Nostr notes by Alexandre Dulaunoy

A standalone, browser-only HTML/JavaScript application for ...

2026-10-25T19:39:29Z

A standalone, browser-only HTML/JavaScript application for exploring the MISP threat-actor galaxy, UUID-based relationships across every cluster in the MISP Galaxy repository, and shared MISP Galaxy metadata. Graph rendering is performed by Pivotick.

Upgraded to Pivotick to v3 and add graph simplification tools and table export.

:github: https://github.com/adulau/threat-actor-explorer
🌍️ Online version https://foo.be/threat-actor-explorer/misp-threat-actor-explorer.html

#cti #misp #threatintel #threatintelligence #opensource

svg-sanitize rebuilds untrusted SVG as static vector graphics ...

2026-10-23T20:18:18Z

svg-sanitize rebuilds untrusted SVG as static vector graphics only. It does not simply search and replace script tags. It parses XML with defusedxml, checks resource limits, and constructs an entirely new XML tree from a small, explicit allowlist of elements, attributes, and valid values.

Thanks to Jeroen Pinoy (npub17pn…jnzs) for the initial idea at the [@hack_lu](https://infosec.exchange/@hack_lu ) hackathon and also Saumil Shah 🇮🇳 (npub1caw…cy8q) to trigger me again about SVG at the 20th edition hack.lu ;-)

It's a prototype and maybe utterly broken.

🔗 https://github.com/adulau/svg-sanitize

#svg #cybersecurity #hacklu #opensource

MISP Modules v3.0.13 is a substantial release, bringing a new ...

2026-10-20T05:47:07Z

MISP Modules v3.0.13 is a substantial release, bringing a new wave of OSINT and threat intelligence enrichment capabilities, new ways to export indicators into operational security tools, and new workflows for publishing IOCs directly to security platforms.

MISP (npub1mly…rl2t)

🔗 https://github.com/MISP/misp-modules/releases/tag/v3.1.0

#misp #cti #threatintel #intelligence #cybersecurity #osint

I added the relationships for the ones you mentioned (it was a ...

2026-10-15T14:35:42Z

In reply to nevent1q…th56
_________________________

I added the relationships for the ones you mentioned (it was a very good example).

Now we have a combined view as the relationships are there. So we can live with old and new records and keep our life easy when searching.

https://cpe.gcve.eu/vendors/f1264d7a-feb5-5e95-9b5b-0e87832c5d3c

Enjoy!

If you want we can even do a private online session ;-)

gcve.eu (npub1pna…2y52)

Yes can propose relationship to solve that exact issue. Let's ...

2026-10-15T14:18:26Z

In reply to nevent1q…p0hr
_________________________

Yes can propose relationship to solve that exact issue. Let's do it live for curl_project which is renamed to curl. I'll do for the other. Screenshots attached.

gcve.eu (npub1pna…2y52)

Indeed. That's why we have the relationship proposal to ...

2026-10-14T11:35:07Z

In reply to nevent1q…3dgc
_________________________

Indeed.

That's why we have the relationship proposal to correct existing records. Especially vendor typographic mistakes, name changes, ...

Working on a new release of the CPE editor for @npub1pna…2y52 ...

2026-10-13T12:41:06Z

Working on a new release of the CPE editor for gcve.eu (npub1pna…2y52) which is the crowd-sourced way to handle and improve CPE records for CVE records or any vulnerability format using CPE.

Now there is an nice visualisation of the relationships between vendors/products.

Don't hesitate to propose changes.

🔗 GCVE CPE - MISP Vendor entry https://cpe.gcve.eu/vendors/536016cd-a314-5880-947a-e465002d0fab
🔗 https://cpe.gcve.eu/

#cpe #cve #vulnerabilityManagement #

The Radio Image Framing Protocol (RIFP) is an experimental, ...

2026-10-10T08:53:24Z

The Radio Image Framing Protocol (RIFP) is an experimental, extensible standard for sending images over low-rate radio links. I did a new version 1.1 with an extension to authenticate the images.

The extension is now published as an Internet-Draft.

#rifp #radio #opensource #openstandard

🔗 RIFP source code https://github.com/adulau/rifp#optional-image-authentication

🔗 RIFP Standard https://datatracker.ietf.org/doc/draft-dulaunoy-rifp/

🔗 RFIP Authentication Extension https://datatracker.ietf.org/doc/draft-dulaunoy-rifp-auth/

Rulezet and its ecosystem: how detection rules travel between ...

2026-10-09T09:16:38Z

Rulezet and its ecosystem: how detection rules travel between tools.

Vulnerability-Lookup, AIL, Flowintel, MISP, Velociraptor and more: every tool that reads from Rulezet or receives its rules, what each connection does, and an interactive map of the whole ecosystem.

🔗 https://rulezet.org/blog/post/fe4f4c93-94d5-45f9-88b2-792d74bda07f

#threatintelligence #threatintel #rulezet #misp #opensource #cybersecurity #detectionengineering #flowintel #velociraptor #dfir

Threat-Actor explorer v1.1.0 released with many improvements and ...

2026-10-04T09:49:54Z

Threat-Actor explorer v1.1.0 released with many improvements and upgrade to the latest Pivotick library Latest

A standalone, browser-only HTML/JavaScript application for exploring the MISP threat-actor galaxy, UUID-based relationships across every cluster in the MISP Galaxy repository, and shared MISP Galaxy metadata. Graph rendering is performed by Pivotick.

:github: https://github.com/adulau/threat-actor-explorer/releases/tag/v1.1.0
🌐 Online version https://foo.be/threat-actor-explorer/misp-threat-actor-explorer.html#actor=a5f64c1a-c829-4855-903d-e0ff2098b2d7

#misp #threatactor #threatintelligence #cybersecurity #mispgalaxy #cti #opensource #cybersecurity

Yep, we’re known for being transparent about vulnerability ...

2026-10-02T18:25:53Z

In reply to nevent1q…qc8r
_________________________

Yep, we’re known for being transparent about vulnerability disclosure and not sweeping issues under the rug, as many others do…

GCVE BCP-05-X-03: Bringing Vulnerability Handling Timelines into ...

