Nostr notes by Tim (Wadhwa-)Brown :donor:

Some people will tell you that PQC resilience is a maths issue, ...

2026-07-28T12:02:58Z

Some people will tell you that PQC resilience is a maths issue, but I'm arguing it's a hygiene issue.

RE: https://mastodon.social/@sellathechemist/116992339665635678 ...

2026-07-27T20:15:05Z

RE: https://mastodon.social/@sellathechemist/116992339665635678

It's not really random if it's not from from the location of getrandom(), instead it's just sparkling CPU state data...

quoting
note1nsl…u9v4

Message for the day – Commit a random act of maintenance!

Listen to it, look at it, wipe it, clean it, lube it, brush it, tighten it, grease it, turn it, check it, test it, sweep it, mop it, paint it, tape it, sand it, tweak it, tune it, adjust it, wash it, oil it, dust it, align it, scrub it, wind it, fill it, seal it…

There is no better feeling than a Friday thumbs up on a ...

2026-07-24T16:10:37Z

There is no better feeling than a Friday thumbs up on a deliverable The next step in securing the waterfall awaits and I can go to the pub with a smile on my face.

Might go bug hunting KDE later for the full 2010'ish ...

2026-07-22T18:50:43Z

In reply to nevent1q…uzw0
_________________________

Might go bug hunting KDE later for the full 2010'ish experience. The big questions:

1) Are IOSlaves still a problem?
2) Is DBUS any better than DCOP?

Also went with KDE which I'd not used since ~3.something and ...

2026-07-22T18:41:15Z

In reply to nevent1q…ysyq
_________________________

Also went with KDE which I'd not used since ~3.something and now Akregator is being loaded with all my "interesting links"...

I'd kinda forgotten what games can be like. but building my ...

2026-07-22T18:35:38Z

I'd kinda forgotten what games can be like. but building my first personal laptop in the last decade or so, I've installed vitetris and the rogue-like angband.

Be interesting to see how I get on with this, just discovered ...

2026-07-21T22:07:37Z

Be interesting to see how I get on with this, just discovered Tokodon (npub1zts…4g7j)...

@npub1yak…d8rp If I buy all the spare parts from the online ...

2026-07-19T12:42:10Z

EMF Badge (npub1yak…d8rp) If I buy all the spare parts from the online store and the new 2026 bits (both already done), do I need the 2024 green front board or will it work without? If I do, do you have any spares on site?

Asking as I gave my 2024 badge to someone who missed out and I'm trying to bootstrap a replacement from the spare parts...

Could do with some saying you are number X in the queue. That ...

2026-07-19T08:24:53Z

In reply to nevent1q…g4ka
_________________________

Could do with some saying you are number X in the queue. That would be very #emfcamp :bloblaugh:..

Found a wristband, so if you could all check the whereabouts of ...

2026-07-19T07:54:28Z

Found a wristband, so if you could all check the whereabouts of yours before I have to involve orga, EMF info and help (npub1x0e…yc6u), lost property and site security...

#emfcamp, #emfcamp2026

Traffic jam at EMF border. #emfcamp

2026-07-16T09:59:21Z

Traffic jam at EMF border.

#emfcamp

A little bit on machine-id from a friend: ...

2026-07-13T17:47:12Z

A little bit on machine-id from a friend:

https://ransomware.sh/posts/machine-id/

#linux, #blueteam

Super keen to launch my laptops into the sun right now. Mac ...

2026-07-12T08:49:36Z

Super keen to launch my laptops into the sun right now.

Mac laptop doesn't recognise wifi interface after an upgrade, Ubuntu is bitching about my partitioning due to a GRUB issue after a dist-upgrade and my old Surface needs flattening after I migrated to a new one. The only laptops in a working state are the corporate Linux and corporate Surface.

That time of the week, where I go through all the crazy ideas on ...

2026-07-11T10:58:05Z

That time of the week, where I go through all the crazy ideas on the timeline proposed for #emfcamp to pick out the scavenger hunt challenges for Electromagnetic Field CTF Team (npub1t23…k3r5).

Interesting Git repos of the week: Strategy: * ...

2026-07-11T09:40:43Z

Interesting Git repos of the week:

Strategy:

* https://github.com/connectans/awesome-CISSP-CCSP - so you want to CIISP?

Bugs:

* https://github.com/dinosn/apache-activemq-rce-research - queue jumping
* https://github.com/hacefresko/CVE-2021-4045 - popping the TP-Link Tapo
* https://github.com/jarnovandenbrink/CVE-2026-26128 - what KRB5 identity do you see in the mirror?

Exploitation:

* https://github.com/apify/fingerprint-suite - mess with your fingerprints 🤖
* https://github.com/apisec-inc/AI-Surface - map the AI attack surface 🤖
* https://github.com/doyensec/maSSO - Doyensec (npub12c3…ulke)'s hostile IdP

Hard hacks:

* https://github.com/nervous-inhuman/tplink-tapo-c200-re - reverse engineering a TP-Link camera

#security, #research, #code

Pointed this out before but UNIX sockets are an untapped LPE ...

2026-07-05T17:11:45Z

Pointed this out before but UNIX sockets are an untapped LPE opportunity:

https://syntetisk.tech/blog/posts/privilege-escalation-to-root-in-lima-qemu-guests-via-a-world-writable-agent-socket-cve-2026-53657/

Interesting links of the week: Strategy: * ...

