<unnamed>

Public Key

npub1lcc6wn885u6k395x5j5tmdm94r6dh9zajxm8gyk82pv2s2j3el7sc6lcye

Profile Code

nprofile1qqs0uvd8fnn6wdtgj6r2f29akaj63axmj3werdn5ztr4qk9g9fgullgpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsc6sxv8

Publishing to

relay.damus.io

nos.lol

Last Notes

2026-08-30 17:54:43 CEST

I suspect something that hurts Mastodon adoption is that when you first join, assuming you don't join Mastodon.social, you get a server list:
https://joinmastodon.org/servers
But many of the top servers block sign ups, e.g. social.vivaldi.net and mstdn.ca
https://cyberplace.social/system/media_attachments/files/117/185/256/902/885/027/original/1d33280e16655eba.png
https://cyberplace.social/system/media_attachments/files/117/185/259/432/081/925/original/1b513d8de14d2680.png

2026-08-26 01:35:58 CEST

Both Xcancel and Nitter have had cease and desist letter from Twitter. You can still follow Twitter account on Mastodon via [email protected] and the like.
https://cyberplace.social/system/media_attachments/files/117/158/765/329/192/734/original/c676589085585ddf.jpeg
https://cyberplace.social/system/media_attachments/files/117/158/765/366/693/105/original/3fdac1b142433310.jpeg

2026-08-24 00:01:52 CEST

For anybody the media covering the privacy beat, you might want to have a look at the Take2 court orders to Microsoft over the Grand Theft Auto 6 leaks. There’s a big story.
I’ll give you some hints - MachineGuid and MSA device identifiers.

2026-08-17 17:24:10 CEST

- reply

ShieldBreak appears to be CVE-2026-69414 ht @npub12xh…zxeq https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69414

2026-08-17 16:36:22 CEST

- reply

Microsoft working to confirm validity of ShieldBreak. lol, bit slow. https://www.bleepingcomputer.com/news/security/microsoft-working-on-defender-patch-for-shieldbreak-zero-day/

2026-08-14 23:04:59 CEST

I regret to inform you Elon Musk has made a 6 minute AI video of himself as a superhero and it’s the cringiest shit I’ve ever seen.
https://cyberplace.social/system/media_attachments/files/117/095/884/937/487/672/original/833b25bb7d4daef9.mp4

2026-08-12 14:51:00 CEST

Nightmare Eclipse has published an unpatched zero day in Microsoft Defender called ShieldBreak, gets you SYSTEM privileges from any user account
They term it RoguePlanet 2 - however it operates very differently.
https://git.projectnightcrawler.dev/NightmareEclipse/ShieldBreak/src/branch/main/ShieldBreak.cpp
I've tried it, it works on latest Windows 11.

2026-08-07 23:58:13 CEST

- reply

If you run N-enable urgently apply the latest hot fix in this thread. I just spent 3 hours helping a government office hit with ransomware via this. A ransomware group definitely has the exploit, it’s a bypass for the previously issued CVE.

2026-08-07 02:02:03 CEST

- reply

Check your N-central server for traffic to Cloudflare Tunnels, they’re doing persistence via that even after patching.

2026-08-02 20:07:37 CEST

- reply

or Microsoft https://protonvpn.com/blog/windows-is-spyware

2026-07-30 19:16:20 CEST

Well done to the US government for running an AIDS conference, AI generating the slides, and presenting the slides with every country in Africa mislabelled by said AI https://www.theguardian.com/us-news/2026/jul/30/government-map-mislabels-african-countries

2026-07-30 16:16:22 CEST

- reply

RE: https://infosec.exchange/@hacksilon/116990837620035279
Looks like Max spotted it 3 days ago
#note1tr8…ucvz

2026-07-30 16:01:45 CEST

- reply

I didn't cover it in the blog but it does an amusing thing where aside from hijacking the clipboard, it also rewrites browser forms already filled in to change wallet addreses, lol. So if you browse an autofill form it replaces that too.
One of the big crypto firm execs sits on Adform's executive, I think they may have been hit in the incident by this.

