Alexandre Dulaunoy

Enjoy when humans are using machines in unexpected ways. I break stuff and I do stuff.

The other side is at [@a](https://paperbay.org/@a ) (photography, art and free software at large)

#infosec #opensource #threatintelligence #fedi22 #threatintel

Website: https://www.foo.be
GitHub: https://github.com/adulau
Matrix: [@adulau](https://infosec.exchange/@adulau ):matrix.circl.lu
ORCID: https://orcid.org/0000-0002-5437-4652
PGP FP: 6BB5 6353 1D99 F112 4C00 8C4F 815D 4786 1ECB 73D5
Other Mastodon: https://paperbay.org/@a

Public Key

npub1xanpgt7tl8scvww672puu3pt2ez0v6fz8ms3tatgzu638pc000jqsa9q9d

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsrwes59l9lncvx88d09q7wgs44v38kdy3racg4745pwdgnsu8hheqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds79zc56

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1xanpgt7tl8scvww672puu3pt2ez0v6fz8ms3tatgzu638pc000jqsa9q9d

Show more details

Last Notes

2026-08-24 20:00:49 UTC

I spent many hours in vulnogram today and to be honest. I'm glad that a colleague started to work on a replacement called vulniverse. Still early beta but it's promising.
#opensource #vulniverse #cybersecurity #cve #gcve
:github: work in progress https://github.com/vulnerability-lookup/vulniverse

2026-08-24 15:22:02 UTC

- reply

Time to welcome Canada as an EU member.

2026-08-23 09:56:48 UTC

I just released ptrclassify is a small, dependency-free Python library and CLI that infers likely IP usage from reverse-DNS PTR hostnames.
It is intentionally heuristic and multi-label. PTR naming is operator-controlled and is not authoritative evidence of how an address is actually used. The output therefore includes a confidence score, the text that matched, and the rule IDs that produced each label.
To summarize, the library is trying to guess usage (and a bit location) of an IP address based on its PTR records. It's based on a set of rules which can be updated easily.
#osint #cybersecurity #ptrclassify #opensource #dns
:github: https://github.com/adulau/ptrclassify
:python: module https://pypi.org/project/ptrclassify/

2026-08-13 15:21:01 UTC

If you are curious about (nearly) everything we did the past months at the GCVE.eu initiative:
https://gcve.eu/2026/08/13/gcve-recent-activities-standards-software-and-a-growing-gna-community/
We published a recap blog post.
#gcve #cve #vulnerability #vulnerabilitymanagement #cra #cybersecurity #openstandard #opensource
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/088/873/286/833/458/original/fdc805f548017885.png

2026-08-11 09:36:56 UTC

From a research paper to running open-source code in just a few days.
We (with @npub1cyh…z0cm) have been experimenting in Vulnerability-Lookup with the concept of Local Exploit Hazard, based on the recent research paper “Modeling Local Exploit Hazard — A Bayesian Framework for Quantifying Exploit Risk and Operational Efficiency” by Stephen Shaffer and Laura Cristiana Voicu.
The idea addresses an important question in vulnerability management:
Not simply “How dangerous is this vulnerability globally?” but “How much exploitation risk does this vulnerability represent in my environment?”
Instead of introducing yet another static vulnerability score, the model starts from exploit likelihood such as EPSS and combines it with local security controls, CVSS attack vectors, vulnerability age and KEV policy to estimate an exploitation hazard.
We implemented an experimental version in Vulnerability-Lookup and connected it directly to operational workflows.
For the full details: https://www.vulnerability-lookup.org/2026/08/11/local-exploit-hazard/
#cve #gcve #vulnerabilitymanagement #vulnerability #opensource #opendata
@npub143x…w0tp
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/076/193/954/912/380/original/8dda29892c24dccc.png

2026-08-09 08:26:26 UTC

Pretty cool idea from @npub1t9q…r0p6 - a bot to analyse fucked up references from the CVE records.
[@fuckeduprefs_bot](https://infosec.exchange/@fuckeduprefs_bot )
Maybe we could imagine an archive bot at the same time to ensure that the references don't get lost. Just like archive.org or similar. Maybe something for @npub1pna…2y52 to look into.
#cve #vulnerability #gcve

