Dr. Christopher Kunz

Security (web, infra, app) nerd, has accepted that VR will never be a mass market, writer @heise Security 
All toots are IMHO & not my employer's opinion.
PGP fingerprint: C882 8ED1 7DD1 9011 C088 EA50 5CFA 2EEB 397A CAC1

where I work: heise Security
Linktr.ee: https://linktr.ee/christopher.kunz
private blog: https://www.christopher-kunz.de/
heise.de: https://www.heise.de/autor/Dr-Christopher-Kunz-4325470

Public Key

npub1sttn3l2n40lkk5eyt2czgeqnsct9ql6ltau6nmcqq4s8422ahcjqkjddpm

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsg94ecl4f6hlmt2vj94vpyvsfcv9js0a0477dfauqq2cr649wmufqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsplt2a3

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1sttn3l2n40lkk5eyt2czgeqnsct9ql6ltau6nmcqq4s8422ahcjqkjddpm

Show more details

Last Notes

2026-07-09 16:47:48 CEST

- reply

Again? I know that ASN by heart now.

2026-07-09 16:30:37 CEST

- reply

I have questions. Especially one: Which is the PAN-OS release preferred by the folks at @npub13vn…f849 Labs?

2026-07-09 16:24:01 CEST

- reply

Wait, we have preferred releases now? Like, as in "beta", "latest", "lts", "preferred", "notso-hotso"?

2026-07-09 16:03:18 CEST

- reply

"Product fails at core competency" should be the takeaway from this. Unfortunaly, CVSS 1.7 will land this very low on anyone's priority list, be it SSVC or that CISA thing.

2026-07-09 16:00:31 CEST

- reply

I should have made a 2026 issue for my insecurity appliance bingo. With another column: "CVSS sandbagging". However, I think they are actually right here, because the flaw only affects subsequent systems. I would have gone for SC:N/SI:H/SA:H though, upping the score to 2.7
This shows again how bad CVSS performs as a threat metric.

2026-07-01 14:50:53 CEST

Die Innenministerkonferenz will Indymedia komplett verbieten.
Weil wir als Gesellschaft derzeit keine drängenderen Extremismus-Probleme haben.
In 85 Seiten der Beschlusssammlung wird kein einziges Mal das Wort "rechtsextrem" erwähnt.
Die haben im wahrsten Sinne des Wortes die Schüsse nicht gehört. https://www.innenministerkonferenz.de/IMK/DE/termine/to-beschluesse/2026-06-19_DOK/Freie_Beschl%C3%BCsse.pdf?__blob=publicationFile&v=1

2026-06-30 14:39:58 CEST

- reply

I mean, why not use GLM 5.2 in the meantime? https://www.provos.org/p/qemu-escape-glm-5-2/

2026-06-10 22:24:53 CEST

- reply

Err...?
https://assets.chaos.social/media_attachments/files/116/727/682/720/280/241/original/5ffc1c769a7f09fa.png

2026-06-10 22:09:04 CEST

- reply

I can verify that the exploit still works with that mpengine.dll version and the 1.453.28.0 definition update that got released 6/10/2026 6:29:20 PM. It takes more than one attempt, sometimes up to 6-7 now, where it used to be almost always one shot, but it still works.
I'm waiting for my other VM to fully update and then I'll retry there, too.

2026-06-10 17:25:27 CEST

- reply

N/A is a status, too. Just sayin'.

2026-06-10 09:50:51 CEST

The simplest of all possible modifications to the original RoguePlanet.cpp (literally interchanging two letters in the source code) defeats the detection and re-enables the exploit in current, fully patched Windows 11 with Definition Update 1.453.20.0 installed.
https://assets.chaos.social/media_attachments/files/116/724/716/653/225/168/original/120c686a318ba84b.png

2026-06-10 09:22:01 CEST

- reply

Sure, take it directly from the horse's mouth: https://deadeclipse666.blogspot.com/2026/05/july-14th.html

2026-06-10 09:19:23 CEST

- reply

CVE-2026-41091 is RedSun.

2026-06-09 23:35:19 CEST

Will we wake up to see Windows Defender quarantining wermgr.exe pr the Task Scheduler in an attempt to contain RoguePlanet? Oh, the excitement….

2026-06-09 23:29:55 CEST

- reply

Blatant typo: should be RougePlanet, not RoguePlanet. What with it being a RedSun variant 'n all.

