shellsharks

Infosec researcher | Indieweb enthusiast | Find me @ https://shellsharks.com

#infosec #cybersecurity #tech #indieweb searchable

Profile picture: A red shark holding a terminal window shaped like a surfboard. The terminal reads “> whoami shellsharks”

#fedi22

Blog: https://shellsharks.com
Personal Mastodon: https://mastodon.social/@sass

Public Key

npub1z3mcjcv2xhwpqgsx7hvmwqfu8lmczcrxkw4lnr2v07hg2fqsm7xsu5zn2f

NIP-05 Address

shellsharks_at_shellsharks.social@momostr.pink

Profile Code

nprofile1qqspgaufvx9rthqsygr0tkdhqy7rlaupvpnt82le34x8lt59ysgdlrgpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds3esnx2

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1z3mcjcv2xhwpqgsx7hvmwqfu8lmczcrxkw4lnr2v07hg2fqsm7xsu5zn2f

Show more details

Last Notes

2026-10-27 20:06:11 UTC

- reply

Yeah. Pretty rude. 😄😡

2026-10-27 14:20:56 UTC

- reply

First it was the credit-jostling that we all saw happen with PHP4Shell, and now everyone seems to want to self-label this Brotli issue. Answering the question no one was asking… “can we make security even MORE confusing and frustrating??”

2026-10-27 14:18:33 UTC

- reply

*wistful sigh*… simpler times…

2026-10-27 14:11:09 UTC

CVE-2026-11497 having a bit of an identity crisis…
- Imperva coined the initial term, “Node2Shell” (https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/)
- Aikido tried to turn it into “HTTP2Shell” (https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497)
- Not satisfied with either of those, someone came up with “Broccoli2Shell” 🥦 (https://broccoli2shell.com)
- And now, super late to the game, humorless Tenable has decided to label it “Brotli2Shell” (https://www.tenable.com/blog/brotli2shell-frequently-asked-questions-for-google-brotli-decoder-cve-2026-111497)
Same vuln, 4 different names (so far). Yeesh…

2026-10-25 13:46:00 UTC

Recently discovered this https://2shell2furio.us/, poking a bit of fun at all the "-2shell" named vulns (there's quite a few not even listed there yet if you search on https://vulnerability.garden/). But "shell" isn't even the most used vuln-naming trope. Taking the top 3 spots is "bleed", "jack" & "pwn" 😄
- "bleed": 45
- "jack": 37
- "pwn": 33
- "shell": 30
- "bad": 30
- "leak": 29
- "ghost": 28
- "dirty": 19
- "fail": 17
- "shadow": 14
- "break": 13
- "root": 12
- "hammer": 12

2026-10-25 12:11:38 UTC

- reply

Oh I got something for ya 😄. All your "shell"-ey vulns in one place: https://vulnerability.garden/

2026-10-24 15:57:44 UTC

- reply

I need my feed to just be pics like this. 🧡

2026-10-23 12:53:41 UTC

- reply

Welcome! Maybe this li’l packet of stuff can help you explore a bit 🤗 https://shellsharks.com/notes/2025/01/10/welcome-to-the-fediverse

2026-10-22 22:47:18 UTC

- reply

😄

2026-10-22 17:43:08 UTC

- reply

Yeah. This this this. Google and OpenAI out here crediting themselves for finding the vuln because their models were used as part of the process is only a hair less absurd than the manufacturers of the chair Ryan sat on while he was expertly crafting this exploit taking credit for php2shell as well. Hell, get everyone involved taking credit! The electric company for providing power to his computer, bakery for providing Ryans breakfast that morning, etc… etc…

2026-10-22 16:45:10 UTC

I read Calif’s (i.e. Ryan Austin’s) writeup on PHP2Shell (https://calif.io/php2shell/) and come away feeling like an absolutely uncreative, and super noob infosec person. The perfect chaser, and a great way to feel better about myself (at least entropically speaking 🤭), is to mosey on over to eMudhra’s press release feed (https://emudhra.com/en/press-release/emudhra-to-exit-global-ssl-tls-certificate-business). I guess we’re pretty much all somewhere between the two… 🤗

2026-10-22 16:32:35 UTC

- reply

Yeah, agreed. But damn, it's a bit scary how large a subset of humanity fits the BS'ers category 🤦‍♂️

2026-10-22 16:26:17 UTC

- reply

"I can't believe AI is replacing actual humans"
*Watches this clip*
"Actually, yeah... maybe humans are cooked."

