331 private links
Hashcat on a Game Boy Advance runs 727 Hashes per second
About the xz backdoor
It should work with a Tailscape IP (or VPN) for example to be accessible from the Internet.
It's a set of tools to protect a webserver.
- USB: If the USB stick is removed, the LUKS keys are erased and the computer rebooted (it's smilar to a formatting of the hard drive because the data can not be decrypted anymore).
- Dead man switch : If a signal is not sent to a service every 24 hours, the similar operation occurs: Keys are erased and the server reboots.
It's kind of like in spy movies when you don't want your data to fall into the wrong hands.
Transsion est un framework construit sur Android.
Le framework surveille: "Votre position GPS précise, les antennes-relais autour de vous, la consommation réseau appli par appli sur une soixantaine d'applis, quelle appli est affichée à l'écran en temps réel, et même quelle appli vient d'allumer la caméra".
Tout cela est remontée sur des domaines shalltry.com et transsion-os.com.
Ce SDK est utilisé dans plusieurs applications populaire en Afrique aussi.
Tout cela n'est pas désactivable puisque c'est installé au niveau de l'OS. Un malware s'installait sur 53 000 Tecno W2 vendus en Éthiopie, au Ghana ou enore au Cameroun.
Un workaround serait de bloquer les domaines au niveau du DNS, pour qu'au moins aucune information ne remote aux serveurs.
Un retour sur des outils d'IA pour la sécurité.
Cette vulnérabilité nous amène également à parler de Claude Mythos. En effet, un unique commit de 2023 (58c9b016e128, avril 2023) a introduit non pas une, mais deux race conditions distinctes dans quelque 2 500 lignes du code epoll.
But the most troubling part of this story is Apple’s terrible handling of the issue. Murphy reported the bug in June 2024, and Apple responded a month later, saying they had launched an internal investigation. Then, in March of this year, they announced they’d fixed the issue—except they hadn’t. Murphy checked, and the flaw was still there. So in May, Apple changed its tune and flat-out told him to shut up, but the most annoying thing about this whole situation is the crappy handling of it: “We would appreciate it if you wouldn’t disclose this information until our investigation is complete.” In short, just shut up while we do nothing to fix it ^^.
(via https://korben.info/apple-hide-my-email-faille-adresse-reelle.html)
The weekend PyPI wave showed how a compromised maintainer account could publish malicious wheels that abused Python startup behavior
It runs JS with Bun in a subprocess from a python program.
It includes a counter-measure to LLM analysis with a comment about biological und nuclear weapons.
No way it's real: using specific URLs with a NO_ROLE provide access to the dashboard of the FIFA worldcup 2026.
The whole thing boils down to one architectural mistake: client-side authorization with no server-side enforcement.
FIFA's internal applications use Microsoft Entra for authentication and role-based access control. The Angular/React/Vue frontends check the JWT token for role claims and render access-denied pages accordingly. But the backend APIs trust any authenticated tenant member and serve data regardless of roles.
Rules to follow:
- Get a security.txt file. Seriously. It's 2026.
- Publish a VDP (Vulnerability Disclosure Policy). You're running the biggest sporting event on earth.
- Client-side authorization is not authorization. Every intern learns this.
- When a researcher has to call CISA and the FBI to reach you, something is wrong.
- Start a bug bounty program. Researchers shouldn't have to call the FBI to do you a favor.
6 ans de travail, 362 commits pour remplacer une fonction.
Vendor the dependencies in the project directly. It will avoid to install the dependencies every time.
So just by not updating dependencies automatically, you turn every single package in an ecosystem into a fire-break for supply chain attacks.
Toute l'astuce tient dans le mariage de deux mécanismes connus depuis des lustres. HTTP/2 sait compresser les en-têtes des requêtes pour éviter de répéter cent fois la même chose, et c'est précisément cette générosité que l'attaquant retourne contre le serveur, en faisant référence des milliers de fois à un en-tête glissé une seule fois, si bien que la machine réserve de la mémoire à tour de bras pour quelque chose qui, au départ, ne pèse presque rien.