2026-07-04T11:42:05Z

Interesting links of the week:

Strategy:

* https://ecs-org.eu/policy/nis2-directive-transposition-tracker/ - following along at home with NIS2 enactment
* https://mr-r3b00t.github.io/org_cyber_attack_sim/ - what does it really feel life to defend, [@UK_Daniel_Card](https://infosec.exchange/@UK_Daniel_Card ) has built a sim to find out

Standards:

* https://www.w3.org/TR/security-disclosure/ - World Wide Web Consortium (npub1tl7…6j09) weighs in on disclosure

Threats:

* https://anuragbhatia.com/post/2026/06/telegram-bgp-hijack-and-blackholing/ - some reporting on a BGP hijack of Telegram

Detection:

* https://www.huntress.com/blog/ldap-active-directory-detection-part-six - more from Huntress (npub1fe0…30s6) on LDAP detection
* https://tradecraftgarden.org/ - from the people that brought you Cobalt Strike
* https://nesbitt.io/2026/06/26/incident-report-cve-2026-lgtm.html - incident satire from Andrew Nesbitt (npub1m49…yl0h)
* https://blog.sentry.security/log-curation-101/ - a subject after my own heart, useful logs...
* https://www.deathcon.wales/ - here be dragons

Bugs:

* https://askar.so/blogs/chaining-isc-dhcp-server-features-for-unauthenticated-root-remote-code-execution/ - poppin' DHCP
* https://pop.argus-systems.ai/advisory/adv-040.html - OpenBSD is too open 🤖

Data:

* https://intheweights.com/ - which models are you in? 🤖

Nerd:

* https://fediverse.info/explore/people - people of the Fediverse
* https://fedidb.com/welcome - find your perfect Fediverse platform

#security, #research

What's the best bit of post-exploitation? #redteam, #blueteam

2026-07-04T05:12:53Z

What's the best bit of post-exploitation?

#redteam, #blueteam

Just logged on to my new Surface with a Sun USB keyboard from ...

2026-06-30T21:48:59Z

Just logged on to my new Surface with a Sun USB keyboard from almost 2 decades back. Eat that Bill.

Regretting not fixing the mower earlier in the season, the garden ...

2026-06-28T20:58:13Z

Regretting not fixing the mower earlier in the season, the garden was one big thistle patch.

"Who do I file bugs with?" enquired the ghost. "That ...

2026-06-28T00:48:21Z

"Who do I file bugs with?" enquired the ghost. "That one down there is faulty", they continued, pointing at a politician on the earth below.

#microfiction

I've never done an "interesting links" from ...

2026-06-27T19:42:08Z

I've never done an "interesting links" from Electromagnetic Field (npub1fak…rg6c), it could be a big one...

RE: https://infosec.exchange/@timb_machine/116195097544770832 ...

2026-06-27T12:22:20Z

RE: https://infosec.exchange/@timb_machine/116195097544770832

Pro-tip: You can still be supportive of gay, bi, lesbian, non-binary, trans, queer folks etc tomorrow, next month, next year etc. Don't limit yourself to just treating them decently for one month!
nostr:note153ea4t3sg7vh6cjkcxja3qz6nlyyj8q92hpz2mdhrvyy5xss04cqqsj0jq

Hydration thought. I have a new snark WRT to AI... ...

2026-06-27T11:32:12Z

Hydration thought. I have a new snark WRT to AI... "you're like the backend of a millipede"

The thing I like about AI this week is all these folks showing ...

2026-06-27T07:38:45Z

In reply to nevent1q…9h80
_________________________

The thing I like about AI this week is all these folks showing up, prattling on about agentic AI identity like it's a new thing and that most agent based solutions aren't really just the web service model done really insecurely.

++ Buy your dog a wet coat, cold mat, take it out pre-8am, give ...

2026-06-26T14:38:28Z

In reply to nevent1q…ak5h
_________________________

++

Buy your dog a wet coat, cold mat, take it out pre-8am, give them a shaded corner of the home etc. Also, find out if your dog like ice cubes and frozen treats.

Above all, don't make them suffer for your ignorance.

This goes as much for #uk as it does from our friends across the river on the mainland.

#dogsofmastodon, #dogops

Tim's first law of thermodynamics: Hot weather makes people ...

2026-06-25T18:16:04Z

Tim's first law of thermodynamics: Hot weather makes people drive like dicks.

RE: https://bots.robots.rodeo/@scream/116803800090167176 Illegal ...

2026-06-24T07:40:38Z

RE: https://bots.robots.rodeo/@scream/116803800090167176

Illegal instruction: 4

quoting
note1l68…rhx7

AAAAAAAAAAAAAAAAAAAAHHHHHHHHHHHHH

Not one, but two presentations on building better detections for ...

2026-06-23T17:55:34Z

In reply to nevent1q…2kre
_________________________

Not one, but two presentations on building better detections for service providers:

* https://github.com/CiscoCXSecurity/presentations/blob/master/Telecoms%20Threat%20Landscape%20-%20Mapping%20reality%20to%20frameworks.pdf
* https://github.com/CiscoCXSecurity/presentations/blob/master/Practical%20Threat%20Detections%20for%20Telecommunications%20-%20Strategic%20defense%20insights%20from%20the%20wider%20world.pdf

#threatintel, #detection, #engineering, #blueteam, #soc, #telco

Keir Starmer, so dull, he couldn't even deliver an inspiring ...

2026-06-23T06:20:06Z

Keir Starmer, so dull, he couldn't even deliver an inspiring resignation speech when for once, people were actually excited to hear from him.

Interesting links of the week: Strategy: * ...

