Remember the early days of Uber and Lyft, when rides were dirt cheap because the companies were operating at a loss in order to capture the minds/wallets of the masses? The rug pull in the AI/LLM world when the companies adjust pricing to actually make a profit is going to be spectacular […]

So I just rebooted my iPhone (as one should do, if they care about security), and only after I did so did I remember that I had a timer going. After it came back up, the timer picked up where it left off.

The 3 recent Linux LPEs are sort of interesting in that each one took a different path from discovery to disclosure. 1. **[Copy Fail](https://infosec.exchange/@wdormann/116489443704631952** : Publicity stunt where they claim to have done the right thing, yet didn't bother to tell a single […]

While it's raining Linux LPEs, I suppose it's worth mentioning Copy Fail 2:Electric Boogaloo Unlike CopyFail, this one works against Ubuntu 26.04, as it was only patched a few days ago

Did you like CopyFail, but were annoyed that it didn't work on distros with somewhat up-to-date kernels, like Ubuntu 26.04? Don't worry. Dirty Frag has got your back! From the advisory: > Because the responsible disclosure schedule and embargo have been […] [Original post on infosec.exchange]

Let's talk about Windows `.URL` (InternetShortcut) files. Last year there was discussion about a vulnerability in how Windows handles `.URL` files. Specifically, when a `.URL` file specifies a `WorkingDirectory` directive, an otherwise harmless app being […] [Original post on infosec.exchange]

Me, watching 2025's Alien Earth: 1979's Alien had more believable special effects. Presumably we'll get to a point where CGI isn't so damn obvious? But the way that it currently is, or at least is, based on the amount of money that film/TV producers are willing to put into it... 😬

Today's episode of "my life is a lie": Part 1: A strawberry is not a berry, but an aggregate fruit. Part infinity: What appears to be a seed on the outside is an achene, which is actually a dry fruit, which contains a seed **inside of it**. The red part of […] [Original post on infosec.exchange]

From Kasperky Securelist: DAEMON Tools software infected – supply chain attack ongoing since April 8, 2026 Per Kaspersky, > At the time of writing this article, the supply chain attack is still active. While I haven't seen the associated network activity […] [Original post on infosec.exchange]

This. 👇

Everything is a lie.

TBH, I was surprised that it was still around.

Apparently if you work in "Cyber", you can loosen some of the guardrails ChatGPT has when being asked such questions. All you have to do is... Consent to the processing of your biometric information by persona. I don't like what the internet has become.

I'll admit that I was surprised that RHEL installed a system-wide app (by way of PackageKit) without asking for credentials. But this only works for users in the sudo group, so I guess this is only as important as a UAC bypass on Windows (i.e. not important)

So CopyFail CVE-2026-31431 is a thing.

> Microsoft Edge's Enhanced Security Mode was designed as the ultimate defense when browsing unfamiliar websites. By disabling JIT compilation and forcing all WebAssembly code through an interpreter called DrumBrake, Microsoft promised protection against the most common classes of browser […]

Akamai: While the RCE that targets CVE-2026-21513 and CVE-2026-21510 has been fixed, there's still a zero-click Net-NTLMv2 hash leak. Microsoft: Got it. We'll call the fix: `Windows Shell Spoofing Vulnerability` and assign it `CWE-693: Protection Mechanism […] [Original post on infosec.exchange]

In today's episode of Cheap Crap From Sketchy Purveyors (you know who): Batteries (cells). You have two options for a LiPo of the same form factor. One is 2000 mAh, and the other is 4000 mAh. Surely the 4k is exaggerated, but who cares? It's still surely […] [Original post on infosec.exchange]

Apparently Ubuntu 26.04 has been released. At least somewhat?

Never forget the Electric Sun kids.

Mozilla: This week’s release of Firefox 150 includes fixes for 271 vulnerabilities identified during this initial evaluation. Also Mozilla: One CVE should suffice I get it. LLM tools are useful. But I also don't like that everything on the internet today reads as an ad for `<AI thing that is […]

For Android phones I've cared about, I have gone with the Pixel and friends because they: 1) Don't come with vendor bloat 2) Get updates both rapidly and for a reasonable amount of time. I've heard that the Android world has changed and that major vendors […] [Original post on infosec.exchange]

The folks at iTerm figured out a way to get arbitrary code execution as the result of cat <file>, which is... impressive?

TIL that medical and religious ski masks are a thing?

