I wish California could promote LSD to politicians back in the day as effectively as they do today with AI.

[RSS] 4 jsoup vulnerabilities

https://joshua.hu/4-jsoup-vulnerabilities

Great, YT now put me into the "white girl music better than any pre workout" basket...

Now I feel irresistible urge to listen to Katy Perry o.O

https://www.youtube.com/watch?v=tmlGA_zFtpQ

Brains are weird. (fortunately I'm not alone in case crazy ear worms are an indicator of aneurysm :S)

It’s out! New video! Finally!

#science #physics

https://www.youtube.com/watch?v=P_ooEuOnNB8

RE: https://mastodon.social/@mrmacintosh/117075193323529726

A hacker's hacker. 🫡

OpenSSH 10.5 has just been released, mostly to fix a handful of security vulnerabilities.

https://www.openssh.org/releasenotes.html#10.5

We plan to move to a more frequent release schedule for as long as this season of LLM-found bugs lasts. More details in the release notes.

The soundtrack of my dream was a Sabaton song about debugging Binary Ninja:

"Debug the Ninja
Binary Ninja
Debug the Ninja
This is the song"

(note: I don't usually listen to Sabaton)

High level diff of macOS 26.6.1 vs. macOS 26.6.2 🎉

https://github.com/blacktop/ipsw-diffs/tree/main/26_6_1_25G76_vs_26_6_2_25G82/README.md

@phillip Hot take: signups should be disabled at install time by default in almost every software.

RE: https://social.lol/@phillip/117061432689860232

The postmortem of the hack on my Forgejo instance is here! I had fun investigating and writing it, so I hope y’all enjoy reading about it :)

#Homelab #SelfHosted #Cybersecurity #Infosec

https://phunky.cafe/my-homelab-got-hacked/

this program was generated with LLVM assistance
"don't you mean LLM assistance?"
no, i mean i implemented a few examples and left the rest as UB for the compiler to figure out https://gcc.godbolt.org/z/hd5Mhdhev

Somebody posted a Windows 11 LPE writeup, with a CVE that doesn't yet exist (CVE-2026-62737).

By poking at kloader's ExecutionContext, we can get kernel mode execution at an arbitrary address.

A stock Windows VM won't have a NIC that uses the NetAdapterCx framework, so will not show as affected. But you can start that service to see it in action.

The PoC has a hard-coded 0xFFFFF80041414141 as an execution target. I'm sure that somebody knowledgeable with Windows kernel stuff can figure out how to modify this to do something useful.

I predict that CVE-2026-62737 will be included in this Patch Tuesday lineup.

Since Metabase couldn't be bothered, it looks like CISA has assigned CVEs.

• CVE-2026-72898 Metabase SQL injection via password reset endpoint
• CVE-2026-72899 Metabase SQL injection via public card or dashboard
• CVE-2026-72900 Metabase information exposure

RE: https://live.acarsdrama.com/@acarsdrama/117072256729860162

come on now. be cool guys.

On Saturday night, one of our CT logs rejected most submissions for 30 minutes.

I just published the post-mortem, and the investigation was... a lot of fun? It involves Go mutex starvation, SQLite WAL behavior, and ZFS record sizes.

I got to SIGKILL a VM 200 times, implement a turnstile (TIL!), and order a Nokia flip phone.

https://groups.google.com/a/chromium.org/d/msgid/ct-policy/b1b5e8a2-b010-4e2a-b8c8-91c1d1b7ca91%40app.fastmail.com

Beatboxing is one of countless very good example why AI will never be able to replace actual art.
Most (if not all) sounds a beatboxer makes can technically be made by a synthesizer. The arrangement can be the same too.
Yet millions and millions of people enjoy beatboxing a lot more, specifically BECAUSE it comes from humans.

I think this principle can be applied to most forms of art.

So I don't think there's too much need to worry.

Happy Monday

Just accidentally spilled some cold water on my tshirt and decided it's actually better this way.

@scottwilson I'm carefully optimistic about markup getting more traction through tools like Obsidian. You'd write content with desired emphasis, then the recipient will get a rendering that fits their theme/other requirements (e.g. high contrast).