Coldcard devices used predictable RNGs, and apparently this has consequences. 😂

I'm pleased to announce a new release of the #idalib #Rust bindings for @HexRaysSA IDA Pro! This release adds compatibility with latest SDK (v9.4), and a couple of bug fixes. Thanks to @raptor and @yegor for their contributions.
https://github.com/idalib-rs/idalib.git

Happy Sys Admin Appreciation Day to all to who observe it.

This made us think

Yet another attack against the Arch User Repository is underway. We are monitoring and analyzing the malware samples.

https://discourse.ifin.network/t/new-aur-attack-prompts-adoption-lock/698

#ThreatIntel #ThreatIntelligence #IFIN

anyone experienced with #outdoor high-speed #ethernet (~150m) cabling and possibly also somewhere half-way injecting solar-based PoE? is this a thing?

[RSS] LLMs won't break symmetric crypto

https://www.bfswa.blog/p/llms-wont-break-symmetric-crypto

Anthropic choosing an asshole as the logo for Claude is the most honest marketing move in recent history.

Somehow, we have ended up in a universe where companies brag about deploying multibillion dollar software systems with an objective to break decades old IT security legislation, and nobody holds their executives to account.
https://www.wired.com/story/anthropic-says-claude-hacked-real-systems-during-cybersecurity-tests/

#VMware: three critical #vulnerabilities in VMware vCenter, ESX, Workstation, and Fusion, allow attackers to bypass authentication, execute arbitrary code, or escape from a virtual machine to the host. Patches released by Broadcom - it's time to patch!
👇
https://www.bleepingcomputer.com/news/security/vmware-fixes-three-critical-flaws-allowing-auth-bypass-vm-escapes/

For the nerds in the back:

Not understanding how your program works is not an excuse for it doing the bad shit it was literally programmed to do.

@codinghorror CEOs often work for minimal wage for tax reasons around here. But even that case is much better than simply asking your billionaire friends to push literal peanuts your way along with a job contract 2 years before you run for office.

Wiz found a master key that could access every database in Azure's Cosmos DB. #cosmosescape

Whoops.

https://nitter.net/yuvalavra/status/2082864672294736324

My present to all of you: Go ahead and think a bit about why such a key even exists. Go ahead...

AI: Considerations for people who make decisions. There is enormous pressure to deploy AI, and if you believe the LinkedIn thought leadership, you'd think that if you don't get on board NOW you'll be lost forever. Meanwhile other people severely detest AI, so much so that it damages their (worthwhile) arguments against it. Below, thoughts on what to do now, and what things might best be postponed. Finally, some stimulating words on what we actually DO at the office: https://berthub.eu/articles/posts/ai-for-decision-makers/

This wonderful wallpaper and the Issue #9 cover were created by Vasyl/Joker^NAH^TRSI. Both this and other wallpapers, as well as Issue #9 which just came out, can be downloaded from Paged Out!'s website!

This feels like kindergarteners making up stories about who fell bigger with their scooters during summer break :P

https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals

[RSS] Escaping Linux Sandboxes via PipeWire (CVE-2026-5674)

https://embracethered.com/blog/posts/2026/pipewire-flatpak-linux-sandbox-escape-cve-2026-5674/

Reproduced the LPE in 1h 56m on Linux 6.12.96 LTS.

Also managed to get root on Pixel 10 with the latest 2026-07-05 security update.

It was originally submitted by another researcher to Google KernelCTF as exp527 and should qualify for a $101,337 bounty.
https://bird.makeup/users/spendergrsec/statuses/2082627090310938838

Fun engineering challenge if anyone has ideas:

The DisplayPort auxiliary channel appears to reuse opcodes for request and completion packets, and uses generally the same framing. This means that, to a first order, if you have a single packet, or a capture that starts in the middle of a long burst of transactions and don't know if you are at an even or odd packet boundary, it is not trivially possible to unambiguously decode the traffic.

Is there a heuristic that you can apply to the first few packets in a capture to determine which one is a request vs a completion and correctly phase the capture?

Slop-coded SPARC64 exploit for Solaris kernel vuln that recently been fixed in Illumos by Dan McDonald:
https://www.illumos.org/issues/18118
https://github.com/illumos/illumos-gate/commit/08292a06bdfa570d21571965b7bd0f053b3aaaa5
No KASLR, no kernel heap NX -- ain't difficult target, heh. I don't have an access to latest 11.4 SRU to check if it was fixed by Oracle on current version, but on 11.3 SRU 36 it still there