MSRC is starting well with their "piss off the reporter" strategy.

I reported in full detail a two-vulnerability exploit chain, since on their own either vulnerability is somewhat shrug-worthy. I got a request that I submit a separate report for the second vulnerability.

I dunno, maybe do it yourself? You already have everything. MSRC is a perfect example of an organization where nobody wants to do their job.

@cR0w @darfplatypus casual Fridays should be pants optional

I kinda wasn't expecting a multi trillion dollar industry to build its marketing campaigns on my tiny niche. Makes sense IMO, 0day have always been pretty easy and false positives don't really matter during the audits... and the entire world has been told 0day are impossible

The amount of people who aren't comfortable saying "I don't know" is staggering.

Make "I don't know" more common in y'alls vernacular. It's healthy and leads to learning new things

The PTFs for IBM i 7.6 TR2 and 7.5 TR8 are released today, Friday July 24 2026.

https://www.rpgpgm.com/2026/07/first-technology-refreshes-of-2026.html
#IBMi #rpgpgm #IBMChampion

The man whose codebreaking may have helped to shorten the Second World War by two years met a grim reward: in 1952 Alan Turing was convicted simply for being gay and chemically castrated; a royal pardon came only in 2013, decades after his death

By Space Daily Editorial Team

https://spacedaily.com/m-the-man-whose-codebreaking-may-have-shortened-the-second-world-war-by-two-years-met-a-grim-reward-in-1952-alan-turing-was-convicted-simply-for-being-gay-and-chemically-castrated-a-royal-pardon-came/

More information about Alan Turing:
https://en.wikipedia.org/wiki/Alan_Turing

#computerScience #cryptanalysis #lgbt

Authenticated RCE PoC for Redis 6.2.22, 7.4.9, 8.6.4, 8.8.0 https://github.com/berabuddies/redis-poc

Fun fact:

If you go to report a vulnerability to MSRC that is a missed-fix or a variant of something that Microsoft has already released an update for, you must provide the existing VULN- identifier. Just a CVE isn't enough, for reasons I cannot fathom. (If you tell Microsoft a CVE ID, they themselves can easily see which VULN- ID is associated with it.)

Meaning, only the person who reports a vulnerability to Microsoft is allowed to tell them that the fix wasn't good enough. (The VULN- ID is what you get when you submit a case to MSRC)

Great job, folks. It instills great confidence when your form for receiving vulnerabilities confuses when to use OR with when to use AND. 🤦‍♂️

There's apparently scammers going round pretending to be Mastodon admins, demanding people "verify their identity".

Do not click on their links, do not give them any info. It is a scam. Genuine Mastodon server admins never demand verification like this.

Here's a guide to how to recognise and avoid various kinds of scams on Mastodon and the wider Fediverse:

➡️ https://fedi.tips/how-to-avoid-scammers-on-mastodon-and-the-fediverse

(Thanks to @amministratore for providing warning about the latest wave of scam posts.)

#FediTips