5putnick @5putnick

🚨 BrEaKiNg: Splunk, a security product, has zero authentication in its built-in database service and accepts any credentials, according to the security researchers who just dropped a full pre-auth RCE chain for Splunk Enterprise (CVE-2026-20253, CVSS 9.8). Splunk Enterprise on AWS is vulnerable out of the box.

keyboard_arrow_left Previous keyboard_arrow_right Next

🚨 BREAKING: More than 400 Arch Linux User Repository packages have been compromised with infostealer malware and a rootkit. Attacker posed as a trusted maintainer and "adopted" orphaned packages. Arch maintainers are purging infected packages now. Audit your AUR installs.

keyboard_arrow_left Previous keyboard_arrow_right Next

This looks accurate 😂😀

🚨 A single stray "!" in the #Linux kernel's firewall code (nftables). That one character let any normal logged-in user become root, and step out of the container. The fix? One line. And the exploit (CVE-2026-23111) to abuse it just went public. Read: thehackernews.com/2026/06/one-ch…

‼️🚨 BREAKING: Another researcher skipped coordinated disclosure entirely and dropped a critical 1-click GitHub token theft in public because he doesn't want to deal with MSRC. In his own words: "I really don't want to deal with MSRC on VSCode bugs." The bug: just clicking a link can hand an attacker a GitHub token that reads AND writes to all your repos, including private ones. It lives in github[.]dev, GitHub's browser-based VSCode editor, which passes the browser an OAuth token that isn't scoped to a single repo. That token can touch everything you can. Researcher Ammar Askar found that VSCode's sandboxed "webviews" leak keyboard events to the main editor. A malicious repo opened via one link can simulate keystrokes, install a local extension that skips VSCode's publisher-trust check, and exfiltrate your token. He published a working proof-of-concept. He says when he reports github[.]dev bugs, GitHub tells him they're out of scope and to go report to MSRC, and a prior VSCode bug he reported was silently fixed with no credit. One commenter summed up the mood: "MSRC has turned into Feedback Hub."

keyboard_arrow_left Previous keyboard_arrow_right Next

📢 CFP for #BSidesMaribor is STILL OPEN! You’ve got 5 more days to submit your: 🎤 Talks 🛠️ Workshops 🔬 Research 💡 Case studies Whether you’re a first-time speaker or experienced researcher - we want to hear from you. 👉bsidesmaribor.si #CallForPapers #SecurityBSides

ssh-keysign-pwn is the fourth local-root Linux kernel disclosure in roughly two weeks. (But who's counting?) AlmaLinux 9 and 10 are both vulnerable. AlmaLinux 8 is not exploitable with the current public PoCs, but is getting the patch as well. Patched kernel versions are available for testing now: almalinux.org/blog/2026-05-1…

Security things from the last few days: - CopyFail (linux pwn'd) - CopyFail 2/Dirty Frag - 13 advisories in Next.js - Over 70 CVEs addressed in MacOS 26.5 - ~50 CVEs addressed in iOS 26.5 - YellowKey (Windows Bitlocker pwn'd entirely) - GreenPlasma (Windows privilege escalation) - CVE-2026-21510 and CVE-2026-21513 confirmed to be used by Russia for Windows RCE - CVE-2026-32202 separately confirmed to be used by Russia for sensitive document access - Mini-Shai Hulud (over 300 JS and Python packages compromised via GitHub Action cache poisoning) - Google confirms they have identified AI-powered exploitation of zero days in an unidentified "open-source, web-based system administration too" - Canvas (popular LMS used in most schools) pwn'd entirely - PAN-OS (palo alto networks) pwn'd with a 9.3 severity CVE-2026-0300 Are you scared yet?