2026-07-30 15:57:44 CEST

- reply

If you like malware reverse engineering, this was being served by Adform a few days ago: https://pastebin.com/mc7psaNF

2026-07-30 15:39:45 CEST

Adform, a web advertising firm, have been hacked and have been serving a supply chain attack to steal crypto https://doublepulsar.com/adform-compromised-to-serve-crypto-stealer-via-supply-chain-attack-2f1ec024f33e

2026-07-30 14:42:12 CEST

- reply

https://cyberplace.social/@GossiTheDog/117008566099747755
#note1x4j…6jk6

2026-07-30 12:57:08 CEST

The ExfilSquad portal listings are real, they gained access to companies Microsoft Dynamics365 environments (including Microsoft itself).

2026-07-29 18:16:35 CEST

Sense check for people working in cybersecurity in operations roles in the trenches:
I’m not finding or seeing cyber incidents off the back of Generative AI still. Are you? Not ones you’ve read about online - I mean ones you’ve actually dealt with.

2026-07-26 15:33:57 CEST

Elon Musk, an immigrant, was interviewed recently by the editor of the Economist. He said a bunch of dumb shit - for example that money wouldn’t exist in 2036, and that everybody wouldn’t have to work any more as AI would do their job for them.
Anyway, he’s now essentially calling for the assassination of the journalist over her questions about immigration.
https://cyberplace.social/system/media_attachments/files/116/986/523/670/932/738/original/834d0c9cab83b8fe.jpeg
https://cyberplace.social/system/media_attachments/files/116/986/523/725/376/414/original/518c795273ca41ab.jpeg
https://cyberplace.social/system/media_attachments/files/116/986/523/837/211/418/original/a6b85d485904d624.jpeg
https://cyberplace.social/system/media_attachments/files/116/986/523/977/604/522/original/7e34c8188f3d6797.jpeg

2026-07-24 01:09:25 CEST

- reply

The post incident review is out for the Microsoft Azure, Cloud and 365 outage today.
Tl;dr - failed change. 5 hour restoration. Similar to the big WAN outage they had in 2022 where a similar BGP command was executed incorrectly. Took down ExpressRoute customers too.
https://cyberplace.social/system/media_attachments/files/116/971/800/395/496/292/original/c2e84ddf5d5b4665.jpeg

2026-07-23 19:44:46 CEST

- reply

Microsoft are telling customers there is no ETA to resolution and they may want to review their DR plans for their SaaS services.
"Customers may wish to review their business continuity and disaster recovery plans and take actions appropriate for their environment."

2026-07-23 19:19:16 CEST

- reply

It's taken several hours but Microsoft finally put impacted services on the Azure status page, prior it was showing no impacted services.
https://cyberplace.social/system/media_attachments/files/116/970/432/289/311/563/original/940dfcca3e04c95a.png

2026-07-23 18:59:33 CEST

- reply

For anybody tracking the Microsoft outages... Azure West US is the cause:
Starting at 14:44 UTC on 23 July, 2026, we began investigating a networking issue affecting connectivity to Azure services in the West US region. Impacted customers may be experiencing intermittent connectivity failures, increased latency, or difficulty accessing Azure services. Customers with traffic traversing the West US region may also experience downstream impact.

2026-07-23 17:46:49 CEST

Microsoft 365 aka Microsoft Copilot aka Office 365 has jumped off a cliff.
https://cyberplace.social/system/media_attachments/files/116/970/067/142/940/405/original/a06fc044349b8a4f.jpeg

2026-07-21 18:57:50 CEST

- reply

most of .gov is

2026-07-17 23:24:06 CEST

I feel like I’m having a stroke every time I open BBC News this year
https://cyberplace.social/system/media_attachments/files/116/937/419/329/045/966/original/c855ac8d6d249d18.jpeg

