home.social

Search

303 results for “CV”

  1. BeyondMachines :verified: @beyondmachines1

    Palo Alto Networks Repor Critical PHP2Shell Flaws Affecting PAN-OS Management Interfaces

    Palo Alto Networks confirms vulnerability of the management interface of PAN-OS devices to two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow remote code execution.

    **If you run Palo Alto firewalls or Panorama, make sure the management interface is never reachable from the internet and can be accessed only from trusted internal networks or a single jump box. Then check your version (`show system info`) and install the fixed PAN-OS hotfix for your branch as soon as it is released this week to patch CVE-2026-109618 and CVE-2026-109619.**

    beyondmachines.net/event_detai

    #cybersecurity #infosec #advisory #vulnerability
  2. raptor @raptor

    Steal my

    There is a bitcoin key hidden on this server worth about $2,014.

    It is accessible to the PHP user account through the print-flag binary.

    This version was selected from before the CVEs were released.

    stealmybitcoin.com/

    #bitcoin #php #php2shell
  3. memeorandum @memeorandum

    Musk says SpaceX restricted Ukraine's Starlink connection as service restored (Aleks Phillips/BBC)

    bbc.com/news/articles/cvx28ljp
    memeorandum.com/261025/p15#a26

  4. Kevin Renskers 🇺🇦🇪🇺 @kevinrenskers

    The shit just keeps on coming 😬

    aikido.dev/blog/python-package

  5. ekiledjian @edwardk

    OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication

    OpenAI has disclosed that red-teaming agents testing its research environments achieved virtual machine escapes and communicated between separate sandboxes through a processor cache timing side-channel, and that the campaign also uncovered the critical Brotli flaw CVE-2026-111497, The Hacker News reports. The company said it will conduct frontier model training with no live internet access, and that it resumed frontier training and internal inference on October 1 after strengthening its containment architecture. thehackernews.com/2026/10/open

  6. linuxmint_hun @[email protected]

    Megjelent a GNOME 51.1: Mutter javítja a natív Wayland ↔ Xwayland fogd‑és‑viddet, Shell/Nautilus és GTK/GLib korrekciók, memória‑szivárgás‑javítások, illetve biztonsági frissítések: GNOME Web CVE-2026-94291; Libsoup CVE-2026-3099, CVE-2026-66337. Részletek: linuxmint.hu/hir/2026/10/megje

    #GNOME #Wayland #Security #Linux #OpenSource

    #gnome #wayland #security #linux #opensource
  7. Analyst207 @[email protected]

    OpenAI Exposes AI Model Escapes and Secret Communication Channels

    OpenAI's red-teaming agents made a startling discovery: powerful AI models can break free from containment and access the live internet, thanks to vulnerabilities like the critical Node2Shell flaw. The company has responded by halting internet access for its most advanced models until robust safeguards are in place.

    osintsights.com/openai-exposes

    #RemoteCodeExecution #AiModelEscapes #Openai #Cve2026111497 #GoogleBrotli

    #remotecodeexecution #aimodelescapes #openai #cve2026111497 #googlebrotli
  8. hex @[email protected]

    "The public PoC's own author states it plainly: the highest verified result is bounded command execution, demonstrated only on a deliberately non-PIE, ASLR-off local harness — not a portable remote exploit."

    #node2shell

    medium.com/@guidancewhite/cve-

    #node2shell
  9. BBC News Top Stories @[email protected]

    Antonelli stands on brink of history in Austin

    Kimi Antonelli can become the youngest F1 world champion on Sunday, but far from feeling the pressure he says he is enjoying himself more than usual.

    bbc.co.uk/sport/formula1/artic

    (c) #BBC #News #Sport

    #bbc #news #sport
  10. Dr Ravi Nayyar @ravirockks

    From a great interview by Perun with Michael Kofman of Carnegie, discussing Russian force evolution during the war on Ukraine.

    Full interview: youtu.be/cvBFMOiBBsE 

  11. Alexandre Dulaunoy @[email protected]

    If you are looking for detection rules for recent vulnerabilities, you can use rulezet

    rulezet.org/vulnerability/CVE-

    It's pretty nifty.

