A critical vulnerability affecting certain configurations of the Exim open-source mail transfer agent could be exploited by an unauthenticated remote attacker to execute arbitrary code.

The FreeBSD team has patched a remote code execution in its operating system that impacts all versions released since 2005 Tracked as CVE-2026-42511, the vulnerability resides in the FreeBSD DHCP client and is extremely easy to exploit aisle.com/blog/aisle-d...

One in five IP addresses listed in residential proxy network are also communicating with malware command-and-control servers, suggesting the owners of those devices have an active malware infection www.bitsight.com/blog/residen...

I’ve been working on this classical cipher cryptanalysis tool using a mixture of Claude Code and Codex, just to get a sense of how capable these tools are on big (advanced) code bases. So far it solves homophonic, substitution, and a few polyalphabetic test cases. github.com/matthewdgree...

The cPanel auth bypass was a zero-day for two months before being patched webhosting.today/2026/05/03/t...

A Chinese threat actor has hacked the website of DAEMON Tools and has distributed trojanized installers since April 8 securelist.com/tr/daemon-to...

Dans son dernier bulletin d'actualité, le CERT-FR revient sur certaines vulnérabilités significatives de la semaine dernière. https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-020/

"The Pulitzer Prize for International Reporting is shared by journalists Dake Kang, Garance Burke, Byron Tau, Aniruddha Ghosal and Yael Grauer." Incredibly well deserved. @yaelwrites.com @byrontau.bsky.social @dakekang.bsky.social

What is the relationship between #CTI and more formal conceptions of "intelligence" - or, why maybe taking the "intelligence" out of CTI is long overdue: pylos.co/2026/05/03/a...

North Korean hackers have stolen $577 million worth of crypto-assets since the start of the year, accounting for three-quarters of all crypto stolen in 2026 Total is now at more than $6 billion since 2017 www.trmlabs.com/resources/bl...

I laughed so hard at this that I snorted more than once. www.youtube.com/watch?v=WAUn...

Spéculation et tulipomania plume-dhistoire.fr/tulipomania-...

NEW! We're joined by WIRED writer Andy Greenberg to dig into SentinelLabs' bombshell FAST16 research, a newly deciphered piece of sabotage malware that predates Stuxnet by five years and quietly tampered with physics modeling software likely tied to Iran's nuclear program. youtu.be/jIr6QdgUodU

… are fucking kidding me. A github.com cross-account RCE due to the most pedestrian of injection attacks along the obvious exposed surface… and they actually have a globally shared “git” UNIX user!! This is not what taking the role of supply chain stewards seriously looks like.

The Elastic security team is open-sourcing CI/CD Abuse Detector, a collection of drop-in CI templates that use an LLM to detect suspicious changes to CI/CD pipelines, workflows, and automation configurations. www.elastic.co/security-lab... github.com/elastic/cicd...

javvadmalik.com/2026/04/29/t... empathy in security control implementation matters

Microsoft will roll out passkey support for phishing-resistant passwordless authentication to Microsoft Entra‑protected resources from Windows devices starting late April.

Dans son dernier bulletin d'actualité, le CERT-FR revient sur certaines vulnérabilités significatives de la semaine dernière. https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-018/

La Cantine numérique Brest et le TyFab vous proposent une nouvelle séance de l'atelier d'initiation réseaux maillés sur #LoRa (#meshtastic, #Gaulix, #meshcore, #reticulum...) Ouvert à tous - pendant l'openlab 23 avril à 20h30 wiki.tyfab.fr renseignements [email protected]

More Vintage Computing museums should rent out cloud access to their rare hardware.

 SDF (Super Dimension Fortress) does it, and it’s freaking awesome.

 I’m literally logged into a Sun SPARCstation…anyone can do this for free, right now. Just SSH in.

Two papers came out last week that suggest classical asymmetric cryptography might indeed be broken by quantum computers in just a few years. That means we need to ship post-quantum crypto now, with the tools we have: ML-KEM and ML-DSA. I didn't think PQ auth was so urgent until recently.

Hours after Microsoft reveals that Russian hackers have been breaking into poorly secured routers & hijacking DNS requests (sometimes to collect Outlook data) www.microsoft.com/en-us/securi... DOJ says it has kicked those Russians out of the US routers they hacked: www.justice.gov/opa/pr/justi...

Russian espionage group APT28 compromised MikroTik and TP-Link routers to redirect traffic for certain authentication operations to AitM phishing kits This botnet was taken down today by the FBI, DOJ, Lumen, and Microsoft www.lumen.com/blog-and-new...

