Elektrine lite

← Feed

:rainbowCrow:

cR0w@infosec.exchange

<p>Analyst</p>

Posts

  • View post

    Walking the walk, here is my TLD allow list for home. Anything I need on blocked TLDs gets added as individual exceptions. ca co com edu gov io mil net org uk us

  • View post

    How long until the other billionaires start making up stories about their own affairs because they&#39;re jealous of the attention given to Huang, just like when they all had to get on the &quot;My AI did some felonies too&quot; hype train?

  • View post

    So how&#39;s your day going?

  • View post

    watching those email queues getting filled like a state run honeypot 🥴

  • View post

    I find it funny that so much of Microsoft is down but GitHub, of all services, still appears to be up.

  • View post

    Who the fuck thought that Node belongs anywhere that OPC-UA is used?! https://github.com/node-opcua/node-opcua/security/advisories/GHSA-xggf-m53x-jc3f An unauthenticated (Anonymous) client can Write protected Variables and Call privileged Methods on any Node that lacks explicit per-node permissions.

  • View post

    RE: https://infosec.exchange/@cR0w/117441794214168313 RIP Server 2012 🫡

  • View post

    Getting ready for Exploit Wednesday next month since it&#39;s the last Patch Tuesday for Server 2012.

  • View post

    Shodan query of the day: https://www.shodan.io/search?query=http.favicon.hash%3A1521142546

  • View post

    No one told me @catsalad@infosec.exchange has a new book out. https://www.worldmarket.com/p/catt-butt-coloring-book-602898.html

  • View post

    Block ms365sso.com ASAP. :brdKnife:

  • View post

  • View post

    Bulletproof hosting network transfers. Keep an eye on that recipient. https://social.bgp.tools/@transfers/statuses/01M6HYT08Z8P88F7J020WCDQWE

  • View post

  • View post

    Did the infosec dot exchange background color just change or am I losing my mind here?

  • View post

    RE: https://digipres.club/@foone/117515687469904550 You heard her. From now on we&#39;re a base9 society and the numeral 4 shall henceforth be an illegal character.

  • View post

    Auth bypasses are so hot right now. https://nvd.nist.gov/vuln/detail/cve-2026-112352 Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection. Attackers can guess default account names such as Admin or sftp_user and submit a forged username cookie to satisfy the...

  • View post

    If you can&#39;t handle me at my fedi, you don&#39;t deserve me at my LinkedIn.

  • View post

    I&#39;m really hoping I can get my ducting replaced to get my heat on soon.

  • View post

    You. Had. One. Job. https://nvd.nist.gov/vuln/detail/cve-2026-96760 Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.

  • View post

    Palo finally published an advisory outlining impact from CVE-2026-111497 in brotli. https://security.paloaltonetworks.com/CVE-2026-111497 A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream....

  • View post

  • View post

  • View post

    If your org&#39;s response to this week is &quot;What can we purchase to get us out of this situation?&quot; instead of something like &quot;How can we enable the analysts we have to do their job and get us out of this?&quot; then you are doing it wrong.

  • View post

    @nerpulus@mastodon.online https://masto.deoan.org/@neurovagrant/117475385470377669

  • View post

    Had anyone tried making cybersecurity vendors aware of cybersecurity instead of just focusing on practitioners? I feel like there may be a missed opportunity there, especially with how this week has gone.

  • View post

    The &quot;h&quot; in &quot;php&quot; is an upside down &quot;4&quot;. Coincidence? I think not. :catte:

  • View post

    Don&#39;t let the Node vuln slip through the cracks just because it&#39;s harder to meme.

  • View post

    Has anyone been able to successfully convince their execs that the takeaway from all this &quot;Vulnpocalypse&quot; or whatever is that architecture is actually important and to not blindly trust the claims of vendors? I&#39;ve been trying unsuccessfully. The general consensus seems to be &quot;We can fix this exposed attack surface by purchasing more attack surface.&quot;

  • View post

    Is today the day people realize that full disclosure is responsible disclosure? The FUD around the embargo nonsense has made things so much worse.