Posts
3255
Following
708
Followers
1565
"I'm interested in all kinds of astronomy."
repeated

Just read this via repost from @HalvarFlake
https://sean.heelan.io/2026/01/18/on-the-coming-industrialisation-of-exploit-generation-with-llms/

This post from Sean Heelan is probably the most important post in that domain (being LLMs in offensive security contexts) in quite a while. We're already discussing this in my research group, and I have some initial thoughts. Exciting times!

0
2
0
RCECoaster, an exploit for Rollercoaster Tycoon 1999

https://github.com/RickdeJager/RCECoaster
0
1
0
repeated

Bit of a long shot, would anyone on here know how to get in touch with anyone from the Finnish demoscene group Future Crew, in particular Psi (Sami Tammilehto)? Are any on them on fedi? They must be in their 50's now.

I'd like to ask if he still has the Scream Tracker 3 source code, and if he would consider releasing it... It's such an important part of computing and music history. It deserves preservation.

0
6
0
repeated

At Berlin 2025, a full exploit chain against VMware Workstation was demonstrated via a heap overflow in the PVSCSI controller.
Despite Windows 11 LFH mitigations, advanced heap shaping and side-channel techniques enabled a reliable exploit.

๐Ÿ” Full technical write-up ๐Ÿ‘‡
https://www.synacktiv.com/en/publications/on-the-clock-escaping-vmware-workstation-at-pwn2own-berlin-2025

0
2
0
[RSS] CVE-2026-23864: React and Next.js Denial of Service via Memory Exhaustion

https://www.akamai.com/blog/security-research/2026/jan/cve-2026-23864-react-nextjs-denial-of-service
0
0
0
#Kubernetes Remote Code Execution Via Nodes/Proxy GET Permission

https://grahamhelton.com/blog/nodes-proxy-rce

Thread with vendor response/workaround:

https://threadreaderapp.com/thread/2015789985459212714.html

#k8s
0
0
1
repeated

Odd anomaly caused Microsoft's network to mishandle example.com traffic
Company's autodiscover caused users' test credentials to be sent outside Microsoft networks.
https://arstechnica.com/information-technology/2026/01/odd-anomaly-caused-microsofts-network-to-mishandle-example-com-traffic/?utm_brand=arstechnica&utm_social-type=owned&utm_source=mastodon&utm_medium=social

2
6
0
repeated

My first blog post on Windows Administrator Protection is out. https://projectzero.google/2026/26/windows-administrator-protection.html probably the most interesting and complex bug out of the 9 I found, but that doesn't mean the rest weren't interesting as well, stay tuned :D

1
11
0
repeated

Felicitas Pojtinger ๐Ÿ”œ FOSDEM

RE: https://infosec.exchange/@briankrebs/115962508398912420

This might actually be the point where I just refuse to go.

Not getting an Apple/Google-sanctioned phone with SafetyNet in order to enter a country.

0
1
0
[RSS] More Scope Injection for Fun and Profit (or, why those security updates broke your functions) [ColdFusion]

https://www.hoyahaxa.com/2026/01/more-scope-injection-for-fun-and-profit.html
0
0
0
[RSS] Districton 1 Slides - Control the Variables and You Control the Code: Language-Level Vulnerabilities in Adobe ColdFusion

https://www.hoyahaxa.com/2026/01/districton-1-slides-control-variables.html
0
0
0
[RSS] After reporting vulnerabilities found in MDT, Microsoft chose to retire the service rather than fix the issues... Admins should follow the defensive recommendations to mitigate the issues if they choose to continue using the software or can't migrate to a different solution.

https://specterops.io/blog/2026/01/21/task-failed-successfully-microsofts-immediate-retirement-of-mdt/
0
2
4
repeated

Sign-up and first information are now live!
Save the date and start working on your productions!
https://2026.revision-party.net/

0
1
0
repeated

๐Ÿ†• The URL Pattern API is Newly Available!

Use it to match and extract parts of URLs, no need to reinvent routing logic. Supports literals, wildcards, named groups, and even regex constraints.

Learn how it works ๐Ÿ‘‡
https://developer.mozilla.org/en-US/docs/Web/API/URL_Pattern_API

0
3
0
repeated
repeated

Meta drops appeal against court ruling requiring non-algorithmic social media timelines https://nltimes.nl/2026/01/26/meta-drops-appeal-court-ruling-requiring-non-algorithmic-social-media-timelines

0
2
0
repeated

Hands-Free Lockpicking: Critical Vulnerabilities in dormakabaโ€™s Physical Access Control System https://sec-consult.com/blog/detail/hands-free-lockpicking-critical-vulnerabilities-in-dormakabas-physical-access-control-system/

0
3
0
repeated
repeated

Frankly: binaries are the thing that executes on your system and embody the truth of software behaviour, and with modern technology it's often *easier* to determine that truth through the binary than through the source code (throw the "login" app from Reflections on Trusting Trust into Ghidra and you'd learn the truth even if the source code wouldn't tell you that)

4
5
0
Show older