2026-06-09 17:55:19 CEST

- reply

I see your header collection and raise you one "X-Disclaimer: This email was set up by Hornetsecurity GmbH"

2026-06-04 16:50:13 CEST

- reply

Yeahhh.... so that one looks fishy. It seems to be a fork of the earlier one, but added a setup.py which seems to do slightly weird stuff.

2026-06-04 14:47:09 CEST

- reply

From what I read in the writeup (and the sparse other sources), you need a long enough DNS name on the victim host to trigger the overflow. I think 54 chars or more? This github has a possible explanation why the PoC fails under most normal conditions: https://github.com/ADScanPro/CVE-2026-41089-LongLogon

2026-06-04 14:42:17 CEST

- reply

This writeup *seems* to make sense, were it not for the magic two letters in the TLD: https://aretiq.ai/research/vul260513-cve-2026-41089-microsoft-windows-netlogon-buildsamlogonresponse-stack-based-buffer-overflow-rce/

2026-06-04 14:38:48 CEST

- reply

https://chaos.social/@christopherkunz/116676523296824499
#note1ave…h92z

2026-06-04 06:18:11 CEST

- reply

https://github.com/0xABCD01/CVE-2026-41089/blob/main/poc.py#L234

2026-06-01 20:53:41 CEST

So CVE-2026-41089 (CVSS 9.8) in Windows Netlogon can be triggered by sending a username that is AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA or longer.
How original.

2026-05-27 17:39:55 CEST

- reply

So what's the suggestion? Instead of full disclosure + poc, let MS bury the vulns? I'm not really following.

2026-05-27 15:05:17 CEST

- reply

Uh, not that it matters much if it's 1% or more, but the 14 CVE IDs on the dashboard are the _disclosed_ CVEs, there are more. Quote: "The records below are publicly available. The remainder are reserved, pending publication by the assigning authority."

2026-05-26 09:05:03 CEST

- reply

Und wenn man dann noch Tolkien zitiert, kann man eigentlich nichts mehr falsch machen.

2026-05-20 19:49:10 CEST

- reply

https://assets.chaos.social/media_attachments/files/116/608/161/648/949/411/original/150f098838bd8a2a.mp4

2026-05-20 19:25:52 CEST

- reply

WTF is Cisco Secure Workload? Apart from, obviously, an oymoron?

2026-05-18 15:30:54 CEST

- reply

I also lowkey like how Crowdstrike goes from "data theft and exto..." to "Contact sales".
https://assets.chaos.social/media_attachments/files/116/595/820/397/626/474/original/05a29b161694cdd1.png

2026-05-18 15:28:25 CEST

- reply

I like "GRACEFUL SPIDER". I think this might be their logo.
Wait, that looks way too familiar.
https://assets.chaos.social/media_attachments/files/116/595/811/734/782/266/original/6abccc2ac823982a.png

2026-05-15 08:31:31 CEST

Oh well. ssh-keysign-pwn seems to be _not_ copyfail class, but a six year old unfixed vuln in many distro kernels. This is a freshly installed VM with Ubuntu 24.04.4, latest patch level, 6.8.0-111-generic kernel.
I'm not even redacting the privkey because the VM is dead already as I write this.
https://assets.chaos.social/media_attachments/files/116/577/184/033/185/765/original/47f98ee1f4b4ba15.png

2026-05-14 18:08:54 CEST

- reply

And then, there's this gem. Google ads for ddos.su and Cloudflare, chilling on the result page for "best stresser tool". ddos.su has been advertising on Google for over a year. I have reported the ads but have not heard back yet.
Of course, ddos.su is behind CF. So I reported ddos.su to Cloudflare who just said "yeah that's no longer on our network". My bad, but www.ddos.su is.
https://assets.chaos.social/media_attachments/files/116/573/782/902/159/850/original/9f9c437ca7065469.png

2026-05-14 17:58:38 CEST

- reply

A fresh VM with all updates and the latest definitions?

2026-05-13 15:57:50 CEST

@npub1z3m…zn2f Time to add Fragnesia to vulnerability.garden? https://www.wiz.io/blog/fragnesia-linux-kernel-local-privilege-escalation-via-esp-in-tcp
Or are we just giving this vuln class a blanket name like "the copyfail zoo"?

2026-05-12 17:15:49 CEST

- reply

Huh, that's odd. Works fine for me. Same definitions version.
https://assets.chaos.social/media_attachments/files/116/562/259/860/271/917/original/6f7da661bb4a5b9a.png

2026-05-11 08:23:51 CEST

May 11, 2026: The Red Sun still prevails.
However, I noticed something odd. Either this is purely coincidence, or the exploit has less reliability now (?). On a freshly booted system, it works 100%, but after a couple minutes of runtime, it seems that it doesn't always win the race condition (or it takes longer than the usual ~10 seconds).

