Seeing open source and privacy companies having Discord as there support channel feels like a vegan community meeting at a steak house for events.

GCVE-BCP-05 - GCVE Vulnerability Format (Updated CVE Record Format) has been published as DRAFT and ready for public review. The standard is similar to the @cve record format with some extensions (via the `X_` prefixes) for GCVE format and the reference implementation vulnerability-lookup. This […]

We presented “Advancing Vulnerability Tracking and Disclosure Through an Open and Distributed Platform” at the excellent @UYBHYS #cve #vulnerability #opensource #vulnerabilitymanagement #cybersecurity 🔗 https://www.vulnerability-lookup.org/2025/11/08/unlock-your-brain-2025/

py5sig build automatically 5G signalling messages and fuzz SBI interfaces Pretty cool stuff seen at the @UYBHYS workshop #5g #fuzzing #opensource #cybersecurity 🔗 https://github.com/ANSSI-FR/py5sig

py5sig build automatically 5G signalling messages and fuzz SBI interfaces Pretty cool stuff seen at the @UYBHYS workshop #5g #fuzzing #opensource #cybersecurity 🔗 https://github.com/ANSSI-FR/py5sig

The MISP Galaxy now includes an updated knowledge base of UAVs and drones covering both civilian and military models. It comes with detailed attributes such as manufacturer, cost, and technical specs. You can now easily classify, model, and share […] [Original post on infosec.exchange]

Good example why open sources projects should self-publish or even counter-publish as a GNA in @gcve Distributed publishing is not weakening the security advisory publication but it’s providing additional valuable sources. #gcve #cve 🔗 https://www.openwall.com/lists/oss-security/2025/10/27/1

New UI to RansomLook.io The open source project providing real-time ransomware intelligence. Thanks to @F_kZ_ for the incredible work. #ransomware #threatintelligence #threatintel #opensource 🔗 https://www.ransomlook.io/

New UI to RansomLook.io The open source project providing real-time ransomware intelligence. Thanks to @F_kZ_ for the incredible work. #ransomware #threatintelligence #threatintel #opensource 🔗 https://www.ransomlook.io/

I think the best summary until now about Post-quantum cryptography is from Peter Gutmann in the cryptography mailing-list. Given that after 20 years and hundreds of millions of dollars spent researchers have yet to demonstrate a single legitimate […] [Original post on infosec.exchange]

Sometimes I understand why people design new standards or formats when the existing ones can’t be extended (whether due to practical constraints, authority, or bureaucracy) or simply aren’t flexible enough to evolve. I think the XKCD comic doesn’t include […] [Original post on infosec.exchange]

Imagine a threat intelligence report that concludes, ‘The target is three hops away, therefore it is the correct one.’ This is the method the Pentagon reportedly uses today: not only to identify targets, but also to justify and execute strikes. 🔗 […] [Original post on infosec.exchange]

If you look at topics you actually know on #grokipedia, it becomes obvious how this whole thing was put together: - Poorly scraped #wikipedia pages, sometimes even merging unrelated disambiguation content - A single-pass LLM prompted without care or validation The result is a pile of […]

RE: https://infosec.exchange/@ministraitor/115430049959447776 This talk from @wr is a masterpiece if you want to dive into all the gory details of the X.509 certificate format. #hacklu #cybersecurity #certificate #threatintel

Vulnerability Lookup and GCVE: A Decentralized Approach to Vulnerability Publishing and Management Workshop at Hack.lu 2025 We published all the materials from the workshop given at #hacklu 2025 #gcve #vulnerabilitymanagement #opensource #cybersecurity […] [Original post on infosec.exchange]

Second up today is Maxine Escourbiac breaking into Palo Alto GlobalProtect clients in “Palo Alto GlobalProtect: Remote full compromise exploit chain” at #hacklu2025

On stage now is another set of repeat #hacklu speakers -> @ddu and @cvandeplas are on stage with “Building a pipeline to analyse iOS devices at scale” #hacklu2025

RE: https://infosec.exchange/@ministraitor/115420393928205564 Curious about a developer’s vibe-coding journey? @iglocska is sharing his experiments and insights at hack.lu 2025! #vibecoding #ai #cybersecurity #hacklu

Seeing a presentation of the Kaitai project. If you need to document or describe or decode binary format, Kaitai is clearly there to help. https://kaitai.io/ @kaitai #hacklu #kaitai #dfir #cybersecurity

Next up at #hacklu2025 is Paul Rascagneres with a talk about threat actors that use blockchains. Taking us through what smart contracts to get to the malware and exploitation Smart contracts can directly store malware!

Following a discussion with @ddu about a cybersecurity format that uses YAML, I’ve come to the conclusion that the acronym really stands for “Yet Another Misaligned Language. #yaml #cybersecurity #hacklu

Just discovered a new RAT at #hacklu and it seems the name can confuse a lot of french-speaking persons. RATatouille Not sure it''s a good idea for the SEO of the RAT author. ;-) 🔗 https://www.aikido.dev/blog/catching-a-rat-remote-access-trojian-rand-user-agent-supply-chain-compromise #rat […]

During the Call for Failures at #hacklu on Wednesday, 22 October, I’ll be presenting: “The cve-search design failure(s)” Yep, the things I got wrong, the kind you only truly notice once you start implementing them. #cybersecurity #failure #fail #conference #opensource

An interesting lighting talk at #hacklu presenting a tool for Offline decryption of SCCM database secrets. https://github.com/MartinoTommasini/offlineSCCMdecrypt #sccm #decrypt #cybersecurity

i didn't relaize just to what extent the ISRG now dominates certificate issuance

One year, I had a chat with the fine people @suricata during the @cert_eu conference, and they were wondering why we didn't create an open source website for all the different rules (YARA, Suricata, and many others) — a place to allow comments, reviews […] [Original post on infosec.exchange]