I thought that ClickFix was silly, but we've clearly entered the "please fire this footgun" stage of infosec. https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/

From the same author as BlueHammer we now have RedSun. This works 100% reliably to go from unprivileged user to `SYSTEM` against Windows 11 and Windows Server with April 2026 updates, as well as Windows 10.

I guess we've entered the phase where doing anything is going to require you uploading your ID and more.

Pasting into PowerShell on Windows 11 is orders of magnitude slower than doing the same on Windows 10. Is there a workaround for this?

From over on the Bad Site: * Google ads are evil, as usual. * Some threat actor only skimmed over what ClickFix is. (Hint: The text next to the copy button is fully under your control. Make it look harmless for best results.) * AV detection is abysmal […] [Original post on infosec.exchange]

"Looks plausible at a glance" is the only requirement for both the tools using AI and also those using said tools.

There is at least one Adobe Reader 0day being exploited in the wild: https://justhaifei1.blogspot.com/2026/04/expmon-detected-sophisticated-zero-day-adobe-reader.html TL;DR: One 0day is being used to simply communicate details to a C2 server to get further commands. Specifically, there is a […]

Let me get this straight... The **default setting** for Signal on an iPhone allows law enforcement to see the content of all incoming messages, even after the app has been deleted? 🤔 https://www.404media.co/fbi-extracts-suspects-deleted-signal-messages-saved-in-iphone-notification-database-2/

I think the only times I restart my Mac is when there's an OS update. As such, I find it somewhat hard to believe that macOS has a TCP timestamp integer overflow that happens at 49 days But perhaps I'm just being forgetful?

I wrote a thing about a thing. Specifically, Finding Vulnerabilities with Crassus – A Case Study with ESET. I created Crassus on a whim a few years ago, and it's interesting to see that it *_still_ can find things. It's also interesting (disappointing) […] [Original post on infosec.exchange]

Dear Linux UI people: If you want to round corners, cool. **However** , if you do round corners, maybe **just maybe** move the point where the cursor is activated to where the corner actually **is** after rounding. Not where it **would have been** if you didn't do the rounding. 🤷‍♂️

I've always known that I'm **terrible** at using websites (I never know where to click). But I guess I've recently realized that this applies to apps as well. Today's case: Paragon Hard Disk Manager. My goal: Mount a backup as a drive letter. After […] [Original post on infosec.exchange]

Shortly after switching to T-Mobile (Both faster and better than Verizon), I get a spam email linking to a fake T-Mobile website. There are probably **lots** of parties that get notice of such a change. Who do I blame? 😂 P.S. Smart apostrophes? Try harder.

Me, looking at a broken tool... I think it's the brushless motor controller board (after lots of diagnostics). Oh, it's hard-wired in. Oh, this is the replacement "part", which costs almost as much as the entire tool, new. Everything is disposable now, huh?

My office smells of potting soil.. I may have a small problem. 😂

I can't explain why, but I get some amount of enjoyment knowing that there is a song out there titled Pale Vegan Hip Pain. https://www.youtube.com/watch?v=2m_TJSvUZzM

Gambling is illegal for kids. Can anyone at FanDuel Casino say with a straight face that this ad is indeed targeting adults?

You can get a cheap Wi-Fi enabled camera intended for sticking in your ear for less than $5. You know what else it's good for? Reading tiny print on tiny chips. Here's a comparison of this device vs. an iPhone 16. You're welcome.

Miracle Gro: Here's some fertilizer. Half a capful is all you need. Miracle Gro later: We need more money. Let's make it **FOUR LARGE PUMPS** of the liquid. Why not charge people for water?

As I update a VM to the latest macOS Tahoe, I'm reminded of how damn **UGLY** it is. Apple: Let's make the corner radius **huge**. But inconsistently. With this level of YOLO, I have to assume that they must've hired some Linux UI devs.

Has anybody ever had the desire to enter an emoji of the last word that they typed? Like, **ever**?

Call me crazy, but there are times when I think that ChatGPT sprinkling in knowledge about what I normally ask is... **not** useful. This is from a question I asked about grease.

I made a pizza pie. You know, for pie day.

When I first got an iPhone with a USB-C connector, I assumed that I would be exiting the "lightning socket collects pocket lint until it fails to connect securely" club. No, the problem is still there. But I'd say that it's **worse** in that you can no longer safely use a stock toothpick to […]

You can cast YouTube to TVs. Some YouTube videos are called "shorts". You cannot cast Shorts to a TV. Can anyone explain to me why this is?

My local hardware store just installed a vending machine out front of it, in case you need things when they're closed. I love it.