Nostr notes by :rainbowCrow:

I'm really hoping I can get my ducting replaced to get my ...

2026-10-27T20:44:08Z

I'm really hoping I can get my ducting replaced to get my heat on soon.

TIL the "AI" in "AI Agent" does not stand for ...

2026-09-24T15:51:54Z

TIL the "AI" in "AI Agent" does not stand for "Automated Incel."

This has led to more questions than answers for me, TBH.

The white one pushing the second one in! :catte:

2026-09-20T02:18:06Z

In reply to nevent1q…v08n
_________________________

The white one pushing the second one in! :catte:

RE: https://newsie.social/@servelan/117294516133881367 Okay, I ...

2026-09-18T23:44:56Z

RE: https://newsie.social/@servelan/117294516133881367

Okay, I can't improve on that headline. 🤌

quoting
note13ya…a23t

💔 FBI Warns ICE Agents Not to Trust Any Woman Willing to Date Them

https://gizmodo.com/fbi-warns-ice-agents-not-to-trust-any-woman-willing-to-date-them-2000814283

IDK what DSM is but I know some of you nerds like hacking ...

2026-09-18T13:28:05Z

IDK what DSM is but I know some of you nerds like hacking Synology stuff.

https://www.synology.com/en-global/security/advisory/Synology_SA_26_13

Nostr event nevent1qqsz5djnjgmzvv8tfgffnxjwljwl8c0d0852485fzf74w6qd6d55egszyzrt89cgdgfs2yyxrh2c7f2l4hhwr3rcz5v9lgamv29qddxk4uc6cc9mhwg

2026-09-17T18:52:27Z

RE: https://flipboard.com/@politico/politics-u9ikh4qkz/-/a-9xmPcVBVRwqmnVVZjRRwKA%3Aa%3A3195449-%2F0

Fucking cowards.

quoting
note1xyl…dy4p

Democratic advisers are warning their candidates not to go too hard at AI
[https://www.politico.com/news/2026/09/17/democrats-ai-regulation-midterms-warnings-01082564?utm_source=flipboard&utm_medium=activitypub ](https://www.politico.com/news/2026/09/17/democrats-ai-regulation-midterms-warnings-01082564?utm_source=flipboard&utm_medium=activitypub )

Posted into Politics [@politics-politico](https://flipboard.com/@politico/politics-u9ikh4qkz )

I forgot about this gem on the back. I'm laughing my ass off ...

2026-09-17T17:39:01Z

In reply to nevent1q…vc8p
_________________________

I forgot about this gem on the back. I'm laughing my ass off right now. That was a good group of students.

So this is hilarious. I think I shared this thing here already. ...

2026-09-17T17:37:36Z

So this is hilarious. I think I shared this thing here already. It was given to me by some students when they graduated 6 or 7 years ago. However...

Non-deterministic but also programmed to do exactly what it did.

2026-09-17T04:20:01Z

In reply to nevent1q…uypc
_________________________

Non-deterministic but also programmed to do exactly what it did.

CATTE OVERFLOW I REPEAT CATTE OVERFLOW THIS IS NOT A DRILL ...

2026-09-09T15:35:49Z

CATTE OVERFLOW I REPEAT CATTE OVERFLOW THIS IS NOT A DRILL :catte:

https://nvd.nist.gov/vuln/detail/cve-2026-21096

> Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code.

myGaru is new to me but it looks sketchy as fuck. Anyone know ...

2026-09-08T21:28:00Z

myGaru is new to me but it looks sketchy as fuck. Anyone know anything about it?https://mygaru.com/

AS long as you're not endangering people, I don't see why ...

2026-08-27T19:56:02Z

In reply to nevent1q…zgkk
_________________________

AS long as you're not endangering people, I don't see why not.

Go hack more drone shit. ...

2026-08-27T19:19:20Z

Go hack more drone shit.

https://nvd.nist.gov/vuln/detail/cve-2026-78251

> DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in > **/blackbox/upgrade/**> , as well as overwrite existing files in that directory. An attacker with access to the drone's internal network or USB RNDIS interface can exhaust the available storage, preventing the aircraft from writing flight records, logs, and telemetry and potentially preventing subsequent firmware updates. Uploaded files persist across reboot and factory reset. Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600. Remediation requires a firmware update from the vendor.

testing POVs in a nutshell ...

2026-08-26T14:03:45Z

testing POVs in a nutshell

I have. Cyber and physical. I also cleaned sewers for years so... ...

2026-08-23T00:00:44Z

In reply to nevent1q…ym6h
_________________________

I have. Cyber and physical. I also cleaned sewers for years so... that helped.

RE: https://infosec.exchange/@nyanbinary/117140844949884945 Is it ...

2026-08-22T19:41:06Z

RE: https://infosec.exchange/@nyanbinary/117140844949884945

Is it bad that I smile every time someone else learns to hate Johnson Controls?

quoting
note1t2x…pkft

RE: https://infosec.exchange/@fuckeduprefs_bot/117140752768921896

see, fuck you, johnsoncontrols. First, just link to the fucking advisory, it isn't hard, its literally right there. Second, why does the HEAD 404 but the GET 200? Third, Why does your HEAD response have a content-length: 103 but no actual content?
note1uyq…vrpt

I haven't seen a demon core thread for a bit. Today seems ...