2026-08-04 20:30:25 UTC

- reply

MISP Galaxy Threat Actor Explorer v1.0.0 released
https://github.com/adulau/threat-actor-explorer
#cti #cybersecurity #misp #threatintelligence #threatintel
@npub1mly…rl2t

2026-08-03 17:34:45 UTC

A standalone, browser-only HTML/JavaScript application for exploring the MISP threat-actor galaxy, UUID-based relationships across every cluster in the MISP Galaxy repository, and shared MISP Galaxy metadata. Graph rendering is performed by Pivotick.
Source code: https://github.com/adulau/threat-actor-explorer/
Online (in-browser): https://foo.be/threat-actor-explorer/misp-threat-actor-explorer.html
Discussions and feedback: https://discourse.ossbase.org/t/playing-with-a-threat-actor-explorer-browser-local-from-the-misp-galaxy-dataset/1118
@npub1mly…rl2t
#misp #cti #threatintelligence #opensource #threatactor #cybersecurity
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/032/767/514/157/529/original/a497567873843296.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/032/767/529/112/717/original/4828a4050f14ea51.png

2026-08-01 08:20:08 UTC

Sightings have long been a major topic of discussion in the CTI community, particularly in the field of vulnerability management. We have now published a GCVE BCP to standardise the format that has been implemented, tested and used operationally in Vulnerability-Lookup for some time.
Thanks to everyone (Cédric Bonhomme, Éireann Leverett, Andras Iklody, Sami Mokaddem and many more) who participated in discussions and worked on the implementation details of sightings over the past several years. These efforts had a strong focus on practical implementation, while BCP-12 specifically addresses sightings in the context of vulnerability management.
BCP-12 is still a draft open for review, but it already provides a strong foundation for existing implementations.
https://gcve.eu/2026/08/01/gcve-bcp-12-a-standard-sighting-format-for-vulnerabilities/
#cve #cra #gcve #vulnerabilitymanagement #cybersecurity #openstandard
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/019/271/476/322/962/original/2677c9ab0ea5b405.png

2026-07-28 08:39:01 UTC

The Radio Image Framing Protocol (RIFP) 1.0 is an experimental, extensible standard for sending images over low-rate radio links.
The default rifp-cpfsk-4800 profile uses binary continuous-phase FSK and can be deployed around 433.92 MHz where local regulation permits it. RIFP itself is not tied to 433 MHz or to FSK and can be used in any frequency bands.
I'm still exploring various low-cost options for a device that can receive and display images on an e-ink screen in emergency areas or similar environments.
:github: Python implementation https://github.com/adulau/rifp
Internet-Draft https://www.ietf.org/archive/id/draft-dulaunoy-rifp-00.html
#radio #fax #433mhz #opensource
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/996/644/160/470/271/original/144cc58443efe230.png

2026-07-27 20:33:48 UTC

Pivotick is an open-source network graph library to facilitate pivoting.
Version 1.4.0 has been released and also includes a security fix.
Release notes https://github.com/Pivotick/Pivotick/releases/tag/v1.4.0
Documentation https://pivotick.github.io/Pivotick/
Vulnerability fixed in 1.4.0 https://vulnerability.circl.lu/vuln/gcve-1-2026-20151
Gallery https://pivotick.github.io/Pivotick/gallery.html
#opensource #infovis #graph #networkgraph #visual
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/993/842/083/920/061/original/b5c071f8235d8939.png

2026-07-27 17:54:37 UTC

So finally Kimi-k3 is not really open-source
https://huggingface.co/moonshotai/Kimi-K3/blob/main/LICENSE
I'm a bit disappointed.
#kimi #ai #opensource

2026-07-26 09:40:01 UTC

The GCVE Lab is an open space for experimenting with new ideas, tools, formats, and services related to the Global CVE Allocation System initiative.
The lab allows the GCVE community to explore promising concepts without immediately imposing the stability, compatibility, and operational requirements expected from the core GCVE infrastructure.
Open to comments/ideas.
#gcve #cve #cybersecurity
https://discourse.ossbase.org/t/gcve-lab-proposal/1117
https://gcve.eu
@npub1pna…2y52 @npub1a66…fej9