2026-07-16 15:14:20 CEST

Regarding CVE-2026-56155, the in-the-wild ADFS vulnerability - the July patch just released does not fix the vulnerability.
Instead it adds an audit log. The changes to harden the service and enforce protection will only apply with October 2026’s update applied.
https://support.microsoft.com/en-us/servicing/os/windows/docs/2026/07/kb5121391-cve-2026-56155-ad-fs-dkm-container-acl-hardening

2026-07-14 18:39:51 CEST

Pretty funny Cursor issue - if you put a file named git.exe in a repo and open it in Cursor, it blindly runs said git.exe file https://mindgard.ai/blog/cursor-0day-when-full-disclosure-becomes-the-only-protection-left

2026-07-12 19:47:28 CEST

- reply

I’m really serious about this one btw. Companies have no measurable way of knowing what employees are doing with GenAI. They’re giving Claude Code out like it’s candy and just presuming everybody is an IT power user. They aren’t. They’re converting PDFs and vibe coding garden planning tools.
Copilot M365 has a fake dashboard showing how productive people are.. it has no actual data. It just shows people use it. It’s CIO porn for the CEO. Orgs are pissing money up a wall worldwide.

2026-07-12 19:44:07 CEST

RE: https://mastodon.social/@404mediaco/116908074107231828
Anybody who has worked in IT support in the trenches in enterprise IT will tell you there are some Excel power users who basically run the company, are macros wizards and actual ninjas.. about 0.1% of the workforce. About 99% of people can’t align a table in Word.
Giving the 99% of people tools which cost $$$ per user a month and letting them do anything is like giving a child a car, and being surprised when they ram the car into a wall three days later and cost $10k after achieving nothing.
#note1qwv…lwrf

2026-07-05 19:44:59 CEST

The study found that women who submit resumes created with AI assistance are evaluated as less competent and less trustworthy than men who submit identical AI-assisted resumes. To the evaluators, women’s AI use signaled inability, while men’s AI use signaled initiative. https://www.forbes.com/sites/michelletravis/2026/06/25/women-who-use-ai-seen-as-incompetent-men-who-use-ai-seen-as-pragmatic/

2026-07-02 14:08:51 CEST

RE: https://cyberplace.social/@WiteWulf/116849958470323752
what IT actually looks like in the trenches
#note1lj2…yu53

2026-06-26 12:44:12 CEST

- reply

There’s a further look at the two Lapsus$ guys here. The NCA are pushing for new powers to intervene with cases like this. https://www.bbc.co.uk/news/articles/cx2kx8jr244o

2026-06-25 15:42:35 CEST

GenAI update I'm sure y'all will be very surprised about
/s
Turns out giving every staff member hundreds of dollars a day = staff piss money up a wall trying to do simple things instead of working for a living.
https://www.404media.co/the-tokenpocalypse-is-here-companies-are-scrambling-to-stop-spending-so-much-on-ai/
https://cyberplace.social/system/media_attachments/files/116/811/032/497/034/985/original/4c83b507fb695d9c.png

2026-06-25 15:38:42 CEST

Snap glasses update I'm sure y'all will be very surprised about
/s
https://www.404media.co/snaps-ai-ar-specs-lol/
https://cyberplace.social/system/media_attachments/files/116/811/016/820/811/337/original/d450b99fe1a23aea.png

2026-06-23 00:34:30 CEST

Very funny screw up by Meta. They installed a keylogger on employees PCs, so they could train their AI. However they exposed the collected data online, so anybody could see what anybody who works there has been typing.
https://www.wired.com/story/meta-accidentally-let-employees-access-each-others-keystroke-data/

2026-06-22 18:14:25 CEST

- reply

Two men plead guilty over £39m TfL cyber attack https://www.bbc.co.uk/news/articles/czx5yp9qy0do

2026-06-22 14:31:51 CEST

The video game Quake is 30 years old today.
I played it with a 14.4k (0.0144 mbit/sec) modem with a 200 millisecond ping. Also back then internet was billed by the minute, I think was 4p per minute at peak time. RIP my parents phone bill.
My mum got annoyed with me once being online all the time so she confesquated my modem cable for two weeks. Somebody from IRC rang my house to check if I'd died.
https://cyberplace.social/system/media_attachments/files/116/793/752/741/252/992/original/98fe50dbd8a958ed.mp4

