@lcamtuf Grandpa still in business: https://labs.watchtowr.com/do-secure-by-design-pledges-come-with-stickers-ivanti-connect-secure-rce-cve-2025-0282/

Another take on AI that (at least for now) kinda nails it.

Use of AI tools reduces critical thinking abilities. Frank Herbert looks more prophetic every day.

Exploiting SSTI in a Modern Spring Boot Application (3.3.4) https://modzero.com/en/blog/spring_boot_ssti/

Overview of WebAssembly Type Confusion in JavaScript Engines Exploitation

https://xia0.sh/blog/overview-of-wasm-in-jsengine-exploit?ref=blog.exploits.club

@troed Devs make mistakes. This should've been caught by a code scanner.

New Project Zero issue:

Samsung S24: Out of bounds write in APE Decoder

https://project-zero.issues.chromium.org/issues/368695689

CVE-2024-49415

It's not ../, it's a vanilla stack overflow as a result of strncpy with input size.

This company should not exist by now.

https://labs.watchtowr.com/do-secure-by-design-pledges-come-with-stickers-ivanti-connect-secure-rce-cve-2025-0282/

Our 2025 RE//verse talk schedule is now live! Talks start Friday, but don't forget to check the Thursday schedule and arrive early enough for the kick-off event!

https://re-verse.io/schedule.html?utm_source=mastodon&utm_medium=social&utm_campaign=schedulepub#sz-tab-45716

One of the most useful skills you get out of doing open source comes from learning to write READMEs.

Being able to describe a piece of software clearly and concisely in terms of
- what is is
- what it does
- how it does it
- why it does it that way
- how you use it
is a superpower that will you will be able to use throughout your career.

PowerSchool, a provider of K-12 software and cloud solutions, had a breach over the holidays. But not to worry, they paid the cybercriminals who hacked them and they have a video of the crooks deleting the data.

"PowerSchool has received reasonable assurances from the threat actor that the data has been deleted and that no additional copies exist."

Thank goodness the threat actors are so reasonable, right? SMH.

Big news: a recent copyleft lawsuit we funded and supported has concluded with a very positive result for user rights! The suit, brought by a device owner in Germany, resolved with the purchaser receiving the right to repair, modify, and reinstall LGPLed software on their devices. Check out the details at https://sfconservancy.org/news/2025/jan/09/avm-copyleft-lawsuit-resolved-with-install/

Congratulations all crowd strike users on macOS who now get warnings about the libcurl version shipped by Apple. May you all enjoy your choices of software vendors.

It alerts about CVE-2024-9681. We said it is severity low. NVD says 6.5 medium.

Never a dull moment.

OK, I fleshed this out a little more. You can find the (In)Security Appliance Bingo 2025 in proper, two-dimensional form here:

https://cku.gt/appbingo25

Suggestions and submissions very welcome.

CrowdStrike: Recruitment Phishing Scam Imitates CrowdStrike Hiring Process
Following CrowdStrike's successful Denial of Service attack on customers' Windows systems worldwide in July 2024, recruitment has gone up (this is a joke). CrowdStrike reports that a newly discovered phishing campaign uses CrowdStrike recruitment branding to convince victims to download a fake application, which serves as a downloader for the XMRig cryptominer. They describe the infection chain and provide Indicators of Compromise.

#crowdstrike #IOC #xmrig #cryptomining #infosec #cybersecurity #cyberthreatintelligence #CTI

[RSS] WorstFit: Unveiling Hidden Transformers in Windows ANSI!

https://devco.re/blog/2025/01/09/worstfit-unveiling-hidden-transformers-in-windows-ansi/

Nominations are now open for the Top 10 Web (new) Hacking Techniques of 2024! Browse the contestants and submit your own here:
https://portswigger.net/research/top-10-web-hacking-techniques-of-2024-nominations-open

Mozilla Foundation security advisories 09 January 2025:

• MFSA2025-04 Security Vulnerabilities fixed in Thunderbird 134 (9 CVEs: 2 high, 7 "moderate")
• MFSA2025-05 Security Vulnerabilities fixed in Thunderbird ESR 128.6 (7 CVEs: 1 high, 6 moderate)

No mention of exploitation.

#mozilla #thunderbird #vulnerability #cve #infosec #cybersecurity

I really hope I'm missing something, but I can't find a VSCode API that allows me, in an extension, to get an event when a breakpoint is hit.
Seems like a massive blocker for developing debugging tools.

#vscode #debugging

"The economic value of the outgoing traffic... based on the cost-per-click estimated via the Google Ads platform showed that the owners of external websites linked from Wikipedia infoboxes would need to collectively
pay a total of around $7-13 million per month (or $84-156 million per year) to obtain the same volume of traffic as they receive from Wikipedia for free."

!!