2026-07-25 11:05:13 UTC

Wireshark for the web (webasm)
Open, dissect and analyse .pcap / .pcapng capture files entirely in your web browser.
Online - local in your browser https://stricaud.github.io/wpcapng/
Sourc code - https://github.com/stricaud/wpcapng
#nids #pcap #networkanalysis #wireshark

2026-07-17 10:12:23 UTC

I don’t like playing the futurologist, but after seeing AI companies warn EU institutions about the supposed risks of open-weight models, I suspect some are lobbying to regain control over genuine open source and open-weight AI.
Don’t fall into the trap: the greater danger lies in opaque, proprietary models, not open-source ones.
#opensource #ai #cybersecurity

2026-07-10 19:56:50 UTC

The first version of tempolocus, v1.0.0, is out.tempolocus
analyses time-series activity patterns to infer likely locations.
I’ve been experimenting with this idea for years, but AI-assisted development now makes it much easier to collect and maintain country-specific holidays and their many exceptions.
#threatintel #threatintelligence #opensource #osint
:github: https://github.com/ail-project/tempolocus

2026-07-08 15:15:33 UTC

We are exploring some ambitious ideas around reducing external dependencies and relying more on our own libraries across MISP and related tooling. Over the past year, we have been working on a replacement network graph library for the new MISP interface and things are getting really interesting. Pivotick is already used in around ten open-source tools, including CTI Transmute, AIL Project, and Rulezet. It has also recently been integrated into the new MISP UI, OverMind. The library is, of course, open source and comes with extensive documentation, including AI-parseable documentation to make integration easier. We have just released Pivotick v1.2.0.
https://pivotick.github.io/Pivotick/
https://github.com/Pivotick/Pivotick
#infovis #cybersecurity #opensource
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/885/005/467/863/705/original/85e6e3992fca30a1.png

2026-07-07 15:02:25 UTC

Working on tempolocus, a tool that analyses time-series activity patterns to infer a user’s likely location.
In [@ail_project](https://infosec.exchange/@ail_project ), we work with a large volume of social-network time series. Estimating users’ locations from these patterns is often a manual task.
I prototyped a Python module that combines potential locations with yearly activity signals, such as vacation periods and public holidays. It is still at an early stage, but it is already producing promising results with weekly time series.
Ideas, feedback, and improvements are welcome. tempolocus is planned for integration into AIL Framework 7.1.
#cybersecurity #threatintelligence #threatintel #opensource
:github: https://github.com/ail-project/tempolocus
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/879/206/589/401/725/original/5be194dae72d89dd.png

2026-06-23 18:15:29 UTC

EU project proposals have become a bureaucratic endurance test.
The application process is painfully long, the evaluations often opaque, and rejection letters can feel almost dismissive. Even when a proposal succeeds, far too much of the budget disappears into compliance, coordination, reporting, controls, and audits.
When roughly 60% of resources go to administration rather than impact, something is fundamentally broken.
Europe cannot afford to turn innovation into paperwork. We need a serious reform of EU funding: simpler applications, transparent evaluations, proportionate controls, and more funding directed to actual delivery.
#europe #research #funding #opensource

2026-06-23 14:22:22 UTC

Improving the CPE editor for the GCVE initiative: clearer API behavior, better performance, and many other enhancements. This will be released in version 1.1 and the improvements are already in the online version.
🌍️ Online version https://cpe.gcve.eu/
:github: https://github.com/gcve-eu/cpe-editor
If you want to improve the CPE dataset, you can make proposal online.
Thanks to all the users who provided feedback for improvements @npub1cwm…2qdf @npub1cyh…z0cm @npub1660…u8rt
@npub1pna…2y52
#gcve #cpe #cve #vulnerability #vulnerabilitymanagement #opensource #opendata

2026-06-19 17:14:46 UTC

imsi-dataset contains pseudonymised mobile-network observation records derived from IMSI-catcher-style telemetry. It is intended for research on mobile-network measurements, cellular security, anomaly detection, roaming patterns, and privacy-preserving analysis of telecom metadata.
#imsi #dataset #opendata #cybersecurity
https://huggingface.co/datasets/adulau/imsi-dataset

