<unnamed>

"Product fails at core competency" should be the takeaway from this. Unfortunaly, CVSS 1.7 will land this very low on anyone's priority list, be it SSVC or that CISA thing.

2026-07-09 14:00:31 UTC

- reply

I should have made a 2026 issue for my insecurity appliance bingo. With another column: "CVSS sandbagging". However, I think they are actually right here, because the flaw only affects subsequent systems. I would have gone for SC:N/SI:H/SA:H though, upping the score to 2.7
This shows again how bad CVSS performs as a threat metric.

2026-07-01 12:50:53 UTC

Die Innenministerkonferenz will Indymedia komplett verbieten.
Weil wir als Gesellschaft derzeit keine drängenderen Extremismus-Probleme haben.
In 85 Seiten der Beschlusssammlung wird kein einziges Mal das Wort "rechtsextrem" erwähnt.
Die haben im wahrsten Sinne des Wortes die Schüsse nicht gehört. https://www.innenministerkonferenz.de/IMK/DE/termine/to-beschluesse/2026-06-19_DOK/Freie_Beschl%C3%BCsse.pdf?__blob=publicationFile&v=1

2026-06-30 12:39:58 UTC

- reply

I mean, why not use GLM 5.2 in the meantime? https://www.provos.org/p/qemu-escape-glm-5-2/

2026-06-23 12:52:54 UTC

- reply

Clearly, that's almost 6/17th of all devices.

2026-06-19 08:51:27 UTC

- reply

Du wolltest sagen: "Wenn du deine Security nach dem samstäglichen Polizeibesuch im März immer noch nicht auf die Reihe gekriegt hast, ..." Common typo, passiert mir auch ständig.
Kontext: https://heise.de/-11221345

2026-06-16 12:52:25 UTC

- reply

Wait, the Zayo, like AS6461 (ex AboveNet) Zayo?

2026-06-11 09:16:26 UTC

- reply

This definitely belongs in the Vulnerability Garden: Bumsrakete is the FreeBSD equivalent of copy.fail.

2026-06-11 09:14:55 UTC

Ich lache darüber mehr, als ich sollte.
Bumsrakete klingt auch einfach cooler als Copyfail.
https://bumsrake.de/

2026-06-10 20:27:29 UTC

- reply

The commit msg... "Up till now every client connection to vSphere had hardcoded behaviour for skipping TLS verification,"
I'm just gonna put it out there: Should we switch to a career in woodworking or blacksmithing? Seems prudent at this point.

2026-06-10 20:24:53 UTC

- reply

Err...?
https://assets.chaos.social/media_attachments/files/116/727/682/720/280/241/original/5ffc1c769a7f09fa.png

2026-06-10 20:09:04 UTC

- reply

I can verify that the exploit still works with that mpengine.dll version and the 1.453.28.0 definition update that got released 6/10/2026 6:29:20 PM. It takes more than one attempt, sometimes up to 6-7 now, where it used to be almost always one shot, but it still works.
I'm waiting for my other VM to fully update and then I'll retry there, too.

2026-06-10 16:55:42 UTC

- reply

snapshots aren't currently working properly for win VMs on my homelab hypervisor and I haven't had time to really look into it. My VM is now on 1.453.27.0.

2026-06-10 16:39:34 UTC

- reply

With the latest definition update and after an sfc /scannow, the modified PoGue still starts, but the EICAR file gets quarantined after the ISO is mounted, and I think the race becomes unwinnable. I can also not see a modification to \system32\wermgr.exe anymore. So I think this might be fixed now?
Maybe even a little more advanced than initial RedSun fix, seeing that they added Trojan:Win64/RoguePlanet.DA!MTB in 1.453.23.0 and Behavior:Win32/SuspDefAbuse in .21.0?

2026-06-10 15:25:27 UTC

- reply

N/A is a status, too. Just sayin'.

