Let's go...

[RSS] CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys

https://www.thezdi.com/blog/2026/7/9/cve-2026-47291-remote-code-execution-in-the-windows-httpsys

I’ve been working with computers for five decades. Some people view me as an “expert” in certain subjects.

And I can tell you that when I am learning a new technology I still feel like the dumbest newb on the planet. I make tons of mistakes. I go down stupid rabbit holes of my own making. I have tons of self doubt.

So give yourself some grace. Everybody goes through this phase. Take a deep breath. Believe that you can do this.

Apple SEAR is hiring an offensive security researcher focused on wireless security!

We're looking for talented researchers to help find and exploit vulnerabilities across wireless technologies.

Apply here: https://jobs.apple.com/en-us/details/200671326-2911/offensive-security-researcher-wireless-security?team=SFTWR

If you love digging into wireless stacks and

CVE-2025-45422: Proximus b-box UPnP Persistence & Access Control Bypass https://github.com/Cedrico03/CVE-2025-45422---Bbox

GET IT HERE https://github.com/shibco/ableton-linux/

So
after 14 months(?) of work
and a lot of frustration
barely knowing what i was doing
i think i made someting special (!)

presenting:

a Wine fork
for Ableton Live 12

on Linux

stable
pixel perfect
vst support
1st class gnome citizen
device hotwire support
low latency audio

tell ur friends 🥹🥹

How ChatControl passed in the EU parliament.

[RSS] The other kind of control flow guard check: The combined validate and call

https://devblogs.microsoft.com/oldnewthing/20260708-00/?p=112510

[RSS] Reverse-engineering a Neopets shop with 48,000 inventory snapshots

https://danielmay.co.uk/posts/redistributing-billions-neopets/

ALT https://effinbirds.com/post/821685348153360384

This is in fact

Foxit Foxit Reader Javascript checkbox CBF_Widget code execution vulnerability (CVE-2026-57256)

(Hope this is just a temporary problem with the bot and I don't have to touch the HTML parser :P)

RE: https://infosec.place/objects/48afd31c-35ab-4cfa-b28d-4a27e66c1259

Cursed circuits #6: reverse avalanche oscillator - https://lcamtuf.coredump.cx/blog/avalanche/

New Project Zero issue:

Adobe DNG SDK: Heap memory disclosure via LZW-compressed semantic masks rendered through MaskedRGBTables

https://project-zero.issues.chromium.org/issues/514643907

CVE-2026-47963

New Project Zero issue:

Adobe DNG SDK: Heap memory disclosure via uninitialized MCU buffer in Hasselblad 3FR lossless JPEG decode path

https://project-zero.issues.chromium.org/issues/514249399

CVE-2026-47934

New Project Zero issue:

Adobe DNG SDK: Heap memory disclosure in ReorderSubTileBlocks due to truncated row block count for clipped strips

https://project-zero.issues.chromium.org/issues/514247216

CVE-2026-47927

New Project Zero issue:

Adobe DNG SDK: heap buffer overflow in DecodeFPDelta due to missing pixel format validation and non-fatal error handling for semantic mask IFDs

https://project-zero.issues.chromium.org/issues/509923792

CVE-2026-47964

[RSS] Some interesting findings in Windows Defender

https://blog.projectnightcrawler.dev/posts/2026-07-09-some-interesting-findings-in-windows-defender/

Client-side DoS via ADS :)

Spent my childhood optimizing CONFIG.SYS and AUTOEXEC.BAT to fit everything into 640 KB.

Now one browser tab needs 2 GB of RAM so 17 analytics companies can find out I looked at socks.

Meta faces $1.4 trillion in damages for hooking kids on purpose. The company's market cap is $1.5 trillion. They're arguing the number is unprecedented in consumer protection history, which is technically true. It's also the first time anyone built a $1 trillion business on deliberately addicting children.

https://gizmodo.com/metas-teen-safety-case-just-became-a-1-4-trillion-existential-threat-2000782306

If you're just now hearing about GhostLock and looking to fix it, make sure you don't introduce two unpriv-reachable DoSes associated with its fixes. The fix the Linux CNA lists for CVE-2026-43499 introduces a NULL deref, which caused CVE-2026-53166 to be issued. Unfortunately...