🚨 A third Linux kernel local-root flaw has been disclosed: Fragnesia. 🚨 Like Copy Fail & Dirty Frag, Fragnesia gives root on all major distributions. Every supported AlmaLinux release is affected. Help us test the patched kernels: almalinux.org/blog/2026-05-1…

@theo AI was busy tracking down all those bugs

The official JDownloader site (.org) was compromised. Attackers modified the alternative download page and replaced the Windows .exe installers as well as the Linux shell installer. The tampered Windows files lack valid digital signatures, display fake publisher names such as Zipline LLC, The Water Team, or Peace Team, and are flagged by Windows Defender and SmartScreen as malicious. The Linux shell installer now contains harmful code. What remains safe: >macOS installers >The main JDownloader.jar file >All existing app updates (running installations are unaffected) >Third-party packages such as Flatpak, Winget, or Snap (these use external hosting and unchanged manifests) The JDownloader developers have publicly confirmed the breach on Reddit and are working to restore the site. Do not download any Windows .exe or Linux shell files directly from jdownloader. org until they post an official all-clear. If you downloaded and ran a recent installer from the site in the past few days, run a full system scan with your antivirus and monitor for unusual activity.

keyboard_arrow_left Previous keyboard_arrow_right Next

‼️🚨 One of the world's largest Certificate Authorities, DigiCert, was compromised by a malicious screensaver file sent through a customer support chat. Their antivirus blocked the malware four times. The agent kept clicking. The fifth try got through. 27 code signing certificates were stolen and used to sign malware. DigiCert ultimately revoked 60 certificates. Per DigiCert's incident report, filed in Mozilla's CA compliance tracker as Bug 2033170, here is how it unfolded: April 2: an attacker contacted a DigiCert helpdesk agent through the company's customer support chat channel, posing as a customer. The lure was a zip file pitched as a screenshot. Inside the zip was a .scr file. On Windows, .scr files are executables, and this one carried a malicious payload. Opening a file a customer sent through the official support channel is what an agent is supposed to do. Support staff are the one role designed to accept files from strangers. DigiCert's endpoint security blocked four infection attempts. On the fifth, the support analyst's machine was infected. DigiCert detected the infection, ran an investigation, and concluded the incident was contained. Eleven days later, an external researcher tipped DigiCert off about misuse of DigiCert-issued code signing certificates in the wild. That tip led to the discovery of a second compromised machine, belonging to a different support analyst, infected through the same vector. The EDR on that machine had not been functioning correctly, so the original investigation missed it. The second machine gave the attacker access to DigiCert's internal support portal. That portal lets support staff reach limited views of customer accounts, including initialization codes for ordered but not-yet-issued code signing certificates. Combining a stolen initialization code with an approved order let the attacker pull a real, validly issued code signing certificate. They did this 27 times. DigiCert's own list of what went wrong: - File-type filtering on the customer support chat channel did not catch the .scr - EDR coverage was inconsistent and incomplete, creating a blind spot - Initialization codes for code signing certificates were not adequately protected DigiCert says it got lucky. An outside researcher found the malware abuse before DigiCert did. Without that tip, the second machine and the active certificate theft might still be running today.

keyboard_arrow_left Previous keyboard_arrow_right Next

The day a blind man sees. The first thing he throws away is the stick that has helped him all his life

❗️🚨 Microsoft Edge keeps every saved password in process memory as cleartext from the moment it launches. Microsoft's responsed when reported: "by design." All of them. Including credentials for sites you won't open this session. Researcher @L1v1ng0ffTh3L4N tested every major Chromium browser. Edge is the only one that behaves this way. Chrome decrypts credentials on demand, and App-Bound Encryption locks the keys to an authenticated Chrome process so other processes can't reuse them. In Chrome, plaintext surfaces only during autofill or when a password is viewed, making memory scraping far less useful. What makes this extra weird is that Edge still demands re-authentication before revealing those passwords in its Password Manager UI, while the same browser process already holds every one of them in plaintext. In shared environments, this turns into a credential harvest. On a terminal server, an attacker with admin rights can read the memory of every logged-on user process. In the published PoC video, a compromised admin account lifts stored credentials from two other logged-on (and even disconnected) users with Edge running. Microsoft's official response when notified: "by design." The finding was disclosed April 29 at BigBiteOfTech by PaloAltoNtwks Norway, alongside a small educational tool that lets anyone verify the cleartext storage for themselves.