2026-06-10 15:18:13 UTC

- reply

1.1.26050.11, I think.
https://assets.chaos.social/media_attachments/files/116/726/476/352/332/154/original/856f4058e62fda58.png

2026-06-10 08:43:42 UTC

- reply

Yup, here we go.
https://assets.chaos.social/media_attachments/files/116/724/925/303/998/565/original/aa47a1aa1e4af7f8.png

2026-06-10 08:20:53 UTC

- reply

My version also works with 1.453.21.0, as far as I can tell. EDIT: Or maybe not as reliably anymore - while it's not quarantined, it currently doesn't seem to win the race anymore (stuck on "MpCleanCallbackFunction called."). But this might have to do with the contaminated state of my test machine (which already has 6 or 7 volume shadow copies for the attacked volume).

2026-06-10 07:50:51 UTC

The simplest of all possible modifications to the original RoguePlanet.cpp (literally interchanging two letters in the source code) defeats the detection and re-enables the exploit in current, fully patched Windows 11 with Definition Update 1.453.20.0 installed.
https://assets.chaos.social/media_attachments/files/116/724/716/653/225/168/original/120c686a318ba84b.png

2026-06-10 07:22:01 UTC

- reply

Sure, take it directly from the horse's mouth: https://deadeclipse666.blogspot.com/2026/05/july-14th.html

2026-06-10 07:19:23 UTC

- reply

CVE-2026-41091 is RedSun.

2026-06-10 06:15:32 UTC

- reply

The June 10 Defender definition update added a detection named "Exploit:Win32/DfndrRugPlnt.BB" which catches the vanilla version of RoguePlanet.exe and prevents its execution. https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes @npub12xh…zxeq

2026-06-09 21:35:19 UTC

Will we wake up to see Windows Defender quarantining wermgr.exe pr the Task Scheduler in an attempt to contain RoguePlanet? Oh, the excitement….

2026-06-09 21:29:55 UTC

- reply

Blatant typo: should be RougePlanet, not RoguePlanet. What with it being a RedSun variant 'n all.

2026-06-09 15:55:19 UTC

- reply

I see your header collection and raise you one "X-Disclaimer: This email was set up by Hornetsecurity GmbH"

2026-06-04 14:50:13 UTC

- reply

Yeahhh.... so that one looks fishy. It seems to be a fork of the earlier one, but added a setup.py which seems to do slightly weird stuff.

2026-06-04 14:33:11 UTC

- reply

Of all the writeups, I think I like this one best, especially with it having a human name in the byline: https://adscanpro.com/blog/patch-diffing-cve-2026-41089-netlogon
"read advisories carefully before deciding how to allocate research time." made me chuckle.

2026-06-04 12:47:09 UTC

- reply

From what I read in the writeup (and the sparse other sources), you need a long enough DNS name on the victim host to trigger the overflow. I think 54 chars or more? This github has a possible explanation why the PoC fails under most normal conditions: https://github.com/ADScanPro/CVE-2026-41089-LongLogon

2026-06-04 12:42:17 UTC

- reply

This writeup *seems* to make sense, were it not for the magic two letters in the TLD: https://aretiq.ai/research/vul260513-cve-2026-41089-microsoft-windows-netlogon-buildsamlogonresponse-stack-based-buffer-overflow-rce/

2026-06-04 12:38:48 UTC

- reply

https://chaos.social/@christopherkunz/116676523296824499
#note1ave…h92z

2026-06-04 04:18:11 UTC

- reply

https://github.com/0xABCD01/CVE-2026-41089/blob/main/poc.py#L234

2026-06-01 19:38:17 UTC

- reply

Nope. It seems like a rather trivial oversight in a rather critical component.
But then again, we live in a world in which you can tell an AI chatbot you want to change someone else's Instagram password... and it will let you. So there's that.

