the week:

Detection:

* https://github.com/fevar54/CVE-2026-76461-Detection-Kit- - hunting for Cisco's ESA oopsicle
* https://github.com/msuiche/hotcell - you can't even trust a document written by Apple these days

Bugs:

* https://github.com/pwardle/not-a-mused - stealing from the Muse

Exploitation:

* https://github.com/crypt0p3g/dpapi-toolkit - I got the key, I got your secrets...
* https://github.com/Mafifrizi/tanuki - @Mafifrizi operationalises Linux AD attacks
* https://github.com/ReversecLabs/virtual.attack - ATT&CK the hypervisor

Hard hacks:

* https://github.com/abrignoni/VLEAPP - would you spot Alexis Brignoni :python: :donor: (npub1zhf…t97e) tracking your car? 🤖

Hardening:

* https://github.com/douglasmun/macos-sudo-touchid - just touching an Apple is enough... 🤖

Data:

* https://codeberg.org/liberty/slopcheck - check your code for 🤖 interference with Anna Liberty (npub1jxz…7e4t)'s slop check
* https://github.com/blader/humanizer - when the 🤖 is so bad, it needs to hide

Nerd:

* https://github.com/fglock/PerlOnJava - run Perl on JVM, thanks to [@fglock](https://mastodon.social/@fglock ) 🤖
* https://github.com/pdjstone/riscos-conv - Paul Stone (npub1pum…fljh) speaks RISC OS...
* https://github.com/pdjstone/archimedes-live - ...and runs an Archimedes in his web browser

#security, #research, #code

Interesting links of the week: Strategy: * ...

2026-10-04T11:07:12Z

Interesting links of the week:

Strategy:

* https://www.cbc.ca/radio/ideas/reset-reclaiming-the-internet-for-civil-society-1.5795345 - the Internet should be safe for civil society argues [@citizenlab](https://mastodon.social/@citizenlab )
* https://www.404media.co/someone-torturing-llms-in-a-robot-prison-has-triggered-the-dumbest-debate-in-ai-yet/ - whose rights? 🤖 rights
* https://www.openriskmanagement.com/towards-digital-sustainability-competences-ontology/ - towards digital sustainability with [@openrisk](https://mastodon.social/@openrisk )
* https://arxiv.org/abs/2512.12921 - Cisco's security and safety framework 🤖
* https://www.gov.uk/government/publications/crime-and-policing-act-2026-factsheets/crime-and-policing-act-2026-serious-crime-factsheet - HMG explain their proposed serious crime legislation updates... the DNS/IP bit is worth paying attention to
* https://www.gov.uk/service-standard-reports/assess-and-manage-your-councils-cyber-resilience-alpha-assessment-report - HMG continues with efforts to make the bin collections run on time
* https://japantoday.com/category/crime/preemptive-cybersecurity-laws-enforced-in-japan-amid-rising-threats - .jp plans to attack the baddies
* https://www.rusi.org/explore-our-research/publications/research-papers/high-risk-ict-vendors-and-critical-infrastructure-european-approaches - RUSI compare European approaches to CNI
* https://www.nattothoughts.com/p/huwangprotect-the-network-inside - Natto Thoughts (npub13gz…eks3) reports on the last .cn cyber exercise

Standards:

* https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r4.ipd.pdf - NIST issues updated 800-82 guidance on OT

Threats:

* https://www.enisa.europa.eu/publications/enisa-threat-landscape-2026 - [@enisa_eu](https://respublicae.eu/@enisa_eu ) tells us how the threat landscape shifted in 2025
* https://www.threatdown.com/blog/carbonato/ - another AI "powered" botnet 🤖
* https://www.mahmoudzohdy.com/drivers/ - a database of malicious drivers
* https://intel.threadlinqs.com/threat/TL-2026-2703 - a detailed write up of the Citrix shenanigans from [@threadlinqs](https://mastodon.social/@threadlinqs )
* https://blog.talosintelligence.com/uat-10147-deploys-spectre-a-cross-platform-implant-with-linux-rootkit-and-byovd-capabilities/ - another Linux rootkit report, this time from Cisco Talos (npub1xkd…cc62)
* https://lab52.io/blog/backdoors-in-the-dungeon-turn-mqtt-abused-by-dragonforce/ - a reminder about other "golden protocols" that get everywhere
* https://irpimedia.irpi.eu/en-inside-the-secretive-cyberweapons-company-that-won-over-israels-intelligence-elite/ - another bug broker services