2026-06-15 14:46:21 UTC

The idea from @npub1cm0…enqe is so interesting that it gave me the idea to extend the "GCVE-BCP-02 - Practical Guide to Vulnerability Handling and Disclosure" with "Temporary Closure of Vulnerability Intake Windows"
#gcve #cve #vulnerabilitymanagement #vulnerability #opensource #cybersecurity
🔗 Proposal https://discourse.ossbase.org/t/temporary-closure-of-vulnerability-intake-windows-potential-annex-extension-for-gcve-bcp-02/1104
🔗 Original BCP-02 https://gcve.eu/bcp/gcve-bcp-02/

2026-06-14 15:07:01 UTC

cpe-editor v1.0.0 released : Establishing the Foundation for Collaborative CPE & PURL Mapping
Release note - https://github.com/gcve-eu/cpe-editor/releases/tag/v1.0.0
Online version - https://cpe.gcve.eu/
#gcve #cpe #vulnerability #vulnerabilitymanagement #cve cvd
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/749/080/828/308/180/original/eeb8f5dd0614d0aa.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/749/080/869/147/205/original/36c5ab75204ac34e.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/749/080/874/515/602/original/05abb8cdc184d0bf.png

2026-06-06 07:59:29 UTC

Sovereignty Is Engineered, Not Procured
Europe often asks whether it can build a company like Palantir: a software champion capable of serving intelligence, defence, law enforcement, crisis response, cyber defence, and public-sector decision-making at scale.
The usual answer is that Europe lacks data, capital, talent, or legal room. I do not think this is the full story.
The capacity is there. The data is there. The technical talent is there. The public-sector problems are real, urgent, and interesting. What is often missing is the will to tackle complex programmes seriously, over time, with teams that are allowed to build, fail, iterate, and take responsibility.
Europe does not need a Palantir clone. It needs the capacity to build strategic software for intelligence and security missions without outsourcing the core of its thinking.
#opensource #intelligence #cybersecurity #palantir #europe #sovereignty #intelligence
🔗 My full blog post about the topic https://foo.be/2026/06/Sovereignty-Is-Engineered-Not-Procured

2026-05-30 20:44:21 UTC

IETF I-D updated - Programming Methodology Framework aka PMF
This update includes "Swearwords and Software Engineering"
#update #computerscience #methodology #programming
🔗 https://datatracker.ietf.org/doc/draft-dulaunoy-programming-methodology-framework/

2026-05-29 21:09:05 UTC

The synthetic exercise world format now includes a nice map.
So no one can blame us when you conduct an exercise: everything is fictional ;-) Yes, we’ve had cases like this during threat intelligence exercises.
All Synthetic Exercise World - Self-contained fictional world dataset for cyber exercises and standards documents are available at https://github.com/MISP/Synthetic-Exercise-World-Format
#cti #cyberexercise #exercise #threatintelligence #opensource
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/659/899/607/911/382/original/76d13aa10e6ee82b.png

2026-05-27 15:37:45 UTC

Yesterday, in our very warm office, an interesting discussion emerged: there was no dedicated taxonomy for evaluating Cyber Threat Intelligence (CTI) in MISP.
So, we created one called: cti-evaluation
🔗 https://www.misp-project.org/taxonomies.html#_cti_evaluation
My colleagues Théo Geffe and Christian Studer then took it one step further by implementing it in CTI-transmute.
From discussion to a first implementation and tests in less than 48 hours, not too bad! Feedback on the taxonomy is more than welcome. And you can already test it live on cti-transmute.org
🔗 https://cti-transmute.org/convert/detail/93
#cti #misp #cybersecurity #threatintelligence #opensource #threatintel
@npub1mly…rl2t
@npub143x…w0tp
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/647/272/714/336/660/original/f38d6c400c1776ac.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/647/272/721/376/348/original/377e6bf63d04a332.png

