@Edent

"I can understand why .bid and .loan are popular with scammers. But why .mobi?!" -> because the avg user has 0 clue about what a domain name is, what its parts are and what they signify. Not to mention URLs...

"What can be done?" -> So far I could only think of enforcing a strict domain allow list for users (at the endpoint/browser) who don't know better.

It was brought to my attention that Real Hack History, a youtube channel, has been uploading documents, audio and video related to hacking history to the Internet Archive and they deserve a little collection. I'm making them for them now but you can look at their excellent uploads immediately.

Really good stuff. Really well sourced.

https://archive.org/details/@realhackhistory

Hot take:

a 20 kloc PR - even if it fixes the problem or adds the feature perfectly - is spam.

it is spam because it overwhelms the reviewer, who is then unable to reasonably perform their duty of actually comprehending and checking the code to make sure it does what it's supposed to.

Micropatches released for "ResetNightmare" Windows Kerberos Elevation of Privilege (CVE-2026-27912) https://0patch.com/blog/micropatches-released-for-resetnightmare-windows-kerberos-elevation-of-privilege

I'm launching a series of short posts about the tools I've built to automate
reverse-engineering workflows. I've used them to analyze protections such as
SafetyNet, DexProtector, iXGuard, and Arxan.

First up: MCStone, a clean & efficient assembler and disassembler built on LLVM's MC layer.

https://www.romainthomas.fr/project/mcstone/

An interesting paper: Frontier Models’ Vulnerability Patches are Often
F.L.A.W.E.D.

https://1password.com/files/resources/frontier-models-vulnerability-patches-flawed.pdf

Epoch is live! ⚡ Time Travel Debugging built for the agentic era.

Record full-system execution from Kernel to userland, then let your AI agents investigate the trace: instructions, registers, memory, all replayable forward and backward.

Discover Epoch: https://www.eshard.com/blog/introducing-epoch-time-travel-debugging-built-for-the-agentic-era
Dynamic analysis has never been so powerful.

#reverseengineering #cybersecurity #ai #agenticreversing #agentic #agenticai #cybersec

Want to write kernel exploits or analyze malware? You need to understand Windows internals first. Syscalls, IRQL, pools, mitigations & more. Architecture 2821: Windows Kernel Internals 2 by Cedric Halbronn @saidelike https://ost2.fyi/Arch2821

Oh lovely. Our government is investing €500m into slop, and are joining the AI Gigafactory program.

Can the bubble burst already, please?

https://bynar.io/blog/linux-has-screensharing-rces-too
Welp time to update

PLACES/TAXCO7.GIF

How accurate have Ed Zitron's AI skeptic predictions been?

https://danluu.com/zitron/

[RSS] Chamilo LMS... It's raining 0days, hallelujah, it's raining 0days

http://blog.quarkslab.com/chamilo-lms-its-raining-0days-hallelujah-its-raining-0days.html

[RSS] Binary Ninja 6.0 (Krypton)

https://binary.ninja/2026/09/03/binary-ninja-6.0-krypton.html

TIL #MermaidJS supports packet diagrams since v11.0.0!

https://mermaid.ai/open-source/syntax/packet.html

Can't wait to try this!

Interesting Git repos of the week:

Bugs:

* https://github.com/MSNightmare/FalconFlank - everyone's favourite new source of 0day pops CrowdStrike Falcon
* https://github.com/MSNightmare/HardBreacher - everyone's favourite new source of 0day pops Kaspersky AV

Hard hacks:

* https://github.com/salmg/SIMtrace2-T1-Research - research into SIM cards
* https://github.com/i12bp8/TagTinker - messing with IR on the Flipper Zero
* https://github.com/nickdaria/wyze-bulb-color-pwned - and Nick opened the firmware and set "let there be light..."
* https://github.com/jprx/darwin-vm - the Apple never falls far from the tree

Hardening:

* https://github.com/a13xp0p0v/linux-kernel-defence-map - mapping the Linux kernel attack surface
* https://github.com/ryancdotorg/libclaymore - @ryanc defuses dd

Data:

* https://github.com/going-doer/Paper2Code - generate PoC code from papers 🤖
* https://github.com/adulau/ptrclassify - what's in a name asks @adulau

#security, #research, #code

make bad art

@ppb1701 @AAKL

- How drunk did you get last night?
- Oh, they just had to alert the Gripens...

@ppb1701 @AAKL small price for an epic story (if you live)!

What happens if a model is repeatedly asked to make a small, localized tweak to an image. In case you were wondering. You can thank me later.

[ Edit: article with more goodies here: https://blog.coredump.cx/p/recursion-into-madness ]