2026-10-22 15:58:42 UTC

- reply

Perfect. Shit/shame-posters of the united Fediverse… ASSEMBLE!!!!

2026-10-22 15:57:24 UTC

- reply

Lol exactly. My 3yo cracked their key watching an episode of number blocks (https://www.youtube.com/watch?v=Wafr8h4EsXg)

2026-10-22 15:52:47 UTC

- reply

This is made even sweeter by the fact that eMudhra specifically calls out “social media amplification” and its resulting *disproportionate scrutiny* of their SSL/TLS practices as reasons for completing exiting the PKI game entirely. https://emudhra.com/en/press-release/emudhra-to-exit-global-ssl-tls-certificate-business
I mean, congrats Fedi team (shitposters unite!). Y’alls memes made the Internet a bit safer with eMudhra now outta the game. 🫡
Makes me wonder who else we can shame into quitting…

2026-10-22 15:46:09 UTC

Shoutout to everyone continuing to meme the eMudhra thing, despite there being a newer, hotter (as in flaming garbage dump hot) infosec disaster (i.e. PHP). I love you guys. 🧡 #never4get

2026-10-22 15:40:09 UTC

- reply

Lol, their screw up was so absurdly and comically atrocious that they’re lopping off that part of the business, much like a hand that got bitten by a zombie, so that it can’t further taint the rest of their company? They also try to “no-biggie” the whole thing by saying they make no money off of it anyways? Too late friendos... I think the taint has already spread. But as we’ve learned with other security disasters… (crowdstrike taking strays here) …. You can always bounce back =)

2026-10-22 15:32:54 UTC

- reply

Right? Honestly don’t know what I’m looking at half the time right now… I’m lucky in a way that in my role I’m not too affected by any of this (no absurd work spike) so I get to be a spectator, drop memes, make jokes and such. It’s fun seeing Fedi (and infosec social in general) come alive when stuff like this comes about (last time there was this level of energy was either the crowdstrike debacle or the xz/JiaTan situation).

2026-10-22 15:16:19 UTC

I think we can all agree that the ongoing PHP situation (#php2shell) is pure chaos. Sites being pulled down, everyone scrambling to produce a working exploit, botched disclosure, tons of half-assed exploitation attempts in the wild, etc. But my favorite part of this whole mess has been watching everyone and their mom trying to claim some bit of credit for it all... read on if you want a bit of a laugh (or you just want to try to make sense of it)
https://shellsharks.com/php2chaos
#infosec #cybersecurity

2026-10-21 17:46:08 UTC

- reply

They make a lot of claims here about how they’re helping out… https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/. But honestly it just seems like their models are being used for offense, and not so much proactive defense =/.

2026-10-21 13:07:37 UTC

- reply

🥳 time to update https://istheinternetonfire.com with #PHPocalypse too @npub1z6e…ehl4

2026-10-21 12:43:22 UTC

Actual footage of eMudhra PKI folks... Crazy right?
https://cdn.masto.host/shellsharkssocial/media_attachments/files/117/478/955/358/403/312/original/481e8c4995a27160.mp4

2026-10-21 12:31:39 UTC

Two more nominations for biggest security woopsie woopsie of the last 10 years...
- WannaCry 😭
- Log4J 🪵
- Solarwinds ☀️
- clownstrike 🤡
- xz (shoutout to Jia!) 😎
- 4 🤦‍♂️
- like... all of PHP
Congrats to all the nominees!