2026-10-01T12:42:44Z

GCVE BCP-05-X-03: Bringing Vulnerability Handling Timelines into Vulnerability Records.

Vulnerability records usually provide a good description of what a vulnerability is, which products are affected, how severe it may be, and where additional information can be found.

They are often much less effective at describing what happened, when it happened, and who was involved during the vulnerability handling and disclosure process.

Following many discussions during VulnOptiCON 2026 in Luxembourg, this limitation became particularly clear. Vulnerability analysts, coordinators, vendors and other participants repeatedly discussed how difficult it can be to reconstruct a reliable timeline during vulnerability analysis and coordinated vulnerability disclosure.

To help address this, the GCVE initiative has published a new extension:

GCVE BCP-05-X-03 - Vulnerability Handling and Disclosure Timeline.

The extension provides a structured and machine-readable way to represent the lifecycle of a vulnerability from discovery and reporting through acknowledgement, validation, remediation and public disclosure. It's already live in our open-source tool-set.

🔗 Blog post https://gcve.eu/2026/10/01/gcve-bcp-05-x-03-bringing-vulnerability-handling-timelines-into-vulnerability-records/

🔗 Extension https://gcve.eu/bcp/extension/gcve-bcp-05-x-03/

#opensource #openstandard #cve #gcve #cra #cybersecurity #vulnerability

The new AI conglomerates are publishing documents warning about ...

2026-09-29T20:18:25Z

The new AI conglomerates are publishing documents warning about the dangers of semi-open models that defenders can actually use, while those same conglomerates are restricting defenders’ access to their own models.

#ai #cybersecurity

🔗🤦 https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities

VULNARCHIVE and GNA 1988: Automated Vulnerability Identifier ...

2026-09-20T14:14:42Z

VULNARCHIVE and GNA 1988: Automated Vulnerability Identifier Allocation in a Federated GCVE Ecosystem.

One of the core ideas behind GCVE is that vulnerability identification does not need to depend on a single central authority. Independent GCVE Numbering Authorities (GNAs) can operate their own processes, allocation policies and publication infrastructure while remaining interoperable with the wider GCVE ecosystem.

VULNARCHIVE is a new example of this model in practice. It has been assigned GNA 1988 and can automatically allocate identifiers.

Automatic allocation does not mean blind allocation. The system separates evidence collection, matching, review and publication, allowing uncertain cases to be reviewed while well-defined cases can flow through the pipeline automatically.

#gcve #cve #vulnerability #vulnerabilitymanagement

https://gcve.eu/2026/09/20/vulnarchive-and-gna-1988-automated-vulnerability-identifier-allocation-in-a-federated-gcve-ecosystem/

gcve.eu (npub1pna…2y52)

Tired of drafting vulnerability advisories from Git patches? We ...

2026-09-18T14:55:27Z

Tired of drafting vulnerability advisories from Git patches?

We developed patch2vuln to facilitate the creation of security advisories directly from Git patches.

With a single command, patch2vuln can assist an analyst throughout the advisory creation process: analyzing the patch, drafting the vulnerability title and description, identifying CWE and CAPEC mappings, proposing a CVSS v4.0 vector, extracting affected versions, remediation information and credits, and generating a structured CVE/GCVE record.

The analysis can run entirely locally using an LLM via Ollama, while deterministic processing is used for elements such as CVSS scoring and structured output validation.

The goal is not to replace the security analyst, but to remove much of the repetitive work and provide a solid structured draft for human review and publication.

patch2vuln v1.0 is now available as open-source software under the gcve.eu (npub1pna…2y52) Lab initiative.

https://gcve.eu/2026/09/18/introducing-patch2vuln-v1.0-streamlining-vulnerability-advisory-creation-from-git-patches/

Thanks to David Cruciani for the tests and Jeroen Pinoy for the initial feedback.

#VulnerabilityManagement #CVD #CVE #GCVE #OpenSource #CyberSecurity #AI

hack.lu 2026 agenda is live! (the 20th Edition) including more ...

2026-09-14T16:38:04Z

hack.lu 2026 agenda is live! (the 20th Edition) including more details about the keynote.

🔗 https://2026.hack.lu/blog/hack.lu-2026-agenda-is-live/

#conference #hacklu #cybersecurity

I love to see clever use of the @npub1pna…2y52 ecosystem and ...

2026-09-11T20:00:00Z

I love to see clever use of the gcve.eu (npub1pna…2y52) ecosystem and rommelfs (npub1jlt…7u3q) did a cool GNA which is automatically creating GCVE records and structured security advisories from full-disclosure mailing-list or alike:

🔗 Project details https://vuln.freearchive.org/

🔗 As it's a GNA, it's part of the GCVE ecosystem if you decide to pull it https://db.gcve.eu/recent?source=gna-1988

#gcve #cve #vulnerability #vulnerability #opensource #cybersecurity

We had difficulties automatically classifying chats, messaging ...

2026-09-11T06:10:26Z

We had difficulties automatically classifying chats, messaging channels, and forums. So we tested several open-weight large language models for our use case. The benchmark is published below, along with a tool supporting the classification process.

This helps us avoid manually classifying channels collected from dark-web forums and social networks, while reliably identifying which channels can be discarded and which deserve further analysis.

🔗 Publication https://aipitch.eu/2026/09/10/Automated-Topic-Classification-of-Chat-Messaging-and-Forum/
🔗 Source code https://github.com/AIPITCH/topic-classifier

#ai #llm #cybersecurity #darkweb #osint #opensource

The @npub1pna…2y52 BCP-07 KEV format has been updated to allow ...

2026-09-09T14:43:49Z

The gcve.eu (npub1pna…2y52) BCP-07 KEV format has been updated to allow the Withdrawn and Reasserted KEV Assertions.

This allows to support case like CVE-2026-69836 .

🔗 https://gcve.eu/bcp/gcve-bcp-07/#withdrawn-and-reasserted-kev-assertions

#cve #gcve #kev #cybersecurity #vulnerabilitymanagement #vulnerability

Doing some statistics on the persistence of information published ...

2026-09-06T10:17:02Z

Doing some statistics on the persistence of information published on security and threat intelligence blogs. A surprising number of the domains in the list below are NXDOMAIN nowadays.

