TECHNLGY/TECH.GIF

Monday morning, same old feeling…

Have a great week all!

"HEIF Heist is Hacktron's name for a class of remote attack paths targeting services that decode attacker-controlled HEIF, HEIC, or AVIF images"

https://heif-heist.com/

Cool finding, but these issues have been around for ages. It's embarrassing for all the affected large corps that they didn't care to invest in testing their dependencies and proper sandboxing.

Seems like AI companies are not that easygoing when they are on the wrong end of hacking :P

https://threadreaderapp.com/thread/2101252692635004997.html

New Pwndbg release!

We now disassemble code backwards in context and nearpc, display indirect jumps, nearpc -f works without debug syms, added stack-vis command to visualize stack frames, improved v2p, p2w and pageinfo kernel debugging commands & more!

See https://github.com/pwndbg/pwndbg/releases/tag/2026.09.15

Please sponsor us: https://github.com/sponsors/pwndbg !

#pwndbg #gdb #lldb #reverseengineering #security #lowlevel #exploitation #pwning

Are "HACK THE PLANET" t-shirts responsible for multi-modal prompt injection into the agents at world leading AI labs?

Lasers. Microscopes. $250K. One secured chip.
Ledger Donjon just showed how they cracked debug access on RP2350-A4, a break worthy of Raspberry Pi's own Hacking Challenge.
Respin or no respin? Raspberry Pi says no. Read why: https://www.raspberrypi.com/news/everything-is-better-with-lasers/

I love a cartoon that sums up a line of argument I have often made as a political economist, so here's a great example from the (recently deceased) P.C.Vey - whose work appeared in the New Yorker & elsewhere.

#economics #regulation #politics

h/t Loren Fox/LinkedIn

Windows Defender Update DoS Vulnerability https://github.com/MSNightmare/BigDiskBuster

My son is reading Lord of the Rings for the first time and he just stuck his head out the door:

"Who the fuck is Tom Bombadil??"

[RSS] What Go Taught Us About Java Garbage Collection

https://debugagent.com/what-go-taught-us-about-java-garbage-collection

This meme has so much telling about the current status of AI racing as well as how everyone seems to have forgotten the basic IT security.
https://bird.makeup/users/0xtib3rius/statuses/2101147121063751903

[RSS] Quarkdown: Turing-complete Markdown typesetting system

https://github.com/iamgio/quarkdown

~~There is a demand for this. Shut up.~~

Edit: actually, this seems really useful, although I don't know why Turing-completeness was chosen as the selling point :)

LMAO, can we just issue one giant CVE for the entire Linux kernel

PoC for CUPS LPE on Linux https://github.com/v12-security/pocs/tree/main/cups/cups2root

US military had close call after using AI for false intelligence report

https://edition.cnn.com/2026/09/18/politics/us-military-ai-false-intelligence-china-ship

They almost attacked a Chinese ship believing it was transporting nuclear weapons component (/via OSINTTechnical@X)

Sweden is also choosing @forgejo for their digitally sovereign government codeplatform, just like the Dutch code.overheid.nl 🥳🥳

https://github.com/diggsweden/ena-kodsamverkansplattform-poc

This is a nice step towards less dependence on US big tech, aka Github.

In my last days at the @BZKopensource I hope to set up a working group with other EU governments, to work towards a federated network of codeplatforms 🇪🇺

#codeplatform #forgejo #ospo #digitalsovereignty #opensource #foss #govtech

Buyers of pervert glasses join the war on pervert glasses: https://www.latimes.com/business/story/2026-09-18/meta-glasses-captured-shared-intimate-images-without-users-consent-lawsuit-claims

The quickest teardown ever. Zero screws removed. 👀 Your first look inside the iPhone 18 Pro thanks to Lumafield!

just in case you don't have it saved, here's the most important reaction meme for navigating the fediverse