@dymaxion @kaoudis I guess back in the day this was about workforce distribution? People with pentest skills usually didn't work at places that required them + project distribution didn't justify hiring? There is also a conflict of interest if a person with pentest skills also works on the system under test.

[RSS] CVE-2026-78902: XSS to RCE in pfSense with one DNS request

https://www.netspi.com/blog/technical-blog/web-application-pentesting/cve-2026-78902-xss-to-rce-in-pfsense-with-one-dns-request/

"It is hard to be brave," said Piglet, sniffing slightly, "when you're only a Very Small Animal."

[RSS] How One Twitch Chat Message Became Code Execution on a Streamer's PC

https://blog.scrt.ch/2026/09/22/how-one-twitch-chat-message-became-code-execution-on-a-streamers-pc/

The Irish Presidency of the EU has proposed member states to allow AI companies unfettered access to the data of EU citizens.

According to leaked docs, the proposal would effectively exempt AI companies from any of the GDPR rules and deny EU citizens data protection rights

https://noyb.eu/en/ai-eu-member-states-plan-digital-expropriation-europeans-interest-ai-companies

Everyone ready to vote for the fattest bears? Who are your picks for the 2026 competition?

I'm voting 910!

https://katmaiconservancy.org/fatbearweek

Veeam Agent LPE PoC https://github.com/suce0155/CVE-2026-32996

Can gzip be a language model?

https://nathan.rs/posts/gzip-lm/

Woops:

* https://mobeta.fr/blog/vcenter-cve-2026-59309-cve-2026-59310/

#threatintel, #vmware

A first public side-channel attack on the Arm CryptoCell-310.

Our latest blog post walks through the full methodology: EM signal analysis, a collision-correlation attack, and full AES key recovery.

Read it here: https://www.eshard.com/blog/side-channel-analysis-arm-cryptocell-310-aes

#SCA #HARdware #CYBERsecurity #ARM #ARM64 #SCA

[Commercial, since it involved my company] Two of my friends - Jarosław Jedynak and Michał Leszczyński - are doing a webinar on Kubernetes hacking tomorrow, with live demos and stuff. It's free, but you do have to sign up to hackArcana's newsletter:

https://hackarcana.com/workshop-session/2026-Q4-k8s/intro-webinar

It's funny how WinDbg's TTD docs[1] emphasizes that PII may appear in dumps, while e.g. docs for crash dump analysis[2] don't.

Based on the observation that behind every warning sign there is a story I suspect that at one point a TTD trace somehow resulted in summoning MS's legal team :)

[1] https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/time-travel-debugging-overview
[2] https://learn.microsoft.com/en-us/windows/win32/dxtecharts/crash-dump-analysis

📢 Registration for CHERITech'26 is now open!

Join us on 12-13 November 2026 alongside SEMI Europe's SEMICON Europa 2026 at the NextSEMI Arena (Hall B0), Messe München, Germany for two days of talks, technical discussions, and networking focused on CHERI, memory safety, and secure computing.

How to register:

1️⃣ Purchase a valid SEMICON Europa 2026 ticket
2️⃣ Complete the CHERITech'26 registration form

Please note: CHERITech'26 is free to attend for all SEMICON Europa 2026 visitors. However, a valid SEMICON Europa 2026 ticket is required for each day you wish to attend CHERITech'26.

🔗 Register and learn more: https://cheri-alliance.org/events/cheritech26/

Today's xkcd is especially unhinged, love it!

https://xkcd.com/3301/

[RSS] Windows Exploitation Techniques: Dangling COM Object Registrations

https://projectzero.google/2026/09/windows-dangling-com.html

#IBMi could allow a remote authenticated attacker to obtain sensitive information due to the use of hardcoded cryptographic constants to obfuscate encryption keys

https://www.ibm.com/support/pages/node/7285846

The 90s called and want their dumb obfuscation back!

@Natasha_Jay I really like Andorra's concept of Transportation via Electric Boogie!

[RSS] Advisory X41-2026-004: dm-verity can be bypassed in Debian live-boot

https://x41-dsec.de/lab/advisories/x41-2026-004-debian-live-boot/

[RSS] ZTE SmartHome Account Takeover: Password Reset Without Verification Code. 4 CVEs, 100K+ Android Downloads - CVE-2026-86553

https://minanagehsalalma.github.io/zte-smartlife-app-pwned/

High level diff of iOS 27.2 beta vs. iOS 27.2 beta2 🎉

https://github.com/blacktop/ipsw-diffs/tree/main/27_2_24B5084k_vs_27_2_24B5089g/README.md