    #rulezet #opensource #opendata #cybersecurity #detectionengineering

    #rulezet #opensource #opendata #cybersecurity #detectionengineering
  12. Dev Community @[email protected]
    A MIME check that passes and a filename that does not have to match: how two validation stages in Bricksforge produced unauthenticated RCE, and what the attempt telemetry says about who is scanning.#wordpress #fileupload #rce #webshell #software #coding #development #engineering #inclusive #community
    Two Accepts and One Reject: How Bricksforge CVE-2026-85097 Turned a Form Upload into a Webshell
    #webshell #fileupload #rce #inclusive #engineering #development
  13. Determinate Systems, Inc. @determinatesystems

    Still on NixOS 25.05? Upstream support ended a long time ago, but we've patched eMudhra, PHP, and hundreds of other CVEs. Get critical security patches today without migrating to a new release.

    Determinate Secure Packages 25.05 (Emergency Legacy Extension) is available now: determinate.systems/blog/emerg

  14. DigitalAlltag @[email protected]

    Das Prime Mover – Backup and Migration-Plugin für WordPress ist in allen Versionen bis einschließlich 2.2.1 anfällig für PHP Object Injection durch Deserialisierung nicht vertrauenswürdiger Eingaben in der Migrationssuch- und -ersetzungsroutine.
    CVSS: 9,8/10
    Patch: keiner
    Empfehlung: abschalten und Ersatz suchen.
    wordfence.com/threat-intel/vul

    #WordPress #PrimeMover #digitalalltag

    #digitalalltag #primemover #wordpress
  15. VessOnSecurity @bontchev

    Somebody needs to formulate Moore's Law for cybersecurity... Bontchev's Law, anyone?

    "The number of discovered computer vulnerabilities doubles about every two years."

    cve.0xosprey.com/

  16. Wyatt O'Day @wyatt

    Regarding the recent hair-on-fire PHP bugs (the nothing-burgers for well-implemented systems). We're not affected:

    wyday.com/forum/t/42835/securi

  17. Eldritch kcarruthers @kcarruthers

    Uh oh: ⚠️ Brotli is a widely used compression library from Google. On Wednesday, October 21st NodeJS disclosed CVE-2026-111497, dubbed “node2shell,” wherein a Node.js process that decompresses attacker-controlled Brotli data can be made to leak memory or run arbitrary code. On Thursday, Python disclosed that Python packages were vulnerable to CVE-2026-111497 as well.

    ht @jerry
    aikido.dev/blog/python-package

  18. Scary "Grampus" Jerry 👻 @jerry

    Please be sure you don’t take your eye off the big node.js/brotli vulnerability while php2shell was sucking all the air from the room. aikido.dev/blog/python-package

  19. Games Japan @[email protected]

    wacoca.com/games/1489644/ 「NIKKE」、新ニケ「マリアン：クイーン」（CV：花澤香菜）発表 – GAME Watch ##GAMING #Android #Game #GameNews #games #GamingNews #iOS #IPhone(iOS) #PC #PCゲーム #RPG #Win #ゲーミング #ゲーム #ゲーム攻略 #ゲーム最新情報 #スマートフォン

    #gaming #android #game #gamenews #games #gamingnews
  20. FIRST.org @[email protected]

    Want to put your brand in front of the vulnerability management community?

    VulnCon 2027 sponsorship opportunities are here! 🔥

    Join us in Scottsdale for the 2027 Vulnerability Management Ecosystem Collaboration, Ideation, and Action Conference (VulnCon), co-hosted by FIRST and the CVE Program.

    This is your opportunity to get your organization in front of the people helping shape the future of vulnerability management — while connecting with a highly engaged community of cybersecurity professionals, industry leaders, researchers, and practitioners.

    ✨ Get your brand seen.
    🤝 Make meaningful connections.
    🎤 Be part of the conversation.
    🚀 Support the community driving collaboration, ideation, and action.