2026-10-21 12:19:14 UTC

- reply

Calif supposedly has a poc dubbed "php2shell" or something. A more apt name is seemingly php2jesusfuckingchrist 😬

2026-10-21 12:15:52 UTC

- reply

Looking at PHP: "My god, it's full of <str>stars</str> attack surface!"
https://cdn.masto.host/shellsharkssocial/media_attachments/files/117/478/847/358/526/840/original/e26019bd9963e184.jpeg

2026-10-20 22:21:43 UTC

- reply

"4Bleed" 4️⃣🩸

2026-10-18 11:58:23 UTC

- reply

There's also xpath scraping magic you can do to create an RSS feed out of nothing if you were up for such a thing.
https://freshrss.github.io/FreshRSS/en/users/11_website_scraping.html
https://github.com/jareware/xpath2rss

2026-10-18 02:09:18 UTC

- reply

More like... "Bluesky is the only platform not silencing No Kings and other political contents YET"
🤨

2026-10-16 20:58:41 UTC

- reply

Want. Put me on the waitlist.

2026-10-16 12:03:10 UTC

Shoutout to [@campuscodi](https://mastodon.social/@campuscodi ) and risky.biz. I went through every (and I mean *every*) newsletter (https://risky.biz/newsletters/) dating back to 2022 to pull out any “named vulnerabilities” that I didn’t yet have in the Vulnerability Garden (https://vulnerability.garden). Despite how thorough I’ve been, adding these throughout the years, I still managed to find just shy of 100 (99 to be exact) new vulns to add to the list. Thanks to Catalin for contributing to the madness! 🪴

2026-10-15 12:30:40 UTC

- reply

"Sithteaming": Like redteaming, but fueled by hate, fear and anger.

2026-10-02 01:02:54 UTC

- reply

My personal finance app, which I really like, and has nothing to do with Microsoft, is also called Copilot 🤦‍♂️
https://apps.apple.com/us/app/copilot-track-budget-money/id1447330651

2026-09-19 15:52:14 UTC

- reply

Yeah some of these are like... meh. But I'm committed - so in the DB they go 🤷‍♂️

2026-09-10 12:51:27 UTC

- reply

🎯

2026-09-09 16:07:21 UTC

- reply

I mean it's just this right? https://browsergate.eu/ 🤦‍♂️

2026-07-18 20:01:11 UTC

- reply

Will be adding. Thanks!

2026-07-12 11:33:32 UTC

- reply

Thanks! 🧡

2026-07-10 20:43:11 UTC

📜 Scrolls 46 is out! (I’m back!)
https://shellsharks.com/scrolls/scroll/2026-07-10
Thanks to everyone mentioned below. Their work is featured in this week's issue.
@npub1hu0…vz3q @npub109f…3mc6 @npub1yfe…92ae [@Notesfromtheroad](https://mastodon.art/@Notesfromtheroad ) @npub1q0t…dgvk @npub1rp5…r7dm [@jzb](https://hachyderm.io/@jzb ) @npub14cl…nnue @npub1p34…jr9r @npub1uk9…xemg @npub1a0s…dmkd @npub1eqe…vhyp @npub1c99…ljas @npub1t2p…53hs @npub109f…3mc6 @npub19j2…slel @npub1uxq…5dcj @npub1d4r…k2pv @npub1puh…vk5s @npub1eu4…677w @npub1x74…ruph @npub15h0…lsjv @npub109d…cpmt @npub1m49…yl0h @npub1mz8…3kt8 @npub1t9q…r0p6 @npub1lw8…60jz @npub1tay…f3zn @npub1wfp…w2m9 @npub1vyg…0gll @npub1w5g…m2hw
#indieweb #fediverse #infosec #cybersecurity

2026-07-10 20:01:54 UTC

- reply

Once-ler-core

2026-07-10 19:07:39 UTC

- reply

Here’s a bunch of mine - https://shellsharks.com/notes/2024/08/30/favorite-fedi-artists

2026-07-08 14:47:06 UTC

- reply

But if you’re looking for more webrings - I’ve got a bunch you can peruse here: https://shellsharks.com/indieweb#webrings

2026-07-08 14:03:46 UTC

- reply

I’m partial to the Webrings I’m in 🤗 - https://shellsharks.com/#webrings

2026-07-08 14:01:22 UTC

- reply

Yep. Still the biggest downside of vanilla Masto. It’s beyond me why they don’t just allow admins to change this in the settings. Literally no reason not to do this.
cc @npub1vl7…f6g0 PLEASEEEEE!

