Somebody released a PoC for Firefox CVE-2026-8389, and it works.

The PoC doesn't include a sandbox escape, and claims that poc-win-sbx.html includes the escape. This file was not shared in the repo.

The python server on localhost seems unnecessary, as the exploit web server can surely serve up primer.js the first time that payload.js is requested, and the actual payload.js the second time. 🤔

absolute gem of a Wikipedia image description

New Project Zero issue:

Linux >=6.10: io_uring: kernel memory read via unchecked address in ITER_UBUF/ITER_IOVEC iov_iter combined with non-checking nocache/flushcache accessors

https://project-zero.issues.chromium.org/issues/496923375

CVE-2026-43073

To save you 34 minutes, researchers had previously found 72 days on which there were second-long jamming events of GPS in most of Europe (as described in https://radionavlab.ae.utexas.edu/wp-content/uploads/Clements-space-interference-iongnss25.pdf ) Later they were able to record such an event & could locate the source of the disruption to a Russian military satellite. https://www.youtube.com/watch?v=tz23G_UXCGA

ti84 game programming about to enter a new golden era
https://bird.makeup/users/coffeededo_o/statuses/2062166308809269495

Unauthenticated RCE as QSECOFR via #IBMi Management Central

https://blog.silentsignal.eu/2026/06/05/unauthenticated-rce-as-qsecofr-via-ibm-i-management-central/

#Java #Deserialization #0day #NoCVE

The idea of banning minors from using social media is at its heart an attempt to punish victims instead of going against the perpetrator. If minors are more easily victimized by the predatory practices of large tech corporations it's not their fault. The blame lies squarely on the corporations. They must stop using predatory practices. And that's doubly important because those practices hurt adults and minors alike.

proof per unit test

Holy moly, one of my cousins (8 weeks into undergraduate computer science) asked me for help on a university assignment. I was surprised because he's very switched on.

It's a group assignment and it was extremely obvious that every other student has logged into a parent's corporate LLM and written all the code via prompt with no understanding.

When I asked how they're getting away with it, he said that the lecturers have just given up on all policing. (University is RMIT in Melbourne.)

[RSS] System Over Model, Tested: Reproducing Mythos's FreeBSD Find on Local Open-Weight Models

https://clearbluejar.github.io/posts/system-over-model-tested-mythos-freebsd-local-openweight/

[RSS] Docker Internal (3)

https://u1f383.github.io/linux/2026/06/04/Docker-Internal-3.html

3rd part of the Docker security research series

[RSS] The futex READ_ONCE

https://guysrd.github.io/futex-read-once

Android kernel race condition analysis

I complained about hexeditors recently. Now I found TeeHee, and I think I'll stick with it on all platforms:

https://sr.ht/~aleksi/teehee/

Edit: Since this took off somewhat, I'd note that I found the editor in this list: https://github.com/merces/awesome-hex-editors <- give it some love <3

Our Call for Participation will close on 7 June - if you have a talk, workshop, or performance you'd like to give at EMF, there's still time to submit!

https://www.emfcamp.org/cfp

Some perspective:

An 8TB hard drive that was $129.99 a year ago is now $299.99.

Thanks, AI. You're really making the world a better place.

#Redis - Security advisory: [CVE‑2026‑23479] [CVE‑2026‑25243] [CVE-2026-25588] [CVE‑2026‑25589] [CVE-2026-23631]

https://redis.io/blog/security-advisory-cve202623479-cve202625243-cve-2026-25588-cve202625589-cve-2026-23631/

For 19 years, GPS satellites have secretly broadcast a “numbers station” in their public signals. We decoded 12M messages: a 2011 flash where 31 of 32 satellites flipped in hours, “ghost” substrings repeating years apart, and a “TEXT” prefix spreading now. https://lsc-pagepro.mydigitalpublication.com/publication/?i=865273&p=62&view=issueViewer

🚀𝐎𝐟𝐟-𝐁𝐲-𝐎𝐧𝐞 𝟐𝟎𝟐𝟔 CFP looking for the research that will shape the conversations, techniques and tooling of tomorrow's offensive security community.
CFP closes on 1 July 2026, 18:00 SGT.
The next great OFF-BY-ONE talk might be yours!
https://cfp.offbyone.sg