Grok Build CLI uploads your whole repo — full git history + .env secrets — to xAI's cloud, and the opt-out doesn't stop it (wire-captured) : r/LocalLLaMA https://www.reddit.com/r/LocalLLaMA/comments/1ut7tis/

I went to a BSidesPGH presentation recently that was part not-good: I can scramble `mimikatz.exe` in a way that VirusTotal has **zero** detections for it! (Of course?? You can do the same with a password-protected ZIP or PGP encryption, or your own bespoke […] [Original post on infosec.exchange]

A while back I made a certificate-based openvvpn endpoint to connect to my home network. I now know that it was 10 years ago. Ask me how I know. 😂 Validity Not Before: Jun 13 19:13:26 2016 GMT Not After : Jun 11 19:13:26 2026 GMT

Dear Android people: How does one design a telephone where it's not obvious how to **answer a phone call**?

I hate the idea of needing a browser extension to do something. So, install in a separate profile, or in a VM, or whatever you're comfortable with. But somebody created a Chrome extension to hide junk knockoff brands from Amazon. knockoff.shopping You can […] [Original post on infosec.exchange]

Is it hard to keep track of the sea of Linux LPEs available these days? Yes. Somebody did something about it: A toolkit that includes 24 different exploits: lpe-toolkit Here's it in action against a fully patched Linux Mint 22.3 system. How well it works […] [Original post on infosec.exchange]

Pretty much every mobile app update: > Bug fixes and performance improvements If this were true, apps on your phone will become faster as your phone ages. Why is everything a lie?

Somebody posted a bunch of exploits on GitHub that claim to be 0days. https://github.com/bikini/exploitarium Let's look at the first one: A 7-Zip MotW bypass. **Problem #1** : 7-Zip **DOESN'T EVEN WRITE MOTW FOR EXTRACTED FILES BY DEFAULT**. This doesn't […] [Original post on infosec.exchange]

I think my membership to the Tinned Fish Club is one of the best gifts I've received.

Drink coasters should: * Be inexpensive * Absorb condensation * Prevent liquid from reaching the table After much searching, I found **zero** products that meet these requirements. My solution: 1. Get some cheapo felt coasters 2. Brush the […] [Original post on infosec.exchange]

Remember: While there are indeed some good Prime Day deals out there, those deals are mixed in with the not-deals. But the `Prime Day Deal` decorator is used quite liberally, for obvious reasons. Before clicking that purchase button on your incredible deal […] [Original post on infosec.exchange]

I'm so old that I remember when `Check for updates...` in VMware checked for updates. Now the only option is a `Learn More..." button in the resulting dialog. Which dumps you at`https://techdocs.broadcom.com/us/en/vmware-cis/desktop-hypervisors.html` Which […] [Original post on infosec.exchange]

I deleted a post about Claude asking for PII due to my bad memory. It apparently was OpenAI that wanted such nonsense. I guess the days of anonymous internet are over. We had a decent run.

So every single page load on this site is now greeted with a pop-up saying `Oops! An unexpected error occurred.` The site is still usable, but it's annoying. Is this a known Mastodon bug? Obviously, I have iOS Lockdown Mode enabled.

Nature.

In today's episode of "Have you tried rebooting?" My AirPods refused to pair with my phone after pairing them to an airplane. Even after factory reset of the AirPods. The solution? Reboot the iPhone. 🤷‍♂️ Side note: From a security perspective, you should […] [Original post on infosec.exchange]

Remember kids, if an app asks you where you'd like to install it on Windows, don't do it. Unless it defaults to outside of C:\Program Files. This is Acronis Cyber Files 9.0.0.2, which is EOL'd, so no fix will be made.

I just realized that I'm personally "credited" in April's Microsoft Patch Tuesday with a CVE-less "Defense-in-depth" update. The vulnerability? CAB files downloaded from the internet do not write the MotW for files extracted from them. I reported this to […] [Original post on infosec.exchange]

In Parallels, you can create a linked clone of a TPM-using Win11 VM just fine. But VMware Workstation refuses to do such things. Why?

Neat.

So the Trump Mobile T1 phone is just an off the shelf phone painted gold, and with a malformed American flag on the back. Who could have predicted? 😂 https://www.ifixit.com/News/117789/teardown-confirms-the-trump-phone-is-a-gold-painted-htc-u24-pro

Right this minute there is a giant Monster Energy Drink banner ad plastered at the White House. We are in a literal Idiocracy. I laughed at this. America will never know dignity again. The White House has shown once and for all time exactly what they are. And that their price is within reach […]

There's a new FreeBSD LPE exploit out with a hilarious publication: BUMSRAKETE

Nightmare Eclipse has posted another purported bitlocker bypass: GreatXML This exploit claims to be able to bypass bitlocker on systems that have executed Microsoft Defender Offline at some point in the past. This is done by replacing […] [Original post on infosec.exchange]

Nightmare Eclipse has released a new exploit: RoguePlanet It's reportedly not 100% reliable, but it worked on the first attempt for me.

