One of the recommendation is to use a 3-day cooldown before using new versions. Crazy.

1. Rust doesn't prevent TOCTOU (Time-of-Check to Time-of-Use) race conditions (file path resolution → use file handlers directly)
2. Panics are denial-of-service vulnerabilities when handling untrusted input.
3. In case of a well established tool, compatibility is a security feature.
4. Resolve external information before crossing trust boundaries.
5. The interactions with the operating system is a security boundary in Rust. The developer has to be careful.

The post goes in-depth for many cases.

Hashcat on a Game Boy Advance runs 727 Hashes per second

About the xz backdoor

It should work with a Tailscape IP (or VPN) for example to be accessible from the Internet.

It's a set of tools to protect a webserver.

• USB: If the USB stick is removed, the LUKS keys are erased and the computer rebooted (it's smilar to a formatting of the hard drive because the data can not be decrypted anymore).
• Dead man switch : If a signal is not sent to a service every 24 hours, the similar operation occurs: Keys are erased and the server reboots.

It's kind of like in spy movies when you don't want your data to fall into the wrong hands.

(via https://sebsauvage.net/links/?dIanfA)

Transsion est un framework construit sur Android.

Le framework surveille: "Votre position GPS précise, les antennes-relais autour de vous, la consommation réseau appli par appli sur une soixantaine d'applis, quelle appli est affichée à l'écran en temps réel, et même quelle appli vient d'allumer la caméra".

Tout cela est remontée sur des domaines shalltry.com et transsion-os.com.

Ce SDK est utilisé dans plusieurs applications populaire en Afrique aussi.

Tout cela n'est pas désactivable puisque c'est installé au niveau de l'OS. Un malware s'installait sur 53 000 Tecno W2 vendus en Éthiopie, au Ghana ou enore au Cameroun.

Un workaround serait de bloquer les domaines au niveau du DNS, pour qu'au moins aucune information ne remote aux serveurs.

Source: https://www.nowsecure.com/blog/2026/07/08/what-the-transsion-telemetry-research-means-for-mobile-security/

Un retour sur des outils d'IA pour la sécurité.

Cette vulnérabilité nous amène également à parler de Claude Mythos. En effet, un unique commit de 2023 (58c9b016e128, avril 2023) a introduit non pas une, mais deux race conditions distinctes dans quelque 2 500 lignes du code epoll.

But the most troubling part of this story is Apple’s terrible handling of the issue. Murphy reported the bug in June 2024, and Apple responded a month later, saying they had launched an internal investigation. Then, in March of this year, they announced they’d fixed the issue—except they hadn’t. Murphy checked, and the flaw was still there. So in May, Apple changed its tune and flat-out told him to shut up, but the most annoying thing about this whole situation is the crappy handling of it: “We would appreciate it if you wouldn’t disclose this information until our investigation is complete.” In short, just shut up while we do nothing to fix it ^^.

(via https://korben.info/apple-hide-my-email-faille-adresse-reelle.html)

The weekend PyPI wave showed how a compromised maintainer account could publish malicious wheels that abused Python startup behavior

It runs JS with Bun in a subprocess from a python program.

It includes a counter-measure to LLM analysis with a comment about biological und nuclear weapons.

No way it's real: using specific URLs with a NO_ROLE provide access to the dashboard of the FIFA worldcup 2026.

The whole thing boils down to one architectural mistake: client-side authorization with no server-side enforcement.

FIFA's internal applications use Microsoft Entra for authentication and role-based access control. The Angular/React/Vue frontends check the JWT token for role claims and render access-denied pages accordingly. But the backend APIs trust any authenticated tenant member and serve data regardless of roles.

Rules to follow:

• Get a security.txt file. Seriously. It's 2026.
• Publish a VDP (Vulnerability Disclosure Policy). You're running the biggest sporting event on earth.
• Client-side authorization is not authorization. Every intern learns this.
• When a researcher has to call CISA and the FBI to reach you, something is wrong.
• Start a bug bounty program. Researchers shouldn't have to call the FBI to do you a favor.

6 ans de travail, 362 commits pour remplacer une fonction.

Vendor the dependencies in the project directly. It will avoid to install the dependencies every time.

So just by not updating dependencies automatically, you turn every single package in an ecosystem into a fire-break for supply chain attacks.

Toute l'astuce tient dans le mariage de deux mécanismes connus depuis des lustres. HTTP/2 sait compresser les en-têtes des requêtes pour éviter de répéter cent fois la même chose, et c'est précisément cette générosité que l'attaquant retourne contre le serveur, en faisant référence des milliers de fois à un en-tête glissé une seule fois, si bien que la machine réserve de la mémoire à tour de bras pour quelque chose qui, au départ, ne pèse presque rien.

C'est comme un shell bomb, en HTTP 2 via la décompression. L'attaque a un ratio de données de 5000:1.
100Mb/s peuvent donc causer 500Gb/s de DoS.

Source: https://thehackernews.com/2026/06/new-http2-bomb-vulnerability-allows.html

Technique si vous recevez du spam clairement illégal.

1. Prendre le nom de domaine de l'adresse email (après le @)
2. Rechercher ce nom de domaine sur whois https://www.whois.com/whois/
3. Regarder la ligne "Registrar Abuse Contact Email" (ou dans le groupe Registrar Information, la ligne Abuse Email)
4. Transmettre le mail frauduleux, et donner un peu de contexte dans le mail. Le service devrait faire le reste

Signal client uses SQLcipher database to store conversation messages. Since SQLcipher
is essentially SQLite with encryption, it inherits SQLite features.

To update the database, SQLite (and consequently SQLcipher) uses Write-Ahead Logging.
All transactions are written to a Write-Ahead Log file, which is then merged to the
main database file when a certain number of pages are written to the log file, the
database is manually checkpointed, or the database file is reopened.

This results in an unexpected situation when messages are deleted in Signal, either
manually or by a timed deletion. The deletions from the database are recorded to the
Write-Ahead Log file, but they are not actually deleted from the database file until
the Write-Ahead Log is committed back to the main database.

By default, the Write-Ahead Log has a threshold size of 1000 pages. Depending on how
busy your Signal app is, this transaction limit could take several days to reach. This
means that the messages deleted in Signal will linger on disk far longer than expected.
The database file with the supposedly deleted messages can easily end up being backed
up to Time Machine backups, adding unexpected data persistence.

Since its reporting 29 months ago, the vulnerability remained unknown except to Chromium developers. Then on Wednesday morning, it was published to the Chromium bug tracker. Rebane initially assumed the vulnerability was finally fixed. Shortly thereafter, she learned that, in fact, it remained unpatched. While Google removed the post, it remains available on archival sites, along with the exploit code.