Wowowow Auth bypass/privesc in telnetd! seclists.org/oss-sec...

Microsoft are upselling security controls for Microsoft Recall, which allow orgs to limit what it records specifically - if the org pay for Microsoft Purview. I’ve had a look at how this works under the hood, it is using undocumented features in Recall. learn.microsoft.com/en-us/purvie...

Bellingcat uses the ATLOS platform to take those archived sources and assign verification and tagging tasks to each item, allowing the creation of verified and searchable archives bellingcat.gitbook.io/toolkit/more...

The Australian cybersecurity agency has warned local businesses against uploading customer data and files to AI chatbots or genAI platforms www.cyber.gov.au/business-gov...

One thing I'm sometimes asked is why NBN isn't upgrading apartments to full fibre like everywhere else. Saw this from estimate briefing documents from October... seems they only plan to on a "commercial basis" eg building pays. www.infrastructure.gov.au/sites/defaul...

IMHO if you depend on any of these for your work, it is a good time to consider your BCP, & dependencies. Urgently. There's lots of good knowledge & guidance the various orgs have produced. Make sure you've got your supply chain & dependencies secured, & prepared for compliance implications.

-Truebit hacked for $26mil -Kontigo hacked for $340k -Pro-trans hacktivists hack UK right-wing org -BreachForums data gets leaked -Italy fines Cloudflare -Ireland revokes passports after software glitch -Logitech outage crashes mice -CISA retires ten emergency directives -NIST gets a funding boost

If you run a git forge: disable unauthenticated clones for repos larger than 512Mi until further notice.

Git's HTTP server side design does not scale https://xeiaso.net/notes/2025/distributed-git-ddos/

This just in - Google is about to break to gmail for POP3 users: www.theregister.com/2026/01/05/g...

First blog of the year is five general tips for learning about #OTCybersecurity as a student tisiphone.net/2026/01/04/my-t...

Wanting to fit into society by *checks notes* having a clean desk Prints / Comic Archive adhd-alien.com Patreon patreon.com/adhd_alien/

New breach: WIRED magazine had 2.3M records allegedly breached from parent company Condé Nast and published online this week. Data included email and display name, some records contained additional personal data. 81% were already in @haveibeenpwned.com. More: haveibeenpwned.com/Breach/WIRED

Relfection: I find it very telling when groups makes a lot of fuss about others not doing the right thing, but refuse to be bound by those same rules. Very interesting.

#MongoDB and MongoDB Server multiple versions are vulnerable to Remote Code Execution (#RCE) #vulnerability CVE-2025-14847 and may be abused by unauthenticated threat actors in low-complexity attacks that don't require user interaction. Patch now! 👇 www.bleepingcomputer.com/news/securit...

Casey Ellis: Pioneering The Bug Bounty Platform To Empower Ethical Hackers

Peter Gutmann - Why Quantum Cryptanalysis is Bollocks #quantum #cryptanalysis #cryptography www.youtube.com/watch?v=xa4O...

CVE-2018-25154 - GNU Barcode 0.99 Buffer Overflow in Code 93 Encoding Mechanism CVE ID : CVE-2018-25154 Published : Dec. 24, 2025, 8:15 p.m. | 41 minutes ago Description : GNU Barcode 0.99 contains a buffer overflow vulnerability in its code 93 encoding process that allo...

You don't need to think about what is "normal." You are you. One day, the world will come where there is no need to categorize people as LGBT🏳️‍⚧️🏳️‍🌈 Until that day arrives, I will continue to send out this message. Your soul is beautiful.

Wanna re-live the ✨kawaii ✨ magic? Well lucky ducks, guess what we have prepared! All of the Kawaiicon 3 talks are up on YouTube! Check em out! youtube.com/@kawaiiconnz

It may feel like the whole idea of protecting yourself online is too big of an issue to tackle. But we can take small steps to better protect our own privacy and build an online space that feels as free and safe as speaking with those close to us in the offline world. www.eff.org/deeplinks/2...

owo whats this atcr.io

Huh. Atproto docker publishing. atcr.io

Announcing Key Transparency for the Fediverse soatok.blog/2025/12/15/a... #fediverse #e2ee #keytrans #keytransparency #key-transparency #crypto #cryptography #privacy #opensource

Roomba maker iRobot gets cleaned out in Chapter 11

ICYMI This is an excellent read, postmortem and lessons from PostHog which was a victim of a software supply chain attack. posthog.com/blog/nov-24-... #appsec #prodsec

🤔 With practically all Gov, Banks, etc interactions via apps these days, with a ban from these platforms for whatever reason, how will a person continue to live? Do offline options exists? This is more significant impact than just a corp enforcing it's rights to choose who it does business with.