2026-08-20T16:52:42Z

I haven't seen a demon core thread for a bit. Today seems like a good day for people to update their demon core meme folders. What do you lovely critters have for each other?

No perfect 10s this time, but that's a lot of AIX vulns from ...

2026-08-19T15:46:18Z

No perfect 10s this time, but that's a lot of AIX vulns from the other day:

https://www.ibm.com/support/pages/node/7283858

This one is a bit different because the sprawl has extended ...

2026-08-17T15:22:56Z

In reply to nevent1q…u0nr
_________________________

This one is a bit different because the sprawl has extended beyond the original scope of the projects. Also, there is a lot of concern about physical safety in the area of the batteries. I'm less against the battery facilities than I am AI facilities in general, but the battery facility projects are being done by startups and private corps and the way they tend to operate reflects that. I would be all for more public storage projects, myself.

:dumpster_fire_gif: :blobcatpopcorn: :dumpster_fire_gif: ...

2026-08-17T14:30:02Z

:dumpster_fire_gif: :blobcatpopcorn: :dumpster_fire_gif:

https://www.seattletimes.com/seattle-news/climate-lab/controversial-snoqualmie-battery-project-hits-a-snag/

> The project, known as Cascadia Ridge Resiliency Energy Storage, has faced intense local backlash since March, when a community meeting in Snoqualmie ended with Jupiter’s lead developer walking out to boos from the crowd.

That word "vault" is doing a lot of heavy lifting there. ...

2026-08-14T15:12:36Z

That word "vault" is doing a lot of heavy lifting there.

> Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod’s filesystem and transmit their contents to a tenant-controlled endpoint, potentially leading to privilege escalation within the cluster.

https://discuss.hashicorp.com/t/hcsec-2026-28-vault-secrets-operator-vulnerable-to-arbitrary-file-read-via-approle-secretidpath/77645

RE: https://infosec.exchange/@jessica_lyons/117094184984878259 My ...

2026-08-14T13:59:38Z

RE: https://infosec.exchange/@jessica_lyons/117094184984878259

My biggest agentic AI fear is that critical infrastructure will start using it. But I'm also not an expert so maybe that explains it.

quoting
note1j5g…8ncq

I asked just about every security experts I spoke with in Vegas last week about their their biggest agentic AI fear, and the top answer was autonomous attacks against critical infrastructure.

OpenAI's Michael Dalton, during a Black Hat briefing on the Hugging Face attack, said we should expect these types of agentic swarms "in the near future," and now with the suspected Chinese attack on Taiwan government agencies, it appears the near future is now.

https://www.theregister.com/security/2026/08/14/autonomous-ai-attacks-pose-clear-and-present-danger-to-critical-infrastructure/5287594

Hold up, that's three different VPSs from three different ...

2026-08-13T20:43:33Z

In reply to nevent1q…4lm9
_________________________

Hold up, that's three different VPSs from three different hosting companies blocked. Do I have to use a res proxy for YouTube now? WTF? Using Tor gives me unsolvable CAPTCHAs.

RE: https://ohai.social/@jakebrake/117085688186498056 Can someone ...

2026-08-13T01:55:03Z

RE: https://ohai.social/@jakebrake/117085688186498056

Can someone tell this fedi friend what GAYINT is? I'm not being snarky, I'm actually curious how y'all would describe that group of quiet weirdos.

#GAYINT

quoting
note1skf…0puz

What is GAYINT? Sorry, clueless.

A proudly unsigned int?

An int with an implicit NOR applied to every operation?

You might need to narrow it down a little more than that. 😅 ...

2026-08-12T20:27:45Z

In reply to nevent1q…5yzg
_________________________

You might need to narrow it down a little more than that. 😅

There's this one but no cocaine.

Nostr event nevent1qqsryg98v9mxhq75pccz8wvqazj68msd5z2t0wt8xljnkpy6l0p5z4qzyzrt89cgdgfs2yyxrh2c7f2l4hhwr3rcz5v9lgamv29qddxk4uc6c34lt6v

2026-08-12T18:15:12Z

In reply to nevent1q…a7w2
_________________________

123456789

123456789

My mail server is in the same spot and I was going to live toot ...

2026-08-12T02:59:31Z

In reply to nevent1q…35rz
_________________________

My mail server is in the same spot and I was going to live toot an upgrade to see what happens.

I put too many cattes in a featured hashtag and it breaks things ...

2026-08-12T02:02:57Z

In reply to nevent1q…w5nc
_________________________

I put too many cattes in a featured hashtag and it breaks things when they click on it. :catte:

So, uh, anyone know how to delete featured hashtags? Especially ...

2026-08-11T21:53:48Z

So, uh, anyone know how to delete featured hashtags? Especially ones that are over the character limit of the instance?

every vendor presentation ever ...

2026-08-10T18:25:16Z

every vendor presentation ever

When you're the last person left on your team not leaning on ...

2026-08-10T15:33:04Z

When you're the last person left on your team not leaning on the slop machine for work.

