Fuck this bullshit. This 2024 CVE was just published today. Which, fine, whatever. It happens. Except it specifically says it was observed EITW in July 2024.

https://www.cve.org/CVERecord?id=CVE-2024-58388

Exploitation evidence was first observed by the Shadowserver Foundation on 2024-07-30.

Witholding a CVE for something known to be EITW for over two years is fucking bullshit. Especially when the PoC was published in June 2024:

https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html#pre-auth-lfi

But at least there's a Nuclei template:

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/crocus-lfi.yaml

Exclusive: Israeli spyware maker Paragon positions itself as more responsible than its competitor NSO Group. But the company's new US CEO says in a candid interview that while they will cut off customers who misuse their spyware they have no ability to detect or investigate customer misuse, nor do they want that ability. Their tools also don't log customer activity by default. Though customers can configure some tools to do logging, Paragon doesn't have ability to force customers to provide those logs if allegations of abuse arise. Paragon says instead that it relies on third parties like Citizen Lab to detect abuse by its customers, and even praises Citizen Lab for uncovering suspected abuse in 2025, yet at the same time the company actively works to prevent Citizen Lab and others from detecting its spyware on infected systems, thus thwarting their ability to uncover abuse. Here's my story:

https://www.wired.com/story/the-secrets-of-the-us-spyware-king/

welp. I have exceeded my disgust tolerance for the week; fuck all this shit

https://techcrunch.com/2026/09/30/hackers-stole-millions-of-us-military-personnel-records-during-months-long-data-breach/

CVE ID: CVE-2026-76504
Vendor: Cisco
Product: Catalyst SD-WAN Manager
Date Added: 2026-09-30
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-76504

@catsalad @bongoknight @cR0w

I still remember the day in 1976 when Gary Kildall typed in "dir" to an "A>" prompt on his hazeltine green-screen character display to show me a directory listing on his 8080-based, eight-bit computer running the first release of CP/M, the first real microcomputer operating system (that Gary wrote). He gave me a shy but proud look and asked what I thought. It seemed miraculous to me, and I was hooked.

Anyway, I just tried to rename a file on my Windows 10 PC and midway through the operation Microsoft deleted the file instead. I guess we've really come a long way since those early days 50 years ago. <sigh>

OpenAI Gets Sued Over the Hugging Face Hack https://www.wired.com/story/openai-sued-over-the-hugging-face-hack/

I was wrong. It’s happening

No Time to Pwn – Can AI Find and Exploit the Linux Kernel? https://xbow.com/blog/no-time-to-pwn-cve-2026-72018

Listening to Cloudflare’s CEO say that the only reasons anyone ever makes music is to either get rich or get famous and yeah, I get it. Tech bros don’t art.

Today is the Day of the Hungarian Folktale. So your quest, should you choose to accept it, is to go find a Hungarian folktale a read it / listen to it.

😊

#folktales #folklore #storytelling #Hungary

fucked up that computers don't look like this anymore. tell me you wouldn't live here if you were a one or a zero

The Dutch government has shut down all Citrix Netscalers and is asking every gov org to perform incident response

HT @bert_hubert

https://berthub.eu/tkconv/document.html?nummer=2026D47262

#PitScaler

Kiteworks patches the vulnerability law enforcement warned it about last week and revokes its "take server offline" recommendation

https://www.kiteworks.com/company/press-releases/kiteworks-restores-systems-credible-threat/