OpenAI Gets Sued Over the Hugging Face Hack https://www.wired.com/story/openai-sued-over-the-hugging-face-hack/

I was wrong. It’s happening

No Time to Pwn – Can AI Find and Exploit the Linux Kernel? https://xbow.com/blog/no-time-to-pwn-cve-2026-72018

[RSS] As a general rule, calling product support while drunk is not recommended

https://devblogs.microsoft.com/oldnewthing/20260929-00/?p=112740/

I don't endorse this message: most support calls require at lest a shot and a few cigarettes to maintain sanity.

Listening to Cloudflare’s CEO say that the only reasons anyone ever makes music is to either get rich or get famous and yeah, I get it. Tech bros don’t art.

Practical Spectre-v2 Attacks in JIT Engines via Stale Branch Prediction Entries

https://www.vusec.net/projects/btr/

Today is the Day of the Hungarian Folktale. So your quest, should you choose to accept it, is to go find a Hungarian folktale a read it / listen to it.

😊

#folktales #folklore #storytelling #Hungary

[RSS] Paint It Blue: Reversing Win32k's Callbacks

https://idov31.github.io/posts/paint-it-blue-reverse-win32k

fucked up that computers don't look like this anymore. tell me you wouldn't live here if you were a one or a zero

This week I feel like I need a t-shirt with the deepest wisdom Reddit can offer about #ReverseEngineering, so I used an LLM to convert a screenshot to an SVG:

https://github.com/v-p-b/dreadful-reversing/blob/main/fuck-reverse-engineering.svg

Go nuts!

The Dutch government has shut down all Citrix Netscalers and is asking every gov org to perform incident response

HT @bert_hubert

https://berthub.eu/tkconv/document.html?nummer=2026D47262

#PitScaler

Kiteworks patches the vulnerability law enforcement warned it about last week and revokes its "take server offline" recommendation

https://www.kiteworks.com/company/press-releases/kiteworks-restores-systems-credible-threat/

Whoa!!!

https://lists.debian.org/debian-security-announce/2026/msg00441.html

#IT #Security #Linux #Debian

New kill chain just dropped

[RSS] CVE-2026-43783: Repair Permissions - Get Root: LPE via DesktopServicesHelper in macOS 26.5

https://ptswarm.com/blog/cve-2026-43783-repair-permissions-get-root-lpe-via-desktopserviceshelper-in-macos-26-5/

[RSS] Sender spoofing in Proton Mail via display-name homograph

https://alonsovidales.github.io/protonmail-sender-spoofing/

OpenAI delaying its model launch (and IPO) due to security concerns reminds me of 8yo me delaying the launch of my nerve gas rocket (made of paper and stuff I found in the kitchen, probably inspired by The Rock with Nicholas Cage) for similar reasons.

Later we agreed in mutual disarmament with my toy soldiers.

I made a thing: it's called the DNS Museum, and it's because I kept joking at the start of my talk, "Bizarre and Unusual Uses of DNS" that a lot of the things weren't alive anymore - so it was more like a museum of DNS and I was the curator. Anyway, I'm on holiday right now so I finally got around to doing something about that joke.

Consider this a first draft, I have way more notes about other things to add at some point. It's also a little bland, but one thing I'm not is a designer. Let me know about any issues - AI was used to help create the site, but of course I'm responsible for any mistakes. It's on GitHub too, so PRs are welcome.

https://dns.museum

Some brief thoughts on AI in hacking and optimizing for speed:
https://mahaloz.re/2026/09/28/hack-race.html

A bit is also a response to Flare-On 13.