Stopping the smart TV from being used against you https://lobste.rs/s/nfvukc #hardware #networking #security
https://www.s-config.com/stopping-a-smart-tv-from-being-used-against-you/
security
What happened to the Snowden archive https://lobste.rs/s/vqsefk #security
https://libroot.org/posts/what-happened-to-the-snowden-archive
Just a rumour of a bug is enough to find a security exploit these days via @lobsters https://lobste.rs/s/t73wqi #ml #security #vibecoding
https://anil.recoil.org/notes/rumour-is-the-exploit
Adamsdesk Bans Font Squirrel Over Privacy Concerns?
Find out what lead to the discovery of privacy concerns, complications whether to ban linking to certain websites and what decision was made.
https://www.adamsdesk.com/posts/font-squirrel-privacy-concern/
TCRF taken offline by DDoS attack after Claude user ban https://lobste.rs/s/birquu #security #vibecoding
https://kotaku.com/ddos-attack-breaks-beloved-video-game-wiki-after-ai-bro-was-banned-2000729335
Two Alleged ‘TeamPCP’ Hackers Arrested in Australia via @robey https://lobste.rs/s/1vymfa #security
https://krebsonsecurity.com/2026/08/two-alleged-teampcp-hackers-arrested-in-australia/
php2shell by Calif Research via @refi64 https://lobste.rs/s/bapw7h #php #security
https://calif.io/php2shell.x
Node.js — Wednesday, October 21, 2026 Security Releases https://lobste.rs/s/gu7bow #javascript #nodejs #security
https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
We have posted more information about today's security releases, including the sequence of events that led to the discovery, how the PHP security team is improving their processes, and what we need from you to continue this critical work. https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
#php #security
Turning IPv6 tunnels into programmable delay lines for pulsing DoS via @robalex https://lobste.rs/s/qgbvku #networking #security
https://blog.apnic.net/2026/10/22/turning-ipv6-tunnels-into-programmable-delay-lines-for-pulsing-dos/
Your AI agent fixed the bug, but what else did it change? https://lobste.rs/s/17bp4z #ai-tooling #practices #security
https://blog.trailofbits.com/2026/10/21/your-ai-agent-fixed-the-bug-but-what-else-did-it-change/
GitHub Actions leaking secrets when Miri output is cached https://lobste.rs/s/acz9kk #rust #security
https://blog.rust-lang.org/2026/09/21/github-actions-leaking-secrets-when-miri-output-is-cached/
Omarchy: Any User Process Can Escalate to Root https://lobste.rs/s/bxihn3 #security #vibecoding
https://0xcc.io/posts/omarchy-root-creds/
Windows Exploitation Techniques: Dangling COM Object Registrations https://lobste.rs/s/1somoo #security
https://projectzero.google/2026/09/windows-dangling-com.html
CVE-2026-107891: musl libc: multiple integer overflow in regcomp, possibly leading to incorrect allocation sizes and out-of-bounds heap writes https://lobste.rs/s/dldfel #c #security
https://www.openwall.com/lists/oss-security/2026/10/21/18
Fifty Years of Open Source Software Supply Chain Security https://lobste.rs/s/9jjplv #compsci #security
https://queue.acm.org/doi/10.1145/3722542
Do this now! In all your web browsers, go to https://emudhra.we-have-a-problem.com/ and go to the section titled "Does your client still trust the compromised intermediates?" and look at the right-most "Result" column. If any say "❌ Connected", you need to update your SSL/TLS certificates now. This can affect email, banking, software updating, and anything that uses #SSL, #TLS, and #HTTPS.
Edit: You can also go to https://bgp.tools/ and see if it says "Your SSL/TLS stack is accepting certificates from a #CertificateAuthority tree that is totally #compromised" I think/hope that browsers and operating systems will auto update certificates ASAP but don't do anything private until you're sure they're updated #IMHO!
#sysadmin #cybersecurity #security #privacy #CA #eMudhra #certificates
Edited 21d ago
Privilege escalation from IIS AppPool to NT Authority/SYSTEM https://lobste.rs/s/gqk57d #security #windows
https://www.mannulinux.org/2026/08/Privilege-escalation-from-IIS-AppPool-to-NT-AuthoritySYSTEM-via-AD-CS-RPC-endpoint.html
Any user process can escalate to root https://lobste.rs/s/q2zziq #security
https://www.vesto.me/2026/08/31/any-process-escalate-root.html
stack unwinding can lead to leakless code execution https://lobste.rs/s/0d6gcs #security
https://pepsipu.com/blog/2026-09-dwarf/
Data Became Code: We Ran Code Inside Fortune 500s Using Files They Published for AI Agents via @btp https://lobste.rs/s/77kss6 #ai #security
https://medium.com/@alonhertz1/data-became-code-we-ran-code-inside-fortune-500s-using-files-they-published-for-ai-agents-0cd67ffbbffc
Expect quite a few sites to return error pages toay and possibly through the week. Here's my piece on the new PHP zero-day that affects about 70 percent of the Internet. We'll be updating the story with important new developments.
https://krebsonsecurity.com/2026/10/widespread-php-flaw-may-cause-many-site-outages-today/
Edited 21d ago
Passkeys Attestation Trap via @kaimac https://lobste.rs/s/cdnepk #security #web
https://mjtsai.com/blog/2026/10/15/passkeys-attestation-trap/
📣 Announcing the immediate availability of:
- PHP 8.2.35
- PHP 8.3.36
- PHP 8.4.27
- PHP 8.5.12
‼️ These address the following critical security issues:
- Remote Code Execution via Out of Memory corruption (CVE-2026-109618)
- Remote Code Execution via Stale Global State (CVE-2026-109619)
📝 https://www.php.net/ChangeLog-8.php
🎁 https://www.php.net/downloads?source=Y
Windows: https://www.php.net/downloads.php?os=windows
Read more: https://www.php.net/archive/2026.php#2026-10-21-5
GitLab Critical Patch Release https://lobste.rs/s/pnpcso #security #vcs
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/