[RSS] Exploiting AD ResetNightmare (CVE-2026-27912) and KerberLoss (CVE-2026-25177) from Linux

https://cravaterouge.com/articles/resetnightmare/

The fastest way to get VIP treatment when you land...seriously, how dumb do you have to be to try something like this? This person on Reddit stole my thoughts verbatim: "committing federal crimes from inside a sealed metal tube that lands exactly where the feds are waiting is certainly a strategy."

https://www.reddit.com/r/delta/comments/1vl52vr/dl591_lasatl_arrival_met_by_federal_agents/

RE: https://mastodon.social/@VeroniqueB99/117074185851484440

@emilymbender @alex I'm sure you'll love it!

I thought I'm making up a conspiracy theory around NVIDIA deliberately looking for bubbles to inflate - AI turned out to be a great one - after the crypto bubble bursted. It seems @david_chisnall agrees (sort of):

RE: https://infosec.exchange/@david_chisnall/117075838205635406

Finally, to close out our short #GitHub tour, a few vintage repositories 🍷 that have aged into historical curiosities and are now (mostly) harmless. Still worth a look as a learning resource, for humans and AI alike 🤖

https://github.com/0xdea/exploits - a collection of my public exploits from CVE-1999-1587 onwards

https://github.com/0xdea/shellcode - a small collection of my shellcode samples

https://github.com/0xdea/advisories - my public advisories starting from CAN-2003-0190, err..., CVE-2003-0190 up until today

Thanks for following along, and enjoy your summer break! ☀️

I wish California could promote LSD to politicians back in the day as effectively as they do today with AI.

[RSS] 4 jsoup vulnerabilities

https://joshua.hu/4-jsoup-vulnerabilities

It’s out! New video! Finally!

#science #physics

https://www.youtube.com/watch?v=P_ooEuOnNB8

OpenSSH 10.5 has just been released, mostly to fix a handful of security vulnerabilities.

https://www.openssh.org/releasenotes.html#10.5

We plan to move to a more frequent release schedule for as long as this season of LLM-found bugs lasts. More details in the release notes.

The soundtrack of my dream was a Sabaton song about debugging Binary Ninja:

"Debug the Ninja
Binary Ninja
Debug the Ninja
This is the song"

(note: I don't usually listen to Sabaton)

High level diff of macOS 26.6.1 vs. macOS 26.6.2 🎉

https://github.com/blacktop/ipsw-diffs/tree/main/26_6_1_25G76_vs_26_6_2_25G82/README.md

RE: https://social.lol/@phillip/117061432689860232

The postmortem of the hack on my Forgejo instance is here! I had fun investigating and writing it, so I hope y’all enjoy reading about it :)

#Homelab #SelfHosted #Cybersecurity #Infosec

https://phunky.cafe/my-homelab-got-hacked/

this program was generated with LLVM assistance
"don't you mean LLM assistance?"
no, i mean i implemented a few examples and left the rest as UB for the compiler to figure out https://gcc.godbolt.org/z/hd5Mhdhev

Somebody posted a Windows 11 LPE writeup, with a CVE that doesn't yet exist (CVE-2026-62737).

By poking at kloader's ExecutionContext, we can get kernel mode execution at an arbitrary address.

A stock Windows VM won't have a NIC that uses the NetAdapterCx framework, so will not show as affected. But you can start that service to see it in action.

The PoC has a hard-coded 0xFFFFF80041414141 as an execution target. I'm sure that somebody knowledgeable with Windows kernel stuff can figure out how to modify this to do something useful.

I predict that CVE-2026-62737 will be included in this Patch Tuesday lineup.

RE: https://live.acarsdrama.com/@acarsdrama/117072256729860162

come on now. be cool guys.

On Saturday night, one of our CT logs rejected most submissions for 30 minutes.

I just published the post-mortem, and the investigation was... a lot of fun? It involves Go mutex starvation, SQLite WAL behavior, and ZFS record sizes.

I got to SIGKILL a VM 200 times, implement a turnstile (TIL!), and order a Nokia flip phone.

https://groups.google.com/a/chromium.org/d/msgid/ct-policy/b1b5e8a2-b010-4e2a-b8c8-91c1d1b7ca91%40app.fastmail.com

Beatboxing is one of countless very good example why AI will never be able to replace actual art.
Most (if not all) sounds a beatboxer makes can technically be made by a synthesizer. The arrangement can be the same too.
Yet millions and millions of people enjoy beatboxing a lot more, specifically BECAUSE it comes from humans.

I think this principle can be applied to most forms of art.

So I don't think there's too much need to worry.

Just accidentally spilled some cold water on my tshirt and decided it's actually better this way.

r2ghidra 6.2.0 is out, and this time the changelog is massive! the decompiler output has been heavily improved in sync with all the new type analysis information we have in r2-6.2.0 (yeah next release will reduce backward compatibility with r2 apis)

https://github.com/radareorg/r2ghidra/releases/tag/6.2.0

Security Vendor's AI Best Practices Labels Critical #Elixir RCE Safe

https://paraxial.io/blog/ai-spam