@aerique Mozilla is preparing for a world where the US government (rightly) forces them to do without 90+% of their revenue. Rather than getting disgusted at them, why don't we urge the EU to support them and even do something crazy like take seats on their board or something? Could happen... maybe? Mozilla and this fork you want to make will die without support.

[RSS] Achieving Persistent Client-Side Attacks with a Single WeChat Message

https://www.darknavy.org/blog/achieving_persistent_client_side_attacks_with_a_single_wechat_message/

[oss-security] CVE-2025-48734: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

https://www.openwall.com/lists/oss-security/2025/05/28/6

I wonder if the now restricted behavior is useful for #deserialization gadgets (I couldn't find references to declaredClass abuse, but haven't finished my coffee yet either...)?

[oss-security]

CVE-2025-46701: Apache Tomcat: Security constraint bypass for CGI scripts

https://www.openwall.com/lists/oss-security/2025/05/29/4

I think "GCI" is a typo in the message (CGIServlet.java is patched), although found the same typo elsewhere in the documentation...

@keenancrane I wanted to mention those piggies, glad this design was not lost in time (had think really hard where I saw a similar concept, and it was about 25 years ago) :)

Decomplexification - making #curl use simpler code

https://daniel.haxx.se/blog/2025/05/29/decomplexification/

@mttaggart Also, write-only syntax choices that e.g. require counting different kinds of brackets with your fingers...

The more mental energy you expend parsing a programming language's syntax, the less you have available for parsing a program's logic—or creating it yourself. This is why core fluency is so important; it frees up your own compute cycles for more important work.

It's also another reason why "vibe coding" is so toxic. It robs you of the opportunity to gain that fluency.

[RSS] Cisco IOS XE WLC Arbitrary File Upload Vulnerability (CVE-2025-20188) Analysis

https://horizon3.ai/attack-research/attack-blogs/cisco-ios-xe-wlc-arbitrary-file-upload-vulnerability-cve-2025-20188-analysis/

[RSS] exploits.club Weekly Newsletter 73 - AI Finds Bugs, MTE Bypasses, Old Jailbreaks, and More

https://blog.exploits.club/exploits-club-weekly-newsletter-73-ai-finds-bugs-mte-bypasses-old-jailbreaks-and-more/

"[Qualys] discovered a vulnerability in apport [...], and a similar vulnerability in systemd-coredump [...]: a race condition that allows a local attacker to crash a SUID program and gain read access to the resulting core dump"

https://www.openwall.com/lists/oss-security/2025/05/29/3

CVE-2025-5054 CVE-2025-4598

Google’s search quality has declined, filled with spam and low-quality results, while it maintains dominance through default placements. Cory Doctorow highlights Kagi as a superior alternative, offering cleaner, more relevant search outcomes. Though it requires a subscription, Kagi provides a user-focused experience that recaptures the efficiency Google once had.

I personally HAPPILY pay for @kagihq.

#Kagi #enshittification #tech #privacy

https://pluralistic.net/2024/04/04/teach-me-how-to-shruggie/#kagi

SentinelOne still down, approaching three hours. It doesn’t look like they have an official status page so https://sentinelonestatus.com/ is all ya got.

@mcc mathcore/math rock? E.g.: https://www.youtube.com/watch?v=D4-erceTpc8

Edit: or simply Tool...

New assessment for topic: CVE-2025-41232

Topic description: "Spring Security Aspects may not correctly locate method security annotations on private methods ..."

"On May 19 2025, Spring released an [advisory](https://spring.io/security/cve-2025-41232) warning that Spring Security versions before `6.4.6` were vulnerable to a flaw in how Spring security annotations were identified and processed, that could lead to annotations being ignored on private methods, potentially leading to authorization bypasses on those private methods ..."

Link: https://attackerkb.com/assessments/c3734c78-c018-4e5f-9c70-b5f3c074a411

[RSS] Micropatches Released for Preauth DoS on Windows Deployment Service (CVE-2025-29957)

https://blog.0patch.com/2025/05/micropatches-released-for-preauth-dos.html

Good bathroom reads.

Unfortunately the #OpenStreetMap wiki is very slow today. We are fighting an aggressive web scraper bot. 10,000 of IPs involved. Randomised User-Agent. Ignoring robots.txt #aibot #ddos

Update: Fixed. We've been able to mitigate the bot traffic. #fail2ban

@nicemicro Yes I also have concerns about how restrictions could be implemented in practice.

Thank you, it's good to see that civilized arguments are still possible online!

@david_chisnall @kenshirriff Just for the record, I find this part of AS/400 history pretty fascinating (from Inside AS/400, by Frank Soltis) :)