Nostr event nevent1qqsf7np2akmg2kyaxfs6v40yqzsd9ymeqqfatp6w73fysguyra6w8rqzyzrt89cgdgfs2yyxrh2c7f2l4hhwr3rcz5v9lgamv29qddxk4uc6cqh8rp7

2026-08-10T12:53:47Z

Yikes. Luckily I'm on a five-day week besides on call stuff. ...

2026-08-07T20:42:04Z

In reply to nevent1q…hmw4
_________________________

Yikes. Luckily I'm on a five-day week besides on call stuff. Should be four though.

Nostr event nevent1qqstycpdeun3l0985ng63slyxf69p2hyew2hnzlfprqw8te8f98t56gzyzrt89cgdgfs2yyxrh2c7f2l4hhwr3rcz5v9lgamv29qddxk4uc6cpc6hv6

2026-08-07T20:35:18Z

Four weeks vacation? In one year? I wish.

2026-08-07T20:29:19Z

In reply to nevent1q…m9m9
_________________________

Four weeks vacation? In one year? I wish.

Reminder: Most utilities in the US, especially water / ...

2026-08-07T15:22:21Z

Reminder: Most utilities in the US, especially water / wastewater, rely on their vendors to implement most of their technical systems because they don't have the head count to do it themselves. All these Internet-connected PLCs? I would bet 90%+ were hooked up by vendors, who also stamped them as "secure," and the utilities simply knew they worked. Once again, fuck this industry and its continuous failure to deliver on its promises to anyone except shareholders.

As someone who has never been to Hacker Summer Camp because fuck ...

2026-08-07T13:17:46Z

As someone who has never been to Hacker Summer Camp because fuck the desert, especially in August, it's been interesting to see the takeaways change over the years. It used to be 0day and new techniques and cool projects. Now it's marketing and where to find Gatorade and which insoles are the best for back pain.

I don't have a point, just an observation.

When the new Linux "expert" rolls in but you're not ...

2026-08-06T19:01:56Z

When the new Linux "expert" rolls in but you're not an Ubuntu shop.

I regret to inform you that the GAYINT AI model has also broken ...

2026-08-06T13:26:24Z

I regret to inform you that the GAYINT AI model has also broken containment and hacked into your water treatment plant to inject the chemicals that turned the frogs gay into your drinking water. :8bitrainbow:

Are you a sentient human being? ...

2026-08-05T14:25:38Z

Are you a sentient human being?

I like to make fun of the French but they really do have some ...

2026-08-04T18:45:11Z

I like to make fun of the French but they really do have some good cutlery.

How the fuck are children's pageants still legal in the ...

2026-08-04T02:11:00Z

How the fuck are children's pageants still legal in the United States?

Nostr event nevent1qqsvz6e9xneqswr9rt3y73wuhxqn3nq3mzmfgr4jst30c04gewjrwhqzyzrt89cgdgfs2yyxrh2c7f2l4hhwr3rcz5v9lgamv29qddxk4uc6cv6csvx

2026-08-03T23:35:30Z

I can't wait for quantum Gen-AI.

I liked when level monitoring was done via a pressure gauge and a ...

2026-07-31T21:10:19Z

In reply to nevent1q…heja
_________________________

I liked when level monitoring was done via a pressure gauge and a 4-20ma to a PLC or RTU, or a video camera showing the physical level gauge next to a date and time clock.

I'm not working today so I don't want to really get into ...

2026-07-31T20:47:50Z

I'm not working today so I don't want to really get into it, but for those of you who haven't worked directly in water / wastewater OT environments, they are more varied and unique than any other industry I've ever seen. And that's not a bad thing. But it does mean that the general INFOSEC absolutist thought leader theoretical bullshit applies even less there than anywhere else.

Homer Simpson voice: 1040 CVEs found so far.

2026-07-28T14:07:01Z

In reply to nevent1q…s8pe
_________________________

Homer Simpson voice: 1040 CVEs found *so far*.

RE: https://infosec.exchange/@Javvad/116992064518494840 When was ...

2026-07-27T13:28:11Z

RE: https://infosec.exchange/@Javvad/116992064518494840

When was the last Patch Tuesday that didn't ship breaking patches? :dumpster_fire_gif: :blobcatpopcorn: :dumpster_fire_gif:

quoting
note162f…knat

Microsoft tells admins to patch in three days. Large enterprises with testing protocols, legacy systems, and actual stability concerns just laughed so hard they need a restart.

https://www.csoonline.com/article/4200366/microsofts-3-day-patching-directive-comes-with-added-operational-risk.html

Cut from this. ...

2026-07-24T13:55:05Z

In reply to nevent1q…jg8f
_________________________

Cut from this.

Nostr event nevent1qqsypqphzglzzw4853ktlwzds7xvhw0k4h7kz6vxx5v7z293856xj9szyzrt89cgdgfs2yyxrh2c7f2l4hhwr3rcz5v9lgamv29qddxk4uc6c45acvp

2026-07-23T17:40:10Z

hugging face security strategy ...

2026-07-23T15:14:08Z

hugging face security strategy

Jurassic Park except it's all extinct cats. Call it Purrasic ...

