Dark Elevator: Windows Install Service Local Privilege Escalation (CVE-2026-50343) https://lobste.rs/s/miadav #security #windows
https://blog.calif.io/p/dark-elevator-windows-install-service
security
AT&T's very rare Security-Plus Telephone https://lobste.rs/s/fw8e40 #cryptography #historical #security
https://www.electrospaces.net/2025/10/an-interesting-advertisement-for-stu.html
Secrets Don’t Belong in Config https://lobste.rs/s/iypcjj #nix #security
https://secretspec.dev/blog/secrets-dont-belong-in-config/
OpenSSL HollowByte: A DoS Hiding in 11 Bytes https://lobste.rs/s/tvpnsm #security
https://sec.okta.com/articles/2026/06/openssl-hollowbtye-a-dos-hiding-in-11-bytes/
AI models shock UK testers by using fake identities to try to trick developers https://lobste.rs/s/tmpokv #security
https://www.theguardian.com/technology/2026/aug/05/openai-anthropic-models-went-rogue-cybersecurity-test-ai-security-institute
Full disclosure: Arbitrary code execution in Cursor https://lobste.rs/s/vlr279 #editors #security #vibecoding
https://mindgard.ai/blog/cursor-0day-when-full-disclosure-becomes-the-only-protection-left
Frag Gap (CVE-2026-53362, CVE-2026-53366) https://lobste.rs/s/uibzl8 #linux #security
https://blog.qwerty.or.kr/en/posts/cdf3008a-c1a4-4eca-a373-aa3a2bcf1489/
Reporting a 19+ Years Hidden Linux Kernel Zero-Day for Google kernelCTF: CVE-2026-43456 https://lobste.rs/s/txjns0 #linux #networking #security
https://gmo-cybersecurity.com/blog/19-years-hidden-80000-rewarded-reporting-a-linux-kernel-zero-day-for-google-kernelctf/
OpenAI model breaks out of security sandbox, hacks Hugging Face for data to pass test https://lobste.rs/s/7nrek3 #security #vibecoding
https://openai.com/index/hugging-face-model-evaluation-security-incident/
Local Privilege Escalation in set-capabilities versions of snap-confine (CVE-2026-8933) https://lobste.rs/s/w7qez9 #linux #security
https://cdn2.qualys.com/advisory/2026/07/21/snap-confine-set-capabilities.txt
I Inspected My Take-Home Interview Project. It Was a Whole Operation https://lobste.rs/s/5nhto6 #security
https://citizendot.github.io/articles/fake-job-interview-git-hook-malware/
OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root (CVE-2026-57589) https://lobste.rs/s/7hmu0w #openbsd #security
https://nvd.nist.gov/vuln/detail/cve-2026-57589
SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts https://lobste.rs/s/xbfsho #ruby #security
https://www.aikido.dev/blog/sleepergem-rubygems-supply-chain-attack
DirtySlide - root on macOS from one missing bounds check https://lobste.rs/s/27vr6v #mac #security
https://gracecondition.github.io/posts/dirtyslide/
Microsoft Confirms Windows GDID Device Identifier That Cannot Be Disabled, Documented in FBI Case Filing https://lobste.rs/s/agkcmz #security #windows
https://www.ghacks.net/2026/07/12/microsoft-confirms-windows-gdid-device-identifier-that-cannot-be-disabled-documented-in-fbi-case-filing/
A Filtering engine and DB for unpropagated kernel security patches https://lobste.rs/s/pfz6dj #linux #release #security
https://patchless.natey.sh
Opaque, Interoperable Passkey Records https://lobste.rs/s/boyu9x #cryptography #security
https://words.filippo.io/passkey-record/
SELinux Userspace Utilities: Local Denial-of-Service Attack Vectors in seunshare in release 3.10 https://lobste.rs/s/h2qy4t #linux #security
https://security.opensuse.org/2026/07/15/selinux-seunshare.html
Signing TLS handshakes inside a TPM via @fs111 https://lobste.rs/s/vospwq #go #security
https://bschaatsbergen.com/posts/go-tpm-tls/
wp2shell: Pre Authentication RCE in WordPress Core https://lobste.rs/s/aipvbn #security #web
https://wp2shell.com/
Amnesty International (@amnesty) Security Lab just released their most complete breakdown of the Pegasus spyware.
If you have time, go give it a read
You can't bug fix your way out of the vulnpocalypse https://lobste.rs/s/nkrgcp #security
https://alexgaynor.net/2026/jul/15/you-cant-bugfix-your-way-out-of-the-vulnpocalypse/
PyPI releases now reject new files after 14 days https://lobste.rs/s/53g8f7 #python #security
https://blog.pypi.org/posts/2026-07-22-releases-now-reject-new-files-after-14-days/