#Podcast #Cybersécurité Épisode #537 consacré à la recherche de compromission avancée sur mobile, avec Davy Douhine et Guillaume Lopes, de la société @randorisec.bsky.social (éditrice de la solution @shindan-io.bsky.social) www.nolimitsecu.fr/espionnage-e...

Dans son dernier bulletin d'actualité, le CERT-FR revient sur l'expiration des premiers certificats Secure Boot en juin 2026. www.cert.ssi.gouv.fr/actualite/CE...

In Nara, Japan, sika deer roam freely among cherry blossoms, creating a breathtaking scene each spring. These sacred creatures enjoy the beauty of hanami season too.

"I remind you that this present you're so concerned about losing, you hated it in the first place." <- JAGS on why security practitioners should stop clinging to the broken thing and start imagining what the fixed thing looks like. New episode is live 👇 securityconversations.com/episode/llms...

Vanadium version 147.0.7727.49.0 released: github.com/GrapheneOS/V... See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog. Forum discussion thread: discuss.grapheneos.org/d/33728-vana... #GrapheneOS #privacy #security

⚠️ Alerte CERT-FR ⚠️ La vulnérabilité CVE-2025-53521 est activement exploitée et permet de provoquer une exécution de code arbitraire à distance dans F5 Big-IP APM. www.cert.ssi.gouv.fr/alerte/CERTF...

CERTFR-2026-AVI-0382: Multiples vulnérabilités dans les produits FoxIT https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0382/

The ISO C++ committee has completed work on the C++26 specification of the C++ programming language. This will be the biggest overhaul to C++ since the 2011 specification. herbsutter.com/2026/03/29/c...

A group of North Korean hackers engaged in Contagious Interview campaigns left one of their web consoles exposed on the internet opensourcemalware.com/blog/contagi...

Dans son dernier bulletin d'actualité, le CERT-FR revient sur certaines vulnérabilités significatives de la semaine dernière. https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-013/

A really good primer on memory allocation educatedguesswork.org/posts/memory...

how diffie hellman key exchange works (with as little math as possible)

Dans son dernier bulletin d'actualité, le CERT-FR revient sur certaines vulnérabilités significatives de la semaine dernière. https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-012/

⚠️ Alerte CERT-FR ⚠️ Les travaux conjoints des services membres du Centre de Coordination des Crises Cyber (C4) ont permis d’identifier une recrudescence de campagnes d’attaques ciblant les comptes de messagerie instantanées. www.cert.ssi.gouv.fr/alerte/CERTF...

#Podcast #Cybersécurité Épisode #536 consacré à l'automatisation des investigations du SOC, avec Ahmed Achchak de la société Qevlar AI www.nolimitsecu.fr/automatisati...

This has to be an anticipated April first joke !

Watch on YouTube www.youtube.com/watch?v=s-oB...

Welcome to Velociraptor 101! Download Rapid7's Velociraptor DFIR - github.com/Velocidex/ve... Velociraptor 101: Rapid Windows Endpoint Investigations with Velociraptor & KAPE - www.youtube.com/watch?v=rqEj... AASLR: Playing with Velociraptor! - www.youtube.com/watch?v=sLSa...

After Hunt found an open directory hosting APT28's Roundcube exploit kit, Ctrl-Alt-Intel also found a 2nd open directory on the same server, this one with the "C2 source code, additional payloads, telemetry logs, exfiltrated data and evidence of further campaigns." ctrlaltintel.com/threat%20res...

from PLATO to Lotus Notes computer.rip/2026-03-14-l...

CERTFR-2026-AVI-0253: Multiples vulnérabilités dans Microsoft Edge https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0253/

En 2025, dans un contexte d’aggravation des tensions géopolitiques mondiales, la menace cyber se stabilise à un niveau particulièrement élevé, posant une pression constante sur l’Etat et le tissu économique et social français. cert.ssi.gouv.fr/cti/CERTFR-2...

#Podcast #Cybersécurité Épisode #534 consacré au ver "Shai-Hulud", avec @christophetd.fr www.nolimitsecu.fr/shai-hulud/

#Podcast #Cybersécurité Épisode #530 consacré au Programme de Transfert aux Campus Cyber (PTCC), avec Aline Becq et François Teyssier www.nolimitsecu.fr/ptcc/

#Podcast #Cybersécurité Épisode #531 consacré au marché noir des "credentials", avec Arnaud Garrigues de la société BreacHunt www.nolimitsecu.fr/le-marche-no...

www.proxylity.com/articles/wir... Using Wireguard as a TLS replacement.