2026-05-25 09:19:07 UTC

hack.lu is celebrating its 20th edition!
There is still time to be part of this special anniversary edition: submit your talk, presentation, workshop, or even a short talk for the Call For Failures.
Twenty editions of sharing, learning and community deserve something memorable. Don’t miss the chance to contribute, this year will be special!
Call-for-Papers Submission Site https://pretalx.com/hack-lu-2026/
CfP Details https://2026.hack.lu/blog/hack.lu-2026-call-for-papers/
#hacklu #conference #luxembourg #cybersecurity #hackerconf #cfp #callforpapers #europe
[@hack_lu](https://infosec.exchange/@hack_lu ) @npub143x…w0tp
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/634/465/998/988/680/original/3bf57adae1c1aa5d.png

2026-05-07 08:06:30 UTC

I’m still completely lost with logic of JA4+ patent licensing and actual incompatibility with the copyleft-license. So it seems to be a patent-based license and really risky to implement if you want to keep your actual software open source.
Did someone explore alternatives to avoid this? and especially other format which are open source friendly?
#ja4 #ja3 #jarm #cti #opensource #patent #cti
#threatintel #cybersecurity
🔗 https://github.com/FoxIO-LLC/ja4/blob/main/License%20FAQ.md

2026-04-10 04:38:05 UTC

FSL and BSL belong on any list of false-promise licenses:<li><a href="https://fsl.software/" target="_blank" rel="nofollow noopener" translate="no">https://fsl.software/</a></li><li><a href="https://mariadb.com/bsl-faq-adopting/#whatis" target="_blank" rel="nofollow noopener" translate="no">https://mariadb.com/bsl-faq-adopting/#whatis</a></li>
They are **not open source**. They are restrictive source-available licenses dressed up with “open” language.
Reading the code is not enough. If users cannot freely run, use, or build on the software because of field-of-use or competition restrictions, the software is not open source.
Marketing it as “open source” or even putting “open” in your name is misleading twice: first in the license, then in the messaging.
#opensource #fauxopensource #license

2026-03-31 05:41:10 UTC

If someone comes to me today preaching about “post-quantum” security issues, I’ll remind them of the current state of security: the npm ecosystem gets abused daily, CI pipelines run left and right with full access to cloud services, so-called security devices like F5 and Ivanti are exposed (and compromised) to the internet, mailboxes get compromised just to change an IBAN in a PDF, and a simple phone call is still enough to get someone to hand over an MFA code.
But yes, by all means, let’s focus on post-quantum threats while handing AI tools SSH access like it’s a feature, not a confession.
#cybersecurity #stateoftheworld
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/322/174/707/797/506/original/b2c8beec36c42e77.png

2026-02-10 11:27:17 UTC

- reply

In the same level of discussions, "Discord Alternatives, Ranked" is an interesting read too.
🔗 https://taggart-tech.com/discord-alternatives/

2026-02-10 07:18:15 UTC

I hate Discord. The platform is proprietary, the U/X is just completely confusing and it's difficult to find anything.
If you run a project, I love @npub1shf…7zml - it's open source, the U/X is great and you can archive everything in markdown (and much more).
https://github.com/discourse/discourse
and we run it for GCVE https://discourse.ossbase.org/c/gcve/14
#opensource #discourse

2026-02-09 16:01:17 UTC

- reply

The federation is open. Any matrix server or bridge is allowed.

2026-02-06 21:11:03 UTC

- reply

You need to have an account on another public matrix server like matrix.org to join the public room. We don’t allow account creation on our server.

2026-02-06 13:08:17 UTC

We’ve just set up a Matrix channel for Vulnerability-Lookup and GCVE discussions.
Matrix public room: #vulnerability-lookup-public:matrix.circl.lu
This space is intended for informal discussions. For standard and more detailed discussions, we recommend using:
🔗 vulnerability-lookup discourse https://discourse.ossbase.org/c/vulnerability-lookup/6
🔗 GCVE discourse https://discourse.ossbase.org/c/gcve/14
#gcve #vulnerabilitymanagement #opensource #cve #matrix
@npub1pna…2y52
@npub143x…w0tp

2026-02-01 18:03:25 UTC

- reply

Iperlane Security ?

