Reminder: We're less than an hour away from the drawing for #Pwn2Own Ireland 2026. Watch it on YouTube at https://youtube.com/live/QpP2xDXGa8M?feature=share

Interesting Git repos of the week:

Detection:

* https://github.com/fevar54/CVE-2026-76461-Detection-Kit- - hunting for Cisco's ESA oopsicle
* https://github.com/msuiche/hotcell - you can't even trust a document written by Apple these days

Bugs:

* https://github.com/pwardle/not-a-mused - stealing from the Muse

Exploitation:

* https://github.com/crypt0p3g/dpapi-toolkit - I got the key, I got your secrets...
* https://github.com/Mafifrizi/tanuki - @kraiiandrey operationalises Linux AD attacks
* https://github.com/ReversecLabs/virtual.attack - ATT&CK the hypervisor

Hard hacks:

* https://github.com/abrignoni/VLEAPP - would you spot @abrignoni tracking your car? 🤖

Hardening:

* https://github.com/douglasmun/macos-sudo-touchid - just touching an Apple is enough... 🤖

Data:

* https://codeberg.org/liberty/slopcheck - check your code for 🤖 interference with @liberty's slop check
* https://github.com/blader/humanizer - when the 🤖 is so bad, it needs to hide

Nerd:

* https://github.com/fglock/PerlOnJava - run Perl on JVM, thanks to @fglock 🤖
* https://github.com/pdjstone/riscos-conv - @pdjstone speaks RISC OS...
* https://github.com/pdjstone/archimedes-live - ...and runs an Archimedes in his web browser

#security, #research, #code

Here have some raveioli
As a treat.

Good night fedi.

I've just discovered a nice Unix trick. Let's see if you know about it.
Watch the screenshot. How is this possible?

#Unix #quizz

Just dropping this here: P = NP if P = 0 or N = 1.

My agents are finalizing a Lean proof

[RSS] CVE-2026-43783: Repair Permissions - Get Root: LPE via DesktopServicesHelper in macOS 26.5

https://ptswarm.com/blog/cve-2026-43783-repair-permissions-get-root-lpe-via-desktopserviceshelper-in-macos-26-5/

[RSS] Cato VPN Client: Split-Tunnel and Privilege Escalation (CVE-2026-10739)

http://blog.quarkslab.com/cato-vpn-client-split-tunnel-and-privilege-escalation-cve-2026-10739.html

[RSS] Probabilistic analysis of MTE tagging schemes

https://dustri.org/b/probabilistic-analysis-of-mte-tagging-schemes.html

[RSS] From: anyone@icloud.com - Spoofing Arbitrary Apple iCloud Identities

https://sec-consult.com/blog/detail/from-anyoneicloudcom-spoofing-arbitrary-apple-icloud-identities/

[RSS] A Mere Mortal's Introduction to JIT Vulnerabilities in JavaScript Engines

https://trustfoundry.net/blog/jit-vulnerabilities-javascript-engines

Language Matters:

The words we use influence how people think. Shifting language shifts mindsets.

"Vulnerability" sounds like weather: unpredictable, nobody's fault. "Product defect" names something a manufacturer built and could have prevented. Keep it only where it's a term of art, like CVE.

RE: https://mastodon.social/@monkeydom/117382425456803989

yet more examples of the rollout of passkeys being user hostile in that it does not explain anything to users and does things that may have serious consequences without consent

I recently learned to distinguish rabbits from hares (from a shitpost ofc) and now I feel slightly offended because my emoji keyboard shows a rabbit but it clearly renders as a hare in the app. 🐇

Newsletter: Regulators race to reassure the crypto industry as the its flagship Clarity Act legislation collapses, SBF tries his luck with the Supreme Court, and crypto PACs unleash $30 million against Sherrod Brown.

https://www.citationneeded.news/issue-110/

#crypto #cryptocurrency #USpol #USpolitics #CitationNeededNewsletter

Aaron Swartz was charged on July 14th, 2011 with wire fraud and computer fraud (under the Computer Fraud and Abuse Act). He potentially faced 30 years in jail and a fine of 1 million dollars or more. The theory was that he exceeded authorized access by automated scraping through 4.8 million JSTOR articles.

Contrast with...

AI crawlers crawl trillions of documents, often ignoring any ToS the prohibit automated scraping.

OpenAI downloaded pirated books from Library Genesis and created internal datasets that became the foundation for GPT-3's training.

Meta torrented 80+ TB of data from Anna's Archive for Llama 4. There are records of internal discussions at Meta that the data set was known to be pirated content.

Where is the federal prosecutor to throw charges at OpenAI and Meta? That's right. No charges.

"This 3-day training focuses on macOS Vulnerability Research (VR) for beginner to intermediate students. While intermediate topics will be discussed, the course focuses on bringing security researchers up to speed with macOS’s unique protections and vulnerabilities"

Great content from my friends, now in Budapest:

https://macosvuln.training

Reddit Is Killing RSS Feeds, Ending Public API Access https://tech.slashdot.org/story/26/09/30/1841213/reddit-is-killing-rss-feeds-ending-public-api-access?utm_source=rss1.0mainlinkanon

New series: implementation security for autonomous defense systems.

Their intelligence runs on embedded hardware in the field, where an adversary can recover a device and study it with no time limit.

What happens if someone can study it without constraints?
🔗Part 1: https://www.eshard.com/blog/autonomous-systems-are-changing-the-defence-threat-model

#drones #drone #embedded #embeddedsystems #cybersecurity