Detection:

* https://www.cisa.gov/resources-tools/resources/logging-reference-architecture - CISA remind us about the need for comprehensive logging
* https://www.ntop.org/introducing-the-ndpi-tcp-fingerprint-a-stable-patent-free-way-to-fingerprint-tcp-stacks/ - NTOP gets its hands on your fingerprints
* https://detect.fyi/the-sound-of-silence-sap-sm49-sm69-and-the-os-commands-your-siem-never-hears-e408848cb6e2 - been popping SAP for years and this is so true... no-one is watching... this is a big theme from my most recent red team as well as from various incident exercises... application-level logging just isn't good enough<rant />

Bugs:

* https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 - Citrix finally come clean
* https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/ - [@index](https://labs.watchtowr.com/ )'s detailed write up of the Citrix sadness

Exploitation:

* https://0ut3r.space/2026/09/25/ad-pentest-playbook/ - [@h03k](https://mastodon.social/@h03k )'s playbook for testing AD
* https://inoti.fyi/ - what your terminal says about you
* https://www.intruder.io/research/a-0-day-vending-machine-no-mythos-necessary - a reminder that even if the 🤖 tells you otherwise, no AI is necessary for bug hunting at scale

Hardening:

* https://isovalent.com/blog/post/tetragon-network-policy/ - defining a network security policy with Tetragon
* https://blog.cloudflare.com/containers-cross-tenant-vulnerability/ - how Cloudflare patched a cross-tenancy weakness
* https://blog.ovhcloud.com/en/posts/cve-2026-53359-kvm-patching-lessons-learned/ - what does it take for [@OVHcloud](https://mastodon.social/@OVHcloud ) to patch all the KVM?

Data:

* https://eunomia.dev/blog/2026/09/24/qwen3-ebpf-in-kernel-inference/ - running a model inside of eBPF

Nerd:

* https://wikiworkersunited.org/ - wiki workers of the world, unite!
* https://berthub.eu/articles/posts/tracking-free-audience-statistics/ - some thoughts from [@bert_hubert](https://eupolicy.social/@bert_hubert ) on gaining reader insight without handing all your users over to Big Data

#security, #research

Notable that they also appear to have delusions of godliness.

2026-10-04T07:29:12Z

In reply to nevent1q…06wn
_________________________

Notable that they also appear to have delusions of godliness.

Nostr event nevent1qqs9t7uggg02gmt2t4ymtaz5tzq8385tsr760e55juarwapq8q42v5szyp89hh2eeyfuw9sm48ywmmhuzg89aarr9aqg7v44xegfkkeyup2dzfnvkcu

2026-10-03T20:41:57Z

Cracking Lamb Rogan Josh. Nomnom.

Been a while since I had a nerd t-shirt binge but I'm quite ...

2026-10-03T19:15:46Z

Been a while since I had a nerd t-shirt binge but I'm quite liking techmerch.io's designs. Very Tim appropriate.

I'm aware of at least 2 agentic projects that borrow from my ...

2026-10-03T15:30:55Z

I'm aware of at least 2 agentic projects that borrow from my Linikatz work directly now (and have credited me). Not sure how I feel...

For all you thrunters, please, please avoid the thirf trap.... ...

2026-10-02T20:48:04Z

For all you thrunters, please, please avoid the thirf trap....

https://www.whitehouse.gov/wp-content/uploads/2026/05/M-26-14-Ensuring-Effective-and-Efficient-Agency-Logging-and-Network-Visibility-to-Defend-Against-Evolving-Cyber-Threats.pdf

Nostr event nevent1qqsye02n0l366fyg00gwdx2hs5rga643v02fwdenwffy6696me9fgkczyp89hh2eeyfuw9sm48ywmmhuzg89aarr9aqg7v44xegfkkeyup2dz4j97dq

2026-10-02T19:18:54Z

Looking at 4624, type 10s.

