This affects the Fediverse.

This affects the Internet.

This is the equivalent of the "rubber hose method" of decryption.

All technical solutions (read: all technology) is subject to politics. To political power. To political interactions.

You cannot rely on purely technical approaches. You have to have social approaches, too. Like. Actual policy and procedure geared around social and political group dynamics.

Like. How will we react when the US Govt requires that @jerry to shut off infosec.exchange servers.

Or how we'll react when a specific Mastodon server is declared part of a terrorist infrastructure. Will federating with it mean any other Mastodon server is now part of the officially designated terrorist network (what then of people that federate with a server that federates with a server that is classified as part of a terrorist network. And so on)

You cannot carry the conceit that tech alone or a purely technical approach will save you.

#AutisticiInventati #fediverse

https://sabot.media/post/ai-shuts-down

I regret to inform everyone that my copy of QBittorrent escaped its sandbox last night and downloaded a whole bunch of content owned by major corporations, and then my copy of Jellyfin broke containment and added those unfortunately-downloaded media files to its various libraries. I'm conducting an internal investigation to figure out how this happened, which will involve consuming these media files until the answers become apparent. Thank you for your cooperation during this trying time.

@Edent

"I can understand why .bid and .loan are popular with scammers. But why .mobi?!" -> because the avg user has 0 clue about what a domain name is, what its parts are and what they signify. Not to mention URLs...

"What can be done?" -> So far I could only think of enforcing a strict domain allow list for users (at the endpoint/browser) who don't know better.

It was brought to my attention that Real Hack History, a youtube channel, has been uploading documents, audio and video related to hacking history to the Internet Archive and they deserve a little collection. I'm making them for them now but you can look at their excellent uploads immediately.

Really good stuff. Really well sourced.

https://archive.org/details/@realhackhistory

Hot take:

a 20 kloc PR - even if it fixes the problem or adds the feature perfectly - is spam.

it is spam because it overwhelms the reviewer, who is then unable to reasonably perform their duty of actually comprehending and checking the code to make sure it does what it's supposed to.

Micropatches released for "ResetNightmare" Windows Kerberos Elevation of Privilege (CVE-2026-27912) https://0patch.com/blog/micropatches-released-for-resetnightmare-windows-kerberos-elevation-of-privilege

I'm launching a series of short posts about the tools I've built to automate
reverse-engineering workflows. I've used them to analyze protections such as
SafetyNet, DexProtector, iXGuard, and Arxan.

First up: MCStone, a clean & efficient assembler and disassembler built on LLVM's MC layer.

https://www.romainthomas.fr/project/mcstone/

An interesting paper: Frontier Models’ Vulnerability Patches are Often
F.L.A.W.E.D.

https://1password.com/files/resources/frontier-models-vulnerability-patches-flawed.pdf

Epoch is live! ⚡ Time Travel Debugging built for the agentic era.

Record full-system execution from Kernel to userland, then let your AI agents investigate the trace: instructions, registers, memory, all replayable forward and backward.

Discover Epoch: https://www.eshard.com/blog/introducing-epoch-time-travel-debugging-built-for-the-agentic-era
Dynamic analysis has never been so powerful.

#reverseengineering #cybersecurity #ai #agenticreversing #agentic #agenticai #cybersec

Want to write kernel exploits or analyze malware? You need to understand Windows internals first. Syscalls, IRQL, pools, mitigations & more. Architecture 2821: Windows Kernel Internals 2 by Cedric Halbronn @saidelike https://ost2.fyi/Arch2821

Oh lovely. Our government is investing €500m into slop, and are joining the AI Gigafactory program.

Can the bubble burst already, please?

https://bynar.io/blog/linux-has-screensharing-rces-too
Welp time to update

PLACES/TAXCO7.GIF

How accurate have Ed Zitron's AI skeptic predictions been?

https://danluu.com/zitron/

[RSS] Chamilo LMS... It's raining 0days, hallelujah, it's raining 0days

http://blog.quarkslab.com/chamilo-lms-its-raining-0days-hallelujah-its-raining-0days.html

[RSS] Binary Ninja 6.0 (Krypton)

https://binary.ninja/2026/09/03/binary-ninja-6.0-krypton.html

TIL #MermaidJS supports packet diagrams since v11.0.0!

https://mermaid.ai/open-source/syntax/packet.html

Can't wait to try this!

Interesting Git repos of the week:

Bugs:

* https://github.com/MSNightmare/FalconFlank - everyone's favourite new source of 0day pops CrowdStrike Falcon
* https://github.com/MSNightmare/HardBreacher - everyone's favourite new source of 0day pops Kaspersky AV

Hard hacks:

* https://github.com/salmg/SIMtrace2-T1-Research - research into SIM cards
* https://github.com/i12bp8/TagTinker - messing with IR on the Flipper Zero
* https://github.com/nickdaria/wyze-bulb-color-pwned - and Nick opened the firmware and set "let there be light..."
* https://github.com/jprx/darwin-vm - the Apple never falls far from the tree

Hardening:

* https://github.com/a13xp0p0v/linux-kernel-defence-map - mapping the Linux kernel attack surface
* https://github.com/ryancdotorg/libclaymore - @ryanc defuses dd

Data:

* https://github.com/going-doer/Paper2Code - generate PoC code from papers 🤖
* https://github.com/adulau/ptrclassify - what's in a name asks @adulau

#security, #research, #code

make bad art

@ppb1701 @AAKL

- How drunk did you get last night?
- Oh, they just had to alert the Gripens...