I gave a talk at Bluehat Singapore. Here is a link to the slides, and a photo that perfectly frames it.

https://thomasdullien.github.io/about/slides/An-age-of-experimentation-BlueHat-Asia-2026.pdf

RE: https://mastodon.social/@eff/117215319335459732

Oof. "Copyright bad so AI companies violating copyright good" is a terrible take.

Linux kernel root exploits in EH6, SCTP, PPPoE: https://seclists.org/oss-sec/2026/q3/822

If you don't know what these abbreviations means: networking stuff that you probably don't use (ok, you may use PPPoE on your Internet router, but you still don't need it on your desktop or server).
I'll add my ceterum censeo: Attack surface reduction works.

https://seclists.org/oss-sec/2026/q2/557

Flock cameras are riddled with security vulnerabilities and hard-coded credentials. Here's my analysis of today's @ddosecrets Flock leak https://micahflee.com/flock-cameras-are-riddled-with-security-vulnerabilities-and-hard-coded-credentials/

RE: https://infosec.exchange/@micahflee/117282688510612709

*Jabba the Hut laugh* ho ho ho ho

Flock API key = НаJ3FgupAm8RrDJW3МНgT9X7Ft27eVaD

https://ddosecrets.org/article/flock-alpr-camera

This discussion in the ⁠binutils⁠ mailing list is interesting. I had no idea the target binary could easily detect and interact with Valgrind directly. Valgrind provides a header (⁠valgrind.h⁠) to help the client do exactly that.

A change in the ⁠gas⁠ assembler that optimized ⁠xchg reg, reg⁠ to ⁠mov reg, reg⁠ in specific conditions broke Valgrind. That optimization yielded more efficient code because the ⁠mov⁠ instruction is cheaper.

Valgrind implements a trapdoor—a "hypercall"-like mechanism between the target and Valgrind, officially called the Client Request Mechanism. This trapdoor relies on a magic sequence of preamble instructions followed immediately by an ⁠xchg⁠ instruction.

Because the ⁠gas⁠ optimization replaced that ⁠xchg⁠ with a ⁠mov⁠, Valgrind was seeing a ⁠mov⁠ and failing to recognize the request.

The problem occurred both when Valgrind itself was built with the optimization, and when target binaries were built with the client-request mechanism through the ⁠valgrind.h⁠ file. ⁠systemd⁠ was one of the affected projects. Because there are many projects out there built with the Valgrind header that hardcode the expectation of an ⁠xchg⁠ instruction, the optimization had to be reverted.

That problem resulted in the following error in Valgrind:

vex amd64->IR: unhandled instruction bytes: 0x48 0xC1 0xC7 0x3 0x48 0xC1 0xC7 0xD 0x48 0xC1
vex amd64->IR: REX=0 REX.W=0 REX.R=0 REX.X=0 REX.B=0
vex amd64->IR: VEX=0 VEX.L=0 VEX.nVVVV=0x0 ESC=NONE
vex amd64->IR: PFX.66=0 PFX.F2=0 PFX.F3=0
==568970== valgrind: Unrecognised instruction at address 0x484f1e9.

[PATCH 1/2] x86: optimize XCHG to MOV for same-register forms
https://sourceware.org/pipermail/binutils/2026-July/149944.html

x86: Disable XCHG to MOV optimization
https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=49652cd8ecbb4c305a9a0e9099016edb138e6953

Using and understanding the Valgrind core: Advanced Topics
https://valgrind.org/docs/manual/manual-core-adv.html

The entity drifted dreamlessly through space, as it had for aeons. It woke when it neared a star. Scanned for planets, life, signs of technology.

Having found all, it analyzed and decoded radio emissions, then composed a message to send.

"My hovercraft is full of feels."

It resumed dormancy.

#TootFic #MicroFiction #SmallStories

James Forshaw at @44CON found an old email about the Morris worm.

Sorry my picture actually shows it in rainbow 🌈. colors !!