Don't assume that security information and threat intelligence will remain accessible over time, especially when it is hosted by large private entities.

Some are simply mistyped, while others reflect DNS changes over time that eventually left the original URLs broken.

Stability and persistence of information is hard on Internet.

#threatintelligence #threatintel #infosec #cybersecurity <code> app.response.ncr.com blog.0x3a.com blog.anomali.com blog.cert.societegenerale.com blog.cylance.com blog.deniable.org blog.ioactive.com blog.jpcert.or.jp blog.kleissner.org blog.malwareclipboard.com blog.malwaretracker.com blog.passivetotal.org blog.safebit.mn blog.team-cymru.org blog.zimperium.com blogs.rsa.com cdn.securelist.com community.saas.hpe.com ddos.arbornetworks.com dnsdb.isc.org edu.arabsgate.com info.baesystemsdetica.com info.isightpartners.com insider.domaintools.com ioc.forensicartifacts.com iranthreats.github.i joedd.joesecurity.org lab.anchiva.com labs.alienvault.com labs.lastline.com labs.snort.org labsblog.f-secure.com luminosity.link malware.sekoia.fr morphick.net motherboard.vice.com ocelot.li permalink.gmane.org r.virscan.org remchp.com research.riskiq.net resources.infosecinstitute.com sandbox.deepviz.com sec.sexy securityblog.s21sec.com securityblog.switch.ch securitydaily.org sub0day.com tif.mcafee.com wepawet.iseclab.org www.cve.mitre.org www.cyintanalysis.com www.cyphort.com www.icebrg.io www.infosecdailynews.com www.isightpartners.com www.lexsi.com www.novetta.com www.packetmail.net www.root9b.com www.skycure.com www.threatexpert.com www.vxsecurity.sg </code>

GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg ...

2026-09-02T11:46:31Z

GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference

We are pleased to announce a GCVE workshop on 22 September 2026, from 14:00 to 18:00, hosted at the CIRCL/LHC offices in Luxembourg, just before the VulnOpticon conference.

The workshop is free and open to everyone, but registration is required.

🔗 https://gcve.eu/2026/09/01/gcve-workshop-22-september-2026-1400-1800-luxembourg-before-the-vulnopticon-conference/

#cve #gcve #luxembourg #cybersecurity #vulnerabilitymanagement

GCVE BCP-07, the Known Exploited Vulnerability (KEV) Assertion ...

2026-09-01T15:33:22Z

GCVE BCP-07, the Known Exploited Vulnerability (KEV) Assertion Format, has been updated to version 2.2. A key addition is the formalisation of the GCVE KEV Directory, a simple machine-readable directory allowing organisations to announce where their KEV catalogues and exploitation assertions are published.

We particularly encourage software and hardware vendors to publish their own KEV catalogues. Vendors are often in the best position to confirm exploitation affecting their products, and publishing this information in a machine-readable form can significantly improve vulnerability prioritisation for users, CSIRTs and vulnerability-management platforms.

For more details https://gcve.eu/2026/09/01/gcve-bcp-07-updated-a-directory-for-known-exploited-vulnerability-catalogues/

#GCVE #GNA #vulnerabilityintelligence #opensource #KEV #cybersecurity

gcve.eu (npub1pna…2y52)

I spent many hours in vulnogram today and to be honest. I'm ...

2026-08-24T20:00:49Z

I spent many hours in vulnogram today and to be honest. I'm glad that a colleague started to work on a replacement called vulniverse. Still early beta but it's promising.

#opensource #vulniverse #cybersecurity #cve #gcve

:github: work in progress https://github.com/vulnerability-lookup/vulniverse

Time to welcome Canada as an EU member.

2026-08-24T15:22:02Z

In reply to nevent1q…qw4n
_________________________

Time to welcome Canada as an EU member.

I just released ptrclassify is a small, dependency-free Python ...

2026-08-23T09:56:48Z

I just released ptrclassify is a small, dependency-free Python library and CLI that infers likely IP usage from reverse-DNS PTR hostnames.

It is intentionally heuristic and multi-label. PTR naming is operator-controlled and is not authoritative evidence of how an address is actually used. The output therefore includes a confidence score, the text that matched, and the rule IDs that produced each label.

To summarize, the library is trying to guess usage (and a bit location) of an IP address based on its PTR records. It's based on a set of rules which can be updated easily.

#osint #cybersecurity #ptrclassify #opensource #dns

:github: https://github.com/adulau/ptrclassify
:python: module https://pypi.org/project/ptrclassify/

If you are curious about (nearly) everything we did the past ...

2026-08-13T15:21:01Z

If you are curious about (nearly) everything we did the past months at the GCVE.eu initiative:

https://gcve.eu/2026/08/13/gcve-recent-activities-standards-software-and-a-growing-gna-community/

We published a recap blog post.

#gcve #cve #vulnerability #vulnerabilitymanagement #cra #cybersecurity #openstandard #opensource

From a research paper to running open-source code in just a few ...

2026-08-11T09:36:56Z

From a research paper to running open-source code in just a few days.

We (with Cedric (npub1cyh…z0cm)) have been experimenting in Vulnerability-Lookup with the concept of Local Exploit Hazard, based on the recent research paper “Modeling Local Exploit Hazard — A Bayesian Framework for Quantifying Exploit Risk and Operational Efficiency” by Stephen Shaffer and Laura Cristiana Voicu.

The idea addresses an important question in vulnerability management:

Not simply “How dangerous is this vulnerability globally?” but “How much exploitation risk does this vulnerability represent in my environment?”

Instead of introducing yet another static vulnerability score, the model starts from exploit likelihood such as EPSS and combines it with local security controls, CVSS attack vectors, vulnerability age and KEV policy to estimate an exploitation hazard.

We implemented an experimental version in Vulnerability-Lookup and connected it directly to operational workflows.

For the full details: https://www.vulnerability-lookup.org/2026/08/11/local-exploit-hazard/

#cve #gcve #vulnerabilitymanagement #vulnerability #opensource #opendata

circl (npub143x…w0tp)

Pretty cool idea from @npub1t9q…r0p6 - a bot to analyse fucked ...

2026-08-09T08:26:26Z

Pretty cool idea from nyan (npub1t9q…r0p6) - a bot to analyse fucked up references from the CVE records.