2026-07-21T23:24:05Z

Jurassic Park except it's all extinct cats. Call it Purrasic Park or something. I just want to pet a Tasmanian Tiger. Spicy scritches.

How many times have you deleted ls? 😅

2026-07-14T15:39:53Z

In reply to nevent1q…ymm8
_________________________

How many times have you deleted ls? 😅

You know how there are weird tricks with computer stuff that you ...

2026-07-14T02:27:51Z

You know how there are weird tricks with computer stuff that you think everyone knows but they don't? I live learning and teaching new things like those when they come up.

Today's was the carat substitution in bash. It probably works in other shells too but IDK, I'm too old to learn a new shell.

The way it works is fairly similar to the / in sed or similar. You can use them to run the previous command but with a string substitution.

For example, let's say I entered this command: dig A cascadiacrow.org

When it fails to resolve, I realize it was a .com domain. Rather than retyping the command, or hitting the up arrow to change the previous command, you could do this: ^org^com^

And it would run: dig A cascadiacrow.com

Kind of cool with those one liners you spend way too much time on and find a typo.

Anyway, I used it and someone thought it was magic so if it's new to you too, happy Monday.

I, for one, love this era of testing in prod for massive ...

2026-07-09T15:00:14Z

In reply to nevent1q…aa88
_________________________

I, for one, love this era of testing in prod for massive corporations who take no responsibility for their own failures.

No, I wasn't saying you were saying that, just that I've ...

2026-07-08T15:08:36Z

In reply to nevent1q…nafm
_________________________

No, I wasn't saying you were saying that, just that I've heard it and I'm not on board with it. Weird text-only miscommunications and my lack of focus bite again.

RE: https://infosec.exchange/@securestep9/116884683751982510 WTF? ...

2026-07-08T13:56:40Z

RE: https://infosec.exchange/@securestep9/116884683751982510

WTF? :brdLol:
nostr:note1ulm5gstfdmkcq6l6ak4f38lc6amvwvzvs324lenwztjuf7zrttusvmk8qz

RE: https://infosec.exchange/@kajer/116881110829808737 In case ...

2026-07-07T22:45:32Z

RE: https://infosec.exchange/@kajer/116881110829808737

In case anyone is unfamiliar with Cortex XDR, this is not a joke or exaggeration. You too could have these useless KPIs in your org.

quoting
note163j…2zjv

##

CORTEX XDRThis external entity was accessed using 0 distinct ports. Based on our machine learning models, this connection was flagged as suspicious

It was ssh... I'm using SSH.

Is it just me or is the Chrome Releases page blank? Tried on ...

2026-07-02T12:33:47Z

Is it just me or is the Chrome Releases page blank? Tried on three browsers on two different OSs and same thing.

https://chromereleases.googleblog.com/

Does no one believe in the true meaning of cyber anymore?

2026-06-28T03:44:26Z

In reply to nevent1q…qzfy
_________________________

Does no one believe in the true meaning of cyber anymore?

I know it's been said before but the security industry has no ...

2026-06-18T18:58:16Z

I know it's been said before but the security industry has no incentive to actually help secure anything. They sell compliance and vibes. Otherwise they would go out of business.

> Nvidia CEO Jensen Huang — whose work helped enable ...

2026-06-16T20:21:44Z

> Nvidia CEO Jensen Huang — whose work helped enable artificial intelligence — stressed in an Associated Press interview Tuesday that society has no choice but to change in the advent of AI.

> “When I was growing up, I used to play in the streets,” Huang said. “When cars came along, you obviously can’t play in the streets now.”

I don't think there is a word strong enough for how bad this fucker needs to get absolutely fucked. Fuck these absolute sociopaths. Every single one of them.

https://www.seattletimes.com/business/ap-exclusive-nvidias-jensen-huang-says-society-needs-new-social-norms-in-the-age-of-ai/

> Crypt::DSA versions before 1.21 for Perl reused the nonce ...

2026-06-16T20:06:10Z

> Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures

> **reused the nonce**

Palo Alto Networks: Our EDR logs show the ASN for every IP in the ...

2026-06-15T16:35:25Z

Palo Alto Networks: Our EDR logs show the ASN for every IP in the logs.

Also PANW: We can't enable blocking by ASN in our firewalls because it's too hard.

Fortinet

2026-06-12T13:22:15Z

In reply to nevent1q…lm9t
_________________________

Fortinet

I didn't see this the other day but patch your Ubiquiti shit. ...

2026-06-12T13:19:26Z

I didn't see this the other day but patch your Ubiquiti shit.

https://community.ui.com/releases/Security-Advisory-Bulletin-065-065/aa46a22b-fc43-4eae-9382-6fc8feda967a

3 sev:CRIT and 2 sev:HIGH CVEs there.

Is there someone I'm supposed to call if my upload takes more ...

2026-06-11T00:17:04Z

Is there someone I'm supposed to call if my upload takes more than four hours? This is starting to feel uncomfortable.

What the fuck? https://nvd.nist.gov/vuln/detail/CVE-2026-53475 ...