2026-06-01 19:34:17 UTC

- reply

It's a little more complicated (and I have no means to verify the purported PoC, but it looks legit-ish), but apparently you can crash LSASS by sending a CLDAP DC locator ping packet with the username being Ax130 or longer. Code execution seems possible (according to MSRC), but the PoC is just a DoS.

2026-06-01 18:53:41 UTC

So CVE-2026-41089 (CVSS 9.8) in Windows Netlogon can be triggered by sending a username that is AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA or longer.
How original.

2026-05-27 15:39:55 UTC

- reply

So what's the suggestion? Instead of full disclosure + poc, let MS bury the vulns? I'm not really following.

2026-05-27 13:05:17 UTC

- reply

Uh, not that it matters much if it's 1% or more, but the 14 CVE IDs on the dashboard are the _disclosed_ CVEs, there are more. Quote: "The records below are publicly available. The remainder are reserved, pending publication by the assigning authority."

2026-05-26 07:05:03 UTC

- reply

Und wenn man dann noch Tolkien zitiert, kann man eigentlich nichts mehr falsch machen.

2026-05-20 17:49:10 UTC

- reply

https://assets.chaos.social/media_attachments/files/116/608/161/648/949/411/original/150f098838bd8a2a.mp4

2026-05-20 17:25:52 UTC

- reply

WTF is Cisco Secure Workload? Apart from, obviously, an oymoron?

2026-05-20 14:56:58 UTC

- reply

> Act like you've been there before because we all know you have.
*cough* SandboxEscaper *cough*

2026-05-18 13:30:54 UTC

- reply

I also lowkey like how Crowdstrike goes from "data theft and exto..." to "Contact sales".
https://assets.chaos.social/media_attachments/files/116/595/820/397/626/474/original/05a29b161694cdd1.png

2026-05-18 13:28:25 UTC

- reply

I like "GRACEFUL SPIDER". I think this might be their logo.
Wait, that looks way too familiar.
https://assets.chaos.social/media_attachments/files/116/595/811/734/782/266/original/6abccc2ac823982a.png

2026-05-15 08:34:54 UTC

Obligatory ping for @npub1z3m…zn2f ssh-keysign-pwn might belong in vulnerability.garden, I guess. Although it doesn't have a logo yet.
https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn/tree/main

2026-05-15 06:45:57 UTC

- reply

Same result on a freshly installed Debian13 VM. The train wifi is too spotty to manually upgrade the VM to testing or unstable, so someone else will have to test with more bleeding-edge kernels.
If you run a multi-user Linux system, best bet is probably to consider all your SSH private keys compromised.

2026-05-15 06:31:31 UTC

Oh well. ssh-keysign-pwn seems to be _not_ copyfail class, but a six year old unfixed vuln in many distro kernels. This is a freshly installed VM with Ubuntu 24.04.4, latest patch level, 6.8.0-111-generic kernel.
I'm not even redacting the privkey because the VM is dead already as I write this.
https://assets.chaos.social/media_attachments/files/116/577/184/033/185/765/original/47f98ee1f4b4ba15.png

2026-05-14 16:08:54 UTC

- reply

And then, there's this gem. Google ads for ddos.su and Cloudflare, chilling on the result page for "best stresser tool". ddos.su has been advertising on Google for over a year. I have reported the ads but have not heard back yet.
Of course, ddos.su is behind CF. So I reported ddos.su to Cloudflare who just said "yeah that's no longer on our network". My bad, but www.ddos.su is.
https://assets.chaos.social/media_attachments/files/116/573/782/902/159/850/original/9f9c437ca7065469.png

2026-05-14 15:58:38 UTC

- reply

A fresh VM with all updates and the latest definitions?

2026-05-13 17:23:14 UTC

- reply

They had a whole bunch of LPE CVEs in the Cloud Files API, at least one race condition. I wouldn‘t be too surprised if they fixed it together with one of them.