2026-06-21 12:24:39 CEST

VMware customers abandoning sinking ship https://www.theregister.com/virtualization/2026/06/17/tesco-is-sprinting-to-quit-vmware-and-broadcom-despite-rapid-migration-risks/5256133

2026-06-20 13:10:03 CEST

Gizmodo's serving ClickFix malware to Mac users [@Gizmodo](https://flipboard.com/@Gizmodo ) https://bsky.app/profile/juliametraux.bsky.social/post/3moomipmam22i
https://cyberplace.social/system/media_attachments/files/116/782/119/723/315/733/original/716d3845d898b134.png

2026-06-20 11:10:12 CEST

- reply

Fortinet have put out a blog about FortiBleed finally - where they don’t mention configuration exports (which is definitely happening at scale, I have receipts) or password hash cracking (we have the bash history of the user doing it).. but instead link Fortibleed to a prior marketing blog called “Attacks at the speed of AI” 🤦‍♀️
https://www.fortinet.com/blog/psirt-blogs/analysis-of-reported-credential-compromise-of-fortigate-devices?lctg=197390370

2026-06-19 21:04:04 CEST

- reply

Update on FortiBleed by me
New IOCs doing config dumps (including an IP addressed owned by Fortigate), details on movement inside networks etc.
https://doublepulsar.com/an-update-on-fortibleed-whats-happening-with-victim-orgs-c0671a50e7f4

2026-06-19 18:07:37 CEST

- reply

Canadian Centre for Cyber Security on #FortiBleed
https://www.cyber.gc.ca/en/alerts-advisories/al26-014-fortibleed-leak-thousands-compromised-credentials-impacting-fortinet-devices

2026-06-19 18:02:04 CEST

- reply

Some kind #FortiBleed victims got me to look at their situations. Some IOCs performing remote config dumps:
193.8.186.7
80.75.212.113
213.21.239.65
Look for inbound TCP traffic to Fortigate devices. If seen log into the devices and look for config dump events from those IPs.
Config dumps (including crackable password hashes) have been going on for around a month.
If you have IPsec site to site VPN tunnels on the impacted Fortinets you need to rebuild the tunnels with new keys both ends.

2026-06-18 22:33:31 CEST

- reply

To be transparent about this, a threat actor has been claiming they have an exploit to get FortiOS device password hashes remotely from config for the past month. It’s currently unclear how. They claim it’s an exploit of an unpatched vuln. Their claims predate the discovery of this dump.
If I end up having to set up another FortiGate firewall honeypot to figure out what’s going on.. I’ll British tut and get on with it.
https://cyberplace.social/system/media_attachments/files/116/773/008/265/422/976/original/b764e7e727aade8e.mp4

2026-06-18 22:20:38 CEST

- reply

NCSC UK advice on Fortibleed: https://www.ncsc.gov.uk/news/advice-following-global-targeting-of-fortinet-firewalls-and-vpn-gateways

2026-06-18 22:10:07 CEST

- reply

Fortinet appear to be telling press the #Fortibleed breach is made up of prior breaches and brute forcing.. but I’ve seen the breach data and it includes many passwords not in prior dumps, and I’ve worked with impacted orgs and they report no brute forcing of impacted accounts.
I think there may be some confusion about this one - the brute forcing is the cracking of the passwords by the threat actor, which is done locally.
Watch this space on this one anyhoo.
https://cyberplace.social/system/media_attachments/files/116/772/900/051/768/508/original/4263c41be37060e4.jpeg

2026-06-18 20:49:31 CEST

- reply

I fly planes in VR, drones in real life and go VR clubbing at weekends, and even I wouldn't wear these
https://cyberplace.social/system/media_attachments/files/116/772/606/149/092/327/original/fc999cb09cc33bfd.png