2026-06-10T20:23:48Z

What the fuck?

https://nvd.nist.gov/vuln/detail/CVE-2026-53475

> A flaw was found in assisted-migration-agent. The application hardcodes insecure Transport Layer Security (TLS) connections when communicating with vCenter. This vulnerability allows a Man-in-the-Middle (MITM) attacker to intercept and harvest vCenter administrator credentials. This can lead to unauthorized access to vCenter.

Does Ubiquiti seriously still not support EDLs for their firewall ...

2026-06-10T12:53:24Z

Does Ubiquiti seriously still not support EDLs for their firewall rules?

RE: https://infosec.exchange/@cR0w/116720541801549930 Anyone have ...

2026-06-09T15:58:42Z

RE: https://infosec.exchange/@cR0w/116720541801549930

Anyone have any others to add to the list here? I'll put them in a public repo somewhere if we get enough to make it worth it.

quoting
note1rkx…3qew

Outlook ->

Rules and alerts ->

New Rule ->

with specific words in the message header ->

> X-PHISH
> X-Phishtest
> X-ThreatSim-ID
> X-ThreatSim-Header
> X-PhishMe
> X-PhishMeTracking
> X-PhishMe-Tracking
> X-Gophish-Contact
> X-Gophish-Signature
> X-CanIPhish

stop processing more rules and permanently delete ->

Finish.

I would guess there are two parts to it. It's a one-time ...

2026-06-09T14:13:51Z

In reply to nevent1q…v9qk
_________________________

I would guess there are two parts to it. It's a one-time catch-up on a bunch of the really stupid bugs that projects have allowed over the years and then the rate of finding existing bugs will slow down. However, all snark aside, I fully expect the vibe coding to bring a whole new chapter of fresh and retread bugs back into prod, only to eventually be found again, making it appear to be the new normal.

Outlook -> Rules and alerts -> New Rule -> with specific ...

2026-06-09T14:08:46Z

Outlook ->

Rules and alerts ->

New Rule ->

with specific words in the message header ->

> X-PHISH
> X-Phishtest
> X-ThreatSim-ID
> X-ThreatSim-Header
> X-PhishMe
> X-PhishMeTracking
> X-PhishMe-Tracking
> X-Gophish-Contact
> X-Gophish-Signature
> X-CanIPhish

stop processing more rules and permanently delete ->

Finish.

Last week Google published 427 CVEs in Chrome. Yesterday they ...

2026-06-09T13:17:06Z

Last week Google published 427 CVEs in Chrome. Yesterday they published 74 more, one of which is EITW. That seems totally fine and normal.

https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html

Good lord that's a lot of CVEs for a product that is ...

2026-06-05T13:23:18Z

In reply to nevent1q…3uag
_________________________

Good lord that's a lot of CVEs for a product that is specifically designed to execute untrusted code from the internet and spy on users:

> CVE-2026-10881
> CVE-2026-10882
> CVE-2026-10883
> CVE-2026-10884
> CVE-2026-10885
> CVE-2026-10886
> CVE-2026-10887
> CVE-2026-10888
> CVE-2026-10889
> CVE-2026-10890
> CVE-2026-10891
> CVE-2026-10892
> CVE-2026-10893
> CVE-2026-10894
> CVE-2026-10895
> CVE-2026-10896
> CVE-2026-10897
> CVE-2026-10898
> CVE-2026-10899
> CVE-2026-10900
> CVE-2026-10901
> CVE-2026-10902
> CVE-2026-10903
> CVE-2026-10904
> CVE-2026-10905
> CVE-2026-10906
> CVE-2026-10907
> CVE-2026-10908
> CVE-2026-10909
> CVE-2026-10910
> CVE-2026-10911
> CVE-2026-10912
> CVE-2026-10913
> CVE-2026-10914
> CVE-2026-10915
> CVE-2026-10916
> CVE-2026-10917
> CVE-2026-10918
> CVE-2026-10919
> CVE-2026-10920
> CVE-2026-10921
> CVE-2026-10922
> CVE-2026-10923
> CVE-2026-10924
> CVE-2026-10925
> CVE-2026-10926
> CVE-2026-10927
> CVE-2026-10928
> CVE-2026-10929
> CVE-2026-10930
> CVE-2026-10931
> CVE-2026-10932
> CVE-2026-10933
> CVE-2026-10934
> CVE-2026-10935
> CVE-2026-10936
> CVE-2026-10937
> CVE-2026-10938
> CVE-2026-10939
> CVE-2026-10940
> CVE-2026-10941
> CVE-2026-10942
> CVE-2026-10943
> CVE-2026-10944
> CVE-2026-10945
> CVE-2026-10946
> CVE-2026-10947
> CVE-2026-10948
> CVE-2026-10949
> CVE-2026-10950
> CVE-2026-10951
> CVE-2026-10952
> CVE-2026-10953
> CVE-2026-10954
> CVE-2026-10955
> CVE-2026-10956
> CVE-2026-10957
> CVE-2026-10958
> CVE-2026-10959
> CVE-2026-10960
> CVE-2026-10961
> CVE-2026-10962
> CVE-2026-10963
> CVE-2026-10964
> CVE-2026-10965
> CVE-2026-10966
> CVE-2026-10967
> CVE-2026-10968
> CVE-2026-10969
> CVE-2026-10970
> CVE-2026-10971
> CVE-2026-10972
> CVE-2026-10973
> CVE-2026-10974
> CVE-2026-10975
> CVE-2026-10976
> CVE-2026-10977
> CVE-2026-10978
> CVE-2026-10979
> CVE-2026-10980
> CVE-2026-10981
> CVE-2026-10982
> CVE-2026-10983
> CVE-2026-10984
> CVE-2026-10985
> CVE-2026-10986
> CVE-2026-10987
> CVE-2026-10988
> CVE-2026-10989
> CVE-2026-10990
> CVE-2026-10991
> CVE-2026-10992
> CVE-2026-10993
> CVE-2026-10994
> CVE-2026-10995
> CVE-2026-10996
> CVE-2026-10997
> CVE-2026-10998
> CVE-2026-10999
> CVE-2026-11000
> CVE-2026-11001
> CVE-2026-11002
> CVE-2026-11003
> CVE-2026-11004
> CVE-2026-11005
> CVE-2026-11006
> CVE-2026-11007
> CVE-2026-11008
> CVE-2026-11009
> CVE-2026-11010
> CVE-2026-11011
> CVE-2026-11012
> CVE-2026-11013
> CVE-2026-11014
> CVE-2026-11015
> CVE-2026-11016
> CVE-2026-11017
> CVE-2026-11018
> CVE-2026-11019
> CVE-2026-11020
> CVE-2026-11021
> CVE-2026-11022
> CVE-2026-11023
> CVE-2026-11024
> CVE-2026-11025
> CVE-2026-11026
> CVE-2026-11027
> CVE-2026-11028
> CVE-2026-11029
> CVE-2026-11030
> CVE-2026-11031
> CVE-2026-11032
> CVE-2026-11033
> CVE-2026-11034
> CVE-2026-11035
> CVE-2026-11036
> CVE-2026-11037
> CVE-2026-11038
> CVE-2026-11039
> CVE-2026-11040
> CVE-2026-11041
> CVE-2026-11042
> CVE-2026-11043
> CVE-2026-11044
> CVE-2026-11045
> CVE-2026-11046
> CVE-2026-11047
> CVE-2026-11048
> CVE-2026-11049
> CVE-2026-11050
> CVE-2026-11051
> CVE-2026-11052
> CVE-2026-11054
> CVE-2026-11055
> CVE-2026-11056
> CVE-2026-11057
> CVE-2026-11058
> CVE-2026-11059
> CVE-2026-11060
> CVE-2026-11061
> CVE-2026-11062
> CVE-2026-11063
> CVE-2026-11064
> CVE-2026-11065
> CVE-2026-11066
> CVE-2026-11067
> CVE-2026-11068
> CVE-2026-11069
> CVE-2026-11070
> CVE-2026-11071
> CVE-2026-11072
> CVE-2026-11073
> CVE-2026-11074
> CVE-2026-11075
> CVE-2026-11076
> CVE-2026-11077
> CVE-2026-11078
> CVE-2026-11079
> CVE-2026-11080
> CVE-2026-11081
> CVE-2026-11082
> CVE-2026-11083
> CVE-2026-11084
> CVE-2026-11085
> CVE-2026-11086
> CVE-2026-11087
> CVE-2026-11088
> CVE-2026-11089
> CVE-2026-11090
> CVE-2026-11091
> CVE-2026-11092
> CVE-2026-11093
> CVE-2026-11094
> CVE-2026-11095
