You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE) https://lobste.rs/s/0vmsbe #linux #security
https://ze3tar.github.io/post-zcrx.html
security
Laptops all have built-in security tokens these days by @ahelwer https://lobste.rs/s/ebg5hg #hardware #security
https://ahelwer.ca/post/2026-05-08-builtin-u2f/
ACME CA Comparison via @fanf https://lobste.rs/s/gcd4yl #security
https://poshac.me/docs/v4/Guides/ACME-CA-Comparison/
FreeBSD: Local privilege escalation via execve() https://lobste.rs/s/1p2yun #freebsd #security
https://www.freebsd.org/security/advisories/FreeBSD-SA-26:13.exec.asc
The React2Shell Story and What Happened Next.js https://lobste.rs/s/lwihzw #security
https://sylvie.fyi/posts/react2shell/
Google API keys keep working after you delete them long enough to be exploited https://lobste.rs/s/7s1uf4 #distributed #security
https://www.aikido.dev/blog/google-api-keys-deletion
My Agentic Trust Issues: From Prompt Injection to Supply-Chain Compromise on gemini-cli via @mdaniel https://lobste.rs/s/1at5w8 #security
https://www.pillar.security/blog/my-agentic-trust-issues-from-prompt-injection-to-supply-chain-compromise-on-gemini-cli
272902 – Security: allow passphrases for WPA-EAP to be saved without using clear text
OCaml Infrastructure: How the opam-repository Works https://lobste.rs/s/mteumb #ml #security
https://ocaml.org/backstage/2025-11-05-how-the-opam-repository-works
ClaudeBleed: A Flaw In Claude's Browser Extension Allows Any Extension to Hijack It https://lobste.rs/s/r1eihn #browsers #security #vibecoding
https://layerxsecurity.com/blog/a-flaw-in-claudes-browser-extension-allows-any-extension-to-hijack-it/
Incident Report: CVE-2024-YIKES https://lobste.rs/s/m5j3ov #satire #security
https://nesbitt.io/2026/02/03/incident-report-cve-2024-yikes.html
Mythos 'Discovered' a CVE Already in Its Training Data - and That’s Still Worrying https://lobste.rs/s/zwp0dp #security #vibecoding
https://rival.security/posts/mythos-discovered-a-cve-already-in-its-training-data---and-thats-still-worrying
Kettle: Attested builds for verifiable software provenance https://lobste.rs/s/pu6cxi #cryptography #hardware #security
https://arxiv.org/pdf/2605.08363
Open Source & Security https://lobste.rs/s/xbbyw5 #security
https://jrfom.com/posts/2026/04/08/oss-security/
"Mythos" at Home, and It's Called AISLE via @daveliepmann https://lobste.rs/s/cuh3be #security #vibecoding
https://stanislavfort.substack.com/p/mythos-at-home-and-its-called-aisle
Claude Code RCE: Exploiting Deeplink Handlers via Settings Injection https://lobste.rs/s/5fw1oe #security #vibecoding
https://0day.click/recipe/2026-05-12-cc-rce/
YellowKey Bitlocker Bypass Vulnerability via @PolyWolf https://lobste.rs/s/aovfvz #security #windows
https://github.com/Nightmare-Eclipse/YellowKey
Achieving NGINX Remote Code Execution via an 18-Year-Old Vulnerability https://lobste.rs/s/xnoqe8 #security
https://depthfirst.com/research/nginx-rift-achieving-nginx-rce-via-an-18-year-old-vulnerability
Sculpt OS release 26.04 via @RunxiYu https://lobste.rs/s/8gpopi #osdev #release #security
https://genode.org/news/sculpt-os-release-26.04
Passwords suck. Can passkeys replace them? via @dario https://lobste.rs/s/oyo7dd #security
https://kerkour.com/passkeys
Counterterrorism Czar’s Blueprint Targets Leftists, Ignores Far-Right Violence and Heaps Praise on Trump
---
Sebastian Gorka’s anti-terror plan makes no mention of long-established threats posed by far-right militants and instead villainizes the president’s political enemies. “This administration is not paying attention to the data,” one expert said.
https://www.propublica.org/article/trump-counterterrorism-plan-ignores-far-rights-gorka?utm_source=mastodon&utm_medium=social&utm_campaign=mastodon-post
#News #Terrorism #Trump #USPolitics #Violence #Security #Extremism
Noroboto: Lying fonts and mitigation in Rust https://lobste.rs/s/xsnzi6 #law #rust #security
https://tritium.legal/blog/noroboto
21 Zero-Days in FFmpeg https://lobste.rs/s/ejra5c #security
https://depthfirst.com/research/21-zero-days-in-ffmpeg
The First CVE Wave: Signs That AI-Assisted Vulnerability Discovery Is Reshaping Disclosure Volumes https://lobste.rs/s/xksr2p #security
https://www.vulncheck.com/blog/ai-assisted-vulnerability-discovery