One year, I had a chat with the fine people @suricata during the @cert_eu conference, and they were wondering why we didn't create an open source website for all the different rules (YARA, Suricata, and many others) — a place to allow comments, reviews […] [Original post on infosec.exchange]

« Eavesdropping on Internal Networks via Unencrypted Satellites » Very good paper and research. VSAT vendors used to love their walled gardens: pseudo-standard DVB-S2 implementations, broken encryption everywhere, and zero cooperation on security, all to protect their proprietary turf. The […]

We are pleased to announce the release of CTI-Transmute.org, a new free and open-source service designed to facilitate conversions between MISP and STIX 2.x formats. The service is available both through a web interface and an API, allowing users to convert […] [Original post on infosec.exchange]

No hack.lu for Nicolas… #cybersecurity

a perpetual life #ostende #belgium #streetphotography #photography #monochrome #leica

Imagine working in your country’s cybersecurity center or CERT, and suddenly being reassigned to border control and deportation duties. Something is clearly broken and dangerously so. What will you do as a cybersecurity professional? #us #cybersecurity #dhs #cisa […]

RE: https://infosec.exchange/@UYBHYS/115342659808677542 Glad to present at #uybhys with @cedric our work on GCVE and Vulnerability Lookup, facilitating vulnerability management and publishing through a fully open-source stack. 🔗 Online version https://vulnerability.circl.lu/ 🔗 […]

Understanding the Efficacy of Phishing Training in Practice "Combined with the bulk of empirical evidence from other studies involving real-world, controlled experiments, our results suggests that organizations should not expect large anti-phishing benefits from either annual security awareness […]

We are pleased to announce the release of CTI-Transmute.org, a new free and open-source service designed to facilitate conversions between MISP and STIX 2.x formats. The service is available both through a web interface and an API, allowing users to convert […] [Original post on infosec.exchange]

RE: https://infosec.exchange/@UYBHYS/115342659808677542 Glad to present at #uybhys with @cedric our work on GCVE and Vulnerability Lookup, facilitating vulnerability management and publishing through a fully open-source stack. 🔗 Online version https://vulnerability.circl.lu/ 🔗 […]

The conference in the hack.lu conference. Call for Failure (CfF 0x1) - Over Fail the untold truth behind the magic of cybersecurity. 10-minute talks during hack.lu to present (the/your) biggest failure in cybersecurity you’ve ever experienced and what have you learned from it (or not) […]

The conference in the hack.lu conference. Call for Failure (CfF 0x1) - Over Fail the untold truth behind the magic of cybersecurity. 10-minute talks during hack.lu to present (the/your) biggest failure in cybersecurity you’ve ever experienced and what have you learned from it (or not) […]

Je me baladais à Ostende et je tombe sur la librairie Corman, une vieille institution Ostendaise. Bien sûr, la langue de Vondel dominait partout, mais il y avait quand même quelques bouquins en français ou en anglais qui traînaient dans les rayons. Et puis, je […] [Original post on paperbay.org]

So age determination is not a security risk ? It is and it will be more for future. The latest Discord incident might be an eye opener for some. #ageverification #cybersecurity #leak 🔗 https://discord.com/press-releases/update-on-security-incident-involving-third-party-customer-service

OpenSSL Security Advisory [30th September 2025] * CVE-2025-9231: Timing side-channel in SM2 algorithm on 64 bit ARM * CVE-2025-9232: Out-of-bounds read in HTTP client no_proxy handling * CVE-2025-9230: Out-of-bounds read & write in RFC 3211 KEK Unwrap #openssl #vulnerability […]

I see some people with high expectations for the EU CRA regulation, thinking the number of vulnerable or compromised devices will go down. That’s just a pipe dream, like expecting the DSA to shut down every social network spreading hate speech. #cra #cybersecurity #vulnerability

It's been ages! But Scrolls is back once again. What's in it? A bunch of random stuff from bygone weeks. I hope you enjoy, and I hope to be back again soon with more good shtuff. https://shellsharks.com/scrolls/scroll/2025-10-01 Thanks to those mentioned below. Their blogs, their writing […]

A new open source cyber-range platform released at the @oscl and presented at the cybersecurity track. https://github.com/range42 It seems very promising. @SteveClement @hyd3 #cyberrange #cybersecurity #opensource

It seems that git forge federation is still a critical component. More and more forges from governments and organisations are popping up. What’s the current state of search and federation in @forgejo? I remember some work being done in this space. Following a presentation by @oscl #opensource […]

💬 All talks and workshops from #hacklu2025 have their own Discourse topic — making it easy to comment, share feedback, and follow updates per session. 👉 https://discourse.ossbase.org/c/hack-lu/15 @hack_lu @circl #conference #cybersecurity #hacklu

Je viens de publier une petite nouvelle « le carnet » sur le @sillon_fictionnel Bonne lecture https://sillon-fictionnel.club/post/le-carnet/ #Écriture #nouvelle #nature #lecture #art

Seeing is Deceiving: Mirror-Based LiDAR Spoofing for Autonomous Vehicle Deception https://arxiv.org/pdf/2509.17253 #car #safety #lidar

Collins Aerospace (RTX) was already targeted by ransomware in 2023 by BianLian at that time. Sometime life is just a continuous repetition. #cybersecurity #collinsaerospace

A CVE should be assigned whenever an attacker publishes a malicious package update to a distribution, it’s a released software artifact with malicious intent and must be tracked.