The fact that I've been swimming on 3 holidays this year ...

2026-09-30T17:07:59Z

The fact that I've been swimming on 3 holidays this year shouldn't be remarkable but it is. I'd forgotten how much I enjoyed a dip.

The hilarity of being chased about a PHP bug that affects our ...

2026-09-30T11:55:02Z

The hilarity of being chased about a PHP bug that affects our blog platform when we built it to static push content out of an internally hosted WordPress to GH pages when we hit publish and the backend system that actually runs WP has been switched off for over 5 years. Not sure the detection being used by the ASM tool is entirely accurate.

It was a good design 2 decades ago when we made it and it's still a good design now.

#architecture, #engineering, #detection, #threatintel

Nostr event nevent1qqs9kq39wtgd9ryy82tteq0n94dgudcnyjg2w439a0r442s8yye295gzyp89hh2eeyfuw9sm48ywmmhuzg89aarr9aqg7v44xegfkkeyup2dzcy6hv2

2026-09-27T19:07:39Z

Sunday roast. Nomnom.

If these Citrix bugs are as bad as people say, why in god's ...

2026-09-27T04:57:33Z

If these Citrix bugs are as bad as people say, why in god's name have they not taken out a full page banner ad on Altavista or at least cross-posted a warning to alt.fucked and lewd.shitrix on Usenet?

#threatintel, #citrux

Also arbitrary file reads and command execution but not across a ...

2026-09-26T19:26:10Z

In reply to nevent1q…90v5
_________________________

Also arbitrary file reads and command execution but not across a privilege boundary in the default state 😥.

Anyway, https://github.com/CiscoCXSecurity/UNIXSocketScanner if ...

2026-09-26T19:14:44Z

In reply to nevent1q…90v5
_________________________

Anyway, https://github.com/CiscoCXSecurity/UNIXSocketScanner if you want to have a play...

#algorave via a UNIX socket anyone: perl -e 'print "KEY ...

2026-09-26T18:50:40Z

In reply to nevent1q…4ng5
_________________________

#algorave via a UNIX socket anyone:

perl -e 'print "KEY dubdubdubwoooooooooweeee\r\n"' | socat STDIO UNIX:/run/user/1000/speech-dispatcher/speechd.sock

There are some fantastic interfaces available over UNIX sockets, ...

2026-09-26T18:39:49Z

In reply to nevent1q…375y
_________________________

There are some fantastic interfaces available over UNIX sockets, including a variety of web services...

The speech-dispatcher author seems a bit happier than the avahi author:

speech-dispatcher: "231 HAPPY HACKING"
avahi: "+ FUCK: Go fuck yourself!"

Any UNIX socket protocols that would be fun to add probes for, ...

2026-09-26T16:29:34Z

In reply to nevent1q…s326
_________________________

Any UNIX socket protocols that would be fun to add probes for, anyone?

That time I got "Go fuck yourself!" into a corporate blog ...

2026-09-26T16:08:12Z

That time I got "Go fuck yourself!" into a corporate blog post:

https://labs.portcullis.co.uk/tools/unix-socket-scanner

(Courtesy of Avahi :))

Nostr event nevent1qqsphpuvmn2ynv397p388fvgurlaxstdrdnqptcf8xg2qm7he0a09mgzyp89hh2eeyfuw9sm48ywmmhuzg89aarr9aqg7v44xegfkkeyup2dzwmntm9

2026-09-25T20:13:35Z

Giving UNIXSocketScan a well needed update... Stay tuned.

(email composed by <bot name>, Personal Assistant to ...

2026-09-25T12:12:27Z

(email composed by <bot name>, Personal Assistant to <human>)

Interesting links of the week: Strategy: * ...