2026-05-13 13:57:50 UTC

@npub1z3m…zn2f Time to add Fragnesia to vulnerability.garden? https://www.wiz.io/blog/fragnesia-linux-kernel-local-privilege-escalation-via-esp-in-tcp
Or are we just giving this vuln class a blanket name like "the copyfail zoo"?

2026-05-12 15:15:49 UTC

- reply

Huh, that's odd. Works fine for me. Same definitions version.
https://assets.chaos.social/media_attachments/files/116/562/259/860/271/917/original/6f7da661bb4a5b9a.png

2026-05-11 09:01:05 UTC

- reply

Wir hatten auch was dazu. https://heise.de/-11288423
Allein dieser Gedanke, dass ein Captcha meine Betriebssystemversion überprüfen soll - wo zum F*** sind wir in den vergangenen Jahren falsch abgebogen?
Es gibt datenschutz- und nutzerfreundliche Alternativen, die auch auf GrapheneOS und Co. laufen. Man muss sie nur mal nutzen.

2026-05-11 06:23:51 UTC

May 11, 2026: The Red Sun still prevails.
However, I noticed something odd. Either this is purely coincidence, or the exploit has less reliability now (?). On a freshly booted system, it works 100%, but after a couple minutes of runtime, it seems that it doesn't always win the race condition (or it takes longer than the usual ~10 seconds).

2026-04-19 13:39:33 UTC

- reply

Ich weiß nicht, ob wir jetzt jede nischige Bastelsoftware von irgendwelchen EU-Kommissionen besprechen sollten. ;-)
Ich habe in den Quellcode aber auch schon mit einem halben Auge hineingeschielt - weil ich wissen wollte, inwiefern die Android-Version Play Integrity verwendet. Habe aber nichts gefunden und bin für Pointer dankbar.

2026-04-15 13:58:59 UTC

- reply

...und wie es der Zufall will, reden wir in der just heute erschienenen "Passwort"-Folge erneut über die beschleunigte Timeline im Quantenrennen. Danke für die Weiterempfehlung! #bsikongress2026 #itsicherheitskongress

2026-04-09 11:40:42 UTC

- reply

amphibian Baba Yaga.

2026-04-09 08:55:24 UTC

- reply

Shouldn't be too hard to graph...

2026-03-24 07:49:07 UTC

Aus gegebenem Anlass: Die Älteren unter Euch erinnern sich sicher noch an die Zulassungspflicht für Telekommunikationsgeräte in Deutschland. Nicht von der Post (genauer: dem BZT) zugelassene Modems waren ganz, ganz schlimm verboten.
In meinem Kopfkanon ist das Pesthörnchen des @npub15qj…3kl0 ein Resultat dieser Zulassungspflicht (weiß nicht, ob @npub1yny…pn2p das kanonisieren kann).
Turns out: Geschichte wiederholt sich. Demnächst fahren also FCC-Wagen durch die Städte und kontrollieren auf Fremdrouter.
https://assets.chaos.social/media_attachments/files/116/283/043/417/074/373/original/83992e74b7edff3a.png

2026-03-24 07:44:59 UTC

- reply

Ich freue mich schon auf die Fotos aus dem Best Buy in ein paar Wochen. Vielleicht machen die es ja wie Media Markt hierzulande und füllen leere Regale einfach mit Lego auf. Ach nee, das ist ja auch aus dem Ausland...

2026-03-24 07:06:42 UTC

- reply

Manche Menschen möchten einfach nur die Welt brennen sehen.

2026-03-24 07:03:43 UTC

- reply

Acht Uhr und ich habe schon keinen Bock mehr.

2026-03-24 07:03:10 UTC

> Nachts um drei in den USA
> ICE steht vor der Tür
> Ausländische Freundin und Kind im Hinterhaus versteckt
> Testament unterschrieben
> Burner Phone in Plastikbeutel geschluckt
> Guten Tag, uns wurde ein ausländischer Router gemeldet.

