I've recently scanned DKIM keys for vulnerabilities, more extensively than previous scans. DKIM keys with the Debian OpenSSL bug are still very common. So are too-short RSA keys (quite a few 512 and even 384 bit keys, and *many* 768 bit, which is still difficult to break, but possible).
Also, a notable number publish a private key in their DKIM record. (This is only a problem if they actually use the same key elsewhere correctly.)
I tried disclosing things, but manual disclosure impractical for thousands of affected hosts and automated disclosure is difficult (plenty without security.txt, security@ often is rejected).
Replies to disclosures also show a common misunderstanding: People believe they are unaffected saying these keys are old and unused. This shows a fundamental confusion about how digital signatures work. Attackers don't care if you use insecure keys as long as they can use them.

Some stats for the latest scan: https://monitor.badkeys.info/dkim/2026-08-11-dkim-badkeys.html

Both Xcancel and Nitter have had cease and desist letter from Twitter. You can still follow Twitter account on Mastodon via account@bird.makeup and the like. Eg @c_c_krebs

Oof that’s a lot of CVEs https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/

this wild defcon talk is finally out

researchers created a fake defi startup, hired lazarus it workers, put them into a sandbox and recorded their tooling, workflows, and faces from inside the operation

starts at 5:46:09
https://www.youtube.com/live/_uYQr8hfpbI?t=20770

New on Insinuator: Part 1 of a four-part series on token theft in Microsoft Entra ID, accompanying ERNW White Paper 80.

The target is no longer the password or even MFA, but the token issued once authentication succeeds.

Part 1 covers the threat landscape and the techniques: direct token theft and PRT abuse, AiTM phishing, device code phishing, consent phishing, ClickFix and the ConsentFix family, plus where Microsoft's defense-in-depth strategy still leaves gaps.

By Niklas Kerner.

https://insinuator.net/2026/08/token-theft-in-microsoft-entra-id-part-1-of-4-threat-landscape-and-attack-techniques/

#EntraID #OAuth #identitysecurity #InfoSec

godspeed you wonderful human

I guess throwing up a message like this is easier than optimizing your code

Modeling ELFs into SQL for execution https://fzakaria.com/2026/08/23/your-executable-is-a-sqlite-database

Hackaday Europe 2026: PCBs With A Plot

https://hackaday.com/2026/08/26/hackaday-europe-2026-pcbs-with-a-plot/

This is the first genuinely operational littleFedi instance.

It has been online since 1st July, is single-user (just me), and runs on a Raspberry Pi Zero W powered by NetBSD, directly on its SD card.

It consumes just under 1W.

Its database is this size:

-rw------- 1 little wheel 109289472 Aug 26 15:14 littlefedi.db

That is, just a little over 100 MB. Yes, MB.

Its average CPU load is extremely low.

It is perfectly usable both from the web interface and from Mastodon API apps.

I have 179 followers and 169 followings, and it doesn't bat an eye.

I promise myself to use it more, and I will.

You don't need Big Tech to communicate with others.

You don't need an expensive data center to exist online.

Because we are people, and the bits are just extensions of our voice.

EDIT: littleFedi allows to transform posts into blog posts, having its own SSG (Static Site Generator). The one generated by this post is reachable by clicking here.

#littleFedi #Fediverse #OwnYourData

Meta, mid trial, agrees to settle claims that Facebook and Instagrams harmed children with the owner of the social media platform to pay 29 states more than $16 billion. https://www.reuters.com/world/us/meta-settles-with-us-states-over-social-media-harms-2026-08-26/

RE: https://ohai.social/@TarkabarkaHolgy/117134297730197472

I am sorry, I have to add an update based on a recent news article:

1. The memorial has been dismantled

2. It was supposed to depict a bird with a helmet, soaring into the sky

3. The design was - surprise, surprise - generated by #AI

4. The mayor claims he didn't see the finished product, because he was taking time off for pink eye

You can't make this stuff up

Quick announcement:

We're putting on-hold most Paged Out! prints for conferences/events in EU due to the EU's Packaging and Packaging Waste Regulation.

For now we need to figure out where exactly do we stand with this legally. We'll post an update once there's some movement.

worked for me so far.

We just got a root shell on a @starlink terminal antenna! To our knowledge, this is the first full exploit of a "square dish" since @lennertwo's attack on the "circular" one in 2021.

@spacex security team has done an amazing job, leaving us no choice but a *hardware attack* to achieve this 👏 The demo below shows what's only possible on actual rooted hardware: reading fuse register contents, accessing hardware-encrypted "file_edr" data, and more.