2025-12-17 16:41:09 UTC

French government always talks about technological sovereignty…
https://www.lemonde.fr/en/france/article/2025/12/15/us-tech-firm-palantir-extends-deal-with-french-intelligence-agency_6748523_7.html
#palantir #french #sovereignty
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/735/888/485/402/567/original/c60344041442b80d.jpeg

2025-12-17 12:09:00 UTC

Why it matters to create and maintain open-source infrastructure for security monitoring including collection of forums and malicious communication channels.
This is a strong example (Google dark web report is discontinued) of the risks of relying solely on commercial vendors. If a capability does not align with their business interests or generate sufficient revenue, it can be discontinued at any time. Open-source infrastructure helps ensure continuity, transparency, and long-term access to critical monitoring capabilities that are essential for the security community.
If you want to run your own "darkweb" monitoring, we develop open source tooling supporting such monitoring<li><a href="https://www.ail-project.org/" target="_blank" rel="nofollow noopener" translate="no">https://www.ail-project.org/</a> <a href="https://infosec.exchange/@ail_project" class="u-url mention">@ail_project</a> </li><li><a href="https://github.com/ail-project" target="_blank" rel="nofollow noopener" translate="no">https://github.com/ail-project</a></li>
#darkweb #opensource #osint #cybersecurity
🔗 https://support.google.com/websearch/answer/16767242?hl=en&ref_topic=7028834&co=GENIE.Platform%3DiOS

2025-11-04 14:11:40 UTC

- reply

Can you share the indicators? we can give you an access to a @npub1mly…rl2t community if needed

2025-11-03 05:46:21 UTC

I think the best summary until now about Post-quantum cryptography is from Peter Gutmann in the cryptography mailing-list.<code>Given that after 20 years and hundreds of millions of dollars spent researchers have yet to demonstrate a single legitimate cryptanalysis result using a quantum physics experiment, it's a bit like arguing over which brand of unicorn repellent is the most cromulent. The current state of things in terms of pure vs. hybrid systems seems to be: - Governments = Pure: “We’re putting all our eggs in one basket and hoping that the dial stops spinning at ‘not broken’” - Everyone else = Hybrid: “We trust this new stuff so little that we’re requiring you use the crypto that we claim is broken alongside it” Peter. </code>
#cryptography #pq #postquantum #postquantumcryptography
https://www.metzdowd.com/pipermail/cryptography/2025-October/039129.html
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/484/165/861/731/308/original/37fde305bc3b500f.png

2025-10-28 11:54:49 UTC

- reply

I’m just wondering are you sure of the test? I remember we got trapped in an ASA scanning script which was expecting an HTTP 200 while the patch gives a redirect but this was also a 200.

2025-10-11 06:32:08 UTC

Imagine working in your country’s cybersecurity center or CERT, and suddenly being reassigned to border control and deportation duties. Something is clearly broken and dangerously so.
What will you do as a cybersecurity professional?
#us #cybersecurity #dhs #cisa
https://techcrunch.com/2025/10/10/homeland-security-reassigns-hundreds-of-cisa-cyber-staffers-to-support-trumps-deportation-crackdown/

2025-08-11 06:20:08 UTC

Finally a useful magic quadrant
Thanks to @npub1udn…3tjr for the discovery.
#cybersecurity #vulnerability
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/008/670/175/980/149/original/6909f753c4ce0b8c.png