[@fuckeduprefs_bot](https://infosec.exchange/@fuckeduprefs_bot )

Maybe we could imagine an archive bot at the same time to ensure that the references don't get lost. Just like archive.org or similar. Maybe something for gcve.eu (npub1pna…2y52) to look into.

#cve #vulnerability #gcve

MISP Galaxy Threat Actor Explorer v1.0.0 released ...

2026-08-04T20:30:25Z

In reply to nevent1q…apnt
_________________________

MISP Galaxy Threat Actor Explorer v1.0.0 released

https://github.com/adulau/threat-actor-explorer

#cti #cybersecurity #misp #threatintelligence #threatintel

MISP (npub1mly…rl2t)

A standalone, browser-only HTML/JavaScript application for ...

2026-08-03T17:34:45Z

A standalone, browser-only HTML/JavaScript application for exploring the MISP threat-actor galaxy, UUID-based relationships across every cluster in the MISP Galaxy repository, and shared MISP Galaxy metadata. Graph rendering is performed by Pivotick.

Source code: https://github.com/adulau/threat-actor-explorer/
Online (in-browser): https://foo.be/threat-actor-explorer/misp-threat-actor-explorer.html
Discussions and feedback: https://discourse.ossbase.org/t/playing-with-a-threat-actor-explorer-browser-local-from-the-misp-galaxy-dataset/1118

MISP (npub1mly…rl2t)

#misp #cti #threatintelligence #opensource #threatactor #cybersecurity

Sightings have long been a major topic of discussion in the CTI ...

2026-08-01T08:20:08Z

Sightings have long been a major topic of discussion in the CTI community, particularly in the field of vulnerability management. We have now published a GCVE BCP to standardise the format that has been implemented, tested and used operationally in Vulnerability-Lookup for some time.

Thanks to everyone (Cédric Bonhomme, Éireann Leverett, Andras Iklody, Sami Mokaddem and many more) who participated in discussions and worked on the implementation details of sightings over the past several years. These efforts had a strong focus on practical implementation, while BCP-12 specifically addresses sightings in the context of vulnerability management.

BCP-12 is still a draft open for review, but it already provides a strong foundation for existing implementations.

https://gcve.eu/2026/08/01/gcve-bcp-12-a-standard-sighting-format-for-vulnerabilities/

#cve #cra #gcve #vulnerabilitymanagement #cybersecurity #openstandard

The Radio Image Framing Protocol (RIFP) 1.0 is an experimental, ...

2026-07-28T08:39:01Z

The Radio Image Framing Protocol (RIFP) 1.0 is an experimental, extensible standard for sending images over low-rate radio links.

The default rifp-cpfsk-4800 profile uses binary continuous-phase FSK and can be deployed around 433.92 MHz where local regulation permits it. RIFP itself is not tied to 433 MHz or to FSK and can be used in any frequency bands.

I'm still exploring various low-cost options for a device that can receive and display images on an e-ink screen in emergency areas or similar environments.

:github: Python implementation https://github.com/adulau/rifp

Internet-Draft https://www.ietf.org/archive/id/draft-dulaunoy-rifp-00.html

#radio #fax #433mhz #opensource

Pivotick is an open-source network graph library to facilitate ...

2026-07-27T20:33:48Z

Pivotick is an open-source network graph library to facilitate pivoting.

Version 1.4.0 has been released and also includes a security fix.

Release notes https://github.com/Pivotick/Pivotick/releases/tag/v1.4.0
Documentation https://pivotick.github.io/Pivotick/
Vulnerability fixed in 1.4.0 https://vulnerability.circl.lu/vuln/gcve-1-2026-20151
Gallery https://pivotick.github.io/Pivotick/gallery.html

#opensource #infovis #graph #networkgraph #visual

So finally Kimi-k3 is not really open-source ...

2026-07-27T17:54:37Z

So finally Kimi-k3 is not really open-source

https://huggingface.co/moonshotai/Kimi-K3/blob/main/LICENSE

I'm a bit disappointed.

#kimi #ai #opensource

The GCVE Lab is an open space for experimenting with new ideas, ...

2026-07-26T09:40:01Z

The GCVE Lab is an open space for experimenting with new ideas, tools, formats, and services related to the Global CVE Allocation System initiative.

The lab allows the GCVE community to explore promising concepts without immediately imposing the stability, compatibility, and operational requirements expected from the core GCVE infrastructure.

Open to comments/ideas.

#gcve #cve #cybersecurity

https://discourse.ossbase.org/t/gcve-lab-proposal/1117

https://gcve.eu

gcve.eu (npub1pna…2y52) GCVE.eu (npub1a66…fej9)

Wireshark for the web (webasm) Open, dissect and analyse .pcap / ...

2026-07-25T11:05:13Z

Wireshark for the web (webasm)

Open, dissect and analyse .pcap / .pcapng capture files entirely in your web browser.

Online - local in your browser https://stricaud.github.io/wpcapng/
Sourc code - https://github.com/stricaud/wpcapng

#nids #pcap #networkanalysis #wireshark

I don’t like playing the futurologist, but after seeing AI ...

2026-07-17T10:12:23Z

I don’t like playing the futurologist, but after seeing AI companies warn EU institutions about the supposed risks of open-weight models, I suspect some are lobbying to regain control over genuine open source and open-weight AI.

Don’t fall into the trap: the greater danger lies in opaque, proprietary models, not open-source ones.

#opensource #ai #cybersecurity

The first version of tempolocus, v1.0.0, is out.tempolocus ...

2026-07-10T19:56:50Z

The first version of tempolocus, v1.0.0, is out.tempolocus

analyses time-series activity patterns to infer likely locations.

I’ve been experimenting with this idea for years, but AI-assisted development now makes it much easier to collect and maintain country-specific holidays and their many exceptions.

#threatintel #threatintelligence #opensource #osint

:github: https://github.com/ail-project/tempolocus

We are exploring some ambitious ideas around reducing external ...