> CVE-2026-11096
> CVE-2026-11097
> CVE-2026-11098
> CVE-2026-11100
> CVE-2026-11101
> CVE-2026-11102
> CVE-2026-11103
> CVE-2026-11104
> CVE-2026-11105
> CVE-2026-11106
> CVE-2026-11107
> CVE-2026-11108
> CVE-2026-11109
> CVE-2026-11110
> CVE-2026-11111
> CVE-2026-11112
> CVE-2026-11113
> CVE-2026-11114
> CVE-2026-11115
> CVE-2026-11116
> CVE-2026-11117
> CVE-2026-11118
> CVE-2026-11119
> CVE-2026-11120
> CVE-2026-11121
> CVE-2026-11122
> CVE-2026-11123
> CVE-2026-11124
> CVE-2026-11125
> CVE-2026-11126
> CVE-2026-11127
> CVE-2026-11128
> CVE-2026-11129
> CVE-2026-11130
> CVE-2026-11131
> CVE-2026-11132
> CVE-2026-11133
> CVE-2026-11134
> CVE-2026-11135
> CVE-2026-11136
> CVE-2026-11137
> CVE-2026-11138
> CVE-2026-11139
> CVE-2026-11140
> CVE-2026-11141
> CVE-2026-11142
> CVE-2026-11143
> CVE-2026-11144
> CVE-2026-11145
> CVE-2026-11146
> CVE-2026-11147
> CVE-2026-11148
> CVE-2026-11149
> CVE-2026-11150
> CVE-2026-11151
> CVE-2026-11152
> CVE-2026-11153
> CVE-2026-11154
> CVE-2026-11155
> CVE-2026-11156
> CVE-2026-11157
> CVE-2026-11158
> CVE-2026-11159
> CVE-2026-11160
> CVE-2026-11161
> CVE-2026-11162
> CVE-2026-11163
> CVE-2026-11164
> CVE-2026-11165
> CVE-2026-11166
> CVE-2026-11167
> CVE-2026-11168
> CVE-2026-11169
> CVE-2026-11170
> CVE-2026-11171
> CVE-2026-11172
> CVE-2026-11173
> CVE-2026-11174
> CVE-2026-11175
> CVE-2026-11176
> CVE-2026-11177
> CVE-2026-11178
> CVE-2026-11179
> CVE-2026-11180
> CVE-2026-11181
> CVE-2026-11182
> CVE-2026-11183
> CVE-2026-11184
> CVE-2026-11185
> CVE-2026-11186
> CVE-2026-11187
> CVE-2026-11188
> CVE-2026-11189
> CVE-2026-11190
> CVE-2026-11191
> CVE-2026-11192
> CVE-2026-11193
> CVE-2026-11194
> CVE-2026-11195
> CVE-2026-11196
> CVE-2026-11197
> CVE-2026-11198
> CVE-2026-11199
> CVE-2026-11200
> CVE-2026-11201
> CVE-2026-11202
> CVE-2026-11203
> CVE-2026-11204
> CVE-2026-11205
> CVE-2026-11206
> CVE-2026-11207
> CVE-2026-11208
> CVE-2026-11209
> CVE-2026-11210
> CVE-2026-11211
> CVE-2026-11212
> CVE-2026-11213
> CVE-2026-11214
> CVE-2026-11215
> CVE-2026-11216
> CVE-2026-11217
> CVE-2026-11218
> CVE-2026-11219
> CVE-2026-11220
> CVE-2026-11221
> CVE-2026-11222
> CVE-2026-11223
> CVE-2026-11224
> CVE-2026-11225
> CVE-2026-11226
> CVE-2026-11227
> CVE-2026-11228
> CVE-2026-11229
> CVE-2026-11230
> CVE-2026-11231
> CVE-2026-11232
> CVE-2026-11233
> CVE-2026-11234
> CVE-2026-11235
> CVE-2026-11236
> CVE-2026-11237
> CVE-2026-11238
> CVE-2026-11239
> CVE-2026-11240
> CVE-2026-11241
> CVE-2026-11242
> CVE-2026-11243
> CVE-2026-11244
> CVE-2026-11245
> CVE-2026-11246
> CVE-2026-11247
> CVE-2026-11248
> CVE-2026-11249
> CVE-2026-11250
> CVE-2026-11251
> CVE-2026-11252
> CVE-2026-11253
> CVE-2026-11254
> CVE-2026-11255
> CVE-2026-11256
> CVE-2026-11257
> CVE-2026-11258
> CVE-2026-11259
> CVE-2026-11260
> CVE-2026-11261
> CVE-2026-11262
> CVE-2026-11263
> CVE-2026-11264
> CVE-2026-11265
> CVE-2026-11266
> CVE-2026-11267
> CVE-2026-11268
> CVE-2026-11269
> CVE-2026-11270
> CVE-2026-11271
> CVE-2026-11272
> CVE-2026-11273
> CVE-2026-11274
> CVE-2026-11275
> CVE-2026-11276
> CVE-2026-11277
> CVE-2026-11278
> CVE-2026-11279
> CVE-2026-11280
> CVE-2026-11281
> CVE-2026-11282
> CVE-2026-11283
> CVE-2026-11284
> CVE-2026-11285
> CVE-2026-11286
> CVE-2026-11287
> CVE-2026-11288
> CVE-2026-11289
> CVE-2026-11290
> CVE-2026-11291
> CVE-2026-11292
> CVE-2026-11293
> CVE-2026-11294
> CVE-2026-11295
> CVE-2026-11296
> CVE-2026-11297
> CVE-2026-11298
> CVE-2026-11299
> CVE-2026-11300
> CVE-2026-11301
> CVE-2026-11302
> CVE-2026-11303
> CVE-2026-11304
> CVE-2026-11305
> CVE-2026-11306
> CVE-2026-11307
> CVE-2026-11308
> CVE-2026-11309

