Fun engineering challenge if anyone has ideas:

The DisplayPort auxiliary channel appears to reuse opcodes for request and completion packets, and uses generally the same framing. This means that, to a first order, if you have a single packet, or a capture that starts in the middle of a long burst of transactions and don't know if you are at an even or odd packet boundary, it is not trivially possible to unambiguously decode the traffic.

Is there a heuristic that you can apply to the first few packets in a capture to determine which one is a request vs a completion and correctly phase the capture?

Slop-coded SPARC64 exploit for Solaris kernel vuln that recently been fixed in Illumos by Dan McDonald:
https://www.illumos.org/issues/18118
https://github.com/illumos/illumos-gate/commit/08292a06bdfa570d21571965b7bd0f053b3aaaa5
No KASLR, no kernel heap NX -- ain't difficult target, heh. I don't have an access to latest 11.4 SRU to check if it was fixed by Oracle on current version, but on 11.3 SRU 36 it still there

I dunno how many people remember a few months ago when OpenAI made media headlines everywhere for launching Atlas, their AI agent browser... which was going to revolutionise how we use technology and rival Google.

Anyway, neither do OpenAI as they abandoned it and deleted the downloads.

Well played local book store, well played...

New Pwndbg release!

Added exithandlers cmd, kernel debug improvements + new cmds, support for glibc 2.43 heap dumping, track-heap --where, richer procinfo output (e.g. see those chromium/firefox pipe pairs!) & MORE!

See more at https://github.com/pwndbg/pwndbg/releases/tag/2026.07.29 !

Sponsor us: https://github.com/sponsors/pwndbg !

#pwndbg #pwn #debugging #gdb #lldb #exploit #ctf

New directory traversal CVE!
CVE-2026-15435
IBM - App Connect Enterprise
IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system.

So many POSIX 'RATIONALE' sections can be distilled to:

One vendor did stupid thing A. Another did stupid thing B. We defined this interface to permit both implementations because designing a third thing that's sensible is, sadly, not within our remit and there are existing consumers of both of the stupid APIs.

"You don't need pentesters anymore." - Every hype cycle, ever.

While the AI debate continues in Vegas, we'll be busy finding the bugs it missed and proving which "findings" were never vulnerabilities in the first place.

Happy Black Hat & DEF CON!

#BlackHat #DEFCON #AppSec #AI #CyberSecurity #HackerSummerCamp #doyensec #security

https://www.wiz.io/blog/cosmosescape-taking-over-every-database-in-azure-cosmos-db

sometimes I say "no worries!" when I am at least 33% worries

Another security position at Mozilla. Help manage our (web) bug bounty program on HackerOne as a Senior Security Engineer https://job-boards.greenhouse.io/mozilla/jobs/8088831 (job posting says Germany, but other countries are eligible, use the job search)

Check @aleeamini 's post. He has done a remarkable job of analyzing samples from last year's wipe of Iranian banks. I briefly wrote and talked about the operation before, but now that the cat is out of the bag, I guess everyone gets to enjoy the craftsmanship behind it. The blog post covers only the post-exploitation phase and local side of works, jumping from local access to unrestricted firmware and memory. The initial access remains uncovered here, but I strongly believe at least one of the RCEs dell fixed last year was used for gaining initial access to storage devices.

The structure and style of tooling and operation is also very similar and hallmarks of the infamous Predatory Sparrows. Details about this overlap will remain TLP gated though. You might remember a glimpse of that from the wiping attack against Iranian gas stations and fuel distribution system, which also attempted soft-bricking POS devices installed on pumps, combined with partial wipe of mid-level management and relay servers.

One of the most interesting aspects of these wipers used in Iran, which I believe are first of its kind publicly documented as well, are combining software based wipes with physical disruption of operation of device switches. This is mostly an effort to further block attempts to interrupt the wipe operation by physically switching off or restarting the storage device on-site. That alone buys some extra wipe time, before datacenter operators literally pull the plug on machines.

https://aleeamini.com/firmburn-firmware-zero-day-scsi-passthru-burned-iran-banks-hack/

RE: https://infosec.exchange/@david_chisnall/117007707710681727

“All encryption is end-to-end, if you’re not picky about the ends.” -- Chris Fenner

yay, my 13th (14th?) chrome cve!!
https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html

The screensharingd bug that was killed on latest updates, is a pre-auth, contrary to what the company that disclosed it to Apple is writing. This is an amazing bug that allows to pwn any unpatched Mac that has Screen Sharing enabled. If you have it enabled go patch now. If you have old versions for which a 5T company doesn't bother to release patches, good luck!

Releasing a PoC that just allows to download any file from vulnerable machine.

https://reverse.put.as/2026/07/29/its-a-pre-auth-stupid/