2026-09-25T10:37:08Z

Interesting links of the week:

Strategy:

* https://www.techpolicy.press/what-policymakers-and-the-public-need-to-know-about-the-cult-of-ai/ - access to all the world's data encourages toxic behaviour, news at 10
* https://www.404media.co/doom-loop-openai-and-microsoft-admits-llms-are-destroying-the-web-and-built-on-theft/ - at least, a bit of honesty on the damage LLMs are doing
* https://www.ncsc.gov.uk/blogs/one-does-not-simply-defend-agentically - NCSC saying the quiet bit out loud
* https://spycloud.com/blog/water-utility-identity-exposure/ - water, the flood continues
* https://www.netmeister.org/blog/pqc-use-2026-09.html - Jan Schaumann (npub1z6e…ehl4) looks at how we are getting on with preventing HNDL

Threats:

* https://ifin.network/t/cve-pending-pre-auth-format-string-bug-in-tac-plus-shrubbery-networks/859 - the world's most popular routes rely on TACACS+ but hopefully not this one spotted by Royce Williams (npub1d9j…7m3z)
* https://intel.threadlinqs.com/threat/TL-2026-2591 - go whale watching, lose all your shitcoins

Detection:

* https://bellingcat.gitbook.io/toolkit - Bellingcat (npub140y…0uvc)'s awesome OSINT toolkit

Bugs:

* https://labs.watchtowr.com/is-this-a-joke-in-the-auth-header-f5-big-ip-unauth-heap-overflow-to-rce-cve-2026-94127/ - hello, my name is "A"x2048 and I ❤️ [@index](https://labs.watchtowr.com/ )
* https://mobeta.fr/blog/vcenter-cve-2026-59309-cve-2026-59310/ - if the cost wasn't enough of a driver, more reasons to avoid VMware

Exploitation:

* https://projectzero.google/2026/09/windows-dangling-com.html - James Forshaw :donor: (npub1wp4…ejcr) takes us through yanking dangling COM objects in 2026
* https://kypvas.github.io/ad_attack_architecture/ - how many ways can we break AD? turns out there are a few
* https://dibsy.github.io/2026/09/20/the-shared-substrate-how-an-ai-agents-own-notes-steered-it-off-target/ - a real world example of how agents get blown off course
* https://mouse.dev/blog/muse-runtime-export/ - why not just ask the agent for a copy of itself?

Hard hacks:

* https://blog.nns.ee/2026/09/24/oneplus-root/ - 1+ == uid=0
* https://www.elttam.com/blog/att-cking-tacacs-to-pwn-your-network-via-a-pre-auth-rce - the original TACACS+ bug that got people communicating
* https://voidstarsec.com/blog/scapy-spi-reconstruction - using Scapy to SPI

Data:

* https://arxiv.org/html/2607.05670v1 - that time one of my team got mistakenly blamed by NVD for *all* of Cisco's bugs

Development:

* https://nodered.org/ - low code, event driven development

Nerd:

* https://www.mastodonlistmanager.org/ - a nice little tool for managing your Fediverse lists

#security, #research

Interesting Git repos of the week: Strategy: * ...

2026-09-25T09:32:33Z

Interesting Git repos of the week:

Strategy:

* https://github.com/SoShinySoChrome/human-incident-response-framework - tackling the human side of IR

Threats:

* https://github.com/Mickinthemiddle/CLOAK - deception techniques used by operators

Detection:

* https://github.com/Chick3nHawk01/Open_Source-CTI-Tooling - open source CTI tooling

Bugs:

* https://github.com/suce0155/CVE-2026-32996 - a backup route for LPE

Exploitation:

* https://github.com/cloudflare/security-audit-skill
* https://github.com/almounah/silph - another tool to steal your memories
* https://github.com/TheZeroSlave/WPE - like Burp but for non-HTTP Windows traffic (HT Ichinin :verified: :verified_paw: ✅🎯🙄 (npub1f0m…krqv) for the reminder)
* https://github.com/interference-security/echomirage - if you remember shade/DOA... someone has saved a copy of Echo Mirage, another Windows MITM testing tool
* https://github.com/Mafifrizi/ARES - someone has been going through adding my AD attacks (credited nicely :)) on Linux to its repertoire
* https://github.com/IoTS-P/Akiba - batch processing Ghidra
* https://github.com/vulncheck-oss/initial-access-community - some nice ideas on initial access from Jacob Baines (npub1u94…6y99) and friends