2025-08-01 09:14:32 UTC

When I added the threat-actor @npub1mly…rl2t galaxy type on Mar 4, 2016, I didn’t expect that, years later, vendors would still invent new names for already known threat actors, avoid using UUIDs, reuse similar names for different actors, and create confusing names by mixing tools or software used by the actors.
That’s why we continue the tedious work of maintaining a proper threat-actor database, with relationships to other galaxies such as MITRE ATT&CK, Malpedia, and more.
After years of this monastic effort, we’re seeing the benefits—many open-source and proprietary tools now rely on the MISP galaxy, which serves as both an open standard and a public knowledge base.
We also maintain a dedicated website for all MISP galaxies. Here’s an example from the threat-actor database:
https://www.misp-galaxy.org/threat-actor/relations/fa80877c-f509-4daf-8b62-20aba1635f68/
:github: Repository https://github.com/MISP/misp-galaxy/
🌐 Public website https://www.misp-galaxy.org/threat-actor/
If you’d like to become a monk (just kidding!) and contribute, feel free to open an issue or submit a pull request on the misp-galaxy repo.
In MISP, you can directly benefit from all the galaxies, and you also have advanced functionalities like forking and maintaining an up-to-date private version of the threat-actor database.
#threatintel #threatintelligence #opensource #tip #cti #misp
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/952/712/373/425/103/original/999229c7f8449349.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/952/712/316/970/288/original/0928ff88ed5595a2.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/952/733/039/839/174/original/eb4687037f0d17bb.png

2025-07-16 05:27:24 UTC

« Cloudflare 1.1.1.1 Incident on July 14, 2025 »
Perhaps it’s time to return to DNS’s original distributed design.
#dns #distributed #cloudflare
https://blog.cloudflare.com/cloudflare-1-1-1-1-incident-on-july-14-2025/

2025-06-17 19:46:46 UTC

Something that’s been bothering me for years in the security world: why do researchers demand bug bounties for vulnerabilities in open source projects, when the very contributors maintaining and fixing those issues get nothing, just goodwill?
It feels deeply unfair. The burden falls on unpaid maintainers, yet bounty hunters get rewarded. If you want a paid bounty, maybe help fund the people who actually fix the mess too.
#opensource #security #bugbounty

2025-04-15 19:45:12 UTC

Just a reminder: Vulnerability Lookup isn’t just about finding CVEs. It supports the full chain, collection from multiple sources, continuous distribution, and allocation within a coordinated vulnerability disclosure (CVD) process. 100% open source.
🔗 An online version maintained by @npub143x…w0tp https://vulnerability.circl.lu/
🔗 https://www.vulnerability-lookup.org/
🔗 https://github.com/vulnerability-lookup/vulnerability-lookup
#opensource #cve #vulnerability #cna #cvd #cybersecurity

2025-04-05 18:37:39 UTC

If you want to join an open source #hackathon for open source security tools, it’s next week (on April 8th and 9th, 2025) in Luxembourg.
https://hackathon.lu
#opensource #infosec #cybersecurity
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/286/793/736/838/662/original/9d5a38a7d5817b1c.jpeg

2025-03-12 10:05:18 UTC

We are excited to announce that CIRCL has three open positions available.
As a team strongly oriented towards open-source development, we value contributions that drive innovation and strengthen the cybersecurity community. These roles are open to EU citizens, with the workplace based in Luxembourg. If you’re passionate about cybersecurity and open-source collaboration, we encourage you to apply and make a meaningful impact.<li>CIRCL - Software Engineer and Intelligence Analyst (software-engineering-analyst) </li>
🔗 https://www.circl.lu/projects/position/software-engineering-analyst/<li>CIRCL - Security Analyst and Researcher (Security-Analyst-and-Researcher)</li>
🔗 https://www.circl.lu/projects/position/security-analyst-researcher/<li>CIRCL - Incident and Vulnerability Disclosure Coordinator/Analyst (nis2-incident-analyst)</li>
🔗 https://www.circl.lu/projects/position/nis2-incident-analyst/
@npub143x…w0tp
#cybersecurity #opensource #europe #csirt #cert #nis2

2025-03-12 06:26:28 UTC

I find this vulnerability hilarious
« The GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD plugin for WordPress is vulnerable to Stored Cross-Site Scripting »
Often, websites only use cookies necessary for normal operation and don’t require explicit user consent. However, some legal teams insist on having it “to be on the safe side.” Now it’s very safe indeed. ;-)
This particular vulnerability isn’t a big deal since it requires admin rights on WordPress to inject. If you’re already an admin, you can do worse things. The only advantage for attackers is that the injection spreads everywhere.
#infosec #gdpr #cybersecurity #vulnerability #wordpress
🔗 https://vulnerability.circl.lu/vuln/CVE-2025-2205

2025-02-10 17:44:09 UTC

- reply

The « bias » one is hilarious. So many reports, manuals, and memos mention the word. From Europe, it just looks like ignorance is tearing everything down, like a massive autodafé.