2026-07-08T15:15:33Z

We are exploring some ambitious ideas around reducing external dependencies and relying more on our own libraries across MISP and related tooling. Over the past year, we have been working on a replacement network graph library for the new MISP interface and things are getting really interesting. Pivotick is already used in around ten open-source tools, including CTI Transmute, AIL Project, and Rulezet. It has also recently been integrated into the new MISP UI, OverMind. The library is, of course, open source and comes with extensive documentation, including AI-parseable documentation to make integration easier. We have just released Pivotick v1.2.0.

https://pivotick.github.io/Pivotick/

https://github.com/Pivotick/Pivotick

#infovis #cybersecurity #opensource

Working on tempolocus, a tool that analyses time-series activity ...

2026-07-07T15:02:25Z

Working on tempolocus, a tool that analyses time-series activity patterns to infer a user’s likely location.

In [@ail_project](https://infosec.exchange/@ail_project ), we work with a large volume of social-network time series. Estimating users’ locations from these patterns is often a manual task.

I prototyped a Python module that combines potential locations with yearly activity signals, such as vacation periods and public holidays. It is still at an early stage, but it is already producing promising results with weekly time series.

Ideas, feedback, and improvements are welcome. tempolocus is planned for integration into AIL Framework 7.1.

#cybersecurity #threatintelligence #threatintel #opensource

:github: https://github.com/ail-project/tempolocus

EU project proposals have become a bureaucratic endurance test. ...

2026-06-23T18:15:29Z

EU project proposals have become a bureaucratic endurance test.

The application process is painfully long, the evaluations often opaque, and rejection letters can feel almost dismissive. Even when a proposal succeeds, far too much of the budget disappears into compliance, coordination, reporting, controls, and audits.

When roughly 60% of resources go to administration rather than impact, something is fundamentally broken.

Europe cannot afford to turn innovation into paperwork. We need a serious reform of EU funding: simpler applications, transparent evaluations, proportionate controls, and more funding directed to actual delivery.

#europe #research #funding #opensource

Improving the CPE editor for the GCVE initiative: clearer API ...

2026-06-23T14:22:22Z

Improving the CPE editor for the GCVE initiative: clearer API behavior, better performance, and many other enhancements. This will be released in version 1.1 and the improvements are already in the online version.

🌍️ Online version https://cpe.gcve.eu/
:github: https://github.com/gcve-eu/cpe-editor

If you want to improve the CPE dataset, you can make proposal online.

Thanks to all the users who provided feedback for improvements righel (npub1cwm…2qdf) Cedric (npub1cyh…z0cm) Jerry Gamblin (npub1660…u8rt)

gcve.eu (npub1pna…2y52)

#gcve #cpe #cve #vulnerability #vulnerabilitymanagement #opensource #opendata

imsi-dataset contains pseudonymised mobile-network observation ...

2026-06-19T17:14:46Z

imsi-dataset contains pseudonymised mobile-network observation records derived from IMSI-catcher-style telemetry. It is intended for research on mobile-network measurements, cellular security, anomaly detection, roaming patterns, and privacy-preserving analysis of telecom metadata.

#imsi #dataset #opendata #cybersecurity

https://huggingface.co/datasets/adulau/imsi-dataset

The idea from @npub1cm0…enqe is so interesting that it gave me ...

2026-06-15T14:46:21Z

The idea from daniel:// stenberg:// (npub1cm0…enqe) is so interesting that it gave me the idea to extend the "GCVE-BCP-02 - Practical Guide to Vulnerability Handling and Disclosure" with "Temporary Closure of Vulnerability Intake Windows"

#gcve #cve #vulnerabilitymanagement #vulnerability #opensource #cybersecurity

🔗 Proposal https://discourse.ossbase.org/t/temporary-closure-of-vulnerability-intake-windows-potential-annex-extension-for-gcve-bcp-02/1104
🔗 Original BCP-02 https://gcve.eu/bcp/gcve-bcp-02/

cpe-editor v1.0.0 released : Establishing the Foundation for ...

2026-06-14T15:07:01Z

cpe-editor v1.0.0 released : Establishing the Foundation for Collaborative CPE & PURL Mapping

Release note - https://github.com/gcve-eu/cpe-editor/releases/tag/v1.0.0
Online version - https://cpe.gcve.eu/

#gcve #cpe #vulnerability #vulnerabilitymanagement #cve cvd

Sovereignty Is Engineered, Not Procured Europe often asks whether ...

2026-06-06T07:59:29Z

Sovereignty Is Engineered, Not Procured

Europe often asks whether it can build a company like Palantir: a software champion capable of serving intelligence, defence, law enforcement, crisis response, cyber defence, and public-sector decision-making at scale.

The usual answer is that Europe lacks data, capital, talent, or legal room. I do not think this is the full story.

The capacity is there. The data is there. The technical talent is there. The public-sector problems are real, urgent, and interesting. What is often missing is the will to tackle complex programmes seriously, over time, with teams that are allowed to build, fail, iterate, and take responsibility.

Europe does not need a Palantir clone. It needs the capacity to build strategic software for intelligence and security missions without outsourcing the core of its thinking.

#opensource #intelligence #cybersecurity #palantir #europe #sovereignty #intelligence

🔗 My full blog post about the topic https://foo.be/2026/06/Sovereignty-Is-Engineered-Not-Procured

IETF I-D updated - Programming Methodology Framework aka PMF This ...

2026-05-30T20:44:21Z

IETF I-D updated - Programming Methodology Framework aka PMF

This update includes "Swearwords and Software Engineering"

#update #computerscience #methodology #programming

🔗 https://datatracker.ietf.org/doc/draft-dulaunoy-programming-methodology-framework/

The synthetic exercise world format now includes a nice map. So ...

2026-05-29T21:09:05Z

The synthetic exercise world format now includes a nice map.

So no one can blame us when you conduct an exercise: everything is fictional ;-) Yes, we’ve had cases like this during threat intelligence exercises.

All Synthetic Exercise World - Self-contained fictional world dataset for cyber exercises and standards documents are available at https://github.com/MISP/Synthetic-Exercise-World-Format

#cti #cyberexercise #exercise #threatintelligence #opensource

Yesterday, in our very warm office, an interesting discussion ...

2026-05-27T15:37:45Z

Yesterday, in our very warm office, an interesting discussion emerged: there was no dedicated taxonomy for evaluating Cyber Threat Intelligence (CTI) in MISP.