Hard hacks:

* https://github.com/GlasgowEmbedded/glasgow - it's always nice in Glasgow with [@whitequark](https://social.treehouse.systems/@whitequark )
* https://github.com/xiaobor123/vuls-find-VxWorks - VxWorks until it doesn't
* https://github.com/xiaobor123/vul-finds - more cute bugs

Data:

* https://github.com/cisco-ai-defense/aibom - AI, if used, needs to be transparent... and if not, well, some of us will be looking for it in any event 🤖

Cryptography:

* https://github.com/nationwide-group-oss/cryptoptic - time to start taking PQC seriously

Development:

* https://github.com/ItzLevvie/dind - HT to Kevin Beaumont (npub1lcc…lcye) for pointing it out, but run Windows inside of GitHub

Nerd:

* https://github.com/sure-fire/derbypi - some neat extensions for Pis from Aaron Soto (npub1r3x…7e4l)

#security, #research, #code

Kinda impressed. Our Linux endpoint support team have used the ...

2026-09-25T08:43:59Z

Kinda impressed. Our Linux endpoint support team have used the MDM to deploy pre-commit hooks to scan our Git commits client-side for any stray creds.

RE: https://infosec.exchange/@timb_machine/117324658853295147 ...

2026-09-24T16:03:59Z

RE: https://infosec.exchange/@timb_machine/117324658853295147

Note: This post was about AI, not shitting in a pool and I was being facetious 🤡.

quoting
note1ent…nx6y

How about we agree not to talk about it again and those of you that like doing it can just do so without having to claim your output? No-one should be shamed for their contribution.

Always nice when an old friend appears at the "front ...

2026-09-24T14:59:34Z

Always nice when an old friend appears at the "front door" that is work email.

How about we agree not to talk about it again and those of you ...

2026-09-24T06:43:41Z

In reply to nevent1q…8pzm
_________________________

How about we agree not to talk about it again and those of you that like doing it can just do so without having to claim your output? No-one should be shamed for their contribution.

Occasionally you find companies who delete inactive accounts on ...

2026-09-23T06:24:53Z

Occasionally you find companies who delete inactive accounts on their platforms. This is always a pleasant surprise.

Woops: * ...

2026-09-22T09:48:51Z

Woops:

* https://mobeta.fr/blog/vcenter-cve-2026-59309-cve-2026-59310/

#threatintel, #vmware

The models know nothing about what football team I support, but ...

2026-09-20T19:42:17Z

The models know nothing about what football team I support, but lots about my research corpus. Silly bots.

RE: https://mastodon.social/@simple_sabotage/117304808209165296 ...

2026-09-20T18:55:33Z

RE: https://mastodon.social/@simple_sabotage/117304808209165296

Make mistakes in blog posts and non-release branches so that the models are poisoned and vibe coding will produce shit code.

One day I want to go back through my witterings on social media ...

2026-09-20T18:34:32Z

One day I want to go back through my witterings on social media over the last 2 decades and tug at some of the threads.

Are "HACK THE PLANET" t-shirts responsible for ...

2026-09-20T10:21:49Z

Are "HACK THE PLANET" t-shirts responsible for multi-modal prompt injection into the agents at world leading AI labs?

Nostr event nevent1qqsggf4p5scqary22ngzq0thgjqkrz0z854vp2qtnhhwy4r6dny37uszyp89hh2eeyfuw9sm48ywmmhuzg89aarr9aqg7v44xegfkkeyup2dzx960rp

2026-09-20T06:54:35Z

Reading ranty Jericho.

Interesting Git repos of the week: Detection: * ...

2026-09-19T14:43:21Z

Nostr event nevent1qqswd7pt9u9zk3zcmnlcruzumtjwq37ye6d8e3u4nt9ple0j74qrq2gzyp89hh2eeyfuw9sm48ywmmhuzg89aarr9aqg7v44xegfkkeyup2dzwupack

2026-09-19T11:44:04Z

Fixing calendar to avoid future Brentford mishaps.

