GeneralX ⏳

In case you missed it, all of these malicious VS Code extensions use techniques that were responsibly disclosed to Microsoft, to which the response was:

"After careful investigation, this case has been assessed as low severity and does not meet MSRC’s bar for immediate servicing"

"Therefore, it is the user’s responsibility to ensure that they are not installing malicious extensions."

Five months later, Microsoft's own GitHub was compromised.

https://mazinahmed.net/blog/publishing-malicious-vscode-extensions/
#security #vscode #openvsx

Very happy to see the results of a security audit by @cure53@infosec.exchange of TorVPN (next gen Orbot).

While no High issues found, the Medium issues that could cause Denial of Service conditions are very important to focus on.

Why?

Because if you can't attack the security, you attack the ability to do things securely. Downgrades. Fallbacks. Prevent Signal from working so you're forced to use SMS.

Glad to see the focus on Availability!

https://blog.torproject.org/code-audit-tor-vpn/torvpn_cure53_audit.pdf
#tor #privacy #security #android #orbot

@gsuberland@chaos.social Joke's on you.

--oh-god-when-will-the-horrors-end is an invalid option, but it is a valid package name...that I just published.

How do you mostly pay for stuff, in-person?

#poll #askfedi #money #personalfinance

Self hosters, do you use Cloudflare in front of your hosted services?

#cloudflare #selfhosting #privacy #security

Did the jabber.ru "lawful" intercept on Hetzner and an RCE vuln in acme.sh go hand in hand in 2023?

This blog raises the question, but the reality is probably more mundane, especially since the op was discovered from expired certs.

The recommendation list linked to protect against this MITM misses a key feature - (TLS) channel binding. Conversations supports it.

https://remyhax.xyz/posts/reproducing-lawful-tls-wiretapping/
#xmpp #jabber #security

The meshtastic firmware pipeline on GitHub was vulnerable to pwnRequest 5 days ago, the same vuln that popped Trivy.

This could have let someone take over signing keys for Debian packages and publish malware that infects the machine installing the packages.

Since there are a few vendors that preinstall firmware and sell meshtastic-ready devices, the malware could have been an entry into some e-commerce organization.

https://github.com/meshtastic/firmware/security/advisories/GHSA-mjx5-98jq-q736
#meshtastic #security #devops

The attribution for Mastodon's CVE-2026-46349 (CVSS 5.3, retracted boost reissuance) is interestingly reported as:

"This security issue has been reported by Doyensec in collaboration with Claude and Anthropic Research"

Is this how they say "Mythos" without revealing that Doyensec is one of the undisclosed Project Glasswing members?

https://github.com/mastodon/mastodon/security/advisories/GHSA-chgx-jx3p-rf73

https://w.on-t.work/activitypub/may-2026-vulnerability says:

"Doyensec has contacted us on *behalf* of Anthropic".
#security #mastoadmin #mythos #ai #glasswing

"Don't Look Up" talk:

That Feeling When the NSA says "damn you, academics!"

(T-Mobile using a null cipher in an IPSec tunnel and broadcasting unencrypted voice to whole continents and other free for all data from the US military, Mexican military, inflight WiFi).

https://events.ccc.de/congress/2025/hub/de/event/detail/don-t-look-up-there-are-sensitive-internal-links-in-the-clear-on-geo-satellites

#39c3 #security #sigint #privacy

When Big Tech clouds fail, are censored, or collude with the (US) government, which would you choose for private messaging?

#privacy #security #decentralization #securemessaging #matrix #xmpp #simplex #deltachat #signal #poll #polls #askfedi

It's hard to fall for 'support' scams that target free and open-source software.

Because "support" is browsing GitHub issues, a mailing list, or a discourse forum.

And then submitting your own patch.

#foss #scams #half_joking #signal

Yet another wave of "cybersecurity hiring shortage" articles, this time featuring AI as the cause.

After unsuccessfully finding a job in "cybersecurity" for years, this shortage story is getting old.

The good news: watching how my company does security from afar, I'm glad I'm not a part of it.

#cybersecurity #hiring #oldnews

New Nightmare Eclipse account is at https://gitlab.com/nightmare-eclipse

"You defame me in public with your CVE-2026-45585 advisory even though you literally deleted the Microsoft account I used to report bugs to you with and I got zero pennies from doing so and I still happily did like an idiot.

Now you take the courtesy to flag my github account and wipe it out of the public, just like that ?

Mark this date July 14th, I will make sure your bones are shattered that day."
#threatintel

Have you ever watched a public access TV show?

(Via internet is okay, but PBS doesn't count)
#poll #askfedi #tv #colbert #usa #nonprofit

Pro tip: PGP/GPG public keys store creation date.

Pro Pro tip: creation date can be anything you want.

Think about this the next time you create another rando email account at an encrypted email provider.

#privacy #opsec

The page cache was a mistake.

#linux #security #dirtycbc #dirtydecrypt #dirtyfrag #fragnesia #copyfail

How much money do you make?

#poll #askfedi #money #finance #polls

Are you a procrastinator?
#poll #askfedi #procrastodon

Thought experiment:

Should Mastodon hide the number of followers you have, as shown to other people?
#poll #askfedi #mastodon

Which would you rather deal with?
#security #infosec #cybersecurity #blueteam #poll

I like the narrative of Nightmare-Eclipse being a disgruntled security researcher, because I think the reality is more exciting.

- active/former Microsoft employee?
- NSA employee?
- Shadow Brokers adjacent?
- APT?

🍿
#threatintel

"The scene that grew my love for CTFs is emptying out. The CTFTime leaderboard has almost no semblance of history or human skill anymore. The 2026 scoreboard is unrecognisable compared to every year before it. TheHackersCrew, alongside many other large and reputable teams, either do not play, play with far fewer people, or struggle to cut into the top 10. Unregulated cheating is through the roof."

https://kabir.au/blog/the-ctf-scene-is-dead
#security #pwn2own #reverseengineering

Do you trust the HR department to have your back when you've got a harassment or hostile work environment issue?

#hr #workers #harassment #workplace #poll

Everyone's talking about GenAI code, but have you seen GenAI software requirements?

Now it makes sense why our product is riddled with bugs. The code is poor quality, execs blame coders and QA, but not one person realizes slop, poorly specified requirements are the root of our problems.

Software architects have been replaced with software slopitects.

In this AI-infested ecosystem, 50% of my CSM job is apologizing on behalf of AI.

End rant.

#ai #genai #sdlc #projectmanagement #software

@cityhallin@infosec.exchange Some of my other favorites:

1. Asking "what is your full home address?"

2. Asking for your LinkedIn profile, and actually validating the URL starts contains linkedin.com, not considering that you may not use LinkedIn. One time "idontuse-linkedin.com" worked.

3. "Voluntary" self-disclosure section that has required questions without an "I do not wish to answer" option, e.g. "Are you Latino? Yes/No"

For the last time,

_NSAKEY is not a backdoor!

Sending Bitlocker recovery keys to Microsoft is not a backdoor!

The Bitlocker YellowKey login bypass feature is not a backdoor!

Where do people get these ideas???!!

#security #privacy #conspiracies

Infosec (and adjacent) people:

Are you forced by your employer to use AI to help you do your job?
#infosec #cybersecurity #security #AI #poll

Thought experiment:

- Vulnerability researchers uses centralized AI model to find a vulnerability

- Vulnerability gets automatically reported upstream by the AI vendor, without the AI user's consent

- Alternative: declare a group of embargoed entities who receive the reports instead of the affected projects (cough, cough, Project Glasswing), perhaps for triage or validation.

Is this good or bad?
#ai #security #mythos #projectglasswing