[RSS] The January 2026 Security Update Review

https://www.thezdi.com/blog/2026/1/13/the-january-2026-security-update-review

We are at *twenty* hackerone submissions for #curl so far this year. Zero of them a confirmed vulnerability.

RE: https://mastodon.social/@hennavirkkunen/115888721732640894

I’ve been informed this is an official account and that makes it good news!

Hello #FediHire, I am a laid off malware analyst still looking for work. It's hard out there. I can program in various languages (primarily C++, Python and Rust) and can study non-malware code with just as much ease as complex malware. Enterprise application ready!

Accolades here: https://www.linkedin.com/in/sean-m-taylor-security-engineer/
Code here: https://github.com/frank2

Any biters? Please let me know!

Just saw this on a post on LinkedIn

https://creepylink.com/

It is a URL shortener that makes your links as suspicious as possible. Simply amazing

For example:

https://google.com/

got turned into:

https://capitalone.c1ic.link/Z8gfcH_claim_gift_card.pl

I'm pretty sure every healthcare organization I've ever received an SMS from is already using this technology

We are excited to announce the CFP for the next tmp.0ut Volume 5!

https://tmpout.sh/blog/vol5-cfp.html

If AI coding is so good, where are the performance numbers?

Claude bros know how to measure performance. They just don't.

https://www.youtube.com/watch?v=xeU208KqeRc&list=UU9rJrMVgcXTfa8xuMnbhAEA - video
https://pivottoai.libsyn.com/20260113-if-ai-coding-is-so-good-where-are-the-performance-numbers - podcast

time: 7 min 34 sec

https://pivot-to-ai.com/2026/01/13/if-ai-coding-is-so-good-where-are-the-performance-numbers/ - blog post

ALERT: ACS 1.1.9.11 has been released due to CVE-2025-66516. Please update ASAP!

"IBM strongly recommends upgrading to 1.1.9.11, and discontinuing use of versions 1.1.9.8 through 1.1.9.10."
"Fixes will only be provided for the latest update."

https://www.ibm.com/resources/mrs/assets?source=swg-ia

#IBMi #ACS #Security

@misprintedtype <marquee> - infinite fun!

Here's my analysis of the recent-ish 9.3 Critical in #Emby (CVE-2025-64113).

Sadly, the vulnerability turned out to be pretty boring, but I've tried to make the best of it.

https://gebir.ge/blog/its-not-mine-cve-2025-64113/

Does anyone happen to own an ATM that they’re willing to sell? Preferably NCR or Wincor/Diebold Nixdorf. I‘m based in Hamburg and the ATM is mainly intended for #40C3. Will also take only parts or broken or ancient ATMs as well. Very long shot but worth a try :)

#39C3

Signal Creator Marlinspike Wants To Do For AI What He Did For Messaging https://slashdot.org/story/26/01/13/1529250/signal-creator-marlinspike-wants-to-do-for-ai-what-he-did-for-messaging?utm_source=rss1.0mainlinkanon

@csepp No idea, I posted it in part as a bookmark for myself to read later...

(plus based on my recent experience, scripting IDA data types is always a courageous act)

https://github.com/kaansenol5/VibeOS

[RSS] Symless: an IDA assistant for structure reconstruction

https://blog.thalium.re/posts/symless-an-ida-assistant-for-structure-reconstruction/

[RSS] X41 Audited CRI-O Runtime

https://x41-dsec.de/security/research/job/news/2026/01/13/cri-o/

Observation: low-quality MCPs have more GitHub stars than their high-quality alternatives.

@thezero One important lesson I learned in life is to stay the fuck away from people who employ projection, esp. if they do it consciously:

https://www.psychologytoday.com/us/basics/projection

isomorphisms per monad

@joxean It's perfectly normal, our politicians used that same spyware on journalists etc.