2026-06-18 20:42:33 CEST

"previous flops"
$2000 glasses
which do almost nothing
yep, no way this one will flop!
https://cyberplace.social/system/media_attachments/files/116/772/576/776/245/554/original/6a044a238b8884af.png

2026-06-18 12:42:22 CEST

- reply

#GAYINT list of impacted #FortiBleed IPs. Not all as I couldn't write the parser properly. http://owned.lab6.com/~gossi/research/public/fortibleed/some-fortibleed-ips.txt

2026-06-18 12:27:08 CEST

- reply

#GAYINT list of impacted domains (this is basically email addresses of admin accounts on the device btw) https://blog.gayint.org/intel/fortibleed.txt

2026-06-18 10:44:05 CEST

Truly evil lobbying example https://www.politico.eu/article/europe-choose-ai-climate-goals-data-center-chief-warns/

2026-06-17 17:43:12 CEST

- reply

Lol, the #FortiBleed data was found in an opendir on a webserver 🤣 truly GenAI is going to take over 😜
"They accidentally left an open directory with artefacts, connection strings, tooling, scripts and data online. Analytics obtained via their cron jobs, bash histories, logs etc,"
https://www.bleepingcomputer.com/news/security/fortibleed-leak-exposes-fortinet-vpn-credentials-for-73-000-devices/

2026-06-17 15:43:30 CEST

- reply

So there are definitely devices which weren't in the Belsen Group post back last year, in fact almost all of them weren't.
On how they got the passwords - until about a year ago, FortiOS (Fortinet firewall OS) stored admin passwords SHA-256 salted, which can be bruteforced.
In an update about a year ago, if installed and admins log in, passwords are stored much more securely - but most orgs won't be that condition yet.
https://cyberplace.social/system/media_attachments/files/116/765/736/421/232/371/original/99378007b9a008a1.png

2026-06-17 13:35:50 CEST

- reply

It’s similar to the Belsen Group thing, although that was a smaller collection of devices - prior thread
https://cyberplace.social/@GossiTheDog/113834848200229959

2026-06-17 13:22:46 CEST

- reply

Data looks like this, appears they validated creds too.
https://cyberplace.social/system/media_attachments/files/116/765/184/936/319/367/original/309beb6a558e64d0.jpeg

2026-06-17 13:18:44 CEST

An ecrime group has somehow gained access to 75k Fortinet firewall devices - dubbed Fortibleed
Blog https://www.infostealers.com/article/fortibleed-75000-fortinet-firewalls-compromised-global-enterprises-exposed-claim-your-ethical-disclosure/
Check if your domain is impacted: https://www.hudsonrock.com/fortinet
I’ve verified the data is real. They’ve been dumping the Fortinet config - not sure how yet - and then cracking the passwords it appears. Data is being resold online. #fortibleed

2026-06-16 14:50:03 CEST

The US government has intervened in a lawsuit on the side of X, saying Grok is "critical for national security" https://www.wired.com/story/doj-lawyers-argue-xai-vital-national-security-naacp-lawsuit/

2026-06-16 14:27:47 CEST

Zayo Group paid ShinyHunters ransomware group to hide their breach.

2026-06-13 20:32:43 CEST

I'm on year 3 of trying to convince the UK gov to use Mastodon.. instead ministers are busy tweeting about Elon on Elon's platform.
https://www.lemonde.fr/en/international/article/2026/06/13/musk-s-role-was-instrumental-in-the-belfast-riots-according-to-researchers_6754420_4.html

2026-06-12 23:25:26 CEST

- reply

The Blob(tm) is back... but almost all the files have been removed now.
https://cyberplace.social/system/media_attachments/files/116/739/241/599/590/768/original/fc7c030d4bf45a79.png

2026-06-12 16:05:50 CEST

- reply

This blob is no longer publicly accessible. 🎉
https://cyberplace.social/system/media_attachments/files/116/737/514/767/505/960/original/4888c190d78c12fe.jpeg

2026-06-12 01:01:52 CEST

- reply

I have an internet scanning thing which records firmware patching times. Generally speaking most orgs aren’t meeting CISA directives to patch, including federal government - they’re often weeks or months late.

