@david_chisnall I think part of the problem is few trust that this level of integration between Office and Teams will work, considering the usual issues of each of these components. I'd be esp. concerned about clients running on non-Windows platforms.

🤖 Trojanized Newtonsoft.Json fork on NuGet hides game-rigging code targeting Digitain sportsbook. Package "Newtonsoftt.Json.Net" typosquats the real library and includes logic to rig live betting results.

🔗 https://thehackernews.com/2026/07/trojanized-newtonsoftjson-fork-hides.html
#SupplyChain #Malware #ReverseEngineering #CyberSec

@bayindirh @codinghorror ideally, sure! But I'm afraid shops will have to establish some kind of KYC program for rare items to mitigate this behavior :(

HOLY SHIT I FOUND IT

It was called the "ROBOT COLORING BOOK"

It just had some space tanks on the cover. look at how badass this is

Investigation Scenario 🔎

Alert: Microsoft Defender for Endpoint: Behavior:Win32/SuspClickFix.F detected on a Windows 11 workstation.

No additional context is provided. What artifacts would you examine first to determine whether the user executed the ClickFix command?

To go further, what would you look for to determine whether the alert represents the beginning of an ACR Stealer intrusion?

#InvestigationPath #DFIR #SOC

@bayindirh @codinghorror That sounds bad, but if they have significant historic value shouldn't their trade be restricted in the first place (aka. "it belongs to a museum!")?

Woof. That data breach at Suno last year, but only just disclosed last week, affected over 55 million users, including their names, physical addresses, and phone numbers, according to Have I Been Pwned.

More: https://techcrunch.com/2026/07/21/ai-music-generator-suno-breach-affects-55m-users-per-have-i-been-pwned/

Bypass for ad-blockers: https://web.archive.org/web/20260721144937/https://techcrunch.com/2026/07/21/ai-music-generator-suno-breach-affects-55m-users-per-have-i-been-pwned/

"Dionysius Thrax" sounds like a hammy villain wearing absurdly bulky, spiky armor while zipping around in a hovercraft, but actually he was one of history's biggest nerds https://en.wikipedia.org/wiki/Dionysius_Thrax

@dey Awesome! :) How was it?

Qualys Security Advisory - Local Privilege Escalation in set-capabilities versions of snap-confine (CVE-2026-8933)

https://www.openwall.com/lists/oss-security/2026/07/21/2

Writeup & POC: CVE-2026-49176 Windows WalletService to SYSTEM (LPE) https://davidcarliez.github.io/blog/cve-2026-49176-walletservice-to-system/

ZDI-26-444 - 7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability

https://www.zerodayinitiative.com/advisories/ZDI-26-444/

CVE-2026-14266

@codinghorror Can't wait for past miracle tech like Mercury or Radium do their comeback on the back of LLMs!

"I know that my life has always been vertebrated by two desires: the desire to know and the desire to help, to be of use."

A new page of my comic Ekphrasis, which you can read for free at https://ekphrasiscomic.neocities.org/

[RSS] TruthSocial are selling their API - want it for free?

https://old.reddit.com/r/ExploitDev/comments/1v20jw0/truthsocial_are_selling_their_api_want_it_for_free/

[RSS] Real-world decryption

https://www.bfswa.blog/p/real-world-decryption

[RSS] Crypto etymology

https://www.bfswa.blog/p/crypto-ethymology

[RSS] Escalating All The Privileges With Foxit PDF Reader (CVE-2026-57239)

https://blog.paradoxis.nl/escalating-all-the-privileges-with-foxit-pdf-reader-cve-2026-57239-582a78b60492