Congrats to Steve Weis at Anthropic for factoring RSA-896 in 10 days adapting CADO-NFS to run on a max of 2048 GPUs.

No algorithmic breakthrough, just code optimized for recent parallel compute architectures.

“it does demonstrates that RSA-1024 keys are vulnerable to many actors with data center-level fleets of GPUs.”

https://saweis.net/posts/rsa-896.html

TECHNLGY/TECH.GIF

Monday morning, same old feeling…

Have a great week all!

"HEIF Heist is Hacktron's name for a class of remote attack paths targeting services that decode attacker-controlled HEIF, HEIC, or AVIF images"

https://heif-heist.com/

Cool finding, but these issues have been around for ages. It's embarrassing for all the affected large corps that they didn't care to invest in testing their dependencies and proper sandboxing.

Seems like AI companies are not that easygoing when they are on the wrong end of hacking :P

https://threadreaderapp.com/thread/2101252692635004997.html

New Pwndbg release!

We now disassemble code backwards in context and nearpc, display indirect jumps, nearpc -f works without debug syms, added stack-vis command to visualize stack frames, improved v2p, p2w and pageinfo kernel debugging commands & more!

See https://github.com/pwndbg/pwndbg/releases/tag/2026.09.15

Please sponsor us: https://github.com/sponsors/pwndbg !

#pwndbg #gdb #lldb #reverseengineering #security #lowlevel #exploitation #pwning

@kaoudis 100%! I recently read that even some of our most respected writers were huge fans of the cheap entertainment stories of the era. Max Martin would have given Beethoven ear worms too (if he could hear it).

Are "HACK THE PLANET" t-shirts responsible for multi-modal prompt injection into the agents at world leading AI labs?

Lasers. Microscopes. $250K. One secured chip.
Ledger Donjon just showed how they cracked debug access on RP2350-A4, a break worthy of Raspberry Pi's own Hacking Challenge.
Respin or no respin? Raspberry Pi says no. Read why: https://www.raspberrypi.com/news/everything-is-better-with-lasers/

I love a cartoon that sums up a line of argument I have often made as a political economist, so here's a great example from the (recently deceased) P.C.Vey - whose work appeared in the New Yorker & elsewhere.

#economics #regulation #politics

h/t Loren Fox/LinkedIn

Windows Defender Update DoS Vulnerability https://github.com/MSNightmare/BigDiskBuster

My son is reading Lord of the Rings for the first time and he just stuck his head out the door:

"Who the fuck is Tom Bombadil??"

[RSS] What Go Taught Us About Java Garbage Collection

https://debugagent.com/what-go-taught-us-about-java-garbage-collection

At a high level, this was the full exploit chain.

1. HEIC/HEIF upload
2. ImageMagick decoding
3. Heap overflow on libheif
4. RCE on https://community.openai.com
5. Critical OpenAI SSO flaw
6. ChatGPT/Codex takeover
7. Connected GitHub access
8. Internal repo PR

This meme has so much telling about the current status of AI racing as well as how everyone seems to have forgotten the basic IT security.
https://bird.makeup/users/0xtib3rius/statuses/2101147121063751903

[RSS] Quarkdown: Turing-complete Markdown typesetting system

https://github.com/iamgio/quarkdown

~~There is a demand for this. Shut up.~~

Edit: actually, this seems really useful, although I don't know why Turing-completeness was chosen as the selling point :)

LMAO, can we just issue one giant CVE for the entire Linux kernel

PoC for CUPS LPE on Linux https://github.com/v12-security/pocs/tree/main/cups/cups2root

@buherator i remember reading during the second iraq war, operations led by the british had far fewer friendly fire casualties because they had not just a system for putting a case for a target together, but also researchers trying to rule out the validity of a target (that's a friendly, that's a school, etc)

the americans didn't have that

...then they automated it

and i guess, *now* the stakes are high enough to give them a target offramp, huh

@frobozz My prediction is that this will be covered by some bullshit about "adjustment" then a few million will be spent on additional guArDrAILs then the next hallucination will cause actual damage. So yeah, not a bad bet.