2024-12-18 17:37:38 UTC

- reply

We developed the open source vulnerability-lookup project (and also the sighting part) for providing actionable intelligence in the scope of NIS2 obligation and to share the information with all CSIRTs and SOCs efficiently.
https://www.vulnerability-lookup.org/
about the sighting aspect https://www.vulnerability-lookup.org/tools/#sightings
We have still plenty of ideas. If you see something missing, let us know.
@npub1lcc…lcye @npub14g0…znd6

2024-12-18 17:05:39 UTC

- reply

If you are curious about the evolution of sightings https://vulnerability.circl.lu/vuln/CVE-2023-34990#sightings

2024-12-18 15:00:08 UTC

If you are wondering about the unpublished CVE-2024-49848... there is a PoC.
#vulnerability
🔗 https://vulnerability.circl.lu/comment/23fd524b-475e-4b9f-8dc2-7b67f4cec409

2024-11-07 05:43:59 UTC

Post-Quantum Cryptography in OpenPGP - an IETF draft
#openpgp #pgp #postquantum
🔗 https://datatracker.ietf.org/doc/draft-ietf-openpgp-pqc/

2024-10-27 08:49:46 UTC

The latest proposal from @npub1djq…zj5f poses significant risks to the true principles of open source. This concern reminds me of my primary issue with EPSS, where the model is documented in a paper, yet relies on proprietary data sources that aren’t accessible for reproduction. It's like having free/open source software without the entire build chain needed to create the executable code.
What’s the actual reasoning behind this clause?
https://opensource.org/ai/drafts/the-open-source-ai-definition-1-0-rc2
#opensource #fauxpensource #ai
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/378/496/382/426/809/original/55195ea4179000cc.jpeg

2024-10-07 14:05:28 UTC

We announce the release of onion-lookup v0.1. This open source tool and service is designed to help you search for Tor hidden services / .onion services quickly and efficiently. With its sleek API and user-friendly online interface, onion-lookup simplifies the process of querying and exploring onion addresses without browsing Tor and gather more information.
🔗 Online version https://onion.ail-project.org/
🔗 Source code https://github.com/ail-project/onion-lookup
#tor #darkweb #osint #opensource #infosec #onion
The information is relying on a [@ail_project](https://infosec.exchange/@ail_project ) instance operated by the AIL project.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/266/500/768/615/308/original/cb454d72770f561b.png

2024-09-26 20:37:13 UTC

- reply

If you are curious about the history of vulnerabilities in cups
https://vulnerability.circl.lu/search?vendor=cups&product=cups&vendor_vuln=

2024-09-26 20:06:04 UTC

« A series of bugs in the CUPS printers discovery mechanism (cups-browsed) and in other components of the CUPS system, can be chained together to allow a remote attacker to automatically install a malicious printer (or hijack an existing one via mDNS) to execute arbitrary code on the target host as the lp user when a print job is sent to it. »
Ok…. don’t expose your print server to the Internet. Wait for the update from your favorite open source operating system. Nothing new under the sun.
#cups #vulnerability #infosec
https://gist.github.com/stong/c8847ef27910ae344a7b5408d9840ee1

2024-09-18 20:48:23 UTC

A funny phishing targeting GitHub users with an email notification about a security issue on a existing repository.
Then the captcha verification on a malicious website is trying to trick the user to run a shell command on Windows.
🔗 Powershell to be executed by the user
https://gist.github.com/adulau/6cf6f3e9c5bbd9106af8814d0a22f473
🔗 File downloaded https://pandora.circl.lu/analysis/21e8f693-361b-4a04-853c-276f9dd841e4/seed-1XqUr4mADaFYlLAyrBH8oQUBgOoEbceZ586b8h05YyA - Lumma Stealer
🔗 Malicious domain analysis. https://lookyloo.circl.lu/tree/91106035-dfec-4acc-af06-c9fc36c62774
#malware #malwareanalysis #infosec
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/160/470/862/757/558/original/529545749cc9d6ca.png