C'est comme un shell bomb, en HTTP 2 via la décompression. L'attaque a un ratio de données de 5000:1.
100Mb/s peuvent donc causer 500Gb/s de DoS.
Source: https://thehackernews.com/2026/06/new-http2-bomb-vulnerability-allows.html
Technique si vous recevez du spam clairement illégal.
- Prendre le nom de domaine de l'adresse email (après le @)
- Rechercher ce nom de domaine sur whois https://www.whois.com/whois/
- Regarder la ligne "Registrar Abuse Contact Email" (ou dans le groupe Registrar Information, la ligne Abuse Email)
- Transmettre le mail frauduleux, et donner un peu de contexte dans le mail. Le service devrait faire le reste
Signal client uses SQLcipher database to store conversation messages. Since SQLcipher
is essentially SQLite with encryption, it inherits SQLite features.To update the database, SQLite (and consequently SQLcipher) uses Write-Ahead Logging.
All transactions are written to a Write-Ahead Log file, which is then merged to the
main database file when a certain number of pages are written to the log file, the
database is manually checkpointed, or the database file is reopened.This results in an unexpected situation when messages are deleted in Signal, either
manually or by a timed deletion. The deletions from the database are recorded to the
Write-Ahead Log file, but they are not actually deleted from the database file until
the Write-Ahead Log is committed back to the main database.By default, the Write-Ahead Log has a threshold size of 1000 pages. Depending on how
busy your Signal app is, this transaction limit could take several days to reach. This
means that the messages deleted in Signal will linger on disk far longer than expected.
The database file with the supposedly deleted messages can easily end up being backed
up to Time Machine backups, adding unexpected data persistence.
Since its reporting 29 months ago, the vulnerability remained unknown except to Chromium developers. Then on Wednesday morning, it was published to the Chromium bug tracker. Rebane initially assumed the vulnerability was finally fixed. Shortly thereafter, she learned that, in fact, it remained unpatched. While Google removed the post, it remains available on archival sites, along with the exploit code.
Another security issue in the kernel
A cybersecurity researcher has published proof-of-concept (PoC) exploits for two unpatched Microsoft Windows vulnerabilities named YellowKey and GreenPlasma, which are a BitLocker bypass and a privilege-escalation flaw.
"The result of this is that the X:\Windows\System32\winpeshl.ini is deleted, and when Windows Recovery is entered, rather than launching the actual Windows Recovery environment, it pops up a CMD.EXE. With the disk still unlocked" - Will Dormann
The websites must renew their certificates. Certificates are issued for two years but it's hard to renew certificates after two years! Let's Encrypt came up with a brilliant idea: all certificates are valid for only 90 days.
It has two advantates: it rotates the private key every 90 days and it pushes website owner to automate the renewal process.
In case of private key compromission, there are two methods to revoke the certificates: CRL and OCSP.
In principle, CA certificates themselves carry this information, informing clients that when verifying a certificate, they should visit this URL list to check if the certificate they are validating is in the revocation list. If it is, they should not trust it.
The CRL provides exactly that with the DER format.
The OCSP method needs to verify every URL of each certificates. This method has downsides:
- The website's performance will decrease due to the additional time required for CA requests. The OCSP servers could become htspots and might be overloaded by clients.
- The CA will know which domain names the client has accessed.
- If the CA's OCSP service is down, the client has two choices: ignore verification or no trust the target site.
There can be workarounds with the OCSP Stapling: the website itself query the CA's OCSP service and when a client visits the website, the website provides the OCSP response.
All of these methods works if the CA can be trusted. WoSign had for example a chaotic organization that issued certificates for websites directly, whereas the CA should have issued certificates for Chinese users only.
That's what Certificate Transparency (CT) should address after the DigiNotar incident in 2011.n CT must log the issued certificate in a CT database and the CT will provide a Signed Certificate Timestamp (SCT) back to the website. The clients will only trust certificates that have an SCT when visiting websites and websites (and everyone) can monitor the CT database to check if any certificates have been issued for their domains.