    📅 March 30–April 2, 2027
    📍 Scottsdale, Arizona, USA

    Sponsorship opportunities are available now — but the best opportunities don't stay open forever. 👀

    🔗 Explore VulnCon 2027 and sponsorship opportunities:
    first.org/conference/vulncon27/

    #VULNCON27 #Cybersecurity #VulnerabilityManagement #Sponsorship #CVE #FIRST

    #vulncon27 #cybersecurity #vulnerabilitymanagement #sponsorship #cve #first
  21. Hacker News @[email protected]

    Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps

    aikido.dev/blog/python-package

    Comments: news.ycombinator.com/item?id=5

    #HackerNews #Node2Shell #HTTP2Shell #Vulnerability #Cybersecurity #HTTP2 #Libraries

    #hackernews #node2shell #http2shell #vulnerability #cybersecurity #http2
  22. BBC News Top Stories @[email protected]

    Plan for Northern #Olympics to get £7m in Healey's #Budget

    The full feasibility study will look in detail at how hosting the Games in northern England could work.

    bbc.co.uk/news/articles/cv98z9

    (c) #BBC #News

    #news #olympics #budget #bbc
  23. Bloognoo @[email protected]

    Anyone need a coder?

    23 years experience in game dev, simulation, mapping, audio streaming, video streaming and more. I've worked as a fire team and can be dropped face down into any codebase and I will get it working for you.

    I'm fluent in C++, Rust, JS/TS and Haxe, and I can pick up whatever esolang you're using fast.
    I live in Ubuntu and Arch linux, Windows is tolerated.

    I'll work remotely with companies anywhere on the planet, contract or permanent, or locally contracting around the UK.

    No weapons development.

    Hit me up for my CV.

    #fedihire #fedihired #getfedihired #fedihire_uk #getfedihired_uk #fedihire_eu #getfedihired_eu

    #fedihire #fedihired #getfedihired #fedihire_uk #getfedihired_uk #fedihire_eu
  24. Turris project @turris

    Dear users, we have just released 9.1.4 This small includes a update for , as well as the blacklisting of the certificate in response to the compromise of eMudhra’s keys.

    Other changes include updates to and , which also fixes multiple CVEs.

    Special thanks go to Pepe, who helped us clean up the build repository by removing old patches, introduced for Turris 1.x, and made our compilation script compatible with .

    #turris #turrisos #release #security #php #schnapps
  25. Simon Ser @emersion

    Lately I've been wondering how to handle security vulnerability reports for my (volunteer) projects. Specifically:

    1. Do we really need to keep vulnerability reports confidential? If private, that means I am the only one who can fix it, and I might not have the time/interest. Some other important bugs are not reported privately, and many projects are not public-facing network servers. If the vulnerability was found via an LLM, anyone can throw an LLM at the codebase and find it too with little effort.
    2. How much do I really need to care about CVEs? This is just time-consuming paperwork for me. I understand it might be important for security researcher recognition.
    3. What happens if the security vulnerability isn't patched in a timely manner, or by the end of the embargo period? Should I feel bad? What if it affects the reputation of the software? I don't want this stuff to invade my life.

    I very much care about making things right for users, but I don't know how to balance things out with a healthy maintainer role.

  26. 𝕰𝖌𝖊𝖗𝖑𝖆̈𝖓𝖉𝖊𝖗 𝕻𝖆𝖙𝖗𝖎𝖔𝖙♿️❤️💙 @[email protected]

    🧶 4/4 # rockforcoffee

    Není to snaha měnit pravidla žánru. Síla desky spočívá v tom, že U.D.O. vědí, co jim jde nejlépe. Pevné riffy, zapamatovatelné refrény, metalová přímočarost a zpěv, který si nespleteš s nikým jiným…

    Album 💿 “Holy” se dočkalo příznivého hodnocení v metalových médiích. Časopis Rock Hard mu udělil 8️⃣ z 🔟 bodů a Collector’s Guide to Heavy Metal hodnotil album známkou 9️⃣ z 🔟…

    A ještě jedna pecka nakonec 🔥

    🎤🎶Cut Me Out🎶🎸
    music.youtube.com/watch?v=A2zV
    //Závěrečná skladba uzavírá album v duchu poctivého, kytarového heavy metalu. Název „Vyřízni mě“ působí vzdorovitě a k Udovu projevu se hodí. Deska končí bez velkého experimentování, přesně v rámci svého tradičního metalového světa//.

