Critical vulnerabilities in Ivanti Sentry (CERT-EU Security Advisory 2026-008)

On 9 June 2026, Ivanti released a security advisory addressing two critical vulnerabilities in their Sentry products[1]. An attacker could exploit those flaws to achieve unauthenticated remote code execution on the vulnerable device.

https://www.cert.europa.eu/publications/security-advisories/2026-008/

Holy collisions batman:

Typed `id` on a stock Ubuntu Server. Default user already in the `lxd` group, which is root-equivalent.

Host root on every LTS from 20.04 to 26.04, sudo never entered. Bonus: a free AppArmor hardening downgrade for the whole box.

Vendor: won't-fix.

https://starlabs.sg/blog/2026/06-old-wine-in-a-new-bottle-a-decade-old-lxd-group-root-re-armed/

Our intern Tevel Sho and his mentor @cursered spent some time poking at Cisco ISE. 40+ bugs reported. 4 dupes. This dupe is RCE as root:
https://starlabs.sg/advisories/26/26-20147/

I employ a two-pronged defence against phishing:

First, I am so behind on reading my email that, by the time a phishing message actually gets read, the original scammers have probably had their site taken down, or maybe died of old age.

Second, I don’t know any of my passwords and, if your domain doesn’t match, my password manager won’t fill them, and I’m much too lazy to fill them manually, so will probably just close the window. If it looks important, I’ll flag the email and come back to it eventually. Maybe.

I'm really curious what the CVE graphs will look like once companies have to start paying to secure their own software. I find it hard to believe that companies with 10-20 people looking for 0day will spend $1M+/mo on Claude once they stop getting low hanging fruit?

Like I kinda thought Mythos was gonna include a suite of tools to help find security bugs, and the model would be to sell that tooling + mythos to companies? But instead it's just another chat bot lmao. People are going to get wildly different results based on their tooling

German ruling declares Google liable for false answers in AI Overviews

"AI" news are rarely good news, this one is. I hope this becomes an EU-wide thing eventually.

World-wide would be nicer, but I have no hope for the current US admin.

#algernonReviewsHackerNews

Nightmare Eclipse has released a new exploit: RoguePlanet

It's reportedly not 100% reliable, but it worked on the first attempt for me.

https://starlabs.sg/blog/2026/06-old-wine-in-a-new-bottle-a-decade-old-lxd-group-root-re-armed/ reminds me of the time I pointed out that /usr/local/* was writable by the staff group on Debian. Privesc by design.

Wow. Over 200 CVEs from #Microsoft and another 123 from #Adobe. It's a record-setting Patch Tuesday, but fear not! @TheDustinChilds has broken the release down and provides the details. Check out the blog athttps://www.zerodayinitiative.com/blog/2026/6/9/the-june-2026-security-update-review

Secret Panel HERE 👻 https://patreon.com/posts/54470189

#LiteLLM command injection vulnerability CVE-2026-42271 that could allow any authenticated user to run arbitrary commands on the host, has been added to the CISA KEV catalog:
👇
https://thehackernews.com/2026/06/litellm-flaw-cve-2026-42271-exploited.html