James Forshaw at @44CON found an old email about the Morris worm.

Sorry my picture actually shows it in rainbow 🌈. colors !!

[RSS] Fragnesia primitive via Open vSwitch. Deterministic local privilege escalation.

https://blog.doyensec.com/2026/09/17/ovs.html

Why Ctrl+Alt shouldn’t be used as a shortcut modifier:

https://devblogs.microsoft.com/oldnewthing/20040329-00/?p=40003

Unfortunately Microsoft doesn't seem to follow this wisdom:

https://github.com/microsoft/WinDbg-Feedback/issues/158

#WinDbg

[RSS] Reversing Factorio's RNG

https://gegell.github.io/posts/factorio-rng/

[RSS] Overview of Passive Optical Networks (PONs) Security

http://blog.quarkslab.com/overview-of-passive-optical-networks-pons-security.html

[RSS] Original Sony PlayStation 2 security chip 'broken wide open' after 26 years

https://www.tomshardware.com/video-games/playstation/26-year-old-sony-ps2-security-chip-broken-wide-open-after-four-years-of-effort-reverse-engineering-enthusiast-successfully-unlocks-cxp102064-mechacon-chip

[RSS] Why building a Rust LSP is hard

https://rust-glancer.github.io/blog/why-lsp-is-hard/

[RSS] Evading Machine Learning Based Detections

https://msecops.de/blog/posts/ml-evasion/

In 1983, Gavilan Computer Corporation introduced what it dubbed "the first mobile computer." The Gavilan was a briefcase-sized machine with a 3-inch disk drive, an 8-line display, and promised 7 hours of battery life. But Gavilan was a bust. It burned $31 million in venture capital and only managed to ship about 1,000 machines before filing for bankruptcy.

I detailed Gavilan's history in a 2024 podcast. You can read the entire transcript here:

https://www.computerchronicles.blog/transcript-gavilans-31-million-ride-to-bankruptcy/

#retrocomputing

New: hackers tore down a Flock camera and managed to extract the software running on it. We then analyzed the data to find how a Flock camera really track cars and people. The amount of data this single camera gathered in a short period was huge, 50,000+ vehicles https://www.404media.co/hackers-stole-flocks-camera-software-revealing-how-the-company-tracks-cars-and-people-2/

@algernon @gaborudvari I agree that's cringe but I'd also like to note that the largest companies in the world are built on AdTech. People/societies are weird when it comes to desires and consumption.

@stf @mhoye barbaric!

“The AI Reversing Panel: Are we all powerful, or out of a job?” I moderated at @recon is now out on YouTube.

REcon doesn’t often do panels, but Hugo Fortier asked us to do our best - and we said yes.

We’re all trying to figure out the future of security, research, and what to do next. Is the future all about being super hackers, or re-skilling as washing machine technicians?

My deepest appreciation to our panelists:
John McIntosh, Marion Marschalek, and Aaron Portnoy

To those joining us over Zoom in the middle of their night:
Thomas Dullien and Thai Duong

Guests:
Dragos Ruiu and Sergey Bratus

Video:
https://www.youtube.com/watch?v=iDJDmie8XaQ

With a special note of thanks to our editors:
Ido Kenan Nathan Van Horn

Quick reminder: deadline for Paged Out! Issue #10 is in 2 weeks!

"People and their AI agents are making the act of being on the internet extremely annoying, and the problem is about to get much worse. " https://www.404media.co/theres-a-100-chance-ai-agents-are-already-ruining-the-internet/?ref=daily-stories-newsletter

Great, turns out my TTD trace failed to record some memory and instead of a) displaying an error b) at least marking it unmapped it went with c) filling it with 0x00 just so I could spend half day figuring out how some values magically appeared in a struct.

#ReverseEngineering #WinDbg

My binary so thick it stores data in the base pointer

[RSS] Apple Reference Image: A New Approach for Verified Photography

https://security.apple.com/blog/apple-reference-image

[RSS] Multiple Vulnerabilities in Frappe LMS Leading to Remote Code Execution

https://rhinosecuritylabs.com/research/multiple-vulnerabilities-in-frappe-lms-leading-to-remote-code-execution/

Cybersecurity has an AI doomer problem https://www.youtube.com/watch?v=KMf2RDC5Dyg

The AI industry's proximity to cybersecurity is causing clueless AI doomers to flood the zone. Experts and real issues are now being drowned out by increasingly absurd cyber-apocalypse fantasies imagined by people with no real world experience. From self-replicating AI models, to turning the entire internet into a botnet. The doomers are losing their minds and taking the cybersecurity industry with them.