Clownstrike share price basically tripled since the 2024 fuckup... There is no such thing as long term damage in cyber stocks LOL :PPPPPPPP

🐞 Linus Torvalds says AI-powered bug hunters have made Linux security mailing list ‘almost entirely unmanageable’

“So just to make it really clear: If you found a bug using AI tools, the chances are somebody else found it too. If you actually want to add value, read the documentation, create a patch too, and add some real value on *top* of what the AI did. Don't be the drive-by ‘send a random report with no real understanding’ kind of person. OK?”

https://www.theregister.com/security/2026/05/18/linus-torvalds-says-ai-powered-bug-hunters-have-made-linux-security-mailing-list-almost-entirely-unmanageable/5241633

#ai #linux

RubyGems suspends new Signups after Hundreds of Malicious Packages are Uploaded.

RubyGems, the standard package manager for the Ruby programming language, has temporarily paused account sign ups following what has been described as a "major malicious attack."

"We're dealing with a major malicious attack on Ruby Gems right now," Maciej Mensfeld, senior product manager for software supply chain security at Mend.io, said in a post on X. "Signups are paused for the time being. Hundreds of packages involved – mostly targeting us, but some carrying exploits."

https://x.com/maciejmensfeld/status/2054164602577940619

⁉️Visitors to RubyGems sign up page are now greeted with the message: "New account registration has been temporarily disabled."⁉️

https://rubygems.org/sign_up

#rubygems #security #privacy #media #secure #ruby #programming #developer #infosec #tech #news

so, umm, this is a 16 bytes intro

16 bytes

!!!!!!!!!!!!!!!!

https://www.youtube.com/watch?v=MvycyU-kLjg

#demoscene #intro

Peter G. Neumann, renowned computer scientist, ARPANET/Internet pioneer and expert on technology risks, working at SRI International since 1971, has died at age 93. Peace. He has been my friend and colleague for over half a century. He will be greatly missed.

GitHub says it has no problems with security researchers using AI to find bugs in its service, but it has a problem with researchers filing bad reports that haven't been validated, are extra-verbose and long, and don't contain steps to reproduce and a proof-of-concept.

Basically, KISS!

https://github.blog/security/raising-the-bar-quality-shared-responsibility-and-the-future-of-githubs-bug-bounty-program/

There's apparently another Linux LPE.
DirtyDecrypt, also known as DirtyCBC, is a variant of CopyFail / DirtyFrag / Fragnesia.
I suspect it may be CVE-2026-31635.
Patches (change < to >) were committed on April 8, 2026 and also on April 18, 2026 as beee051f259acd286fed64c32c2b31e6f5097eb5 and e2f1a80d8b1ed6a5ae585a399c2b46500bdcc305

I have not been able to get it to actually work on any Linux distro that I've tried.
(Edit: Fedora and mainline Linux repro fine)

New article on an AppleJPEGXL UaF I found recently.

https://ret2p.lt/2025/05/17/AppleJPEGXL-CVE.html

Enjoy! Constructive criticism is always appreciated.

DOMPurify 3.4.4 is out with again several small in-depth improvements.

These include added stability for IN_PLACE sanitization, improved handling of cross-realm nodes and several newly permitted elements and attributes.

https://github.com/cure53/DOMPurify/releases/tag/3.4.4

TIL that one of the diagnostic clues for autism is "Thinks about their special interests outside of the time when actually engaging with special interests."

And I'm like... what? What else do you think about?...

#neurodivergent #psychology

Big news. A Qemu escape. Are you ready? Panic!!1!

https://www.reddit.com/r/blueteamsec/comments/1tfgm80/qemutiny_is_a_memory_corruption_vulnerability_in/

Wait, CXL? Reddit as a source? AI off, brain on moment incoming...

CXL, that's for FPGAs. The escape isn't for x86 or ARM. It's not even for virtio.

Typical Proxmox CE deployments use AppArmor Sandboxing. Guest-to-host escapes are possible, but not this way.

It's not that Qemu is a fortress of years of great security auditing. That's not my point. My point is that the AI hype for vuln hunting is a fata morgana. Unless you work hard, you get nothing with or without AI.

You are welcome.

#qemu #debian #proxmox #kvm #linux

Interesting Git repos of the week:

Strategy:

* https://github.com/stnert/the-supreme-art-of-cyberwar - surveillance, privacy and cyber war

Bugs:

* https://github.com/Swival/security-audits - interesting bug reports from @jedisct1 🤖
* https://github.com/v12-security/pocs - interesting Linux PoCs
* https://github.com/kiddo-pwn/ffffirefox - originally an 0day but now tracked as CVE-2026-8390
* https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn - race condition in ssh-keysign that allows arbitrary file reads, now tracked as CVE-2026-46333
* https://github.com/Nightmare-Eclipse/YellowKey - another goodie, this one is a bugdoor in BitLocker
* https://github.com/Nightmare-Eclipse/MiniPlasma - previously known as CVE-2020-17103, MiniPlasma pops cldflt.sys

Exploitation:

* https://github.com/1r0BIT/WinSSHound - map SSH usage on Windows

Nerd:

* https://github.com/inferno-os/inferno-os - distributed Plan 9-esque OS... I remember playing with this growing up

#security, #research, #code