2026-06-11 23:55:12 CEST

- reply

REMINDER don't upload everything in a public Azure blob indexed on Google
https://cyberplace.social/system/media_attachments/files/116/733/698/103/326/618/original/3b6b705b7239916f.png

2026-06-11 23:54:22 CEST

While googling something about I just ended up on a Microsoft public Azure blob with meeting recordings, PDFs about how they're selling Copilot and how to get it into business leaders, screenshots with partner data, business strategy etc.
gtmresources.blob.core.windows.net
https://cyberplace.social/system/media_attachments/files/116/733/616/773/884/168/original/991ed9178c70a68a.png
https://cyberplace.social/system/media_attachments/files/116/733/620/361/828/536/original/00db7d0399ebad52.png
https://cyberplace.social/system/media_attachments/files/116/733/633/530/779/876/original/7de32412e2d3d0c6.png
https://cyberplace.social/system/media_attachments/files/116/733/670/841/967/914/original/8febf209b6ef33b1.png

2026-06-08 23:04:19 CEST

- reply

One of the public MS statements about the issue in this thread is it's an "internal technical issue"
https://cyberplace.social/system/media_attachments/files/116/716/510/639/762/800/original/201708bc415c8865.mp4

2026-06-08 21:07:19 CEST

- reply

How it started vs how it’s going.
https://cyberplace.social/system/media_attachments/files/116/716/048/297/043/856/original/b76aaf8e13e1e4cd.jpeg
https://cyberplace.social/system/media_attachments/files/116/716/048/341/431/816/original/4154f390a96d9510.jpeg

2026-06-08 08:47:06 CEST

RE: https://buttplug.zone/@buttplugio/116711889648322798
I opened Mastodon for the first time today and the first post I see is a furry drawing something in Microsoft Paint using a sex toy.
Mom, I’m home.
#note12xa…sye2

2026-06-05 23:38:45 CEST

It looks like Microsoft's DevOps libraries for Azure Functions might have been compromised. No statement yet but Github is nuking Microsoft's own repos.
https://opensourcemalware.com/blog/miasma-reaches-azure

2026-06-05 18:33:25 CEST

If you're wondering why Anthropic et all are publicly making stupid claims ('our AI that writes itself!') and begging world governments to regulate them - while directing setting up the regulation - it's pretty simple: they're locking out competitors.
If you read through this draft of "The Greeat American AI Act" it's pretty clear that nobody but the current big players will be able to comply. It's "regulate me, daddy" = "make sure nobody else can compete".
https://trahan.house.gov/uploadedfiles/the_great_american_ai_act_discussion_draft.pdf

2026-06-05 00:19:57 CEST

- reply

Incogni are back chasing their removal request about publishing another removal request. https://github.com/GossiTheDog/Cyberplace/blob/main/LegalThreats/Re%3A%20Data%20removal%20request%20-%20Felix%20Juhl%20%5BID-EDG1A8611%5D
https://cyberplace.social/system/media_attachments/files/116/694/152/128/564/516/original/515e0a11d979f398.png

2026-06-04 23:47:22 CEST

- reply

the file tree listing is still up on the site and pastebin
https://cyberplace.social/system/media_attachments/files/116/694/032/314/182/485/original/f73c3a2df3cba172.png

2026-06-04 22:50:25 CEST

RE: https://infosec.exchange/@vxdb/116693798620105566
this lego thing is SO dumb
#note173e…anvv

2026-06-04 20:05:56 CEST

I reinstalled Arma Reforger aka Mr Bean War Simulator 5 minutes ago.
Already happened:
- I accidentally fell out of a helicopter
- I got revived by a medic who happened to be passing by in a field in the middle of nowhere
- Then I immediately got run by a truck which happened to cut through the field
I love this game, it's proof human shouldn't do anything.