2026-06-20T14:11:56Z

Interesting links of the week:

Strategy:

* https://www.gov.uk/government/news/social-media-to-be-banned-for-under-16s-in-landmark-government-move-to-givekids-their-childhood-back - and then the arguments started...
* https://cyberdefensereview.army.mil/CDR-Content/Articles/Article-View/Article/4494769/playing-the-future-insights-from-wargaming-cyber-conflict/ - insights from wargaming, or how to dress up as .mil, .ir, .il, cn or .ru*
* https://www.gov.uk/government/publications/draft-revised-telecommunications-security-code-of-practice-2026/draft-revised-telecommunications-security-code-of-practice - the UK TSA gets an update

Threats:

* https://sandflysecurity.com/blog/how-linux-malware-works-from-simple-to-sophisticated - a lovely write up on Linux malware maturity
* http://miod.online.fr/software/openbsd/stories/trojan.html - that time OpenBSD got popped
* https://www.sygnia.co/blog/operation-highland-velvet-ant/ - watch out for 🐜 people
* https://www.ibm.com/think/x-force/interlock-and-rhysida-within-the-ransonware-ecosystem - IBM with some ransomware gossip

Bugs:

* https://pruva.dev/ - automated bug reproduction 🤖
* https://labs.watchtowr.com/marking-your-own-homework-check-point-remote-access-vpn-ikev1-authentication-bypass-cve-2026-50751/ - [@index](https://labs.watchtowr.com/ )'s latest fun and games
* https://bumsrake.de/ - another sloppy bug in FreeBSD 🤖

Exploitation:

* https://pretalx.ripe.net/media/ripe-92/submissions/YHQY7N/resources/Manipulating_RPKI___1zypS0J.pdf - [@sash](https://hachyderm.io/@sash ) talks XSS attacks on RPKI
* https://blog.ikaes.de/getting-the-pid-from-random-numbers/ - PHP is so very predictable

Hardening:

* https://trustedsec.com/blog/hardening-intune-the-implementation-guide - trustedsec (npub1jfz…m99l) discuss hardening Intune
* https://documentation.nokia.com/nsp/25-8/NSP_Security_Hardening_Guide/NSP_Security_Hardening_Guide_Issue_1.pdf - if you've ever wanted to harden a Nokia network

* not complete list of malicious TLDs :/

#security, #research

Interesting Git repos of the week: Strategy: * ...

2026-06-20T13:49:36Z

$snoopcon ++; # The yearly trip to Birmingham has concluded. Many ...

2026-06-19T18:34:01Z

$snoopcon ++; # The yearly trip to Birmingham has concluded. Many thanks to those friends who helped organise the event

Until you walk in the woods every day, you don't realise how ...

2026-06-16T16:23:52Z

Until you walk in the woods every day, you don't realise how many trees suffer systemic failure every year...

Trying to talk a customer out of buying firewalls for their MPLS ...

2026-06-16T11:07:11Z

Trying to talk a customer out of buying firewalls for their MPLS transport network. They'd do better to invest the time in hardening, monitoring but apparently that's too hard.

It's kinda interesting to see who ended up here and who ended ...

2026-06-14T21:17:54Z

It's kinda interesting to see who ended up here and who ended up on BSky. Too bad.

What parts of #detection #engineering do people find difficult? ...

2026-06-14T19:28:54Z

What parts of #detection #engineering do people find difficult?

#blueteam

Good $arbitrarydeity, people bragging about having "used ...

2026-06-14T05:59:40Z

Good $arbitrarydeity, people bragging about having "used Mythos" like it's a badge of honour.

It's disappointing that ...

2026-06-13T12:26:17Z

It's disappointing that https://www.sygnia.co/blog/operation-highland-velvet-ant/ mentions RPATH but then doesn't provide any details. I'm just left wondering if you could exploit their backdoors...

Interesting Git repos of the week: Detection: * ...

2026-06-13T08:52:11Z

Splunk sadness courtesy of [@index](https://labs.watchtowr.com/ ...

2026-06-12T21:23:39Z

Splunk sadness courtesy of [@index](https://labs.watchtowr.com/ ):

https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/

#threatintel, #splunk

There is an irony that despite my offensive background, the only ...

2026-06-09T19:55:36Z

There is an irony that despite my offensive background, the only cyber security discipline I don't hold current certs for is offense.

#purpleteam

Fan thought: Can't imagine many states going for it, but a ...

2026-05-25T13:48:15Z

Fan thought: Can't imagine many states going for it, but a tax on war might be interesting...

Excellent DR exercise last week after the DC caught fire. Now, I ...

2026-05-16T07:18:20Z

Excellent DR exercise last week after the DC caught fire. Now, I do parallel backups so wasn't directly caught out but it turns out the corporate backup solution doesn't notify on failure. This seems a gap.

Gotta love IT. copy.fail directions that use perl and curl to ...

2026-05-14T22:46:34Z

Gotta love IT. copy.fail directions that use perl and curl to apply patches. Not only elite UNIX knowledge but the patching command rhymes. We must curl the perl.

Did some adulting today. Took my parents-in-law into central ...

2026-05-14T17:41:25Z

Did some adulting today. Took my parents-in-law into central London for an eye hospital appointment. Same one my dad used to go to. Tired.

Today in Tim meets old colleagues in random places, bumped into ...

2026-05-13T22:28:44Z

Today in Tim meets old colleagues in random places, bumped into one of our old red team and an old Portcullis customer at the ATT&CK event.

Off to @npub1h8w…vyt6 MASIG.

2026-05-13T09:47:07Z

Off to MITRE ATT&CK (npub1h8w…vyt6) MASIG.

I wonder how many offensive folks have done IR for ILOVEYOU, ...

2026-05-12T17:43:17Z

I wonder how many offensive folks have done IR for ILOVEYOU, SFPs, an MPLs infrastructure, a mainframe, an entire bank and busses amongst other things.

#purpleteam

For all the AI hype, I'm absolutely fascinated to see more ...

2026-05-10T21:12:58Z

For all the AI hype, I'm absolutely fascinated to see more bug content that focusses on the mass of internal, commercial, compiled code that runs businesses. Most of the disclosures thus far appear to be for open source, where we should assume the models know the code, have seen the bug reports and have access to the patches but that's really not the reality of "interesting" enterprise software.

Interesting links of the week: Strategy: * ...

