@Framasoft it'd be so great if you'd set the default language of FramaForms Drupal to English...

Announcing two free #IBMi courses

https://community.ibm.com/community/user/blogs/upendra-rajan/2025/10/16/announcing-two-free-ibm-i-courses

Me: Let's use this well established OSS project again after several years!
Project: We're in Dependency Hell since last month, builds don't work...

Why is it always like this with me?? #fml

Call for Failures @ hack.lu 2025 — Because We All Break Things

At hack.lu, we love stories of brilliance — new tools, cutting-edge exploits, and clever defenses.
But let’s be honest: the best lessons often come from things that went spectacularly wrong.

That’s why we’re bringing back the Call for Failures (CFF) — a mini-conference inside hack.lu dedicated entirely to sharing the things that didn’t go as planned.

🗓️ When: Wednesday, 22 October 2025
🕖 Time: 19:00 – 21:00
📍 Where: At hack.lu, Luxembourg

#conference #unconference #hacklu #cybersecurity

🔗 https://2025.hack.lu/blog/hack.lu-call-for-failures-at-hack-lu/

TIL if you want to change the config of the logging module in PyGhidra you have to reastart #Ghidra for the new config to take effect...

Bonus: There is a predefined `writer` stream object that you can use to log to the GUI console.

1 hour of sleep, 2 energy drinks in.
I blame UEFI Forum for this

The official @Defcon recording of HTTP/1.1 Must Die has landed - join me on the mission to help kill HTTP/1.1! https://www.youtube.com/watch?v=PUCyExOr3sE

I'm looking for publicly available reverse engineered program databases (idb, gpr, bndb, ... ), preferably for relatively small programs.

Any tips?

#ReverseEngineering

Serious bugs often occur in third-party components integrated by other software. Ivan Fratric and I found this vulnerability in the Dolby Unified Decoder. It affects Android, iOS and Windows among other platforms, sometimes 0-click.

Integrators should update today!

https://project-zero.issues.chromium.org/issues/428075495

Hi there! This is #nakeddiefriday again!

Today I'd like to present you one of frequent sources of pain for C64 owners, the infamous PLA. This is MOS 7700R2. They failed way too often, and considering this is custom silicon, the only option was to get another one of the same.

Many thanks to @root42 for providing this sample!

SiPron link: https://siliconprawn.org/archive/doku.php?id=infosecdj:mos:7700r2

#electronics #reverseengineering #retrocomputing

New Project Zero issue:

Dolby Unified Decoder: Out of bounds write in evolution parsing

https://project-zero.issues.chromium.org/issues/428075495

CVE-2025-54957

How I Reversed Amazon's Kindle Web Obfuscation Because Their App Sucked https://blog.pixelmelt.dev/kindle-web-drm/

My OBTS v8 slides for Apple Compressor (part of Final Cut Pro) unauthenticated LAN RCE. No CVE? Because it’s not patched…🫣

https://github.com/ChiChou/slides/blob/b737cc3037408221217d59c8fc6b8a82706b7062/Queen%20B%200-click%20RCE%20for%20Apple%20Compressor.pdf

[RSS] Denial of Fuzzing: Rust in the Windows kernel

https://research.checkpoint.com/2025/denial-of-fuzzing-rust-in-the-windows-kernel/

"Which of course makes perfect sense when you are in the business of breaking stuff so people have to pay you for fixing it."

This is an old article, but this one sentence explains so many things!

https://dzone.com/articles/why-you-should-avoid-jsf

[RSS] exploits.club Weekly Newsletter 89 - iOS GPU Driver Bugs, Kernel Stack UAFs, Hardware Wallet Auth Bypasses, and More

https://blog.exploits.club/exploits-club-weekly-newsletter-89-ios-gpu-driver-bugs-kernel-stack-uafs-hardware-wallet-auth-bypasses-and-more/

CVE-2025-6554: The (rabbit) Hole

https://retr0.zip/blog/cve-2025-6554-the-rabbit-hole.html

So this October 2025 F5 security notification is pretty wild because of the sheer volume of vulnerabilities disclosed: more than 30 high-severity CVEs (!) and around a dozen medium-severity ones in a single release cycle. This affects almost every F5 product family, BIG-IP (all modules), BIG-IP Next, F5OS, and related components. Something we don’t see very often... and a lot of these vulnerabilities score above 8.0; remote exploitation, denial-of-service or privilege escalation. Also, the number of affected software branches (from 15.x through 17.x) means most F5 deployments are touched in some way. YMMV.
In short, this quarter’s bulletin is probably F5’s heaviest security updates ever. If you run F5 products, patch now. https://my.f5.com/manage/s/article/K000156572

[RSS] I remember taking a screen shot of a video, and when I opened it in Paint, the video was playing in it! What witchcraft is this?

https://devblogs.microsoft.com/oldnewthing/20251014-00/?p=111681