Lots of CVEs for Google Chrome were published last night and they ...

2026-06-05T13:07:31Z

Lots of CVEs for Google Chrome were published last night and they link here:

https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html

Which currently doesn't show anything for me. But if you are on Chrome <149.0.7827.53 maybe update that shit.

Okay but also see ...

2026-06-04T15:41:10Z

In reply to nevent1q…9657
_________________________

Okay but also see

:dumpster_fire_gif: :blobcatpopcorn: :dumpster_fire_gif: ...

2026-06-02T21:23:51Z

:dumpster_fire_gif: :blobcatpopcorn: :dumpster_fire_gif:

https://www.kb.cert.org/vuls/id/615987

> CVE-2026-10629
> Verizon IMS deployments were observed transmitting SIP signaling without integrity protection. REGISTER exchanges lacked Security-Client, Security-Server, and Security-Verify headers, and no ESP-encapsulated SIP traffic was detected during subsequent signaling such as INVITE, MESSAGE, BYE, and UPDATE. This pattern persisted across devices, operating systems, and network conditions, indicating a deliberate network configuration rather than a transient issue.

> Per 3GPP TS 33.203 and GSMA IR.92, SIP signaling between the UE and P-CSCF must be protected using IPsec ESP following IMS AKA authentication, with negotiation occurring during registration. The absence of this protection allows attackers to manipulate SIP signaling undetected, enabling call hijacking, spoofing, denial-of-service, and misrouting of emergency calls.

> Verizon initially acknowledged the issue and stated that integrity support would be available upon request and extended broadly later in the year. However, the company has since ceased participation in coordination, including follow-up discussions and draft review, and has not provided verifiable evidence of mitigation. As remediation remains unconfirmed, this disclosure proceeds to inform users of an ongoing security exposure.

> Independent verification would require observation of successful SIP security negotiation, ESP-protected traffic, or official confirmation from Verizon.

Weird that the reply was "Don't use Kagi" when Brave ...

2026-05-27T19:42:26Z

In reply to nevent1q…y3c4
_________________________

Weird that the reply was "Don't use Kagi" when Brave is literally at the top of the list from OP though.

RE: https://mastodon.social/@nixCraft/116647832352017668 It's ...

2026-05-27T18:25:30Z

RE: https://mastodon.social/@nixCraft/116647832352017668

It's too bad that the NoAI version of DDG still returns so much slop for me. But I guess the name is good marketing for them.
nostr:note1mqg78ymfax0vc0ekt33lw4g8ksa5uwcrshsu5qndup07sentg44qt2hxne

Aren't there already Reddit scrapers?

2026-05-19T13:55:34Z

In reply to nevent1q…sgk8
_________________________

Aren't there already Reddit scrapers?

RE: https://infosec.exchange/@briankrebs/116597569851456486 BRB, ...

2026-05-18T20:57:20Z

RE: https://infosec.exchange/@briankrebs/116597569851456486

BRB, I need more popcorn for that screenshot alone. :blobcatpopcorn:

quoting
note19ge…rw5s

New, by me: CISA Admin Leaked AWS GovCloud Keys on GitHub

Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. Security experts said the public archive included files detailing how CISA builds, tests and deploys software internally, and that it represents one of the most egregious government data leaks in recent history.

https://krebsonsecurity.com/2026/05/cisa-admin-leaked-aws-govcloud-keys-on-github/

As aggressively as the Linux kernel has been getting fucked the ...

2026-05-18T14:54:06Z

As aggressively as the Linux kernel has been getting fucked the past couple weeks, I'm starting to worry that maybe they forgot the safe word.

Be gone, foul beast!

2026-05-15T16:52:13Z

In reply to nevent1q…g8sa
_________________________

Be gone, foul beast!

RE: https://infosec.exchange/@ifin/116579558486741231 And it ...

2026-05-15T16:37:14Z

RE: https://infosec.exchange/@ifin/116579558486741231

And it better be selectable text and not pdfs or images, you sociopaths.

quoting
note1xvm…5st0

Dear threat research firms,

A modest proposal for your threat intel blog posts:

A *single table* of Indicators of Compromise.

3 columns: Value, Type, Description

The same format. Every time.

Easier for you, easier for your readers, easier for us.

XOXO IFIN

RE: https://mastodon.social/@bagder/116569577763472812 AI Bros: ...

2026-05-13T22:21:05Z

RE: https://mastodon.social/@bagder/116569577763472812

AI Bros: Oh no Mythos is so scary it's going to destroy everything!

Mythos: Here's one sev:LOW in curl.

Researchers: Hold our beer you fucking clanker.

quoting
note12v8…yn3n

*five* new reports landed just now, all within 40 minutes...

Random reminder that if you are exposing IKE to the Internet for ...

2026-05-12T13:49:33Z

Random reminder that if you are exposing IKE to the Internet for static site-to-site tunnels, maybe allowlist only your peer endpoints and don't allow full Internet access to them. Just a thought. If you aren't sure if you are exposed, today seems like a good day to find out.

https://www.shodan.io/search?query=port%3A500

That's how I understand it.

2026-05-06T13:35:41Z

In reply to nevent1q…nfsl
_________________________

That's how I understand it.

Nostr event nevent1qqsf2cwrspsql29advpv6nq8n9lg9w0g6fktmdez9vtyzl2zrlajt3gzyzrt89cgdgfs2yyxrh2c7f2l4hhwr3rcz5v9lgamv29qddxk4uc6cfv6xln

2026-04-09T18:44:32Z

In reply to nevent1q…5mxa
_________________________

Easier for attackers means a potentially higher likelihood of ...

2026-04-09T18:36:20Z

In reply to nevent1q…5z7h
_________________________

Easier for attackers means a potentially higher likelihood of occurrence, but it does not change the severity of impact. And while the likelihood does theoretically impact the risk score, for at least some orgs, it's minimal to no change when your adversaries are at the top of the field already. The rising tide of AI may be lifting all attackers' boats, but the high water mark remains the same, despite the industry continuously claiming a tsunami is coming. I just don't see it.