@unchartedworlds Of course. Our disagreements root in the fact that you find a street a good analogy for the Internet (in fact, I should've written Fedi/social media), while I don't.

@unchartedworlds The Internet is not the street though, and there seems to be a divide about how different groups of people see the Internet.

Case in point: When I posted first on Fedi I expected my post to be shared, digested, etc. far and wide. Some people clearly expected the opposite.

Norms may have changed, they sometimes do. Still my best bet is that content both of us post on Fedi is shared, digested, etc. far and wide.

@jik "I'm not going to call you names" - I didn't mean you either, sorry for the confusion!

The funny thing is that I don't even think our stances are too far apart, but this topic somehow still triggers flames after all this time.

I expressed my opinion, you expressed yours. I'm OK with not taking this further.

@jik Thanks for the reasonable reaction! I'm thinking about said controls as a band-aid for an already messed up situation (see the first part of my post). E.g. an opt-in system could make all historic posts followers-only by default. This wouldn't affect existing archives ofc. (which do exist whether we like it or not) and may be too much headache for users. We'd need arguments and compromises.

Calling each other names only conserves the current situation where one chunk of users is missing key features while an other is living in a false sense of privacy.

Just published “Vulnerability Analysis of CVE 2025 22226 Information Disclosure Due to OOB Read in VMwares HGFS” by Alex Zaviyalov the first vulnerability in an ITW VMWare guest to host escape chain 👇

https://www.nccgroup.com/media/1mzfvyzl/nccgroup_cve-2025-22226.pdf

We have achieved kernel code execution via the IDT under Windows 11 with VBS/HVCI/kCET enabled.

Read the technical write-up here: https://exploitpack.com/blogs/news/idt-table-hijacking-under-vbs-hvci-kcet-in-windows-11

#Windows11 #KernelExploit #IDT #VBS #HVCI #kCET #DataOnly #RedTeam #ExploitResearch #WindowsSecurity #infosec #pentest

@dsalo See, "we can't even seem to have a proper discussion about the possible solutions". Bye!

@dsalo I think the root of this problem is that people who want to be forgotten historically chose the absolute worst platform for their communication: a public[1] microblogging platform.

I strongly believe a searchable, archived Fedi would be immensely useful and necessary so please don't suggest that everyone in the Fedi are on the same page about this. I'm not against having controls (either opt-in or opt-out) to control indexing on a per-account basis, but unfortunately we can't even seem to have a proper discussion about the possible solutions.

[1] The consent so many people seem to miss is in the act of pressing the button to *publish content on the open Internet*.

TIL when the Windows `copy` command is called with one directory argument it copies all files from that directory to CWD.

This was unexpected.

I'm inclined to draw a Petri net, please send help!

If I gambled on both NFTs and the metaverse to the tune of millions and millions of dollars and even renamed my company accordingly I would be so canceled I’d be farming potatoes, but people are still quoting Zuck AI predictions on my daily news feed.

Doing a presentation tomorrow on our utter dependence on US technology and specifically how we 100% picked US tools/support for cybersecurity as well. We are SO fucking fucked. #sentinel

Can someone explain to me why AI companies are not being investigated for hacking other companies?

In the country I am living in, authorities HAVE TO investigate when they get to know about a crime - even without a criminal complaint (because generally people who were e.g. murdered cannot complain any more...).

Is the US justice system already so broken that this doesn't work any more?

@timb_machine Clear sign of ancient use of antigravity!

#Ghidra 12.1.3 released:

https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.1.3_build/Ghidra/Configurations/Public_Release/src/global/docs/ChangeHistory.md

ASCII Art Farts had the slop era pegged in 2004

The Palo Alto Networks firewall Master Key is p1a2l3o4a5l6t7o8 and it is well past time you changed it!

If you have never changed it, your LDAP service account password is sitting in your firewall config encrypted with a key the whole internet has known since 2016 [1]. So are your API keys, certificate private keys, RADIUS secrets and IPSec pre-shared keys.

And that config is on someone's laptop. In SharePoint. In a ticket you raised with Palo support three years ago.

Public tools [2] will decrypt anything encrypted with the default key. Any threat actor who gets one of those files gets your LDAP service account and walks straight off the firewall into your AD.

This is not theoretical.

Palo's own Unit 42 [3] documented attackers copying running-config.xml to a web-accessible path and retrieving it after exploiting CVE-2024-3400.

Fortinet has had two mass events on exactly this pattern: the Belsen Group dump of ~15,000 FortiGate configs and VPN credentials in January 2025 [4], and FortiBleed in June 2026, where configs from ~75,000 firewalls were cracked offline into working admin credentials [5].

You have always been able to change the Master Key. In my experience nobody ever does as it hasn't been without risk. If you forget to rotate the key before it expires then you risk bricking your firewall.

In PAN-OS 12.2.2, Palo Alto Networks have finally started forcing the issue. It enforces replacement of the default master key within a grace period of 60 days after which the firewall blocks all commits and HA synchronisation. This is a significant operational change and it is not in the release notes but is buried in the admin guide [6].

Three things to do in the next few weeks:

1. Check your config backups are automated and actually working. You want a known-good backup before you touch the key.

2. Change the Master Key. Do it on your schedule, not on Palo's.

3. Rotate the secrets. Changing the key re-encrypts the secret on the box; every copy already out there is still decryptable with the default key.

For more depth see my research [7] and conference talk [8].

[1] @felix "Attacking Next-Generation Firewalls: Breaking PAN-OS", TROOPERS16 — https://troopers.de/media/filer_public/a5/4d/a54da07e-3780-4f83-b4ac-8c620666a60a/paloalto_troopers.pdf
[2] https://github.com/cybliminal/palo-secret-decryptor
[3] https://unit42.paloaltonetworks.com/cve-2024-3400/
[4] https://censys.com/blog/fortigate-config-leak-impact/
[5] https://www.picussecurity.com/resource/blog/fortibleed-inside-the-campaign-that-cracked-75000-fortinet-firewalls
[6] https://docs.paloaltonetworks.com/ngfw/administration/certificate-management/master-key-encryption/configure-master-key
[7] https://cybliminal.com/pdf/Panning_for_Gold.pdf
[8] https://www.youtube.com/watch?v=2PF4aSY1gVo

Frequently Asked Questions

1. what the fuck

[RSS] Stealing the Artifact - JFrog Artifactory Vulnerability

https://www.netspi.com/blog/technical-blog/red-teaming/stealing-the-artifact-jfrog-artifactory-vulnerability/

CVE-2026-42018, CVE-2026-69107