2026-03-23 15:25:07 UTC

OK, I said it first: CitrixBleed3 incoming. @npub1lcc…lcye

2026-03-20 13:53:15 UTC

CVE-2026-20963 Sharepoint Insecure Deserialization 8.8/10
Weekend soon. Where @npub13vn…f849 blog? Need lolz. I can has?

2026-03-09 06:30:54 UTC

- reply

„mit Datenverarbeitung in Europa“ ist wie „mit natürlichen Zutaten“ bei einer Knorr-Tütensuppe. tEcHnIcAlLy cOrReCt, bringt nur nix.

2026-03-03 10:38:50 UTC

Interesting to see how S&D (Socialists & Democrats) in the EU Parliament seems to have no qualms at all voting alongside the moderate and extreme Right as long as it is for upholding chat control.
Didn't work though.
https://assets.chaos.social/media_attachments/files/116/164/803/231/730/680/original/3b49abdc94b93f5c.png

2026-02-11 13:24:58 UTC

So #OpenAI wants to introduce an "adult mode" to ChatGPT so people who are fed up with the boring AI porn over at Grok have more choice.
And their product policy team pushed back, citing that this would likely be detrimental to users' well-being.
Being the balanced, well-hinged company they are, OpenAI then proceed to fire the head of said product team, citing sexual discrimination against a male colleague. And proceeds to tout "adult mode".
Whew.

2026-01-13 12:31:47 UTC

I'm looking for someone who has received one of the ominous unsolicited Instagram password reset e-mails around December 30, last year (or later). I'd like to cross-check their Instagram data with the recent "leak". Appreciate a boost!

2026-01-09 13:46:51 UTC

- reply

I would never in a thousand years recommend to use Telegram, I'm on there anyway. The easiest way to follow vx is likely to use xcancel: https://xcancel.com/vxunderground

2026-01-09 13:41:16 UTC

- reply

The very same. Their last toot is from 2022, while their last Telegram post is from *checks notes* 9:37 today.
I'm not sure why, but being on the Fediverse just doesn't seem to be in the cards for them.

2026-01-09 13:30:56 UTC

- reply

Ich wünschte, ich könnte da mal einen Blick 'reinwerfen. Ich habe vor Monaten 10 Exemplare (Friends&Family) beim @npub1rr4…mqdy bestellt und nie erhalten.

2026-01-09 07:52:27 UTC

Sorry, this could not wait until next #diday - I just deactivated my X account. The recent shitshow around Grok creating deepfake thirst traps is just too appalling.
Also, I found out that vxunderground, literally my last reason to keep my X account alive, is now on Telegram, so that's that. Let that sink in: I'd rather be on Telegram than on X at this point.
Anyhow, my account which has been around since sometime in the late 2000s is now gone.
https://assets.chaos.social/media_attachments/files/115/864/052/925/005/006/original/5aa89ec515c42fb9.png

2025-12-25 17:14:38 UTC

- reply

Youtube did the right thing and resolved my complaint within a few hours. And they decided that the clearly fraudulent ad is... not fraudulent.
Way to go, Youtube. Way to go.
It's a little bit ironic that this ad got shown to me while watching @npub1fdr…lvhs on the Daily Show, in anticipation of meeting him on #39C3.
https://assets.chaos.social/media_attachments/files/115/781/323/210/095/592/original/eff8991df8b6f678.png

2025-12-25 10:03:40 UTC

Merry christmas everyone. A word of warning: I just encountered this scam ad on YT - don't let scammers get the better of you during these holidays. There's obviously no way in hell that a 16TB usb drive is sold for this price.
https://assets.chaos.social/media_attachments/files/115/779/631/911/024/142/original/c9998b54d40e0908.png
https://assets.chaos.social/media_attachments/files/115/779/631/913/508/716/original/d4f2f48374161bca.png
https://assets.chaos.social/media_attachments/files/115/779/631/928/171/194/original/ff82cfc03b38abf0.png
https://assets.chaos.social/media_attachments/files/115/779/634/175/396/772/original/37c133f772c4b821.png