Notepad++ version 8.8.9 was released to fix a security weakness in its WinGUp update tool after researchers and users reported incidents in which the updater retrieved malicious executables instead of legitimate update packages.

TL;DR a couple hundred IPs suddenly started exploiting Cisco devices today - Entire exploitation cluster is originating from OVH (@ovhcloudus.bsky.social). - Payloads are interesting- attacker is even checking hardware temperatures most likely to ensure they are not honeypots

interested in standardization of AT at the IETF? there are ongoing discussions happening on the mailing list, and there will be a video call this Wednesday to discuss the scope of work, especially around DIDs and identity. more details in this email thread: mailarchive.ietf.org/arch/msg/atp...

Notepad++ have published an update to fix the software being hijacked by threat actors remotely: notepad-plus-plus.org/news/v889-re... This was being abused by threat actors in China, a blog from mine from a week ago: doublepulsar.com/small-number...

It's very interesting to see how various platforms are complying with a foreign entity's rules that they are not sovereign to... It's a canary for how they will act, and how genuinely safely their trust & safety teams will implement the policies.

So awesome that the nation's so-called eSafety Commissioner is forcing every Australian over the age of 16 to hand over our biometric data to overseas-based companies whose business model is about monetising personal data & linking online accounts to real world individuals. Excellent work everybody.

Bluesky has also asked the @australia.theguardian.com account to put in its age, and is even more restrictive. Guardian Australia can't use @bsky.app, though 3rd party posts are still going through. I won't put GdnAus's 2013 launch as birth date in case it nukes the account. Maybe I'll try 1821

Checkout atproto.com/specs/permis...

It's actually out.

Rob Fuller (aka Mubix): From Hacking Games to Professional Hacker

📦 aquasecurity / trivy ⭐ 30,093 (+24) 🗒 Go Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Plus If all "official" content is signed, then any real leaked footage of state violence or corruption that isn't signed (because it was taken by a brave bystander on a burner phone) will be automatically flagged as "unverified" or "fake" by the system.

A perfect CVSS 10 🧑🏻‍🍳💋 CVE-2025-55182: Unauthenticated remote code execution vulnerability in React Server Components The vuln is in versions 19.0, 19.1.0, 19.1.1, and 19.2.0: react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack Upgrade immediately!

This Humble Bundle has a lot of really good hacking books from No Starch Press, and it supports EFF! Get it!

Serious Cryptography is the current default answer to “how do I learn cryptography engineering from a book?”

Friends! @danidonovan.com is going through absolute hell right now with awful cyber-bullying, counterfeits of her Anti-Planner book, and other crap. If you or someone you know has #ADHD, please consider buying the anti-planner.com; I highly recommend it! Please share for reach!

The answer is simple. A company’s product also include it’s dependencies. If you are using public libraries it’s not the open source libraries’ fault they have vulnerabilities it’s the commercial company’s responsibility to patch. 11.12.2027 this will become law: www.tributech.io/blog/cra-8-v...

Love the new stations! Super excited about them. 10 bloody years in the making.

Small detour 😁

a game to learn (or teach) how to use standard commands in a Unix or Linux shell. GameShell is available in English, French and Italian. github.com/phyver/GameS...

New: *Looseleaf* publishing — a way to publish standalone Leaflets on AT Protocol! 📝🍃 We started with publications on atproto; now we're bringing it all together so _anything_ you write on Leaflet, incl single documents / posts, can be 'atprotated' :) Learn more in thread! ⬇️

If you couldn't make it to German @owasp Day 2025 in person, you can watch the live stream here: media.ccc.de #owasp_god25

Automatic quota management is now AWS Service Quotas adds support for automatic quota management AWS now auto-raises quotas so you don't hit arbitrary limits they invented. This "exciting" feature solves a problem only AWS created. Free, because charging for it would be too honest.