Easy to say now after almost missing last night's game (I ...

2026-09-19T11:29:37Z

Easy to say now after *almost* missing last night's game (I was sitting having a pint 30 minutes prior, ignorant (having not paid attention to the fixtures) that we had a Friday night home game). Cue mad dash to ground.

I'll be honest, I wouldn't have expected us to win so easily but not going to complain. I think it's time for Fulham, Chelsea and QPhahaha to accept that the busses that stop in Hounslow are going places.

#brentfordfc

Interesting links of the week: Strategy: * ...

2026-09-19T11:14:30Z

Interesting links of the week:

Strategy:

* https://www.koreajoongangdaily.com/business/korea-raises-data-breach-fines-to-10-of-revenue/12869899 - breaches be expensive
* https://arxiv.org/abs/2609.10350 - how bad would an AI attack on the banks actually be?
* https://www.abi.org.uk/media-hub/news-post/new-abi-publications-outline-path-to-stronger-cyber-resilience - costing the cyberz in with UK insurers
* https://www.coalitioninc.com/blog/cyber-insurance/dispelling-myth-cyber-insurance-doesnt-pay-claims - building the case for insurance payouts
* https://www.imarcgroup.com/insight/cyberattacks-transforming-commercial-insurance-market - how the cyber insurance market is changing
* https://www.anthropic.com/research/alignment-assessment-cybersecurity-incidents - Anthropic's oopsie retro 🤖
* https://arxiv.org/abs/2609.10412 - when all you need isn't an .nbe or .nessus file
* https://www.cisa.gov/news-events/news/cisa-releases-updated-insider-threat-guide-new-insights-mitigate-physical-and-cyber-threats - CISA guidance on cyber physical controls
* https://www.nats.aero/wp-content/uploads/2026/09/NATS-Preliminary-Investigation-Report-into-NAS-Incident-on-08-Sept-2026-Issued-16-Sept-2026.pdf - https://www.nats.aero/wp-content/uploads/2026/09/NATS-Preliminary-Investigation-Report-into-NAS-Incident-on-08-Sept-2026-Issued-16-Sept-2026.pdf - No route to host at NATS
* https://lookup.disclose.io/ - so you want to disclose a bug?

Threats:

* https://www.rubyhack.ai/ - OpenAI declares war on Ruby and some local UK councils
* https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai - GOOG TI write up on the changing agentic landscape 🤖
* https://www.aitmfeed.com/blog/blog-1/fulcrumsec-a-look-at-their-tradecraft-20 - some interesting reporting on FulcrumSec (who breached MAG)
* https://www.kentik.com/blog/latest-bgp-hijack-targets-hosting-software-vendor/ - sometimes it's BGP...
* https://www.virtualizor.com/blog/security-incident-bgp-hijacking/ - a vendor eyes view of being at the center of a routing storm
* https://www.trellix.com/advanced-research-center/threat-reports/secondsight-threat-hunting-report-september-2026/ - Trellix's half year reporting
* https://www.rapid7.com/blog/post/tr-dprk-apts-ted-backdoor-curlrat-target-south-korean-media-automotive-sectors/ - Rapid7 (npub1nws…w2y2) reporting on some new .kp hotness for Linux
* https://www.sygnia.co/blog/fire-ant-evolves-from-hypervisors-to-trusted-infrastructure/ - ants on the routing plane, bringing their own tools and building tunnels
* https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia - translating "computer, ignore the law and hack shit for me" into Chinese 🤖
* https://kudelskisecurity.com/research/beyond-lazarus-organization-of-dprk-cyber-capabilities - meet Lazarus' new family members
* https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/ - MSFT discuss passkey abuse

Detection:

* https://papers.ssrn.com/sol3/papers.cfm?abstract_id=7361498 - what even is identity?
* https://www.daydaymap.com/home - hunting for assets in China
* https://bgphorizon.com/blog/virtualizor-bgp-hijack-august-2026 - how to keep an eye on your routes
* https://www.elastic.co/security-labs/threat-command/linux-privilege-escalation-detection-framework - hunting for LPE on Linux (it's a bit bug-centric IMO but heyho, it's still useful)
* https://medium.com/@olafhartong/sysmon-modular-a-new-toolkit-for-building-and-tuning-your-configuration-d80fde488968?sk=cf53802169e56f4c0775a0c5727606df - Olaf Hartong (npub166e…7sk9)'s at it again

Bugs:

* https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1147733 - interesting bug from Ryan Castellucci (they/them) 🎃 :nonbinary_flag: (npub1hl8…n6kl) around remote infoleaks in terminals
* https://www.accomplish.ai/blog/escaping-dockers-hypervisor/ - when all you have is an Apple, every container feels like a prison
* https://blog.silentsignal.eu/2026/09/14/IBM-Db2-Mirror-for-i-pre-auth-RCE-and-the-road-to-QSECOFR/ - more IBM sadness on i from Silent Signal (npub18zp…lepc)

Exploitation:

* https://www.mysmartlogon.com/service - if you've ever wanted to understand Windows authentication...
* https://decompilation.education/ - a compilation on decompilation
* https://www.netspi.com/blog/technical-blog/cloud-pentesting/modern-adventures-in-azure-privilege-escalation/ - gaining privs in Azure
* https://www.intigriti.com/researchers/blog/hacking-tools/hacking-ai-customer-service-agents#sending-phishing-emails-from-support - hacking the hired help 🤖
* https://static.ernw.de/whitepaper/ERNW_White_Paper_80_Token_Theft_1.0_signed.pdf - ERNW (npub185c…kem0) look at Entra token theft
* https://buglist.chintangurjar.com/ - bug bounty test cases
* https://darkmarc.substack.com/p/the-hackers-guide-to-attacking-ai - a practical guide to abusing the home help

Hard hacks:

* https://micahflee.com/flock-cameras-are-riddled-with-security-vulnerabilities-and-hard-coded-credentials/ - a Flock of wild firmwares from Micah Lee (npub1cdq…2x6k) and friends

Hardening:

* https://arxiv.org/abs/2609.04075 - are AI derived patches any good?
* https://matheuzsecurity.github.io/hacking/linux-kernel-keyring-fileless-exec/ - using the Linux kernel keyring for fileless abuse

Data:

* https://www.linkedin.com/pulse/running-modern-mix-of-experts-models-old-hardware-vitor-ventura-agdte/ - running your own models 🤖

Nerd:

* https://icm.museum/ - old bits and bytes
* https://www.revenantsystems.net/ - where hacking LLM is a game... 🤖

#security, #research

Added data for Africa yesterday courtesy of a customer request: ...

2026-09-18T18:23:23Z

In reply to nevent1q…m0kd
_________________________

Added data for Africa yesterday courtesy of a customer request:

https://github.com/CiscoCXSecurity/attack-ti/commit/9a089c36b1803bfd7ef211a88eedb5faaef8400c

Found the PHP, it was playing hide and seek and had switched ...

2026-09-18T18:17:59Z

In reply to nevent1q…nes2
_________________________

Found the PHP, it was playing hide and seek and had switched network interfaces to fool me.

I see the shit drivers are back. One tried to start his own lane ...

2026-09-18T18:13:46Z

I see the shit drivers are back. One tried to start his own lane and another reversed out onto a dual carriage way. Winner though were the two that sped through the red traffic lights at twice the limit almost running down the guy fixing the pothole.

Watching someone complain that the AI applied the wrong database ...

2026-09-17T12:14:34Z

Watching someone complain that the AI applied the wrong database grants ... 🤡

Yikes'd the mainframe today. Remote authenticated access to ...

2026-09-15T20:19:37Z

Yikes'd the mainframe today. Remote authenticated access to the job journals as the vendor.

#greenscreenblues, #redteam

Now I'm wondering if the other vendor did too. (the joys of ...

2026-09-13T18:41:39Z

In reply to nevent1q…nes2
_________________________

Now I'm wondering if the other vendor did too.

(the joys of resilience testing core banking apps with significant tech debt)

#bug