2026-04-19 15:39:33 CEST

- reply

Ich weiß nicht, ob wir jetzt jede nischige Bastelsoftware von irgendwelchen EU-Kommissionen besprechen sollten. ;-)
Ich habe in den Quellcode aber auch schon mit einem halben Auge hineingeschielt - weil ich wissen wollte, inwiefern die Android-Version Play Integrity verwendet. Habe aber nichts gefunden und bin für Pointer dankbar.

2026-03-24 08:03:43 CET

- reply

Acht Uhr und ich habe schon keinen Bock mehr.

2026-03-24 08:03:10 CET

> Nachts um drei in den USA
> ICE steht vor der Tür
> Ausländische Freundin und Kind im Hinterhaus versteckt
> Testament unterschrieben
> Burner Phone in Plastikbeutel geschluckt
> Guten Tag, uns wurde ein ausländischer Router gemeldet.

2026-01-09 14:41:16 CET

- reply

The very same. Their last toot is from 2022, while their last Telegram post is from *checks notes* 9:37 today.
I'm not sure why, but being on the Fediverse just doesn't seem to be in the cards for them.

2026-01-09 08:52:27 CET

Sorry, this could not wait until next #diday - I just deactivated my X account. The recent shitshow around Grok creating deepfake thirst traps is just too appalling.
Also, I found out that vxunderground, literally my last reason to keep my X account alive, is now on Telegram, so that's that. Let that sink in: I'd rather be on Telegram than on X at this point.
Anyhow, my account which has been around since sometime in the late 2000s is now gone.
https://assets.chaos.social/media_attachments/files/115/864/052/925/005/006/original/5aa89ec515c42fb9.png

2025-11-13 09:16:13 CET

- reply

It's amazing to me how many of these screen shots are of an open root shell where multiple skids unsuccessfully tried to install a rootkit.

2025-11-13 08:45:24 CET

- reply

I considered myself to be an early adopter of VR, used a Virtuality headset in ~1996, always dreamed of a Forte VFX1, had Oculus DK2, PSVR1, Quest1-3. I gave the whole VR thing so many tries, but it always felt lackluster.
On the Quest, the ecosystem felt neglected pretty much from the get go: Obviously fake app reviews, terrible lobbies in multiplayer, not-so-great update politics, etc. - after Zuckerberg pitched the whole Metaverse idea, I bailed. Incidentally, I sold my Steam 1/2

2025-09-23 10:37:49 CEST

- reply

This media isn't bored but there's just not enough for updated reports. Last I heard was that ENISA claimed ransomware, ShinyHunters got strangely quiet on the record when questioned by @npub17l5…4kr3 so maybe there's something interesting there. For me there's just not enough substance right now to report anything.

2025-09-16 16:12:48 CEST

- reply

Ha, I was faster! ;-) https://www.heise.de/news/Neuer-NPM-Grossangriff-Selbst-vermehrende-Malware-infiziert-Dutzende-Pakete-10651111.html
Very interested in seeing how this one will play out during the night.

2025-06-10 10:53:10 CEST

Soooo... which Lemmy server should one join as a security interested person?

2025-04-02 09:33:38 CEST

- reply

Total radio silence so far, no statement - not even acknowledgement of my request for comment.

2025-03-31 14:05:03 CEST

- reply

Ah right, then there's an extra space in that link on medium. The video id reads "375_G9wAff+o" there. Thanks!

2025-03-31 14:01:27 CEST

- reply

Interesting. There's however an extra space in the Youtube link in this sentence: "The meeting is viewable here and the transcript is "

2025-03-05 13:05:05 CET

I kinda love the edit history on the US DOD's statement about the purported stand-down order.
"There has been no stand-down order whatsoever from that priority, said the official who was granted anonymity to discuss internal decisions." @npub168d…tu7v
https://assets.chaos.social/media_attachments/files/114/109/729/615/373/758/original/d9069a6361ce57de.png

2025-01-23 09:01:09 CET

- reply

As to be expected, that's from the Qu'ran. Sure al-Anbiya, verse 11-12

2025-01-18 13:24:28 CET

- reply

loads of privkeys in the Fortinet leak, from SSH to what appears to be web certs.