2026-06-03 21:57:00 CEST

- reply

xAI have asked a court to strip the anonymity of four people suing it over Grok removing their clothing in images without their consent. One was depicted as a child in the Grok images.
It appears to be an attempt to have them drop the case.
https://www.wired.com/story/xai-asks-court-to-strip-alleged-grok-deepfake-nudes-victims-of-anonymity/

2026-06-03 12:04:03 CEST

- reply

The CEO has a 44% pay cut after the LAPSUS$ incident https://www.cityam.com/ms-pay-slashed-after-cyberattack-turmoil/

2026-06-03 12:02:18 CEST

- reply

Marks and Spencer have cut all their staff bonuses, citing the LAPSUS$ cyber incident. https://www.thetimes.com/business/companies-markets/article/m-and-s-cyberattack-wipes-131m-off-annual-profits-xrlldf7lb

2026-05-30 20:15:33 CEST

GenAI is going great (this is real)
https://www.google.com/search?q=how+many+days+of+the+week+have+fish+in+them%3F&sourceid=chrome&ie=UTF-8
https://cyberplace.social/system/media_attachments/files/116/664/887/674/648/830/original/be30e94a7d8ed1ab.png

2026-05-28 17:07:37 CEST

Wrote a thing on Microsoft’s stance that not following their “responsible disclosure” process is criminal activity https://doublepulsar.com/microsofts-stance-on-zero-day-exploits-is-a-dumpster-fire-of-their-own-making-0946117940a4?postPublishedType=repub

2026-05-28 13:46:08 CEST

- reply

Do I think the finder was acting rationally? No. Do I think Microsoft gets to decide what is criminal activity around proof of concept exploits? No.

2026-05-28 13:45:09 CEST

I’m deeply uncomfortable with Microsoft attempting to weaponise their extensive law enforcement contacts to arrest people who post zero days in the products.
It comes after the researcher was kicked off GitHub (owned by Microsoft), Gitlab (a Microsoft partner), after they were doxxed on Twitter and had their MSRC - Microsoft vulnerability reporting portal - account disabled.
https://www.microsoft.com/en-us/msrc/blog/2026/05/a-shared-responsibility-protecting-customers-through-coordinated-vulnerability-disclosure
https://cyberplace.social/system/media_attachments/files/116/652/001/846/463/920/original/a5f5f906b35414ee.jpeg

2026-05-26 16:22:22 CEST

Well done to Epic Games, who tweeted and then deleted, when called out, this GenAI image of their Porsche partnership.
Butchers the Porsche logo, puts Riot Games logo on the balloon (a competitor) and other things.
https://cyberplace.social/system/media_attachments/files/116/641/312/137/600/352/original/a3513ea3874082e7.png

2026-05-24 12:20:18 CEST

- reply

that looks like you're at a press conference after breaking the world record for eating bees or something

2026-05-23 14:27:08 CEST

The White House is ordering agencies to place its new app on all employees’ government phones
A button gives the option to “text President Trump,” which, when clicked, opens a text message to a pre-selected number with the default text “Greatest President Ever!”
https://www.govexec.com/management/2026/05/white-house-ordering-agencies-place-its-new-app-all-employees-government-phones/413738/

2026-05-21 21:11:13 CEST

My company has gone AI mad so it's time to get another job but everywhere I look, I look them up on LinkedIn, and it's just people there going mad about AI.
https://cyberplace.social/system/media_attachments/files/116/614/145/658/747/647/original/01d51f1a2a1a48a7.png

2026-05-20 12:10:52 CEST

- reply

I'm still thinking about the Emu War.