2026-07-08 13:53:33 UTC

- reply

Make sure to stay up on your CPEs! (Continue Posting Excrement)

2026-07-07 19:21:53 UTC

- reply

Still one of the coolest sites out there. Nice work!

2026-07-07 14:44:30 UTC

Honestly I almost didn’t even get this off the ground, but here ya go, I’m actually going through with >Shark Week 2026.
https://shellsharks.com/sharkweek/2026
It’s just a cheesy thing I do on my site during Shark Week where I try to post something every day. Also, it turns out shark week isn’t until later in July. But F it. It’s going up this week for me.
Enjoy some random stuff from me for a week straight.
🦈 🗓️

2026-07-06 14:25:31 UTC

- reply

Glad you enjoyed it! 🧡

2026-07-06 14:24:03 UTC

- reply

Oh cool! I hope I didn’t come off mean-spirited. But it’s great you’ll be posting from your own domain 🧡. Looking forward to seeing more from ya!

2026-07-06 14:23:06 UTC

- reply

Thanks! 🙏 🧡

2026-07-05 11:53:54 UTC

- reply

100% no one uses this. It's a breathtakingly stupid idea. WOW.

2026-06-21 06:40:26 UTC

- reply

I also am happy with the result. That there is some good webbin'

2026-06-21 06:38:52 UTC

- reply

In one dialog (again, that I didn't ask for and that popped up suddenly as I began to scroll), it is asking me to...
- download their app
- sign up for Medium
- give them my email address
- agree to their ToS
- subscribe to get updates from this person directly to my inbox
Like, chill! I just wanted to read this *one* article and you didn't even let me do that yet... how tf would I know if I wanted to commit this hard yet???

2026-06-21 06:30:04 UTC

- reply

Yeah I rageclose the browser tab when I get this unwanted full-screen pop-up 😩
(No offense to Stuart or this article - I just can't stand Medium and its ilk)
https://cdn.masto.host/shellsharkssocial/media_attachments/files/116/786/685/437/716/069/original/2f0daaf15d23cd4d.png

2026-06-21 06:24:23 UTC

- reply

I feel the same. I don't have the time to flesh out why rn, but though I like bubbles as it serves as another entry point to the IndieWeb, I don't think it's a good reflection of what it has to offer.
To me, the indieweb shouldn't be a popularity contest, and its best content is often not what's "freshest". I dislike the idea of someone relying exclusively on Bubbles as their way of finding things.
The joys of IndieWeb discovery cannot be algorithmically contained.

2026-06-19 08:10:32 UTC

- reply

Just under 5GB db and 11GB media storage at the moment.

2026-06-19 07:05:32 UTC

- reply

On the grand scale you're probably not wrong. But for me, and what I use "social media" for, it's been pretty good for 4-ish years. I hardly use socials, even Fedi for "micro-blogging" though. Most everything I want to say is done so on my site. I syndicate here sometimes, but mostly use it to interact with others posts. I've met some cool folks this way and that's all this place has ever needed to be. ✌️
Also Jerry's cool enough 😋. The bars low for humans these days 🤦‍♂️

2026-06-18 00:39:56 UTC

- reply

This is the way.

2026-06-18 00:35:17 UTC

- reply

I've always thought this. So they're not only useless but also just ugly cruft on your posts 💩

2026-06-15 13:22:49 UTC

- reply

Doh! That’s my bad. I found that whole coffee debate thing via your article and somehow forgot to link it in the original scroll. It’s fixed now. Sorry about that. And I like your blog!

2026-06-12 18:32:37 UTC

- reply

Thanks friend!

2026-06-12 18:30:27 UTC

- reply

🧡

2026-06-12 18:30:16 UTC

- reply

Thanks for the assist! 🙌

2026-06-12 18:27:58 UTC

- reply

Appreciate it!

2026-06-12 18:27:06 UTC

- reply

You’re very welcome! And thanks! 🙌

2026-06-12 15:16:04 UTC

- reply

Ack probably. I'll fix it when I'm back at my console 😅
Thanks!