keyboard_arrow_left Previous keyboard_arrow_right Next

‼️🚨 BREAKING: An AI found a Linux kernel zero-day that roots every distribution since 2017. The exploit fits in 732 bytes of Python. Patch your kernel ASAP. The vulnerability is CVE-2026-31431, nicknamed "Copy Fail," disclosed today by Theori. It has been sitting quietly in the Linux kernel for nine years. Most Linux privilege-escalation bugs are picky. They need a precise timing window (a "race"), or specific kernel addresses leaked from somewhere, or careful tuning per distribution. Copy Fail needs none of that. It is a straight-line logic mistake that works on the first try, every time, on every mainstream Linux box. The attacker just needs a normal user account on the machine. From there, the script asks the kernel to do some encryption work, abuses how that work is wired up, and ends up writing 4 bytes into a memory area called the "page cache" (Linux's high-speed copy of files in RAM). Those 4 bytes can be aimed at any program the system trusts, like /usr/bin/su, the shortcut to becoming root. Result: the next time anyone runs that program, it lets the attacker in as root. What should worry most: the corruption never touches the file on disk. It only exists in Linux's in-memory copy of that file. If you imaged the hard drive afterwards, the on-disk file would match the official package hash exactly. Reboot the machine, or just put it under memory pressure (any normal system load that needs the RAM), and the cached copy reloads fresh from disk. Containers do not help either. The page cache is shared across the whole host, so a process inside a container can use this bug to compromise the underlying server and reach into other tenants. The original sin was a 2017 "in-place optimization" in a kernel crypto module called algif_aead. It was meant to make encryption slightly faster. The change broke a critical safety assumption, and nobody noticed for nine years. That bug then rode every kernel update from 2017 to today. This vulnerability affects the following: 🔴 Shared servers (dev boxes, jump hosts, build servers): any user becomes root 🔴 Kubernetes and container clusters: one compromised pod escapes to the host 🔴 CI runners (GitHub Actions, GitLab, Jenkins): a malicious pull request becomes root on the runner 🔴 Cloud platforms running user code (notebooks, agent sandboxes, serverless functions): a tenant becomes host root Timeline: 🔴 March 23, 2026: reported to the Linux kernel security team 🔴 April 1: patch committed to mainline (commit a664bf3d603d) 🔴 April 22: CVE assigned 🔴 April 29: public disclosure Mitigation: update your kernel to a build that includes mainline commit a664bf3d603d. If you cannot patch immediately, turn off the vulnerable module: echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf rmmod algif_aead 2>/dev/null || true For environments that run untrusted code (containers, sandboxes, CI runners), block access to the kernel's AF_ALG crypto interface entirely, even after patching. Almost nothing legitimate needs it, and blocking it shuts the door on this whole class of bug...

keyboard_arrow_left Previous keyboard_arrow_right Next

Google has a pirate enemy. He's one guy. His name is Raymond Hill. He built uBlock Origin. The world's best ad blocker. 63K stars. GPL-3.0. He literally refuses every dollar you try to send him. Then Google did the unthinkable. July 24, 2025. Manifest V2 disabled everywhere. The full uBlock Origin stopped working on Chrome. The world's biggest ad company nuked the world's biggest ad blocker on its own browser. They called it "security." Coincidence. Here's the wildest part: Raymond didn't fold. Latest release: March 11, 2026. Still alive on Firefox. Still alive on Edge. Still alive on Brave. Still GPL-3.0. Still refusing every dollar. One developer vs. the trillion-dollar ad empire. But DO NOT install it. We should all keep Google richer. 100% Open Source. (Link in the comments)

A Rust dev just killed Headless Chrome. It's called Obscura. The open-source headless browser purpose-built for AI agents and scrapers at scale. Chrome vs Obscura: - Memory: 200MB+ → 30MB - Binary: 300MB+ → 70MB - Page load: 500ms → 85ms - Startup: 2s → Instant - Anti-detect: None → Built-in Single binary. No Node, no Chrome, no dependencies. Stealth mode is brutal: → Per-session fingerprint randomization (GPU, canvas, audio, battery) → 3,520 tracker domains blocked by default → navigator.webdriver masked to match real Chrome → Native function masking so detectors can't sniff it out Drop-in replacement for Puppeteer and Playwright over CDP. Zero code changes. If you run agents or serious scraping at scale, this repo prints money. 100% Opensource.

North Korean Lazarus Group has weaponized this exact class of Microsoft-signed kernel driver. It is sitting on MILLIONS of Windows PCs right now. It gives any local process full control from the deepest level of Windows. 5 lines of code. Zero validation. Your antivirus can’t stop what runs below the OS.

keyboard_arrow_left Previous keyboard_arrow_right Next