So, we created one called: cti-evaluation

🔗 https://www.misp-project.org/taxonomies.html#_cti_evaluation

My colleagues Théo Geffe and Christian Studer then took it one step further by implementing it in CTI-transmute.

From discussion to a first implementation and tests in less than 48 hours, not too bad! Feedback on the taxonomy is more than welcome. And you can already test it live on cti-transmute.org

🔗 https://cti-transmute.org/convert/detail/93

#cti #misp #cybersecurity #threatintelligence #opensource #threatintel

MISP (npub1mly…rl2t)
circl (npub143x…w0tp)

hack.lu is celebrating its 20th edition! There is still time to ...

2026-05-25T09:19:07Z

hack.lu is celebrating its 20th edition!

There is still time to be part of this special anniversary edition: submit your talk, presentation, workshop, or even a short talk for the Call For Failures.

Twenty editions of sharing, learning and community deserve something memorable. Don’t miss the chance to contribute, this year will be special!

Call-for-Papers Submission Site https://pretalx.com/hack-lu-2026/

CfP Details https://2026.hack.lu/blog/hack.lu-2026-call-for-papers/

#hacklu #conference #luxembourg #cybersecurity #hackerconf #cfp #callforpapers #europe

[@hack_lu](https://infosec.exchange/@hack_lu ) circl (npub143x…w0tp)

I’m still completely lost with logic of JA4+ patent licensing ...

2026-05-07T08:06:30Z

I’m still completely lost with logic of JA4+ patent licensing and actual incompatibility with the copyleft-license. So it seems to be a patent-based license and really risky to implement if you want to keep your actual software open source.

Did someone explore alternatives to avoid this? and especially other format which are open source friendly?

#ja4 #ja3 #jarm #cti #opensource #patent #cti
#threatintel #cybersecurity

🔗 https://github.com/FoxIO-LLC/ja4/blob/main/License%20FAQ.md

FSL and BSL belong on any list of false-promise ...

2026-04-10T04:38:05Z

FSL and BSL belong on any list of false-promise licenses:<li><a href="https://fsl.software/"; target="_blank" rel="nofollow noopener" translate="no">https://fsl.software/</a></li><li><a href="https://mariadb.com/bsl-faq-adopting/#whatis"; target="_blank" rel="nofollow noopener" translate="no">https://mariadb.com/bsl-faq-adopting/#whatis</a></li>

They are **not open source**. They are restrictive source-available licenses dressed up with “open” language.

Reading the code is not enough. If users cannot freely run, use, or build on the software because of field-of-use or competition restrictions, the software is not open source.

Marketing it as “open source” or even putting “open” in your name is misleading twice: first in the license, then in the messaging.

#opensource #fauxopensource #license

If someone comes to me today preaching about “post-quantum” ...

2026-03-31T05:41:10Z

If someone comes to me today preaching about “post-quantum” security issues, I’ll remind them of the current state of security: the npm ecosystem gets abused daily, CI pipelines run left and right with full access to cloud services, so-called security devices like F5 and Ivanti are exposed (and compromised) to the internet, mailboxes get compromised just to change an IBAN in a PDF, and a simple phone call is still enough to get someone to hand over an MFA code.

But yes, by all means, let’s focus on post-quantum threats while handing AI tools SSH access like it’s a feature, not a confession.

#cybersecurity #stateoftheworld

In the same level of discussions, "Discord Alternatives, ...

2026-02-10T11:27:17Z

In reply to nevent1q…52pw
_________________________

In the same level of discussions, "Discord Alternatives, Ranked" is an interesting read too.

🔗 https://taggart-tech.com/discord-alternatives/

I hate Discord. The platform is proprietary, the U/X is just ...

2026-02-10T07:18:15Z

I hate Discord. The platform is proprietary, the U/X is just completely confusing and it's difficult to find anything.

If you run a project, I love Discourse (npub1shf…7zml) - it's open source, the U/X is great and you can archive everything in markdown (and much more).

https://github.com/discourse/discourse
and we run it for GCVE https://discourse.ossbase.org/c/gcve/14

#opensource #discourse

The federation is open. Any matrix server or bridge is allowed.

2026-02-09T16:01:17Z

In reply to nevent1q…7k5z
_________________________

The federation is open. Any matrix server or bridge is allowed.

You need to have an account on another public matrix server like ...

2026-02-06T21:11:03Z

In reply to nevent1q…emfn
_________________________

You need to have an account on another public matrix server like matrix.org to join the public room. We don’t allow account creation on our server.

We’ve just set up a Matrix channel for Vulnerability-Lookup and ...

2026-02-06T13:08:17Z

We’ve just set up a Matrix channel for Vulnerability-Lookup and GCVE discussions.

Matrix public room: #vulnerability-lookup-public:matrix.circl.lu

This space is intended for informal discussions. For standard and more detailed discussions, we recommend using:

🔗 vulnerability-lookup discourse https://discourse.ossbase.org/c/vulnerability-lookup/6

🔗 GCVE discourse https://discourse.ossbase.org/c/gcve/14

#gcve #vulnerabilitymanagement #opensource #cve #matrix

gcve.eu (npub1pna…2y52)
circl (npub143x…w0tp)

Iperlane Security ?

2026-02-01T18:03:25Z

In reply to nevent1q…dzjx
_________________________

Iperlane Security ?

French government always talks about technological sovereignty… ...

2025-12-17T16:41:09Z

French government always talks about technological sovereignty…

https://www.lemonde.fr/en/france/article/2025/12/15/us-tech-firm-palantir-extends-deal-with-french-intelligence-agency_6748523_7.html

#palantir #french #sovereignty

Why it matters to create and maintain open-source infrastructure ...

2025-12-17T12:09:00Z

Why it matters to create and maintain open-source infrastructure for security monitoring including collection of forums and malicious communication channels.

This is a strong example (Google dark web report is discontinued) of the risks of relying solely on commercial vendors. If a capability does not align with their business interests or generate sufficient revenue, it can be discontinued at any time. Open-source infrastructure helps ensure continuity, transparency, and long-term access to critical monitoring capabilities that are essential for the security community.