2026-06-12 14:47:29 UTC

📜 Scrolls vol. 45 is out!
https://shellsharks.com/scrolls/scroll/2026-06-12
Thanks to everyone mentioned below. Their work is featured in this week’s edition! 🧡
@npub158d…9kvp @npub1xle…27vc @npub14q4…3u22 @npub1344…dgc3 @npub1hu0…vz3q @npub1pna…2y52 @npub1eqe…vhyp @npub1u5z…esha @npub15x0…2g26 @npub15mh…h268 [@ifixcoinops](https://retro.social/@ifixcoinops ) @npub17zw…pctk [@petrillic](https://hachyderm.io/@petrillic ) [@kev](https://social.catastrophic.horse/@kev ) @npub1kqc…7wgd [@liztai](https://hachyderm.io/@liztai ) @npub1ur9…v3q2 @npub109f…3mc6 @npub1uxz…e2r6 @npub1eqe…vhyp @npub1zqh…u8aw @npub1090…cff7 @npub1asm…646p @npub1hrf…5zqe @npub1kxh…srr7
#indieweb #fediverse #infosec #cybersecurity
FYI, Scrolls is now on a brief hiatus and will return on 7/10.

2026-06-11 13:47:16 UTC

- reply

No reason you couldn’t put more than 4 in a /top4. Or do /top. Or a totally new slash page of your design! slashpages.net is but a very unofficial guide on a few known slash pages. It isn’t meant to be the decider on what does or doesn’t count. I have a (very much work in-progress) /top4 page and I’ve already linked to other lists I have that aren’t strictly 4-in-length 🤷‍♂️

2026-06-11 13:44:07 UTC

- reply

💯 🚀 👍 Added!

2026-06-06 17:31:12 UTC

- reply

I have a whole lot of feeds here https://shellsharks.com/feeds 🤗

2026-06-05 19:48:08 UTC

- reply

Thanks for the reminder for me to remove all links to Substack from my site. Cheers!

2026-06-05 17:53:10 UTC

📜 Scrolls 44 is out!
https://shellsharks.com/scrolls/scroll/2026-06-05
Shoutout to everyone listed below. Their work was featured in this week’s edition. 🧡
@npub1c99…ljas @npub1z5v…z8zg @npub1m49…yl0h @npub1cyc…9psj @npub1tyl…7s6e @npub1xh9…x0uw @npub1t0w…zgs2 @npub1za8…v6es [@marvin_weblin](https://mastodon.social/@marvin_weblin ) @npub109f…3mc6 @npub1tec…afr2 @npub1tsx…ma4k [@brittcoxon](https://mastodon.art/@brittcoxon ) [@liztai](https://hachyderm.io/@liztai ) @npub1xhj…hq9k @npub1nwk…slxa [@Carl](https://sunny.garden/@Carl ) [@Ailantd](https://mastodon.art/@Ailantd ) @npub1090…cff7 @npub1fs3…njx8
Have a great weekend!
#indieweb #fediverse #cybersecurity #infosec

2026-06-05 12:06:18 UTC

- reply

Definitely got the idea from you tho 😄

2026-06-04 14:01:53 UTC

AI isn’t real “intelligence”. It doesn’t measure up to human intelligence!
Looks around at humans…
Oh…
Well, AI can’t match human intelligence because humans can think for themselves!
Once again looks around at humans today…
Shit…

2026-06-04 13:57:48 UTC

- reply

Here’s mine 🤗 https://shellsharks.com/style
Your style is so crisp and nice looking though =). I’d say mine’s a bit more rough/amateurish… but some might say “full of character” 😄

2026-06-04 13:54:39 UTC

- reply

I keep a list of such places here https://shellsharks.com/indieweb#explore-the-indieweb. Also, recently someone published this list of curated directories here https://theindex.fyi. I’m sure what you’re looking for can be found in one of these two places.

2026-06-03 13:35:41 UTC

- reply

I know nada about ao3 or fan fiction sites in general. What I DO know is a good metaphor when I see one. This one about Internet cross-pollination is perfection. Especially for me right now as I’ve set off into my (IRL) gardening era. The importance of cross-pollination in both contexts can not be understated.
Cheers!

2026-06-03 13:07:14 UTC

- reply

Neat! I had this *exact* idea like 15 years ago but never had the energy ( or maybe know-how? ) to bring it to life. Back then the web seemed a bit less hostile… I have more fears and doubts about how well this concept would work today, but I think it’s awesome that someone’s going to try to make it happen. Looking forward to seeing how it goes!

