My newest Citation Needed project made an appearance on Last Week Tonight with John Oliver! It’s a work in progress, but you can see the new interactive version of my map of the Trump family’s crypto ventures at https://map.citationneeded.news/.

The map contains hundreds of business entities and links to the Trump family (with more being added!), augmented with data from the president’s most recent financial filings to estimate how much money is flowing in. It will be queryable by other researchers/journalists.

✨ A Sprinkle of JoyousJoyness ✨

That's all that matters.

Have a JoyousJoyfulJoyness day!

#happy #cat #funny #cute #joyousjoyness #repost

I can't wait for someone pivoting from a HF build container to Nvidia's ICS :)

#consolidation

RE: https://mastodon.cloud/@slashdot/117168550975017498

The End of SPARC

If Hollywood had any nerve there would be three different movies about a scruffy blue-collar hero who's down on his luck but finds meaning and new love cutting down Flock cameras shooting right now

https://www.theverge.com/tech/985155/flock-camera-destruction-vigilantes

Next.js Windows RCE PoC https://github.com/rafabd1/CVE-2026-75604-poc

Partner: Open this for me?
Me: What are the magic words?
Partner: Please?
Me: ...
Partner: ...
Me: Squeamish...
Partner: ...
Me: Ossifrage.
Partner: looks up "Squeamish Ossifrage"
Partner: NERD!

The latest #PowerShell version is 7.6 (according to Wikipedia).

I need a feature from 7.2.

I downloaded a Windows image literally yesterday.

The feature is not there.

Since I was #FediLectured that I shouldn't expect street names to be displayed on AdTech maps, here is a map from our local bike rental app with zero street names to indicate where the bike stations actually are (map provider is #Mapbox)

#geoinformatics #cartography #bubi

huh

Compromising Signal's Contact Discovery Enclave | V12
https://v12.sh/blog/signal

Hope you're having a better day than the folks at Ziggo who pushed a remote firmware update that bricked eleven thousand customers' cable modems. https://tweakers.net/nieuws/251384/ziggo-vervangt-11000-modems-van-zakelijke-klanten-vanwege-technisch-defect.html
(in case you were wondering why we were offline for much of Monday...)

I've recently scanned DKIM keys for vulnerabilities, more extensively than previous scans. DKIM keys with the Debian OpenSSL bug are still very common. So are too-short RSA keys (quite a few 512 and even 384 bit keys, and *many* 768 bit, which is still difficult to break, but possible).
Also, a notable number publish a private key in their DKIM record. (This is only a problem if they actually use the same key elsewhere correctly.)
I tried disclosing things, but manual disclosure impractical for thousands of affected hosts and automated disclosure is difficult (plenty without security.txt, security@ often is rejected).
Replies to disclosures also show a common misunderstanding: People believe they are unaffected saying these keys are old and unused. This shows a fundamental confusion about how digital signatures work. Attackers don't care if you use insecure keys as long as they can use them.

Some stats for the latest scan: https://monitor.badkeys.info/dkim/2026-08-11-dkim-badkeys.html

Oof that’s a lot of CVEs https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/

this wild defcon talk is finally out

researchers created a fake defi startup, hired lazarus it workers, put them into a sandbox and recorded their tooling, workflows, and faces from inside the operation

starts at 5:46:09
https://www.youtube.com/live/_uYQr8hfpbI?t=20770

New on Insinuator: Part 1 of a four-part series on token theft in Microsoft Entra ID, accompanying ERNW White Paper 80.

The target is no longer the password or even MFA, but the token issued once authentication succeeds.

Part 1 covers the threat landscape and the techniques: direct token theft and PRT abuse, AiTM phishing, device code phishing, consent phishing, ClickFix and the ConsentFix family, plus where Microsoft's defense-in-depth strategy still leaves gaps.

By Niklas Kerner.

https://insinuator.net/2026/08/token-theft-in-microsoft-entra-id-part-1-of-4-threat-landscape-and-attack-techniques/

#EntraID #OAuth #identitysecurity #InfoSec

godspeed you wonderful human

I guess throwing up a message like this is easier than optimizing your code

Modeling ELFs into SQL for execution https://fzakaria.com/2026/08/23/your-executable-is-a-sqlite-database

New vulnerability report from Talos:

Adobe Photoshop Installation privilege escalation vulnerability

https://talosintelligence.com/vulnerability_reports/TALOS-2026-2360

CVE-2026-48388,CVE-2026-48388,CVE-2026-48388