If you want to run your own "darkweb" monitoring, we develop open source tooling supporting such monitoring<li><a href="https://www.ail-project.org/"; target="_blank" rel="nofollow noopener" translate="no">https://www.ail-project.org/</a> <a href="https://infosec.exchange/@ail_project"; class="u-url mention">@ail_project</a> </li><li><a href="https://github.com/ail-project"; target="_blank" rel="nofollow noopener" translate="no">https://github.com/ail-project</a></li>

#darkweb #opensource #osint #cybersecurity

🔗 https://support.google.com/websearch/answer/16767242?hl=en&ref_topic=7028834&co=GENIE.Platform%3DiOS

Can you share the indicators? we can give you an access to a ...

2025-11-04T14:11:40Z

In reply to nevent1q…84jm
_________________________

Can you share the indicators? we can give you an access to a MISP (npub1mly…rl2t) community if needed

I think the best summary until now about Post-quantum ...

2025-11-03T05:46:21Z

I think the best summary until now about Post-quantum cryptography is from Peter Gutmann in the cryptography mailing-list.<code>Given that after 20 years and hundreds of millions of dollars spent researchers have yet to demonstrate a single legitimate cryptanalysis result using a quantum physics experiment, it's a bit like arguing over which brand of unicorn repellent is the most cromulent. The current state of things in terms of pure vs. hybrid systems seems to be: - Governments = Pure: “We’re putting all our eggs in one basket and hoping that the dial stops spinning at ‘not broken’” - Everyone else = Hybrid: “We trust this new stuff so little that we’re requiring you use the crypto that we claim is broken alongside it” Peter. </code>

#cryptography #pq #postquantum #postquantumcryptography

https://www.metzdowd.com/pipermail/cryptography/2025-October/039129.html

I’m just wondering are you sure of the test? I remember we got ...

2025-10-28T11:54:49Z

In reply to nevent1q…cwre
_________________________

I’m just wondering are you sure of the test? I remember we got trapped in an ASA scanning script which was expecting an HTTP 200 while the patch gives a redirect but this was also a 200.

Imagine working in your country’s cybersecurity center or CERT, ...

2025-10-11T06:32:08Z

Imagine working in your country’s cybersecurity center or CERT, and suddenly being reassigned to border control and deportation duties. Something is clearly broken and dangerously so.

What will you do as a cybersecurity professional?

#us #cybersecurity #dhs #cisa

https://techcrunch.com/2025/10/10/homeland-security-reassigns-hundreds-of-cisa-cyber-staffers-to-support-trumps-deportation-crackdown/

Finally a useful magic quadrant Thanks to @npub1udn…3tjr for ...

2025-08-11T06:20:08Z

Finally a useful magic quadrant

Thanks to Wendy Nather (npub1udn…3tjr) for the discovery.

#cybersecurity #vulnerability

When I added the threat-actor @npub1mly…rl2t galaxy type on Mar ...

2025-08-01T09:14:32Z

When I added the threat-actor MISP (npub1mly…rl2t) galaxy type on Mar 4, 2016, I didn’t expect that, years later, vendors would still invent new names for already known threat actors, avoid using UUIDs, reuse similar names for different actors, and create confusing names by mixing tools or software used by the actors.

That’s why we continue the tedious work of maintaining a proper threat-actor database, with relationships to other galaxies such as MITRE ATT&CK, Malpedia, and more.

After years of this monastic effort, we’re seeing the benefits—many open-source and proprietary tools now rely on the MISP galaxy, which serves as both an open standard and a public knowledge base.

We also maintain a dedicated website for all MISP galaxies. Here’s an example from the threat-actor database:
https://www.misp-galaxy.org/threat-actor/relations/fa80877c-f509-4daf-8b62-20aba1635f68/

:github: Repository https://github.com/MISP/misp-galaxy/
🌐 Public website https://www.misp-galaxy.org/threat-actor/

If you’d like to become a monk (just kidding!) and contribute, feel free to open an issue or submit a pull request on the misp-galaxy repo.

In MISP, you can directly benefit from all the galaxies, and you also have advanced functionalities like forking and maintaining an up-to-date private version of the threat-actor database.

#threatintel #threatintelligence #opensource #tip #cti #misp

« Cloudflare 1.1.1.1 Incident on July 14, 2025 » Perhaps it’s ...

2025-07-16T05:27:24Z

« Cloudflare 1.1.1.1 Incident on July 14, 2025 »

Perhaps it’s time to return to DNS’s original distributed design.

#dns #distributed #cloudflare

https://blog.cloudflare.com/cloudflare-1-1-1-1-incident-on-july-14-2025/

Something that’s been bothering me for years in the security ...

2025-06-17T19:46:46Z

Something that’s been bothering me for years in the security world: why do researchers demand bug bounties for vulnerabilities in open source projects, when the very contributors maintaining and fixing those issues get nothing, just goodwill?

It feels deeply unfair. The burden falls on unpaid maintainers, yet bounty hunters get rewarded. If you want a paid bounty, maybe help fund the people who actually fix the mess too.

#opensource #security #bugbounty

Just a reminder: Vulnerability Lookup isn’t just about finding ...

2025-04-15T19:45:12Z

Just a reminder: Vulnerability Lookup isn’t just about finding CVEs. It supports the full chain, collection from multiple sources, continuous distribution, and allocation within a coordinated vulnerability disclosure (CVD) process. 100% open source.

🔗 An online version maintained by circl (npub143x…w0tp) https://vulnerability.circl.lu/

🔗 https://www.vulnerability-lookup.org/

🔗 https://github.com/vulnerability-lookup/vulnerability-lookup

#opensource #cve #vulnerability #cna #cvd #cybersecurity

If you want to join an open source #hackathon for open source ...

2025-04-05T18:37:39Z

If you want to join an open source #hackathon for open source security tools, it’s next week (on April 8th and 9th, 2025) in Luxembourg.

https://hackathon.lu

#opensource #infosec #cybersecurity

We are excited to announce that CIRCL has three open positions ...

2025-03-12T10:05:18Z

We are excited to announce that CIRCL has three open positions available.

