[RSS] Remember CVE-2010-2743 ?

https://blog.projectnightcrawler.dev/posts/2026-08-14-remember-cve-2010-2743/

[RSS] From P-Code to GNN: extract binary code semantics

http://blog.quarkslab.com/from-p-code-to-gnn-extract-binary-code-semantics.html

This is a new low:

YouTube requires me to confirm my age if I *search* for "hair lbj" (I'm old enough if I search for this song, trust me).

Direct link to an uploaded version works.

I spent the past few days going down various fascinating rabbit holes using a nifty new service called Decryptads.com, which scrapes a metric ton of adtech data from websites and apps about who they allow to collect data and serve ads.

A search in DecryptAds for the hugely popular sports network espn.com, e.g. reveals 143 ad partners and 19 registered data broker domains are listed within its ads.txt and app-ads.txt files. That data broker information is gradually becoming available because four states — California, Oregon, Texas and Vermont — have recently passed laws requiring data brokers to register if they buy or sell data on consumers from those states. DecryptAds reports that almost half of those data brokers are collecting geolocation data from espn.com visitors who aren’t blocking ads, while another three disclose that they collect device fingerprints and sensitive personal information.

DecryptAds also makes it easy to learn the beneficiaries and national origins of the advertising firms lurking in apps and websites, displaying a conspicuous warning when adtech partners of an app or website are based in “geo-risk” areas like China and Russia, or in countries with strong financial and political ties to both — such as Cyprus and the United Arab Emirates (UAE).

According to DecryptAds, espn.com works with four different advertising entities that are based in either Russia, China or the UAE, including the adtech firm Between Digital, which lists a New York address. However, the dossier on Between Digital flags them as a Russian firm, showing that their publisher offers (PDF) are processed through Alfa Bank, Russia’s largest private commercial bank and one of several financial institutions placed under U.S. sanctions in 2022 after Russia invaded Ukraine.

A search for several top U.S. military news websites — including armytimes.com, airforcetimes.com, defensenews.com, navytimes.com, marinecorpstimes.com and federaltimes.com — shows they all allow Between Digital to serve ads and track users, as well as two entities in the UAE and another in the ownership secrecy haven of Panama. DecryptAds reports that Between Digital is collecting ad data on approximately 55,000 partner websites.

This service is a gold mine for security researchers, journalists and anyone interested in privacy, adtech, AI slop sites, residential proxies, malvertising, etc. Want to read more? Check out today's story:

https://krebsonsecurity.com/2026/08/whos-tracking-you-use-this-new-service-to-find-out/

random, probably from old tumblr

You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?)) - watchTowr Labs https://labs.watchtowr.com/youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452/

Little human eating ice cream with grandpa:

"Is this delicious or cold?"

#Spotted in Budapest District VIII.

During yesterday's solar eclipse, Spanish Olympic skateboarder Danny Leon performed a jump, timing the trick with the moon passing in front of the sun. Leon shared the epic stunt on his social media accounts and called it ‘the move of his life.’

#SolarEclipse #Skateboarding #DannyLeon

RE: https://hachyderm.io/@tailscale/117083224760630723

I wrote about finding an SQLite bug for the Tailscale blog!

I learnt so much from working on this series of incidents, and I’m proud of the outcome and the story we can finally tell. 🥰

Sziget Festival is going full force, LLMs produce new hits every nanosecond, but there's one thing neither of them can beat:

https://www.youtube.com/watch?v=6DpG_kdtLtA

The multiverse theory - where every variation of events fork to a bazillion parallel realities - is unsettling, but it becomes nerve wrecking if you drive a car.

This is cool! https://github.com/xoreaxeaxeax/skitter-creek-bath-salts

It's 2026 and on Windows Server 2025, attempting to create a TLS certificate will default to a 1024 bit key and you have to find this menu and expand it to change it.

New vulnerability report from Talos:

Microsoft Windows TCPIP.SYS IppQualifyAddresses Out-of-Bounds Read Vulnerability

https://talosintelligence.com/vulnerability_reports/TALOS-2026-2427

CVE-2026-49177,CVE-2026-49177

My terminal is out of black paper

Let’s call it „beg4shell“. At least now everyone can be a vulnerability researcher.

I self-host now: this account runs on my own server and my own domain, @mbr

The old instance is shutting down and the auto-migration only carried a fraction of you across. If you can read this, you're already in the right place.

Everyone else has to re-follow by hand. Please BOOST this to help me get back everyone :)

#Fediverse #SelfHosted #Mastodon #mbr #masterbootrecord

Rob Pike received the 2026 USENIX Lifetime Achievement Award! https://www.usenix.org/about/awards/flame

Git, grant me the serenity
not to stage changes that don't matter
the courage to commit those that do
and the wisdom to know the difference.

Did you read our latest publication?

Our newest advisory highlights a Linux kernel use-after-free vulnerability discovered by independent researchers during TyphoonPWN 2026: https://ssd-disclosure.com/linux-bridge-stp-timer-use-after-free/

SSD Secure Disclosure is a trusted partner for advanced vulnerability researchers, providing a direct path from high-impact research to coordinated disclosure and competitive compensation.

We are actively looking for Linux vulnerability research, including kernel exploitation, privilege escalation, memory corruption, and other high-impact findings.

You focus on the research. We handle the rest. Learn more at https://ssd-disclosure.com/product-index/