2026-05-29 13:32:57 UTC

📜 Scrolls 43 is now out! Lots of great links to discover as usual 🤗
https://shellsharks.com/scrolls/scroll/2026-05-29
Thanks to everyone mentioned below. Their work is featured in this week’s issue. 🧡
@npub17fx…dj24 @npub1wdx…gg3t @npub1lwx…c8f6 @npub1c99…ljas @npub1f5a…705y @npub1x74…ruph @npub1zvq…jy0a @npub1247…zzvh @npub1wnn…93z9 @npub187k…237q [@Paul_FTW](https://xoxo.zone/@Paul_FTW ) [@miclgael](https://hachyderm.io/@miclgael ) @npub1xnz…kpy3 @npub1mpv…v3ac [@caolan](https://hachyderm.io/@caolan ) @npub1jpy…yfwv @npub1e5z…p90v @npub1wz5…gajk @npub1lrq…pn8w @npub1uej…t62s
#indieweb #fediverse #infosec #cybersecurity
Have a great weekend!

2026-05-28 17:42:30 UTC

- reply

Joined in 2018 out of curiosity. Rejoined in 2022 during the early stages of the Elonification of Twitter. I was never much of a Twitter-er anyways (just lurking mostly) but out of principle, and because I saw infosec folks coming to Fedi, I went to.
I’ve stayed (and will continue to stay) for so many reasons….
- My awesome curated timeline filled with wonderful people.
- The level of ownership I have of my presence and data
- Fediversal interoperability
To name a few!

2026-05-27 12:34:51 UTC

- reply

Good tip. I’m still working up the nerve to move my main site over to Codeberg. I recently set up my newest site there and wrote this up to help others do the same https://shellsharks.com/devlog/planting-a-website-on-codeberg-pages.

2026-05-22 14:44:18 UTC

📜 Scrolls volume 42 is out! Enjoy some web surfing and have a great weekend!
https://shellsharks.com/scrolls/scroll/2026-05-22
Thanks to everyone listed below. Their work was featured in this weeks issue.
@npub1x59…gect @npub1y0h…u9hf @npub1599…cfu6 @npub1ujj…94rt @npub1kt8…s5cv @npub109f…3mc6 @npub13dg…65tn @npub1dey…g39n @npub1m49…yl0h @npub1djp…ept4 [@mahryekuh](https://hachyderm.io/@mahryekuh ) @npub140q…0v8s [@albi](https://raintreeruckus.com/ ) @npub1tk4…3wu7 @npub1nyp…ar25 @npub1t4d…y3tj @npub1ejn…ujpe @npub1xxu…fsr2 @npub1raa…r25n @npub17a6…mgkf @npub1asm…646p @npub1rc2…307q @npub1wrf…ktu7 [@fathia](https://sunny.garden/@fathia ) @npub190q…f9lj @npub1jpy…yfwv @npub1z28…9m5z [@xandra](https://tilde.zone/@xandra )
#indieweb #fediverse #infosec #cybersecurity

2026-05-20 18:43:24 UTC

- reply

Oh ok cool. Thanks for the background. The list is more of an art than a science for sure =). Cheers!

2026-05-20 16:10:12 UTC

- reply

Cool! Thanks for sharing. I added FROST (and a few others I was not aware of from your already-published works here https://vulnerability.garden). 🪴🤗
Quick somewhat-related question though. I’ve noticed in this research, and *so* many other similar published white papers, that the authors do not include a Published Date. Why is this? At best I’ll get a year-published for citation purposes, but I’d personally love to know the month+day as well.
Anyways, thanks again!!

2026-05-20 13:08:13 UTC

- reply

Thanks! It’s been kinda rough so far this season. A string of sub 50 degree days followed by several 95+ degree days and now we’re heading right back into 50 degree nights and 10 days straight of rain… ill be amazed if anything survives the onslaught. But plants can be resilient!

2026-05-20 12:34:23 UTC

- reply

I think that's already been done. We've all been calling it the "old web" (complimentary), but they'll spin it to be the "old web" (derogatory). Fortunately there's a surge of personal blogging and indieweb tooling looking to keep the better web afloat. Might be enough to save some of us...

