this psyduck is adorable

Demo video for my OBTS v8 talk next week: objectivebythesea.org/v8/talks.htm... Unauthenticated LAN remote code execution for Apple Compressor v4.9. Fun fact: this video is made with the vulnerable app itself

Apple is planning a special initiative featuring iPhone 17 with Memory Integrity Enforcement. To rapidly make this defense available to those targeted by mercenary spyware, the company will provide a thousand iPhone 17 devices to civil society organizations. security.apple.com/blog/apple-s...

(guy designing c++): alright how do we make it as hard as possible to find the actual value of a variable

NEW: In May, a Texas police department said they used the powerful Flock surveillance network against a woman who had an abortion "for her safety" Newly obtained court records show it was a 'death investigation,' and they considered charging her with a crime www.404media.co/police-said-...

its pretty cool how we are warping our economy so that it will either develop AGI or completely implode. (actually a part of me does unfortunately really think this is cool)

slightly ominous mailer from the Red Cross

Happy radare2 6.0.4 release day infosec.exchange/@radareorg/1...

reading more about the Team Atlanta AIxCC solution i do still wonder if eliminating the LLM components in favor of normal ML classification (or just "dumb" hardcoded logic) could achieve results that are nearly as good and orders of magnitude more efficient team-atlanta.github.io/blog/post-ml...

i was thinking earlier today about how i never reflexively check janky looking sites for injection vulns anymore. so i tested the next site where i got the vibe. immediate sqli

The iPhone 17 is powered by Apple's A19 SoC (System on a Chip). Chipwise took a die photo of the chip, but it's a bit drab. I spiced it up by applying the over-saturated color gradient that Apple used for die photos of the M1 chip :-) Link to the original die photo: chipwise.tech/our-portfoli...

someone needs to make flare-on but not windows shit (i know that this is "literally every other ctfs rev chals")

the grapheneOS hardened allocator is pretty scary www.synacktiv.com/en/publicati... has there ever been a recorded ITW 0c exploit on a grapheneOS device?

i just made a cool video

NEW: 404 Media is suing ICE. We have filed a lawsuit demanding the agency release its $2 million contract with Paragon, a company that makes powerful spyware to break into phones and read messages from encrypted chat apps www.404media.co/were-suing-i...

Found a video from a couple of years ago when I wrote a brainfuck implementation in Fastly VCL. Each tick of the interpreter was executed by making a GET request to the VCL service with the entire interpreter state encoded in the URL. Anyway, here is "hello world" in 1771 GET requests.

this list of people on the wikipedia page for "If Anyone Builds it, Everyone Dies" is absolutely sending me

there is approximately no chance that this is a real effect, and if it is there is a 0% chance it is intentional. LLMs don't understand vulns enough to make subtle mistakes, so any intentional sabotage would be way more obvious than whatever "somewhat more apt to result in low-quality code" means.

I am just going to keep posting that the TX governor recently pardoned a political murderer. The dude texted "I'm going to shoot protestors", then went and shot a Black Lives Matter protester. He was convicted in a jury trial. Hard to find a more blatant example of celebrating political violence.

Wrote a trigger for CVE-2025-38494/5 (an integer underflow in the HID subsystem) that leaks 64 KB of OOB memory over USB. Still works on Pixels and Ubuntus (but the bug is fixed in stable kernels). github.com/xairy/kernel...

Want to learn reverse engineering? There'll be a free, women*-only BlackHoodie workshop from October 6th to 9th in Paris! Topics: • Linux memory forensics 🕵️‍♀️ (by Sonia) • Web app and mobile app pentesting 🕸️📱 (by Paula) • iOS reversing 🍎 (by me)

the dumbest companies are breaking the internet. my mother-in-law lives near Stroudsburg PA and is being cut off from streaming services because the geo-ip company suddenly decided that "STH" now meant "Stockholm"... its almost like the hints geo-ip uses weren't meant to actually be relied on

their friendship 🥺

man i can't wait to finish Serious Hacking Project so i can switch to working on Silly Hacking Project for a little

Normie cyber people it brings me no pleasure to announce the aerospace cyber people absolutely cooked us

I got #nixos to work on my Wii-U!!

Entertaining and inspiring #pwn2own #xdev writeup 👏 (also from a few months back) #lorex 2K Indoor Wi-Fi Security Camera: RCE #exploit Chain https://github.com/sfewer-r7/LorexExploit […]

"Algo" is short for "Al Gore" who invented the algorithm

It's been about a week since we completed DARPA's AIxCC, where we came in 5th and had the most accurate autonomous patching system in the competition. In the coming days, I'll be describing how we achieved it on the patching side. Stay tuned. Our CRS:

Queen domination by SAT solving. ~ Taha Rostami, Curtis Bright. arxiv.org/abs/2508.11945 #ATP #SAT_Solving

3 billion devices. run.

This repo is hype moments and aura honestly github.com/sensepost/bl...

you know like this

Very cool #vulnerability and #exploit by @ret2systems (published a few months ago) #exploiting the #synology DiskStation with Null-byte Writes https://blog.ret2.io/2025/04/23/pwn2own-soho-2024-diskstation/

Exploiting an array-Out-Of-Bounds vulnerability in the Linux network packet scheduler (CVE-2025-37752) syst3mfailure.io/two-bytes-of... #infosec #Linux

🎉 Lean 4.22.0 is here! It represents the culmination of our Year 2 roadmap! Including: 🧠 New grind tactic (SMT-style automated reasoning) 🏗️ New compiler (major performance foundation) Read the release notes: lean-lang.org/doc/reference/latest/releases/v4.22.0/ #LeanLang #LeanProver

Every day we’re getting closer to #r2con2025! Got something cool to share about #radare2? 📢 Submit to the #CFP now! This time it’s fully online, even a 10 minute video works! 👉 radare.org/con/2025/

This jaw dropping write-up of an LLM solving a DEF CON CTF challenge(!) with minimal human interaction 🤯 It seems like "vibe-reversing" is becoming a viable option now...

there's lots of good examples of one person demonstrating how easy it is to find someone, but there is something vital about seeing a group of people with a variety of knowledge and experiences all focused on one goal (sending 12 large sausage pizzas to your house)

Rowhammer is alive again, this time on DDR4 servers with ECC memory. ecc.fail

Some personal news: I'm thrilled to be moving back to Project Zero! Specifically I'll be joining the Big Sleep project to find vulnerabilities in JavaScript engines. We've already found and reported our first vulnerability in V8 last week: issuetracker.google.com/issues/43621...

also being that the primary use case of llms for most people is "hey process some language for me" its probably worth showing people that llms are not doing it in a human-like manner, so they shouldn't necessarily expect human-like results

Totodile curled up for a nap