flock ceo calls for compromise

you heard em, hackers

Chaining CVE-2026-55040 and CVE-2026-63520 for full auth bypass-to-RCE in Microsoft SharePoint: https://www.vulncheck.com/blog/cve-2026-63520-sharepoint-unsafe-type-rce

Know your paradoxes, or how to protect yourself against sentient machines: https://lcamtuf.coredump.cx/blog/paradoxes/

@foone That's enterprise security 101!

it's the last week of my summer sale -- get 50% a copy of "building git" using code BGAUG2026 at https://shop.jcoglan.com/building-git/

LAST WEEK to submit — #OffensiveCon26 Tokyo CFP closes soon.

We want real, original work: cutting-edge security research, novel exploit techniques, AI and deep technical investigations that actually move the field forward.

Can somebody give me a definition of metamorphism for something that aren't rocks? Specifically in binary code generation, how do you define metamorphism?
#metamorphic #metamorphism

Uh nice Keycloak critical 🔥 how did i miss that one x3

https://github.com/keycloak/keycloak/issues/51833

I should not have to use an LLM to figure out a menu hierarchy.

I should not use an LLM to figure out how to undo the result of a hotkey.

LLMs (and search engines) should not be excuses for shitty #UI.

So sparc64 is officially a base-clang architecture now. The first bulk as such is just under 2 hours in.

If you ask "base-clang? What?" - OpenBSD has two types of architectures. Those where cc is the old gcc, and those where cc is clang. After a lot of work by kirill@, sparc64 has switched to using clang by default.

We are pleased to release tmp.0ut 5 Volume!

Get your viruses, rootkits, strange ELFs, weird machines, tiny files, cool art, and phresh beats here!!

https://tmpout.sh/5/

illustration, creative computing, magazine (1983) https://archive.org/details/creativecomputing-1983-08/page/n141/mode/2up

Hister v0.18.0 is out!

- New search suggestion UI with history completions, fields, facets, and sorting
- Import PDF, DOCX, Markdown, Org mode, and text files
- New Twitter, Bluesky, Reddit, and Discourse extractors
- Responsive terminal result details
- Persistent sessions and safer MCP results

https://github.com/asciimoo/hister/releases/tag/v0.18.0

#Hister #SelfHosted #OpenSource #freesoftware #search

“Before you become too entranced with gorgeous gadgets, remember that the goal is not to have more information, but to have more understanding.”

— Arthur C. Clarke

Does anyone actually have real-world examples of widescale token theft occurring through compromised middleware boxes or accidental logging of tokens?

100 companies are responsible for 71% of global emissions.

They told YOU to recycle better while they polluted more.

Don't fall for it.

Hold systems accountable.

#ClimateCrisis

Credit: Abilu Tangwa

@joe BSD and LSD both hail from Berkeley. We do not believe this to be a coincidence

Dutch Pension Fund Pulls Nearly Half a Billion Euros From Climate ‘Megapolluter’ BlackRock.

“This is a massive win for Dutch pensioners—not to mention all living creatures on Earth.” #ClimateChange #GlobalWarming

https://www.commondreams.org/news/blackrock-climate-change

For the past almost a year, I’ve been building a fully working, 1:1 scale Tune Thumper Bike from Mario Kart World!

Full build video: https://youtu.be/vbM31wagyRg

The bike is fully functional. The cassette tape door is also a Nintendo switch 2 dock, so when you put the switch in and plug in hdmi to tv, it outputs without any other power source needed.

Specs:
~65mph top speed
~70lb
Fully functioning buttons, speakers, lights, antenna, nintendo switch 2 dock
wood, steel, and a ton of 3d printing

We gave hundreds of developers an AI agent that can run shell commands, edit files, and call MCP servers on their laptops.

Then we realized we had no record of what it actually did.

So we built one.

1 bash script, 280 lines, no dependencies. Cursor hooks fire it on every tool call. Elastic Agent ships the log to Elasticsearch.

Since the May rollout: 13M+ tool-call events across 1,100+ machines.

What the data showed:
- File reads outnumber shell commands roughly 4 to 1: agents mostly read your codebase before acting
- 300+ distinct MCP servers in use, 86% of them by only 1 or 2 people
- The CLI surface alone produced nearly a fifth of all events

"Which hosts ran an agent that read a .pem file last week?" is now 1 ES|QL query.

We log commands, paths, and tool names. Never file contents, prompts, or responses.

Full writeup from Wieger van der Meulen on the InfoSec team: the collector script, hooks.json, the 2 deployment gotchas that cost the most time, and the ES|QL hunting queries.

https://go.es.io/4wHDZID