But I gotta hand it to AI labs that "WE MUST BE STOPPED AT ANY COST OR WE'RE GOING TO KILL YOU ALL" is one of the most original marketing pitches I've heard in my life

The #Chiptune scene is growing back in Barcelona! https://filedn.eu/lhG9NwEl2KwykI9ctSv7Uqf/8bitnit/index.html

When I drive a car without a valid driver's license, proof of insurance or tag/license plate, I get stopped by the police, my car will be towed and I can either walk home or might end up in jail and face severe fines, a probation period and loss of my driver's license.

When Microsoft runs 45 gas turbines without a state permit, they get 45 days to fix it and a $1.07M fine (which is petty cash for an operation this size) and don't even have to power down the turbines.

https://www.theguardian.com/environment/2026/sep/25/new-jersey-fines-datacenter-unpermitted-generators

🚨 Companies are being urged to shut down their NetScaler instances immediately due to multiple unpatched Citrix NetScaler RCE vulnerabilities.

Source: https://x.com/watchtowrcyber/status/2103891689857228803

DNS errors again. systemd-resolved once again reports 0 errors (in fact, 0 log messages).

From my professional experience I know this means the network is probably fucked. It was.

But why is it so hard to put `error("network is fucked");` in #systemd?

https://blog.netherlabs.nl/articles/2006/09/08/the-perfect-error-message

An official #MCP for #IDA was released by @HexRaysSA

https://hex-rays.com/blog/hex-rays-ida-mcp-server

An old friend is ashamed of speaking English with people but want to practice. Any pro/cons of using an educational chatbot for this?

At first I find this a pretty good use case for language models.

vertex shaders per cryptographic proof

That's right, the right answer for this questions is: 3!

By first pressing the down arrow you remove the selection (which you didn't put there) from the address bar text. The two downs are needed to reach C:\Users\Public.

"2 or 3" would be also acceptable, because if you don't just click the address bar, but start to type in it, there is no selection to remove.

https://infosec.place/objects/85dfac07-d1d6-412b-832c-897be5be860b

We have posted the YouTube playlist for Trusted Computing 1103: Advanced TPM Usage by Dimi Tomov in partnership with the TCG. Now anyone wishing to download the videos for offline viewing can find all their URLs here:
https://www.youtube.com/playlist?list=PLUFkSN0XLZ-l-hmC2f0f0WHh5tm76LyTj

But as always the best experience is at the full class at https://ost2.fyi/TC1103

It seems that Avast managed to settle the lawsuits related to their data abuse in both US and UK. While in the former they agreed to pay a fairly moderate fine, UK let them off the hook even easier. They are offering two years of free software to eligible UK users which is, quite frankly, a joke. It costs Avast exactly nothing, it allows them to email past users on a legal basis and gives them a chance to win them back. Really, who agreed to that?

#Avast #Jumpshot #privacy

Interesting Git repos of the week:

Strategy:

* https://github.com/SoShinySoChrome/human-incident-response-framework - tackling the human side of IR

Threats:

* https://github.com/Mickinthemiddle/CLOAK - deception techniques used by operators

Detection:

* https://github.com/Chick3nHawk01/Open_Source-CTI-Tooling - open source CTI tooling

Bugs:

* https://github.com/suce0155/CVE-2026-32996 - a backup route for LPE

Exploitation:

* https://github.com/cloudflare/security-audit-skill - more skills for your 🤖
* https://github.com/almounah/silph - another tool to steal your memories
* https://github.com/TheZeroSlave/WPE - like Burp but for non-HTTP Windows traffic (HT @Ichinin for the reminder)
* https://github.com/interference-security/echomirage - if you remember shade/DOA... someone has saved a copy of Echo Mirage, another Windows MITM testing tool
* https://github.com/Mafifrizi/ARES - someone has been going through adding my AD attacks (credited nicely :)) on Linux to its repertoire
* https://github.com/IoTS-P/Akiba - batch processing Ghidra
* https://github.com/vulncheck-oss/initial-access-community - some nice ideas on initial access from @albinolobster and friends

Hard hacks:

* https://github.com/GlasgowEmbedded/glasgow - it's always nice in Glasgow with @whitequark
* https://github.com/xiaobor123/vuls-find-VxWorks - VxWorks until it doesn't
* https://github.com/xiaobor123/vul-finds - more cute bugs

Data:

* https://github.com/cisco-ai-defense/aibom - AI usage needs to be transparent... and if not, well, some of us will be looking for it in any event 🤖

Cryptography:

* https://github.com/nationwide-group-oss/cryptoptic - time to start taking PQC seriously

Development:

* https://github.com/ItzLevvie/dind - HT to @GossiTheDog for pointing it out, but run Windows inside of GitHub

Nerd:

* https://github.com/sure-fire/derbypi - some neat extensions for Pis from @surefire

#security, #research, #code

Introducing 𝙷𝚊𝚠𝚔𝚃𝚞𝚊𝚑𝙱𝚛𝚘𝚠𝚜𝚎𝚛.𝚎𝚡𝚎

- 15 KB native web browser
- 6 MB of RAM for the host
- 0 lines of Visual Basic (no C# cuz idk how to write it)
- no URL bar because surfing through 88x31s is more fun
- title bar kept cuz then u can close it and minimize buttons

#Windows experts, can you answer this without trying:

How many times do you need to press the down arrow to select C:\Users\Public?

#UX #UI

Session timeouts[1] provide great examples of #compliance disconnects from reality:

When booking for events it *always* takes *days* to get from registering for an event and getting there to show your QR or whatever. And while an attacker who hijacks your session has 0 benefit from accessing it for a prolonged time, somehow #security finds it crucial that users are auto logged-out after 30mins.

It would take just a *tiny* bit of thinking to avoid making things worse for everyone.

[1] https://wstg.owasp.org/latest/4-Web_Application_Security_Testing/06-Session_Management/07-Session_Timeout/ (congrats to #OWASP for breaking all your indexed links in search engines, also very helpful!)

BBC News has 4 YouTube videos up in the past day about OpenAI hacking “governments”, with approaching a million views.

If you want to know the technical details of this elite frontier AI hacking - these are examples of the actual OpenAI agent requests.

It’s really dumb shit. The story here is OpenAI are utterly incompetent at cybersecurity, as are their victims.

Re: this one I'm still curious how I could tell which document node triggered a network event (denied, with an img Initiator) I see in dev tools. I can't find the corresponding URL by searching in Inspector, DeepSeek hallucinates all the solutions, maybe @freddy has a tip?

#Firefox

RE: https://infosec.place/objects/c55e1bcb-86a9-4d16-b9fb-83dccaeb4dad

#BOFH excuse #442:

Trojan horse ran out of hay

The Degraded Search Engine

Bonus speedpaint: https://www.peppercarrot.com/en/miniFantasyTheater/071.html#bonus

#webcomic #krita #miniFantasyTheater

Umm why does infosec.place "access my device"?

/cc @jerry