RE: https://infosec.exchange/@BleepingComputer/117207756865330014

Oh no! But how will security vendors write their blog posts now?

Egads.

www.yahoo.com/news/us/arti...

If a grocery store is doing dynamic pricing and you just sit there with a flipper zero recording whatever sub GHz or IR signal they are broadcasting to flip them, take the lowest real displayed price, replay it with idk something like this, is that illegal

The recording of "Deobfuscation in the Age of Agentic Reverse Engineering" is now public:

https://www.youtube.com/watch?v=3-gJ6EUFoKM

We (CC @nicolodev) show how to use agents to break protections found in anti-cheats, DRM systems & commercial protectors.

Slides: https://synthesis.to/presentations/recon26_agentic_deobfuscation.pdf

Redis RCE PoC (CVE-2026-81934) https://github.com/v12-security/pocs/tree/main/redis/server_ssl

My energy providers website stopped working properly for me this morning. Why would it expect me to be able to also contact:

ahrefs.com
bing.com
browser-intake-datadoghq.eu
clarity.ms
doubleclick.net
facebook.net
google.com
hs-scripts.com
stapecdn.com
stripe.com
stripe.network
tiktok.com
vercel.com
wurfl.io

Just to submit a meter reading!

And no, I DO NOT want to use your sodding app!

#enshittification

VB's Péter Szőr Award, commemorating the life & work of security researcher Péter Szőr, is awarded for the best piece of technical security research published in the past year. What research deserves to win the 2026 award? Nominations close 9 Sept! https://virusbulletin.com/conference/peter-szor-award/

A couple of weeks ago I showed a preview of a new mode for Mines, in my puzzle collection. I'm pleased to say that the new Mines is now completed and live! You can now play Minesweeper on a wide range of tilings in your browser
https://www.chiark.greenend.org.uk/~sgtatham/puzzles/js/mines.html
or download a desktop version from the parent page which supports the same set of grids.

As well as the support for lots of grid types, there's also a new user preference (off by default) to make it easier to play on them. When you click on a clue square to potentially clear around it, the existing flags adjacent to the square light up, to make it easier to count them and work out how many more mines you're still expecting. Particularly useful in the hat tiling, where it's easy to mistake exactly what is adjacent to what!

I expect different people will prefer different grids. Personally I think the triangular grid is particularly tricky and puzzly; the hexagonal honeycomb makes a gentle introduction; the Cairo, Floret and Kites tilings are a nice set in between those extremes; and of course the aperiodic tilings are there to keep you on your toes and ready for anything.

Many thanks to Anders Höglund for this excellent piece of work.

NightmareEclipse versus CrowdStrike Falcon https://github.com/MSNightmare/FalconFlank

Chamilo LMS was put under the microscope 🔬 by @coiffeur0x90 and Sean Matthews

11 vulnerabilities. multiple attack surfaces. Our new research dives into the vulnerable code paths and exploitation primitives to achieve unauthenticated RCE.

🔗 https://blog.quarkslab.com/chamilo-lms-its-raining-0days-hallelujah-its-raining-0days.html

With Mastodon's new Collections feature (i.e. "starter packs"), I made a Cyber Threat Intelligence Collection:

https://infosec.exchange/collections/117120621715888849

Feel free to share with anyone getting started here on Mastodon, if they need some accounts to build out their feed. Note that Mastodon Collections currently have no "Follow All" button: this is by design.

#cybersecurity #CyberThreatIntelligence #CTI #infosec

"how would you rate the phone app?" YOU'RE FUCKING INFRASTRUCTURE

this shit is as nonsensical as svchost asking you to rate it

product managers are absolutely cuckoo

Happy "Oracle has lost more than 60% of its value since the peak one year ago" to all those who celebrate

DEVCORE CONFERENCE 2027 | CFP is open

#Redteam, #VulnerabilityDiscovery, #Physicalsecurity, firmware and hardware RE, #AI attack surfaces. Bring the research that starts from a hacker's view.

Deadline: Oct 11, 2026, 23:59 GMT+8
https://sessionize.com/devcoreconference2027/

"Because if I know one thing for a fact, it is that I deeply love this island."

The latest and penultimate page of the first chapter of my comic Ekphrasis, which you can read for free at https://ekphrasiscomic.neocities.org/

I really recommending reading this.

In summary, a company which does ID verification for in-person interactions (hotels, car rentals, ID verification for alcohol or marijuana, etc) has some how exposed over 153,000,000 drivers licenses for people in the United States and Canada.

It is a catastrophic data breach, probably one of the worse I've ever seen. If you're in the United States and have traveled, gotten a hotel, purchased marijuana or alcohol, there is a high probability you're in this.

Unlike other breaches, this includes a photo of the person (from the license), making verification you've identified the person significantly easier.

This poses a significant threat to celebrities (musicians, YouTubers, streamers, adult entertainers, actors, etc), politicians, lawyers, wealthy people (CEOs, investors, people of public interest), Law Enforcement Officers, etc

Krebs himself, and several other security researchers, have already confirmed they're in the data leak.

tl;dr gah damn dawg this company is going to be sued into oblivion

https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/