@bayindirh @codinghorror That sounds bad, but if they have significant historic value shouldn't their trade be restricted in the first place (aka. "it belongs to a museum!")?

Woof. That data breach at Suno last year, but only just disclosed last week, affected over 55 million users, including their names, physical addresses, and phone numbers, according to Have I Been Pwned.

More: https://techcrunch.com/2026/07/21/ai-music-generator-suno-breach-affects-55m-users-per-have-i-been-pwned/

Bypass for ad-blockers: https://web.archive.org/web/20260721144937/https://techcrunch.com/2026/07/21/ai-music-generator-suno-breach-affects-55m-users-per-have-i-been-pwned/

"Dionysius Thrax" sounds like a hammy villain wearing absurdly bulky, spiky armor while zipping around in a hovercraft, but actually he was one of history's biggest nerds https://en.wikipedia.org/wiki/Dionysius_Thrax

@dey Awesome! :) How was it?

Qualys Security Advisory - Local Privilege Escalation in set-capabilities versions of snap-confine (CVE-2026-8933)

https://www.openwall.com/lists/oss-security/2026/07/21/2

Writeup & POC: CVE-2026-49176 Windows WalletService to SYSTEM (LPE) https://davidcarliez.github.io/blog/cve-2026-49176-walletservice-to-system/

ZDI-26-444 - 7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability

https://www.zerodayinitiative.com/advisories/ZDI-26-444/

CVE-2026-14266

@codinghorror Can't wait for past miracle tech like Mercury or Radium do their comeback on the back of LLMs!

"I know that my life has always been vertebrated by two desires: the desire to know and the desire to help, to be of use."

A new page of my comic Ekphrasis, which you can read for free at https://ekphrasiscomic.neocities.org/

[RSS] TruthSocial are selling their API - want it for free?

https://old.reddit.com/r/ExploitDev/comments/1v20jw0/truthsocial_are_selling_their_api_want_it_for_free/

[RSS] Real-world decryption

https://www.bfswa.blog/p/real-world-decryption

[RSS] Crypto etymology

https://www.bfswa.blog/p/crypto-ethymology

[RSS] Escalating All The Privileges With Foxit PDF Reader (CVE-2026-57239)

https://blog.paradoxis.nl/escalating-all-the-privileges-with-foxit-pdf-reader-cve-2026-57239-582a78b60492

[RSS] The Design of Everyday Cryptography

http://dlp.rip/everyday-cryptography

[RSS] Dnsmasq DNS Remote Heap Buffer Overflow

https://blog.exodusintel.com/2026/07/20/dnsmasq-dns-remote-heap-buffer-overflow/

CVE-2026-2291

https://github.com/cisagov/vulnrichment/issues/262
Went from "We intentionally don't include CVSS scores or CWE identifiers in http://kernel.org CVEs, and we'd appreciate it if CISA's ADP stopped adding them." in January to effectively "if you don't do what we say by our deadline, we're going to...

They AI slopped up a few CVEs on SATURDAY and none of what it describes talks about the actual impact, claims NULL derefs/kernel panics/"corrupted ciphertext results"/"decryption bypass". Pure slop.

Same slop assigned a 9.4 "CRITICAL" CVSS to an ext4 infinite loop, I'm not joking: https://lore.kernel.org/linux-cve-announce/2026042247-CVE-2026-31448-3c50@gregkh/

I'm convinced that UI developers are my mortal enemies.

Today's experience: Microsoft Outlook, which I have to assume is popular for some reason.

I go to delete a calendar item that I created for testing. Upon hitting [Delete] on my keyboard, I'm presented with the following dialog.

Which button will continue with the deletion of the item?

• [➡️ Send]
• [🗑️ Discard]

If you selected the 🗑️ button to delete the entry, you're a fool like me. Obviously the [➡️ Send] button is the one you click to delete the thing. [🗑️ Discard] obviously means [❌ Cancel] (do nothing).