2026-05-19 02:01:37 CEST

- reply

Fuck me there’s an Emu War cinematic universe
https://cyberplace.social/system/media_attachments/files/116/598/301/185/553/943/original/586b4c7339e0af0b.jpeg

2026-05-19 01:57:48 CEST

- reply

The Great Emu War is so good.
https://cyberplace.social/system/media_attachments/files/116/598/284/845/414/601/original/05e14769e9bb829e.jpeg
https://cyberplace.social/system/media_attachments/files/116/598/284/917/169/073/original/dffbbf4b49217e3e.jpeg
https://cyberplace.social/system/media_attachments/files/116/598/285/065/351/392/original/82cc8010661d5f4a.jpeg

2026-05-19 01:51:59 CEST

It’s 1am. I googled emus, ended up on the Emu War page (sorry, “Great Emu War” as it was called). Nobody show James Cameron this page or we’ll end up with another 12 Avatar movies.
https://cyberplace.social/system/media_attachments/files/116/598/255/479/693/906/original/285f6402f6af360d.jpeg
https://cyberplace.social/system/media_attachments/files/116/598/255/542/335/097/original/9fe0a0a9184b4c06.jpeg
https://cyberplace.social/system/media_attachments/files/116/598/255/619/327/410/original/d5e5f8ffbc9a5b16.jpeg

2026-05-18 17:37:57 CEST

RE: https://techhub.social/@Techmeme/116596312742431654
This is the dumbest fucking thing I’ve read since the last AI thing.
#note17y5…lmgq

2026-05-18 17:28:48 CEST

For some reason Donald Trump has posted a AI generated picture of him pressing a button and blowing up America, Ireland and himself.
https://cyberplace.social/system/media_attachments/files/116/596/284/093/021/452/original/88ae0471326b4c2f.jpeg

2026-05-18 15:21:09 CEST

A reminder that one of the reasons people love AI as you can ask it to justify any dipshit idea and it'll just write whole documents about it being a great idea, write the PowerPoint decks, the Capex requests etc.
https://cyberplace.social/system/media_attachments/files/116/595/779/051/170/254/original/62679bdd0bae072e.png

2026-05-18 15:15:43 CEST

- reply

incredibly funny. SLIPPY SPIDER!

2026-05-18 15:00:19 CEST

- reply

you can't on personal accounts - it's an enterprise Entra ID feature. Also, not everybody is you - the MS personal account signup directs you to install the app.

2026-05-18 10:01:16 CEST

The consequence of going passswordless:
https://www.reddit.com/r/cybersecurity/s/7KIJL7R0Zz

2026-05-15 12:03:29 CEST

- reply

Regarding CVE-2026-42945 in nginx - no modern (or even old) Linux distribution runs nginx without ASLR.
The way the PoC exploit works is they spawn nginx like this:
> exec setarch x86_64 -R /nginx-src/build/nginx -p /app -c /app/nginx.conf
Setarch -R disables ASLR. I've had a look through Github and I can't find any other software which actually does this for nginx either.
So, cool, sweet technical vuln - it's valid - but the RCE apocalypse ain't coming.
https://cyberplace.social/system/media_attachments/files/116/578/013/298/718/371/original/1e57e928d3bae1b0.png

2026-05-14 19:38:38 CEST

- reply

I have had another request remove posts from my Mastodon server - this time removal of cease and desist requests. https://github.com/GossiTheDog/Cyberplace/blob/main/LegalThreats/Data%20removal%20request%20-%20Felix%20Juhl%20%5BID-EDG1A8611%5D
https://cyberplace.social/system/media_attachments/files/116/574/144/814/370/830/original/9ebdc8a8a2eabe07.png

2026-05-14 13:49:50 CEST

RE: https://masto.deoan.org/@neurovagrant/116569138539026520
If you go through Google for 'booter services' or booters (DDoS), almost all of them are Cloudflare customers - you literally use Cloudflare to reach their service to order a DDoS, which businesses then pay Cloudflare to protect against.
Part of the reason I left my prior employer is the UK side of the business purchased Cloudflare, so I said yep, I'm out.

2026-05-14 13:11:16 CEST

- reply

CVE-2026-34486 - Tomcat
- Only exploitable if a certain feature is used, if it's endpoint is reachable and if port 4000. It's pretty niche.

2026-05-14 13:09:40 CEST

There's serious panic being caused by AI discovered vulnerabilities behind the scenes, where those finding them are basically using them as marketing. Automated vulnerability hype train again, basically.
A thread on a few of them.