2026-05-10T14:49:04Z

Interesting links of the week:

Strategy:

* https://cset.georgetown.edu/article/chinas-pla-challenges-and-competitions/ - analysing .cn PLA strategy
* https://ccdcoe.org/news/2026/locked-shields-2026-united-the-power-of-41-nations-to-defend-cyberspace/ - Locked Shield 2026 reporting
* https://www.homeaffairs.gov.au/about-us/our-portfolios/cyber-security/cyber-incident-review-board - post-incident review is necessary, ya galah
* https://dukesecurity.ai/incidents - SEC disclosed incidents
* https://www.theguardian.com/world/2026/may/07/revealed-russia-top-secret-spy-school-hacking-western-electoral-interference - how .ru trains their spies on fiddling with elections
* https://arxiv.org/abs/2509.00462 - AI, stealing all the jobs
* https://arxiv.org/abs/2604.01637 - but first they need job specs
* https://www.ncsc.gov.uk/guidance/guidance-on-digital-forensics-protective-monitoring - NCSC guidance on DFIR and protective monitoring
* https://blog.mozilla.org/en/privacy-security/ai-security-zero-day-vulnerabilities/ - thought piece from Mozilla on Mythos
* https://www.aisi.gov.uk/blog/our-evaluation-of-openais-gpt-5-5-cyber-capabilities - UK AI Security Institute review of GPT 5.5
* https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/ - behind the Mythos curtain with Mozilla
* https://uktl.org.uk/news-events/uktl-ncsc-and-ericsson-strengthen-the-security-of-uk-mobile-networks/ - improving UK telco security

Threats:

* https://www.trendmicro.com/en_us/research/26/d/inside-shadow-earth-053.html - Trend write up on .cn attacks in Asia
* https://www.rtl-sdr.com/student-arrested-in-taiwan-for-using-sdr-and-handheld-radios-to-halt-four-high-speed-trains-with-tetra-hack/comment-page-221/ - TETRA abuse in the wild
* https://home.s2grupo.es/hubfs/Informe%20LAB52-%20EasterBunny_Complete.pdf - new reporting on APT29
* https://i.blackhat.com/Asia-26/Presentations/AS26-Ishimaru-Tropic-Trooper-Reloaded-REV01.pdf - reporting on Tropic Trooper from BlackHat Asia 2026
* https://www.catonetworks.com/blog/global-campaign-discovered-with-modbus-plcs-targeted/ - attacks on CNI intensify

Detection:

* https://righteousit.com/2026/03/27/linux-forensic-scenario/ - [@hal_pomeranz](https://infosec.exchange/@hal_pomeranz )'s Linux investigation (there are a number of follow on posts)

Bugs:

* https://retr0.zip/blog/cve-2026-31431-copy-fail.html - more on copy.fail
* https://seclists.org/oss-sec/2026/q2/332 - winning a race with Rust
* https://aisle.com/blog/aisle-discovers-cve-2026-42511-a-21-year-old-freebsd-remote-command-execution-vulnerability#the-vulnerability - more on the FreeBSD dhclient whoopsie
* https://copy.golf/ - copy.fail.golf
* https://visit.suspect.network/reversing-adventures/inadvertent-injections - accidentally injecting shells

Exploitation:

* https://fuzzinglabs.com/exploring-nvidia-linux-drivers-internals-basics-ioctls/ - exploring NVIDIA's LKM attack surface
* https://www.blackhillsinfosec.com/the-p-in-pam-is-for-persistence-linux-persistence-technique/ - Black Hills Infosec (npub1hrj…mtaz) discuss persisting in PAM
* https://www.group-ib.com/blog/pluggable-authentication-module/ - why PAM matters
* https://blog.trailofbits.com/2026/05/05/c/c-checklist-challenges-solved/ - solutions to Trail of Bits (npub1rcs…7sw8)'s C challenges
* https://ipurple.team/2026/05/04/cross-session-activation/ - cross session lateral moment in Windows with netbiosX (npub14pv…scte)
* https://heyitsas.im/posts/drinking-llms/ - bug hunting the Linux kernel with LLMs
* https://www.incendium.rocks/posts/Fuzzing-MS-RPC-structures-and-monitoring/ - fuzzing Microsoft RPC

Hard hacks:

* https://labs.taszk.io/articles/post/tapocalypse/ - TP-Link whoppers
* https://tantosec.com/blog/2026/04/route-to-root-in-4g-industrial-router/ - hacking a 4G router

Hardening:

* https://jan.wildeboer.net/2026/05/PSA-CopyFail-CVE-2026-31431/ - Jan Wildeboer 😷:krulorange: (npub1m7m…2e7k)'s approach to beating copy.fail
* https://www.secwest.net/copyfail-mitigation - more on copy.fail mitigations with

Nerd:

* https://tekin.co.uk/2025/09/the-ruby-community-has-a-dhh-problem - be mindful of who you mix with
* https://di.day/en - declare your independence

#security, #research

Interesting Git repos of the week: Strategy: * ...

2026-05-10T13:42:53Z

Nostr event nevent1qqsy6xnuwga5j9tnzsgfn8hhmxzky3s83tglprrzvjmfcgud6lrm3dqzyp89hh2eeyfuw9sm48ywmmhuzg89aarr9aqg7v44xegfkkeyup2dz5yyusz

2026-05-09T19:25:01Z

Citations are nice. Thank you anon.

Long old week but 5 happy customers, two commuting to renewals ...

2026-05-07T19:41:52Z

Long old week but 5 happy customers, two commuting to renewals makes it all worthwhile. I shall sleep well tonight.

Provided genuine and nuanced feedback on AI slop on AI slop. ...

2026-05-06T19:15:19Z

Provided genuine and nuanced feedback on AI slop on AI slop. Comments all deleted and article published. That'll teach me to spend time making suggestions to improve an article.