As a team strongly oriented towards open-source development, we value contributions that drive innovation and strengthen the cybersecurity community. These roles are open to EU citizens, with the workplace based in Luxembourg. If you’re passionate about cybersecurity and open-source collaboration, we encourage you to apply and make a meaningful impact.<li>CIRCL - Software Engineer and Intelligence Analyst (software-engineering-analyst) </li>

🔗 https://www.circl.lu/projects/position/software-engineering-analyst/<li>CIRCL - Security Analyst and Researcher (Security-Analyst-and-Researcher)</li>

🔗 https://www.circl.lu/projects/position/security-analyst-researcher/<li>CIRCL - Incident and Vulnerability Disclosure Coordinator/Analyst (nis2-incident-analyst)</li>

🔗 https://www.circl.lu/projects/position/nis2-incident-analyst/

circl (npub143x…w0tp)

#cybersecurity #opensource #europe #csirt #cert #nis2

I find this vulnerability hilarious « The GDPR Cookie Compliance ...

2025-03-12T06:26:28Z

I find this vulnerability hilarious

« The GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD plugin for WordPress is vulnerable to Stored Cross-Site Scripting »

Often, websites only use cookies necessary for normal operation and don’t require explicit user consent. However, some legal teams insist on having it “to be on the safe side.” Now it’s very safe indeed. ;-)

This particular vulnerability isn’t a big deal since it requires admin rights on WordPress to inject. If you’re already an admin, you can do worse things. The only advantage for attackers is that the injection spreads everywhere.

#infosec #gdpr #cybersecurity #vulnerability #wordpress

🔗 https://vulnerability.circl.lu/vuln/CVE-2025-2205

The « bias » one is hilarious. So many reports, manuals, and ...

2025-02-10T17:44:09Z

In reply to nevent1q…qhl7
_________________________

The « bias » one is hilarious. So many reports, manuals, and memos mention the word. From Europe, it just looks like ignorance is tearing everything down, like a massive autodafé.

We developed the open source vulnerability-lookup project (and ...

2024-12-18T17:37:38Z

In reply to nevent1q…2f5x
_________________________

We developed the open source vulnerability-lookup project (and also the sighting part) for providing actionable intelligence in the scope of NIS2 obligation and to share the information with all CSIRTs and SOCs efficiently.

https://www.vulnerability-lookup.org/

about the sighting aspect https://www.vulnerability-lookup.org/tools/#sightings

We have still plenty of ideas. If you see something missing, let us know.

Kevin Beaumont (npub1lcc…lcye) Not Simon 🐐 (npub14g0…znd6)

If you are curious about the evolution of sightings ...

2024-12-18T17:05:39Z

In reply to nevent1q…xkvm
_________________________

If you are curious about the evolution of sightings https://vulnerability.circl.lu/vuln/CVE-2023-34990#sightings

If you are wondering about the unpublished CVE-2024-49848... ...

2024-12-18T15:00:08Z

If you are wondering about the unpublished CVE-2024-49848... there is a PoC.

#vulnerability

🔗 https://vulnerability.circl.lu/comment/23fd524b-475e-4b9f-8dc2-7b67f4cec409

Post-Quantum Cryptography in OpenPGP - an IETF draft #openpgp ...

2024-11-07T05:43:59Z

Post-Quantum Cryptography in OpenPGP - an IETF draft

#openpgp #pgp #postquantum

🔗 https://datatracker.ietf.org/doc/draft-ietf-openpgp-pqc/

The latest proposal from @npub1djq…zj5f poses significant risks ...

2024-10-27T08:49:46Z

The latest proposal from Open Source Initiative :osi: (npub1djq…zj5f) poses significant risks to the true principles of open source. This concern reminds me of my primary issue with EPSS, where the model is documented in a paper, yet relies on proprietary data sources that aren’t accessible for reproduction. It's like having free/open source software without the entire build chain needed to create the executable code.

What’s the actual reasoning behind this clause?

https://opensource.org/ai/drafts/the-open-source-ai-definition-1-0-rc2

#opensource #fauxpensource #ai

We announce the release of onion-lookup v0.1. This open source ...

2024-10-07T14:05:28Z

We announce the release of onion-lookup v0.1. This open source tool and service is designed to help you search for Tor hidden services / .onion services quickly and efficiently. With its sleek API and user-friendly online interface, onion-lookup simplifies the process of querying and exploring onion addresses without browsing Tor and gather more information.

🔗 Online version https://onion.ail-project.org/
🔗 Source code https://github.com/ail-project/onion-lookup

#tor #darkweb #osint #opensource #infosec #onion

The information is relying on a [@ail_project](https://infosec.exchange/@ail_project ) instance operated by the AIL project.

If you are curious about the history of vulnerabilities in cups ...

2024-09-26T20:37:13Z

In reply to nevent1q…kl7m
_________________________

If you are curious about the history of vulnerabilities in cups

https://vulnerability.circl.lu/search?vendor=cups&product=cups&vendor_vuln=

« A series of bugs in the CUPS printers discovery mechanism ...

2024-09-26T20:06:04Z

« A series of bugs in the CUPS printers discovery mechanism (cups-browsed) and in other components of the CUPS system, can be chained together to allow a remote attacker to automatically install a malicious printer (or hijack an existing one via mDNS) to execute arbitrary code on the target host as the lp user when a print job is sent to it. »

Ok…. don’t expose your print server to the Internet. Wait for the update from your favorite open source operating system. Nothing new under the sun.

#cups #vulnerability #infosec

https://gist.github.com/stong/c8847ef27910ae344a7b5408d9840ee1

A funny phishing targeting GitHub users with an email ...

2024-09-18T20:48:23Z

A funny phishing targeting GitHub users with an email notification about a security issue on a existing repository.

Then the captcha verification on a malicious website is trying to trick the user to run a shell command on Windows.

🔗 Powershell to be executed by the user
https://gist.github.com/adulau/6cf6f3e9c5bbd9106af8814d0a22f473

🔗 File downloaded https://pandora.circl.lu/analysis/21e8f693-361b-4a04-853c-276f9dd841e4/seed-1XqUr4mADaFYlLAyrBH8oQUBgOoEbceZ586b8h05YyA - Lumma Stealer

🔗 Malicious domain analysis. https://lookyloo.circl.lu/tree/91106035-dfec-4acc-af06-c9fc36c62774

#malware #malwareanalysis #infosec