High level diff of iOS 27 beta8 vs. iOS 27 RC 🎉

https://github.com/blacktop/ipsw-diffs/tree/main/27_0_24A5430a_vs_27_0_24A435/README.md

Earlier this month, @volexity detected multiple Chinese threat actors launching attacks against its customers using chained 0-day exploits in Google Chrome (CVE-2026-85046 & CVE-2026-87491) and Microsoft Windows (CVE-2026-85880). Volexity observed threat actors it tracks as UTA0560 and JungleBamboo using variations of the same exploits to deliver different malware implants. These implants ranged from a JScript backdoor (GRIMWEDGE) to a fake Google Gemini Chrome extension (LONGTALE).

Read the full analysis of the exploit chain and post-exploitation tradecraft here: https://www.volexity.com/blog/2026/09/09/mind-the-patch-gap-multiple-chinese-threat-actors-chain-0-day-exploits-in-chrome-windows/
 
#DFIR #threatintel

Default auto-generated CC on YT music videos is a great way to demonstrate how much Google's AI sucks.

Heat.
Heat.
[Music]
1-2-3

@rygorous early russian info ops

RE: https://mstdn.social/@jukkan/117240247968300759

I just love this:

”Feature #23 is worth noting in isolation. LinkedIn collects the user’s Do Not Track preference, then excludes it from the fingerprint hash (line 9512, excludes: { doNotTrack: true }). They record that you asked not to be tracked. Then they track you.”

@eduzsh when you do an LLM "fix", "works for me" is good enough and you don't have to consider any of the contribution requirements (like not introducing bugs at places you don't personally use). so I think it's more likely that people will churn out a bunch of fixes that are slightly wrong in different ways. it is true that while some of the fixes will be fine, they'll never make it back to the project anyway.

military-grade mental illness

Edit: resolved

Hey, I am an old school vanilla JS person and want to learn what frontend frameworks do people use these days.

Are there any statistics I could look into? Not looking for engineering advice or suggestions what to use.

I hope to get a better understanding of the engineering practices & workflows and security needs to ensure that our security work in web standards can actually land with the users.

Edit: Specifically, I am interested how people modify/insert HTML :)

Secret Panel HERE 🧠 https://patreon.com/mrlovenstein/posts/mind-body-84972760

Google Chrome #zeroday

Google is aware that an exploit for CVE-2026-87491 exists in the wild.

https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html

#Google #Chrome #CVE

bear with you? dude that sounds dangerous get out of there

@jcoglan not a frequent obsidian user, maybe there's some config for this?

coincidentally, I just slop-coded a python static file server that live renders markdown+mermaid in the browser. It doesn't have embedded mermaid (inside md) support yet, but if you think you could use it I'll publish it sometime today.

LLM anti-pattern:

- #FOSS drops, everyone happy
- #FOSS bugs surface, bitrot needs handling
- Instead of contributing fixes, users use #LLM to solve their specific issues
- #FOSS never gets fixed

Bonus: bugs accumulate so much that the project eventually dies, while everyone regenerates parts of it from scratch on-demand with LLM.

Tickets are live and trainings are up too! Round 1 pricing is happening and won’t last long. Now’s the time to grab your ticket: https://re-verse.io

@jcoglan obsidian? https://www.mermaideditor.io/integrations/obsidian

CVE-2026-83991: Windows Cloud Files access-check bypass https://github.com/karollooool/CVE-2026-83991-writeup-and-poc

@acsawdey I'm also thinking about using this as a compat layer between e.g. IBMi/PASE and x86. Feels like it'd match pretty well with IBMi's SLS too?