Sidebar: Please don't get your pet to paraphrase me and then ...

2026-05-06T16:18:22Z

In reply to nevent1q…ynqp
_________________________

Sidebar: Please don't get your pet to paraphrase me and then attribute the work to me.

Stumbled into a channel where everyone is replacing themselves ...

2026-05-06T16:17:32Z

Stumbled into a channel where everyone is replacing themselves with their AI pets and well, if you're the kind that needs an agent to do anything then no wonder you're having trouble installing an agent...

The statement "lies, lies and statistics" could have been ...

2026-05-05T12:42:57Z

The statement "lies, lies and statistics" could have been written by an AI, and now thanks to LLM, it will be.

Congratulations to Canonical on poor life choices: ...

2026-05-04T18:55:00Z

Congratulations to Canonical on poor life choices:

https://seclists.org/oss-sec/2026/q2/332

#threatintel, #non-GNUcoreutils

A little contribution: ...

2026-05-04T12:04:37Z

In reply to nevent1q…hg3u
_________________________

A little contribution: https://github.com/timb-machine/presentations/blob/main/A%20rising%20tide%20lifts%20all%20ships%20-%20Cyber%20security%20culture%2C%20competence%20and%20community.pdf

Got bored so started submitting rules to @npub1582…zvg8' ...

2026-05-04T11:07:10Z

Got bored so started submitting rules to Florian Roth (npub1582…zvg8)' auditd ruleset...

Tea.

2026-05-03T07:04:10Z

In reply to nevent1q…r8x0
_________________________

Tea.

Nostr event nevent1qqsxwh8syz7x3rznps5g0w2rm8fwq2jxwd79m89sytmnrd07tqfwx0gzyp89hh2eeyfuw9sm48ywmmhuzg89aarr9aqg7v44xegfkkeyup2dzu7jfhn

2026-05-03T06:38:57Z

Toast.

Interesting links of the week: Strategy: * ...

2026-05-02T21:48:47Z

Interesting links of the week:

Strategy:

* https://www.kpmgcri.com/insights/calculating-the-impact-of-a-cyber-attack-on-critical-infrastructure - KPMG discuss how to calculate the cost of CNI impact
* https://shkspr.mobi/blog/2026/05/nhs-goes-to-war-against-open-source/ - Terence Eden (npub1x59…gect) discusses the -ve impact of LLMs on NHS open source strategy
* https://www.kcl.ac.uk/building-nhs-resilience-to-ransomware-1 - a study in national health resilience, not to disease but ransomware
* https://www.rusi.org/explore-our-research/publications/cyber-effects-perspectives/cyber-exercises-and-capture-flag-competitions-uk-policy-tools - with all this ransomware, why cyber exercises are still helpful
* https://insinuator.net/2026/04/when-paradigms-are-shifting-infosec-in-the-age-of-ai/ - Insinuator (npub1x7q…f3q0) in the days of LLM
* https://www.provos.org/p/finding-zero-days-with-any-model/ - Niels Provos (npub1mc0…w5tc) chips in on whether it's the models or the automation
* https://www.technologyreview.com/2026/04/27/1136322/rebuilding-the-data-stack-for-ai/ - MIT Technology Review gives a take on how to rearchitect for AI

Standards:

* https://www.rfc-editor.org/rfc/rfc3631.html - Internet-facing security controls

Threats:

* https://medium.com/mitre-attack/attack-v19-ff329cb65d66 - ATT&CK v19 is out
* https://www.darktrace.com/blog/inside-zionsiphon-darktraces-analysis-of-ot-malware-targeting-israeli-water-systems - an attack on the .il water system?
* https://www.sentinelone.com/labs/fast16-mystery-shadowbrokers-reference-reveals-high-precision-software-sabotage-5-years-before-stuxnet/ - SentinelOne discuss the pre-stuxnet years
* https://mp.weixin.qq.com/s/nJpqvXCYV3ZdvNgYGrG4ow - .cn reporting on Sandworm
* https://blog.talosintelligence.com/uat-4356-firestarter/ - Cisco Talos (npub1xkd…cc62) report on FIRESTARTER
* https://www.cisa.gov/sites/default/files/2026-04/AR26-113A_MAR_FIRESTARTER_backdoor.pdf - joint NCSC/CISA write up on FIRESTARTER
* https://citizenlab.ca/research/uncovering-global-telecom-exploitation-by-covert-surveillance-actors/ - The Citizen Lab (npub12h8…ac3t) discuss global telecom breaches
* https://infrawatch.com/blog/inside-the-mobile-farm-the-oem-stack-powering-us-4g-5g-proxy-networks - SIM farms and how they work
* https://github.com/search?q=knock_functions.sh&type=code - this is fine...

Detection:

* https://x.com/westonlwalker/status/2049931249180119321 - auditd rules for copy.fail
* https://scythe.io/scythe-labs/what-your-rdp-sessions-leave-behind - exploring RDP's stains
* https://www.ncsc.gov.uk/blogs/could-your-choice-of-metrics-be-harming-your-soc - NCSC discuss useful KPIs for a SOC
* https://www.slideshare.net/slideshow/first-cti-2026-evaluating-threat-intelligence-through-velocity/287191850 - Joe Słowik (npub1am5…d84n) discusses threat intel speed in defence
* https://extsentry.github.io/#dashboard - can you and should you trust browser agents

Bugs:

* https://copy.fail/ - reliable LPE for many Linux releases
* https://xint.io/blog/copy-fail-linux-distributions - blog post with the copy.fail details
* https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854 - Wiz found a nice parameter pollution bug in GitHub
* https://shittrix.moksha.dk/ - much Citrix sadness
* https://www.freebsd.org/security/advisories/FreeBSD-SA-26:12.dhclient.asc - dhclient oopsie in FreeBSD
* https://www.freebsd.org/security/advisories/FreeBSD-SA-26:13.exec.asc - poisoning FreeBSD's argv[][] for LPE oopsie
* https://blog.calif.io/p/mad-bugs-even-cat-readmetxt-is-not - abusing a pty for fun and oopsies
* https://github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html - more fun Linux whoopses

Exploitation:

* https://windows-internals.com/goodbye-secure-pool-hello-kdp-pool/ - changes afoot in Windows kernel land from [@yarden_shafir](https://infosec.exchange/@yarden_shafir )
* https://securelist.com/phantomrpc-rpc-vulnerability/119428/ - Kaspersky (npub1ger…6hxz), on new ways to beat a dead horse
* https://ghostbyt3.github.io/blog/nday-research-ai - hunting for n-days
* https://blog.zsec.uk/bullyingllms/ - [@zephrfish](https://bladerunner.social/@zephrfish ) talks through his approach to abusing LLMs
* https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/ - more rotten apples, this time from Cisco Talos (npub1xkd…cc62)

Hardening:

* https://alexreed.srht.site/blog/agent-security-audit.html - Alex Reed (npub1w8v…ympw) looks at how to audit and harden your agent

Nerd:

* https://prism-break.org/en/all/ - escaping the US-led ecosystem

#security, #research

Interesting Git repos of the week: Detection: * ...

2026-05-02T18:56:49Z

Unauthorised maths. ...

2026-05-02T16:47:46Z

Unauthorised maths.

"We're all doomed. GlassWing can read source code and ...

2026-05-01T18:18:46Z

"We're all doomed. GlassWing can read source code and find vulnerabilities."

If the adversary has access to the source code, then they already somewhat could. They will still have to sort the wheat from the chaff no matter if they're using grep or some new super intelligence because not every bug ends up being exploitable. Also, how many controls have they subverted to get there...

"One of the things that upsets me about AI is that it ...

2026-05-01T18:15:17Z

"One of the things that upsets me about AI is that it doesn't think. It just keeps pushing existing ideas."

Yeh, no shit sherlock.

Copy fail is vibe-arg'ing at its finest... https://copy.fail/ ...

2026-04-30T19:58:22Z

Copy fail is vibe-arg'ing at its finest...

https://copy.fail/

#threatintel, #linux

Given that BlueSky 302's <username>.bsky.social to the ...

2026-04-29T09:43:27Z

Given that BlueSky 302's <username>.bsky.social to the user's profile with content that they control, I wonder what they do to filter username against reserved DNS subdomains...

I might rewrite the logic at some point, kinda feels like the ...

2026-04-29T08:15:35Z

In reply to nevent1q…m0kd
_________________________

I might rewrite the logic at some point, kinda feels like the data model has changed sufficiently that my parsing logic might need some love.

Running threat-crank to update ...

2026-04-29T08:13:48Z

Running threat-crank to update https://github.com/timb-machine/attack-ti with v19 data.

#threatmodelling

This is with respect to "traceroute 2.1.2 - MPLS Extension ...

2026-04-29T07:35:01Z

In reply to nevent1q…xh2c
_________________________

This is with respect to "traceroute 2.1.2 - MPLS Extension Out-of-Bounds Read". Feels sloppily written...

Today in CVSS questions: CVSS v3.1 Score: 5.9 (Medium) — ...

2026-04-29T07:22:13Z

Today in CVSS questions:

CVSS v3.1 Score: 5.9 (Medium) — AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector: Network (on-path / rogue router)

Do you mean AV:A?

@npub1ysw…uzpe has just given me bad dreams, uttering ...

2026-04-28T23:11:37Z

lcamtuf :verified: :verified: :verified: (npub1ysw…uzpe) has just given me bad dreams, uttering "systemd-openclawd"...

*shudder*

Full write up here: ...

2026-04-28T19:43:22Z

In reply to nevent1q…amqf
_________________________

Full write up here: https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

Fun with Citrix: https://shittrix.moksha.dk/ #threatintel, ...

2026-04-28T19:42:26Z

Fun with Citrix:

https://shittrix.moksha.dk/

#threatintel, #citrix

We welcome ATT&CK v19: ...

2026-04-28T19:01:17Z

We welcome ATT&CK v19:

https://attack.mitre.org/resources/updates/updates-april-2026/

Blog post here:

https://medium.com/mitre-attack/attack-v19-ff329cb65d66

#redteam, #blueteam, #threatintel, #att&ck

Hard ouch: https://x.com/sagitz_/status/2049153195243372569 ...

2026-04-28T18:54:13Z

Hard ouch:

https://x.com/sagitz_/status/2049153195243372569

#threatintel, #github

I do wish Reform would stop posting their recycling through my ...

2026-04-28T18:43:13Z

I do wish Reform would stop posting their recycling through my letter box.

Discuss: x isn't a security boundary because ... (where x is ...

2026-04-28T14:27:50Z

Discuss: x isn't a security boundary because ... (where x is represented in https://attack.mitre.org/datacomponents/ or other control lists).

Counter point: Anything that changes the profile of the attack surface and presents an opportunity for detection can be considered a security boundary. Some may be more effective than others, some may have bugs, others may be configured badly but they all have some boundary value. The point of a security test is to point out the bugs and misconfigurations.

Just looked at some AI agentic shit being touted for red teaming ...

2026-04-27T13:43:27Z

Just looked at some AI agentic shit being touted for red teaming and I am both terrified by the ROE it has and how it might feel about some of the scenarios real red teams have to deal with and fascinated as to how the skills will fall apart when given upwards of 140000 hosts to target across the globe...

Maybe not you, but some people do want persistent access to ...