2025-12-19 14:54:55 UTC

RE: https://cyberplace.social/@GossiTheDog/115745701289876342
> - HPE added a REST command, executeCommand, which requires no authentication to execute commands. Obviously, this is dumb and now patched out
Wait. What?
#note1k85…suvp

2025-12-15 13:17:48 UTC

- reply

RE: https://mastodon.gamedev.place/@danielalbu/115723469299750446
The sound effects still live rent free in my head after 34 years.
#note1gx7…pfv4

2025-12-08 15:34:34 UTC

- reply

...and don't get me started about the existence of a security.txt.

2025-12-04 14:12:47 UTC

The headline "'End-To-End Encrypted' Smart Toilet Camera Is Not Actually End-To-End Encrypted" was not on my 2025 bingo card. Or any previous one.

2025-11-27 07:22:14 UTC

- reply

Dreamweaver was a pile of odorous excrement, change my mind.
Team HomeSite all the way.

2025-11-26 08:29:13 UTC

Sha1-Hulud has a dead man's switch
The second iteration of the Shai-Hulud worm had a dead man's switch that destroys data on infected machines.
If it can't reach Github or npm to self-propagate, the worm spawns a cmd.exe / bash shell and tries to delete all data that can be written by the current user. Yikes.
It seems sha1-hulud is now contained though: Only about 300 infected repos are left.
https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/
https://assets.chaos.social/media_attachments/files/115/615/047/785/265/668/original/f5e0154ae9ae3eac.png

2025-11-21 06:35:27 UTC

BINGO TIME! With CVE-2025-58034, Fortinet secures the crown in my Insecurity Appliance Bingo. This is technically a "high" severity vuln, but since it's being actively exploited and has landed a spot on CISA KEV, I'm admitting it.
https://cku.gt/appbingo25
Reaching a bingo took longer than expected, with FortiNet and Ivanti sitting at 5/6 vulns since about July. But now, there is a well-deserved winner.
I'm now taking new vuln class and vendor suggestions for next year's edition.
https://assets.chaos.social/media_attachments/files/115/586/296/566/691/683/original/c376c999596e738b.png

2025-11-20 15:35:21 UTC

Let me get this straight. If I want to report a currently active malware dropper domain to Cloudflare, they make forwarding my report (including my name and e-mail address) to the likely culprit _mandatory_?
This seems wrong. [@cloudflare](https://cloudflare.social/@cloudflare ) ?
https://assets.chaos.social/media_attachments/files/115/582/757/506/406/877/original/da0a001d0517a722.png

2025-11-13 08:16:13 UTC

- reply

It's amazing to me how many of these screen shots are of an open root shell where multiple skids unsuccessfully tried to install a rootkit.

2025-11-13 07:47:17 UTC

- reply

Deck at around the same time.
I had a hard time playing games in VR because they were extremely exhausting for me - due to immersion and the more immediate sensations. I'm no longer convinced that VR is capable of becoming a mass, mainstream market at all.
That being said, if anyone is able to make it work, it's probably Valve, if they are able to repeat the success formula of the Steam Deck.
Do you have a link to the discussion?
2/2

2025-11-13 07:45:24 UTC

- reply

I considered myself to be an early adopter of VR, used a Virtuality headset in ~1996, always dreamed of a Forte VFX1, had Oculus DK2, PSVR1, Quest1-3. I gave the whole VR thing so many tries, but it always felt lackluster.
On the Quest, the ecosystem felt neglected pretty much from the get go: Obviously fake app reviews, terrible lobbies in multiplayer, not-so-great update politics, etc. - after Zuckerberg pitched the whole Metaverse idea, I bailed. Incidentally, I sold my Steam 1/2

2025-11-10 08:23:49 UTC

Fediverse! Which password manager do you recommend to your parents, grandparents, kids, grandkids, those people from your sports club who come to you for computer help?
Please comment for additional options, I can only fit four options here.
I'd love a boost for this, it's for a talk I'll give in a week at the heise HQ in Hanover, Germany.