If you bother looking, you'll see Windows do weird things if you give it time. e.g. it will attempt to access `C:\Device\HarddiskVolume3\Windows\System32\svchost.exe`, which is surely intended to be the NT Object Manager path […] [Original post on infosec.exchange]

TIL that titanium cutting boards are a thing. Who is the target audience for such things? Families with little kids, where sharp things are to be avoided?

Well, bitskrieg is public. While Microsoft "fixed" YellowKey as CVE-2026-45585 (and by "fixed", I mean they have provided **manual** steps that you can perform if you want to remove `autofstx.exe` from the WinRE registry `BootExecute` value), bitskrieg […] [Original post on infosec.exchange]

Dan Berulis, IT staffer at the National Labor Relations Board (NLRB) filed a whistleblower complaint that DOGE appeared to be exfiltrating the NLRB's data, five days after the report somebody cut his brake line and disabled his airbag after Musk helped dox him […]

Somebody released a PoC for Firefox CVE-2026-8389, and it works. The PoC doesn't include a sandbox escape, and claims that `poc-win-sbx.html` includes the escape. This file was not shared in the repo. The python server on localhost seems unnecessary, as […] [Original post on infosec.exchange]

Really, really impressed with MSRC: > Hello Adam, > > My name is Nic Fillingham and I work for the Microsoft Security Response Center (MSRC) based in Redmond, WA. I help manage Coordinated Vulnerability Disclosure (also known as Responsible Disclosure) for vulnerabilities discovered in […]

An 8TB hard drive that was $129.99 a year ago is now $299.99. Thanks, AI. You're really making the world a better place.

Somebody wrote about Bring Your Own RWX Region DLL (BYORWXDLL) Which, being a post-exploitation technique, is already something not terribly interesting to me personally, being a vulnerability analyst and all. Stage 1: Realize that the provided script […] [Original post on infosec.exchange]

In preparation for an upcoming blog post, I wondered about the various ways that Windows can refer to a remote WebDAV resource. These all work: \\example.com\pwned.exe \/example.com\pwned.exe file:////example.com\pwned.exe file:///\example.com\pwned.exe file://\/example […]

Once in a blue moon, I see something on Temu that I might consider buying. And then I'm bombarded by spinning wheels that land on "one more spin", and then "(up to) 100% off", explosions, confetti, yelling in ALL CAPS, required app install with […] [Original post on infosec.exchange]

Sooooooo... Why aren't all pill bottles made of aluminum? 🤔

the #TrumpMobile phone is finally here... and it's a spray painted $150 chinese cell phone featuring an american flag with only 11 stripes that roughly 10,000¹ MAGAs paid $500 for. ¹ #Trump and co. claimed 600,000 orders but a data breach revealed there […] [Original post on universeodon.com]

LOL. From over at the bad site: An html email will crash Outlook. Granted, it's "harmless" (stack overflow (exhaustion)), but I dunno... I sort of expect the act of rendering an HTML email that uses CSS to **not** crash my mail client?

Well this was an interesting insight into those using AI for bug bounties. I was able to only grab about 7GB of files before it was taken offline.

Well hello there, Pink Berkeley Tie-Dye!

Android user who is **done** using the flashlight presses what button?

Tired of Linux LPEs? Good. CIFSwitch is for you. It's not quite as universal as recent ones (distro compatibility table), but it works. No CVE, as it seems that we don't do CVEs so much these days.

The openSUSE peeps have figured out some crazy compression, it seems. 107.0 B for everything!

I'm used to having volunteer ground cherry plants in every single container I own. But this is a new one. A volunteer tomato in a crack in front of the car side of the garage! We'll see if it survives transplantation...

SwiftKey users: How can I ensure that I'm never asked to log in to OneDrive again? Or is this simply the Microsoft way? (Consent isn't a thing; feel free to bully users until they give in to what they want)

Motorola, not happy with merely collecting $1300 for a Razr 60 Ultra telephone, apparently comes preloaded with an app to hijack affiliate links for shopping apps Aside: Who installs shopping **apps** on their telephone? Web browsers do a great job at viewing websites. 🤷‍♂️

Microsoft, who banned Nightmare-Eclipse from their GitHub platform, conveys their displeasure with said individual Also manages to sprinkle in a few references to not using CVD as being not "responsible". (Microsoft was a big proponent of the term "responsible disclosure", which has gone by the […]

Neat. An unprivileged user can crash Windows if it has a USB printer driver loaded. No CVE because it doesn't meet MSRC's bar for servicing.