2026-04-25T11:11:13Z

Maybe not you, but *some* people do want persistent access to Cisco devices:

* https://blog.talosintelligence.com/uat-4356-firestarter/
* https://www.cisa.gov/sites/default/files/2026-04/AR26-113A_MAR_FIRESTARTER_backdoor.pdf

#threatintel, #cisco

Accidentally leverage a supply chain attack this week when it ...

2026-04-25T11:06:08Z

Accidentally leverage a supply chain attack this week when it turned out that the GitHub org I'd cloned for a cyber exercise was "unofficial" and none of the exercise participants knew who actually owned it although they did recognise the committers. Chaos ensued.

#purpleteam

RE: https://infosec.exchange/@thc/116158209911493617 Somehow I ...

2026-04-25T09:19:46Z

RE: https://infosec.exchange/@thc/116158209911493617

Somehow I missed this dropping but wow, so much history.

quoting
note15pp…aezp

❤️RELEASE: The TEAM-TESO cvs:

https://thc.org/team-teso/

Exploits, advisories, teso-informational (never released), burneye ELF crypter, bscan mass scanner, …plus some rare pictures.

Which 7350 exploit was your favourite?

Enjoy & Keep hacking,

Yours Sincerely,
Team-Teso (via THC’s bsky account).

Interesting Git repos of the week: Bugs: * ...

2026-04-24T12:25:05Z

Interesting links of the week: Standards: * ...

2026-04-23T17:00:11Z

Interesting links of the week:

Standards:

* https://github.com/OWASP/APTS - OWASP Foundation (npub1nfk…dr9f) has a crack at defining autonomous testing standards
* https://cert.pl/en/posts/2026/04/annual-report-2025/ - .pl CERT gives us their annual update
* https://www.ncsc.gov.uk/news/apt28-exploit-routers-to-enable-dns-hijacking-operations - more on that Guardian story from a couple of weeks back about Russian hostmasters working for free
* https://arxiv.org/abs/2603.29545 - exploring how cyber crime's vibe will change
* https://gambit.security/blog-post/a-single-operator-two-ai-platforms-nine-government-agencies-the-full-technical-report - how .mx got popped
* https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a - .ir are planning a silent disco and all of US are invited

Threats:

* https://socket.dev/blog/bitwarden-cli-compromised - careful warden, I see you're managing a password
* https://krebsonsecurity.com/2026/04/germany-doxes-unkn-head-of-ru-ransomware-gangs-revil-gandcrab/ - .de doxes head of REvil
* https://www.ic3.gov/PSA/2026/PSA260407 - .ru completes sticker collection of logos from every major law enforcement agency
* https://www.lumen.com/blog/en-us/frostarmada-forest-blizzard-dns-hijacking - .ru... in your modem, stealing your DNS requests
* https://dti.domaintools.com/research/dprk-malware-modularity-diversity-and-functional-specialization - .kp IT skills continue to develop
* https://pushsecurity.com/blog/device-code-phishing - phishermen continue to catch phish, news at 10

Bugs:

* https://www.jamf.com/blog/darksword-ios-exploit-kit-three-lessons-mobile-security/ - breaking our on Safari
* https://blog.calif.io/p/we-asked-claude-to-audit-sagredos - Claude vs qmail but FFS, it shouldn't have taken that much effort to spot that one
* https://heyitsas.im/posts/cups/ - printing a new 0day

Exploitation:

* https://vulnbench.ghostsecurity.com/ - testing LLM efficacy on the work bench
* https://agentic-threat-modeling.github.io/MAESTRO/ - how to make friends with agents and influence them

Hard hacks:

* https://gpubreach.ca/ - another hammer, another pixel dead...

Hardening:

* https://lore.kernel.org/lkml/20260404133746.80914-1-zybo1000@gmail.com/ - an interesting new kernel driver for Linux

Cryptography:

* https://www.openssh.org/pq.html - #OpenBSD takes a stance on PQC

#security, #research

Please hold. You are number 1 in the torment nexus. There is ...

2026-04-23T16:12:16Z

Please hold. You are number 1 in the torment nexus. There is no-one in front of you and no-one behind. Your call *is* important to us and there is *no* escape. There is no-one to hear your screams. Please hold.

#microfiction

Interesting to read about the hardware differences between ...

2026-04-23T12:58:31Z

Interesting to read about the hardware differences between USB<>fibre and ThunderBolt<>fibre and how they affect the attack surface. Anyway, ordered an SFP adapter that present via ThunderBolt as Intel chips, so that I can play with ethtool a bit more.

Everyone should be 💜: ...

2026-04-22T17:50:17Z

Everyone should be 💜:

https://github.com/Neo23x0/auditd/issues/178 provoked:

"serving up the defense on a silver platter i see 😜" from one of my team... He knows me quite well and was just teasing, but still!

Despite all my ❤️, I built my first SOC on SQL Server... and handled ILOVEYOU...

That's how 💙 I am!

As we enter conference season, if you're a first time, or ...

2026-04-22T07:52:51Z

As we enter conference season, if you're a first time, or less experience speaker:

https://github.com/timb-machine/presentations/blob/main/A%20rising%20tide%20lifts%20all%20ships%20-%20Cyber%20security%20culture%2C%20competence%20and%20community.pdf

#payforwards, #mutualaid

Now that's /some/ shit posting from the TA: ...

2026-04-21T17:23:21Z

Now that's /some/ shit posting from the TA:

https://www.linkedin.com/posts/jamie-williams-108369190_spoofing-as-a-red-team-is-%F0%9D%9A%9D%F0%9D%9A%8E%F0%9D%9A%8C%F0%9D%9A%91%F0%9D%9A%97%F0%9D%9A%92%F0%9D%9A%8C%F0%9D%9A%8A%F0%9D%9A%95%F0%9D%9A%95%F0%9D%9A%A2-share-7452388382078349312-RxLL?utm_source=share&utm_medium=member_desktop&rcm=ACoAAABLaKEBOSsLj2DTcDmlwFtVAzzZ9BjjPwc

(MDSec is one of the UK's own... so a TA pretending to be them... \o/)

#threatintel, #shitposting

Particularly like the "Waiver required for all ...