2025-11-07 10:52:08 UTC

- reply

always writes stellar articles. I absolutely adored his explainer about the "Chinese have quantum broken RSA" hype a few months ago: https://cku.gt/quantumhype

2025-11-06 09:39:04 UTC

Does anyone have an idea if the number "236787" is a significant number in any context, significant enough to be used as a device or login PIN? I'm a little stumped.
It's not a birthday, not a geometric number, doesn't seem to be a significant swipe pattern.
Any ideas, Fediverse?

2025-11-04 16:48:11 UTC

- reply

Lots of German ASes in that list. 1337 services runs "rdp.sh", a vps provider. the others seem to be mostly vps hosters, too.

2025-10-15 09:17:39 UTC

Do I know anyone from the @npub12us…h86y team who could answer a specific question for our newsroom?

2025-10-13 08:21:43 UTC

This looks like excellent value for the money. The Humble Bundle Cybersecurity Month features 24 O'Reilly books on various security topics: https://www.humblebundle.com/books/cybersecurity-month-oreilly-books

2025-10-07 10:24:16 UTC

Wem gehört denn chat-kontrolle.eu [@echo_pbreyer](https://digitalcourage.social/@echo_pbreyer ) @npub1t3g…qqds?
Bei Strato brennt gerade ein bisschen der Webserver, auf dem die Domain liegt, fürchte ich: Bekam gerade "502 Proxy Error" beim Aufruf.

2025-10-07 10:14:08 UTC

- reply

The timeline checks out: The exploit was posted on TG on October 3, early afternoon. It was also first uploaded to VT on October 3. After Oracle woke up to the news on October 4, they quickly assessed the damage and pivoted their narrative to "discovered during our investigation". aka "downloaded from telegram".
This fits a repetitive pattern of what I would diplomatically call "unethical disclosure practice". If you update your publications, AT LEAST mark the edits.
2/2

2025-10-07 10:08:29 UTC

- reply

I cannot stress enough how deceptive this tactic is.
First, Oracle gaslight their own customers into "if something happens, it's because you haven't patched". Then, after downloading a zero-day off Telegram finding out that they have been pwned by Scattered Lapsus$ Hunters, they quitely edit out the previous content.
And this is not some anonymous marketing writer, but the Chief Security Officer for one of the biggest corporations on the globe.
1/2

2025-10-07 07:57:45 UTC

TIL: The Cl0p ransomware group has been named "Graceful Spider" by CrowdStrike. What the actual f is that? There's nothing graceful about extortion. Nothing.
This is purely a marketing device for companies, and ultimately a transparent sales tactic.
If you want to see if companies take actual security seriously, look at small things like this. There is zero necessity for these individual TA names, on the contrary: They increase confusion by conflating clearly distinct profiles.

2025-10-06 13:48:30 UTC

The "ls -laR" of the Red Hat data breach by Scattered Lapsus$ Hunters is, put into a text file, 2.2 GB. That's a heck of a breach.

2025-10-06 12:12:26 UTC

- reply

They replaced the whole blog post and somehow purged copies from WBM. However, they forgot to change the SEO URL which still hints at their original narrative: "Apply July 2025 CPU".
Cl0p had it, SLSH has it, and if the indicators on the exp aren't faked, they have had it since May or so. And now, everyone has it, I expect it to make CISA KEV by tomorrow.

2025-10-02 06:51:51 UTC

This is Jamal Kashoggi. Seven years ago today, he entered the embassy of Saudi-Arabia in Istanbul and never came back. The people who ordered his assassination have never faced justice.
https://assets.chaos.social/media_attachments/files/115/303/188/214/700/718/original/ac6f00b721550694.png