Oh cool, Ollama on Windows has unpatched vulnerabilities that lead to Ollama downloading unverified updates from a malicious URL if set locally, and also path traversal that leads to arbitrary file write.

Disclosure without patch.

https://www.striga.ai/research/ollama-windows-auto-update-rce

The world is now so full of ridiculous things that at least I struggle to deal with it all. But this is not an 'us' problem. The (political) world really is idiotic. I needed to vent a bit, so I made a list of things that are impossible to believe, yet are very much what is happening. Perhaps seeing it in writing will help you deal better with the situation. https://berthub.eu/articles/posts/the-impossible-things-we-have-to-believe/

This. 👇

Defender nuked legitimate DigiCert roots as malware because Microsoft shipped detections for a real DigiCert breach without distinguishing root certs from the compromised code-signing ones. Your trust store is one bad signature update away from triage hell.
https://www.bleepingcomputer.com/news/security/microsoft-defender-wrongly-flags-digicert-certs-as-trojan-win32-cerdigentadha/

Google Chrome is silently installing a local LLM on your computer that is 4 gigabytes in size. It's done without consent, it's not visible in the settings, and removing it will reinstall it later.

https://www.thatprivacyguy.com/blog/chrome-silent-nano-install/

@stf Given that 1) naming things is hard and 2) you shouldn't reinvent the wheel, you just take the name of a similar project. (and this is how eventually every OSS project becomes "curl")

The existence of a weird proxy economy for AI tokens is very effing cyberpunk, AI issues notwithstanding (or perhaps especially). (Also, China Talk is an *excellent* source for lots of current tech-related goings-on.)

https://www.chinatalk.media/p/how-to-buy-cheap-claude-tokens-in

@openrightsgroup @torproject

This is the wrong message. Ministers do not care about undermining the open web. They see openness as a bug, not a feature.

The message you need to highlight is that the OSA is handing more control to US tech companies that are under the control of Trump.

To kick off his collaboration with @portswigger as a Burp Suite Ambassador, our Research Lead @apps3c just published the 10th article on the creation of extensions for #BurpSuite. Topic: #Burp #AI!

https://hnsecurity.it/blog/extending-burp-suite-for-fun-and-profit-the-montoya-way-part-10/

30 readers took our C/C++ challenge. Some solved the Linux warmup, but nobody cracked the Windows driver bug. Even LLM-assisted submissions came up short.

The walkthrough explains both, including the Windows escalation from local DoS to kernel code execution.

Best 10 submissions are still getting swag. If you won, we'll be in contact.
https://blog.trailofbits.com/2026/05/05/c/c-checklist-challenges-solved/

Proton Pass: Second-Password Bypass Through Emergency Access https://www.zolder.io/blog/proton-pass-second-password-bypass-through-emergency-access/

[RSS] pyghidra-mcp Meets Ghidra GUI: Drive Project-Wide RE with Local AI

https://clearbluejar.github.io/posts/pyghidra-mcp-meets-ghidra-gui-drive-project-wide-re-with-local-ai/

+ CVE-2024-3273 analysis (D-Link)

Coroutine stack-to-heap overflow via unbounded recursion in NAR directory parser

https://github.com/NixOS/nix/security/advisories/GHSA-vh5x-56v6-4368

#Nix #Lix

#NoCVE atm

AISLE boasts about their AI tooling and CVE-2026-42511:

"Our autonomous AI system found another critical vulnerability in the FreeBSD DHCP stack - an unauthenticated remote code execution vulnerability with root privileges.

This finding is significant not only because RCE as root is about as severe as it gets, but also because FreeBSD was explicitly included in Anthropic’s Mythos announcement, and Mythos did not identify this issue."

[RSS] Recursively fuzzing MS-RPC structures and monitoring using ETW

https://incendium.rocks/posts/Fuzzing-MS-RPC-structures-and-monitoring/

[RSS] [WIP] Resolve indirect calls in Binary Ninja with DynamoRIO instrumentation

https://github.com/klemmm/indyresolve

@freddy Look at the bright side: you don't have to carry your bags across the city!

@hajovonta If only I could install updates! But since time is desynchronized...

It's 2026 and Windows still can't synchronize time

Hister has joined the #fediverse

Hister is a general purpose web search engine providing automatic full-text indexing for visited websites.

Follow to be up-to-date with development news, releases and related articles.

#search #selfhosted #freesoftware