2026-04-21T12:33:55Z

In reply to nevent1q…n0l9
_________________________

Particularly like the "Waiver required for all participants"... Presumably this means that if someone turns up shooting, it's on individual attendees heads... Bold move, "you might get shot, but that's on you...".

Hmm. Just got invited to Guns & Cyber by virtue of our CREST ...

2026-04-21T12:10:44Z

Hmm. Just got invited to Guns & Cyber by virtue of our CREST membership. I'm sure for some this would be a very welcome invite but not really one for me. Should I follow my personal ethics and make a complaint that I'm not really all that keen on shooting things and ask if they have an alternate event for people who would prefer to help people?

If like me, you're a fan of Kae Tempest's written word: ...

2026-04-20T18:12:14Z

If like me, you're a fan of Kae Tempest's written word:

https://www.theguardian.com/culture/2026/apr/18/kae-tempest-on-creativity-and-his-gender-transition-im-just-glad-to-be-alive

Someone's just listed out "all" the Windows versions ...

2026-04-20T14:51:57Z

Someone's just listed out "all" the Windows versions - with the tag line "which one did you start on" - and I am genuinely sad they forgot Windows 2.

Forget about the intricacies of the DNS spec. This should have ...

2026-04-19T11:10:05Z

Forget about the intricacies of the DNS spec. This should have seemed like a bad life choice in any event. Turning user input into a command line when all you really wanted to do was write a 0 byte file:

sprintf(acfcommand, "/bin/touch %s/control/notlshosts/'%s'",
info->pw_dir, partner_fqdn);
fp = popen(acfcommand, "r");

Regular reminder to myself that whilst I don't always agree ...

2026-04-19T10:55:30Z

Regular reminder to myself that whilst I don't always agree with everything Jericho says, that he makes a lot more sense than he gets credit for.

Interesting links of the week: Strategy: * ...

2026-04-19T10:23:41Z

Interesting links of the week:

Strategy:

* https://www.isc.org/blogs/2026-04-16-How-to-report-a-vulnerability/ - ISC.org (npub1uus…s9sg) makes some useful suggestions on reporting vulnerabilities
* https://sushegaad.github.io/Claude-Skills-Governance-Risk-and-Compliance/ - building a GRC framework with Claude 🤖
* https://jericho.blog/2026/04/17/nvd-gives-up/ - Jericho from Attrition.org (npub1dy2…hp28) gives us the skinny on the NVD updates
* https://www.usenix.org/system/files/login/articles/login_apr15_12_geer.pdf - Dan Geer predicts...
* https://security.googleblog.com/2025/04/google-launches-sec-gemini-v1-new.html - remembering Sec-Gemini v1 hype
* https://init6.com/papers/Day-Zero-Normal-CISO-Brief.pdf - Rob Fuller (npub1ryt…hg6k) comes with another take on AI and LLM
* https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/04/mythosready-20260413.pdf - the Cloud Security Aliance chip in
* https://cje.io/2026/04/08/offense-scales-with-compute-defense-scales-with-committees/ - as does @cje

Detection:

* https://pub.expmon.com/ - Haifei Li's EXPMON
* https://obdev.at/blog/little-snitch-for-linux/ - Little Snitch (npub1lky…0sa8) comes to Linux

Bugs:

* https://x.com/Gi7w0rm/status/2042370775546482815 - more on that spike in Adobe Reader bugs chain
* https://rhisac.org/threat-intelligence/bluehammer-windows-local-privilege-escalation-zero-day-publicly-released/ - moar on Blue Hammer #1
* https://www.cyderes.com/howler-cell/windows-zero-day-bluehammer - moar on Blue Hammer #2
* https://www.coresecurity.com/blog/analysis-bluehammer-lpe-exploiting-windows-defender-updates - moar on Blue Hammer #3

Exploitation:

* https://www.slideshare.net/slideshow/how-i-use-ai-for-penetration-testing-teri-radichel-2nd-sight-lab-3fb8/286987132 - Teri Radichel (npub1sqh…qex8)

Hard hacks:

* https://hackers-arise.com/scada-ics-hacking-and-security-attacking-the-modbus-protocol-with-rofuzz/ - attacking ICS and other OT with rofuzz
* https://medium.com/@theopenshelf/amazon-is-cutting-kindle-store-access-on-pre-2013-kindles-a7b495cb51ee - Amazon has a Kindle problem and how you can help...

Development:

* https://appsec.guide/docs/languages/c-cpp/lang-c-cpp-bug-classes/ - Trail of Bits (npub1rcs…7sw8)'s security coding guidance with bits'n'pieces from @gsuberland
* https://blog.trailofbits.com/2026/04/09/master-c-and-c-with-our-new-testing-handbook-chapter/ - Graham Sutherland / Polynomial (npub1szz…t4fx)'s accompanying blog post
* https://arxiv.org/html/2603.21852v2 - all elementary functions from a single operator

Data:

* https://cardcatalogforlife.substack.com/p/google-has-a-secret-reference-desk - getting more out of GOOG

It's notable how many of the talking heads on AI and LLM are US based or funded *and* how many of them come from a cloud centric generation of businesses...

#security, #research

Anyone seen any good guidance on hardening Nokia 7xxx series ...

2026-04-19T08:49:05Z

Anyone seen any good guidance on hardening Nokia 7xxx series service routers? The common criteria guide is from the old Alcatel days and whilst I'm familiar with them in their older form, wondering if much has changed...