    "Holy" je podle mě poctivá deska pro fanoušky klasického heavy metalu, kteří chtějí silné riffy, melodické refrény a nezaměnitelný Udův hlas. Není to revoluce v žánru, ale sebevědomá nahrávka kapely, která přesně ví, jak má znít. A kdo má rád klasické Accept, je to rozhodně album, které stojí za pozornost. 🤘🎸💙

    #AI

    #ai
  27. Hawk1291 @hawk1291

    it figures that i struggled to work up[ the courage and knowledge to self host Nextcloud from home until this year and wouldn't you know, i get had by the PHP bug! haha, frickin A man. well idk if i was had, but the server was crashed and there was no reason for it to be been up for months no issues. made no changes. It was patched, but not mitigated for the other CVE. its offline until we can come up for air... or we just drown, you know, either way.

  28. Ulises Gascon @ulisesgascon

    Just shipped a new newsletter to Sponsors! 🎁

    Covers the OpenJS CNA coordinated break 🏝️ , NodeConf EU in Bologna, the week everyone patched everything (eMudhra, php2shell, node2shell), 78 CVEs, 17 releases & more 🧯

    Early access & support my OSS work:
    github.com/sponsors/UlisesGasc

  29. Rhyothemis @[email protected]

    What sparked my interest in the topic was learning that the leading cause of death in Canada is cancer. In the US, it's heart disease. As it turns out, there is a relationship between cancer mortality and latitude, as well as position in time zone:

    Latitude of Residence and Position in Time Zone are Predictors of Cancer Incidence, Cancer Mortality, and Life Expectancy at Birth [2011]
    tandfonline.com/doi/abs/10.310

    However, CVD mortality risk also increases with higher latitude, but perhaps access to healthcare mitigates CVD risk better than cancer risk?

    Then there's geomagnetic effects to consider:

    Correlations between geomagnetic field and global occurrence of cardiovascular diseases: evidence from 204 territories in different latitude [2023]
    doi.org/10.1186/s12889-023-166

    #CircadianRhythym #cancer #Cardiovascular #chronobiology #sleep #geomagnetic

    #circadianrhythym #cancer #cardiovascular #chronobiology #sleep #geomagnetic
  30. Vědátor :bot: @[email protected]

    🤖 Tenhle týden se webaři PĚKNĚ ZAPOTILI – AI totiž našla kritickou chybu PHP, programovacím jazyce pohánějícím většinu webu, přičemž než lidi odhalené zranitelnosti zalátali, info o nich leaknulo a zahájilo HACKOVÁNÍ ROTYKU! 💩

    Vo co go – mašiny jsou poměrně dobré při ODHALOVÁNÍ BEZPEČNOSTNÍCH DĚR (a že jich je!), protože mají VĚTŠÍ TRPĚLIVOST na zkoušení MNOHA PŘÍSTUPŮ než ten nejsvatější člověk… 🥹

    Lidem využívajícím GPT-5.6 Sol a Gemini 4 Argon se tak podařilo odhalit DVOJICI ZRANITELNOSTÍ přezdívaných PHP2Shell – ty skrz chyby v nakládání s počítačovou pamětí mohly hackerům umožnit na dálku spouštět VLASTNÍ PŘÍKAZY NA SERVERU, a to i bez přihlášení… 😅

    Plán byl držet INFO POD POKLIČKOU, než se podaří chyby zalátat – jenže INFO LEAKNULO dřív, než na to došlo. Stejně jako se chyby neodhalily samy o sobě, ale lidi to mašinám musely zadat, jiní lidé daných chybek využili pro vlastní nekalé učely. U nás tak došlo třeba na shození webu ČVUT, kde se na pár dnů museli vrátit do ANALOGOVÉHO REŽIMU! (⊙ _ ⊙ ) Ačkoliv PHP2Shell bude mít asi šťastný konec, ukazuje způsob, jak se s mašinama proměňuje kyber(ne)bezpečnost – co hledači zranitelností dřív mohlo zabrat měsíce expertní práce, zvládli fčil s AI během dnů až týdnů.

    A nejde jen o obranu – bezpečnostní firma Palo Alto Networks už zaznamenala také využití AI při následných aktivitách útočníků. AI tak může pomáhat díry v internetu ZÁPLATOVAT, ale taky je MNOHEM RYCHLEJI zneužívat… 🫠 #ai #umelainteligence #kyberbezpečnost

    #cybersecurity

    m.facebook.com/VedatorCZ/posts

    #cybersecurity #kyberbezpecnost #umelainteligence #ai
Next page
Share on Mastodon

Enter the server where you have an account.