"I'm here to chew bubblegum and punish microsoft for their sins. And I'm all out of bubblegum."

SandboxEscaper is back :)

https://xcancel.com/WeirdQuadratic/status/2046683620987809947

I typically recommend people do not pick a Firefox fork because keeping up with security patches is a lot of work and being downstream of our code typically implies a delay.

But if you feel like you really have to use a Firefox fork, I suggest you find one that has the means to ship an update within a day.

From those I looked at, most did not bring an update based on 150 yet. (Special shout out to the Tor Browser. You're awesome!)

@0xabad1dea Put out a poster with a bounty for the courier who identifies the intruder. It may not worth for them (having a delivery quota, etc), but if the intruder sees the poster (s)he won't trust the couriers anymore.

My new article: "Some notes on the security properties of the pipe_buffer kernel object"

Many Linux kernel exploits use the pipe_buffer kernel object to build strong exploit primitives. I experimented with pipe_buffers and discovered something interesting

https://a13xp0p0v.tech/2026/04/20/pipe-buffer-experiments.html

[RSS] X41 Reviewed SecureDrop

https://x41-dsec.de/security/research/job/news/2026/04/21/securedrop-review-2026/

@mttaggart

Oh my god, OpenAI reinvented Recall, but for macOS.

"Chronicle" is an opt-in feature that scans your screen, saves screenshots temporarily, and sends them to OpenAI's servers.

https://developers.openai.com/codex/memories/chronicle

Indeed.

With Windows 9x Subsystem for Linux you can run all your favourite Windows and Linux apps side-by-side with a modern Linux kernel running cooperatively with the Windows kernel in ring 0. And unlike modern WSL, no hardware virtualisation is used so even your 486 can run it!

Please enjoy, I think this might be one of my greatest hacks of all time

https://codeberg.org/hails/wsl9x

@freddy Can you tell us about token costs?

What Mythos access got us. Now public. https://blog.mozilla.org/en/privacy-security/ai-security-zero-day-vulnerabilities/

More Vintage Computing museums should rent out cloud access to their rare hardware.

SDF (Super Dimension Fortress) does it, and it’s freaking awesome.

I’m literally logged into a Sun SPARCstation…anyone can do this for free, right now. Just SSH in.

"frustrated" mode for #IDA

https://github.com/allthingsida/frustrated

[RSS] "The system is so twisted that even Apple itself begs for these reviews from its own apps."

https://unsung.aresluna.org/the-system-is-so-twisted-that-even-apple-itself-begs-for-these-reviews-from-its-own-apps

[RSS] Hooking Windows Named Pipes

https://www.synacktiv.com/en/publications/hooking-windows-named-pipes.html

@kityates "lifelong ban on buying cigarettes" - Am I reading this wrong or are they proposing for tobacco what has been a disastrous failure with all other drugs?

The Onion have finally completed their takeover of InfoWars, and it's everything I wanted and more.

https://theonion.info/

I often need to explore Windows kernel crashdumps when I'm on Linux/macOS.

WinDbg unfortunatelly doesn't work in Wine.

So... I did a thing. It's multiplatform - doesn't depend on dbgeng.dll nor DIA. WinDbg-flavored.

And it's fast. Really fast.
https://github.com/vmi-rs/ephemera

I'm in my creative phase apparently