2026-05-18 13:05:19 UTC

- reply

Not that it’s the *most* reliable indicator, but a similar trend is evident in what I see on vuln garden. This year we have 83 “named vulns” and we’re not even half way through the year. This pace could see 200+ while no year prior has ever gone over 130. It also seems like a majority of findings coming out recently are from AI shops (V12, those copyfail buggers, xbox, etc…)

2026-05-16 16:36:39 UTC

- reply

Hired.

2026-05-15 20:15:34 UTC

- reply

Yeah if DVWA was installed on thousands of endpoints and *checks notes* also exposed to the Internet 😭
https://protean-labs.io/blog/researchers-find-thousands-of-openclaw-instances-exposed

2026-05-15 20:09:11 UTC

- reply

OpenClaw says "my turn" - https://www.cyera.com/blog/claw-chain-cyera-research-unveil-four-chainable-vulnerabilities-in-openclaw

2026-05-15 18:24:02 UTC

The Vulnerability Garden isn’t exactly “Fedi-Native”, but I did set up RSS Parrot to post out when new records are added. The latest being “Claw Chain” (from today!).
Whether it’s AI being popped, or AI doin’ the poppin’, it’s shaping up to be a big year for named vulns it seems. https://rss-parrot.net/u/vulnerability.garden/status/1778817847002383503

2026-05-15 18:16:52 UTC

- reply

PoppedKernel

2026-05-15 13:02:38 UTC

- reply

This is one of those instances that is kinda on the fence for me in terms of inclusion in the garden… I kinda read this as “ssh-keysign-pwn” being the name of the script, or the name of the repo and not so much it being a “named” vuln. It’s pretty subjective as I’ve explained before though so 🤷‍♂️. It doesn’t have a website, or a logo. The author (in the repo) never really says anything like “named” or “dubbed” or “called” —> ssh-keysign-pwn. Not that it’s that important but yeah..

2026-05-15 12:59:23 UTC

- reply

Hope you find a lot of stuff you’re interested in! 🧡

2026-05-15 12:58:58 UTC

- reply

🤗

2026-05-15 12:53:13 UTC

- reply

infosec.exchange probably has a bit of this vibe. Sure, there are plenty of “broadcast-ey” types on there, but there’s also a solid population of folks that converse, comment, and otherwise *respond* to posts, not just publish. Having a topic-specific instance (like “infosec”) can help with this.

2026-05-15 04:10:42 UTC

📜 Scrolls 41 has been published! Go check it out 🤗
https://shellsharks.com/scrolls/scroll/2026-05-15
Thanks to everyone listed below. Their work is featured in this week's edition!
@npub1t2p…53hs @npub1s8g…ejc3 @npub1huw…c5x7 @npub16pv…g6y2 [@david_bardos](https://mementomori.social/@david_bardos )
@npub109f…3mc6 @npub1x74…ruph @npub1597…3dck @npub1r4x…awyf [@marlin_bian](https://mastodon.social/@marlin_bian ) @npub1umd…wfr7 @npub1m49…yl0h [@hyperreal](https://tilde.zone/@hyperreal ) @npub140q…0v8s @npub1090…cff7 @npub1z6e…ehl4 [@inherentlee](https://flipping.rocks/@inherentlee ) @npub1kn7…rxdq @npub1kf2…rzus @npub1e2g…xwfr @npub1m4j…835a @npub1zyj…25vl [@Ailantd](https://mastodon.art/@Ailantd ) @npub1fs3…njx8
#indieweb #fediverse #infosec #cybersecurity

2026-05-15 02:55:36 UTC

- reply

I still use standard search engines a fair bit. But you know where I turn to that’s pretty cool? My own website! I have a lot of useful links saved up over time, and a fair bit I’ve written myself that I often find useful down the road.

2026-05-14 15:44:42 UTC

- reply

lol. BRB, changing my title to "Cybergarbologist"

2026-05-14 14:35:43 UTC

- reply

It seems to only be accelerating. The AI-fueled vulnshops are having a field day with their li'l naming it seems. I just put 'em in a list 🤷‍♂️