Replying to @krypt3ia@infosec.exchange
@krypt3ia@infosec.exchange "Ordinarily he is insane. But he has lucid moments when he is only stupid." - Heinrich Heine
Remote
Geoff
@sternecker@infosec.exchange
mastodon 4.8.0-alpha.3+glitchBSidesCLE 2026 | ISC2CLE
Cybersecurity | Linux
#InfoSec #Linux #OpenSource #LGBTQ #Vegan
Brain dumps.
321 Followers
440 Following
50 Posts
Joined December 05, 2022
Replying to @nuintari@mastodon.bsd.cafe
@nuintari@mastodon.bsd.cafe hearing has been gone since about 04:00 Tue. Rcvd steroid injection Wed. Taking meds for vertigo, an oral steroid, and a med for nerve damage.
Sudden hearing loss. Right side 100% loss including via bone induction. Side effects are vertigo, nausea, spins. Left side was already reduced. About 70-80% deaf.
Not sure if this is related to rapid weight loss. Went to Germany and walked 10+k per day, ate better quality food. Scale at doctors office indicated I'd lost 20lbs in about 14 days.
From duckduckgo search vestibular hearing loss can be associated with rapid weight loss. Fantastic.
440 CVEs dropped to kernel cve-announce in the last 24 hrs?!?!?!?
Whoa, calm thy horses! It looks like a backlog dump of resolved issues all sequentially numbered. No RCEs and all resolved.
#minimalist #Linux #Selfhosting #selfhosted #selfhost #InfoSec #Exploit
Two previously disclosed CVEs are actively-weaponized kernel root exploits. GhostLock CVE-2026-43499, and Bad Epoll CVE-2026-46242, are both public highly reliable exploits. Ghostlock also appears to enable a container escape and Bad Epoll is also working on Android.
Both are fixed in kernel 6.12.96-1.
If you have local user, upgrade the kernel & boot it.
BRB have to reboot :)
#minimalist #Linux #Selfhosting #selfhosted #selfhost #InfoSec #Exploit
STRONGER PROSE IS NOT ENFORCEMENT
A project to test AI guardrails.
https://github.com/sternecker/guardrails
STRONGER PROSE IS NOT ENFORCEMENT
There is a notice in the repo that it is not to be processed. There is a script that will add markdown to the beginning of a PDF. There is an AWESOME original pdf from @pluralistic@mamot.fr and an updated.pdf with the new preface notice.
A few things to share, nginx: CVE-2026-42533 dropped yesterday 2026-07-15. It is fixed in nginx 1.31.3, also released yesterday. CVSS 8.1 or 9.2 depending on the nginx version. It's a heap buffer overflow in the map directive when regex... regardless, it is unauthenticated, needs a custom HTTP request, can crash it or lead to code execution if Address space layout randomization (ASLR) is disabled, or bypassed. Don't disable memory randomization. Not sure how to bypass ASLR, I'll have to look into that.
glibc CVE-2026-5450 originally disclosed 2026-04-20 so it's "not new." What's new is the SSVC exploitation flag flipping to "poc" within the last 21 days meaning a proof-of-concept surfaced recently for an April CVE, which is the "weaponized old CVE" pattern we see regularly. No vendor patch exists? Maybe i'm missing it. CVSS 9.8, scanf %mc off-by-one heap overflow with an explicit width >1024... real-world exposure is low even with a PoC out.
Debian 13.6 was released 2026-07-11. It's a point release, bundled a ton of security advisories including and an expired Secure Boot CA fix. It's the routine patch cycle.
Make it so.
#minimalist #Linux #Selfhosting #selfhosted #selfhost #InfoSec #Exploit
A couple things this morning. CVE-2026-46242 "Bad Epoll" Linux kernel, CVSS 7.8, local privilege escalation was already mentioned CVE published around May.
1: What's new today: it is now fully weaponized and publicly written up. It's a use-after-free race in the kernel's eventpoll subsystem (ep_remove()/ep_remove_file()). An unprivileged local user can win a race condition and get root.
2: Affected: kernel 5.10 through 6.11.
3: The Attack surface is broad because epoll underlies nginx, Node.js, Python asyncio, databases, Android's event loop.
So, basically anything async I/O.
An App can be the foot in the door, the race condition can lead to root.
I'm running Kernel 6.12.94+deb13-amd64. So driving on.
#minimalist #Linux #Selfhosting #selfhosted #selfhost #InfoSec #Exploit
Podman CVE-2026-44517: A breakout can happen during container build using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive. This is weird, essentially it is a path traversal, which has been fixed in 1.43.2.
Still pulling malicious code into a container, we can agree, is not ideal path traversal or not.
Have not explored the exploitation on this one.
#minimalist #Linux #Selfhosting #selfhosted #selfhost #InfoSec #Exploit
Linus wept, I'm still going through the CVEs.
AI will totally tell you how to use dd to wipe /dev/sda via a configuration management platform of your choice. If you are using agentic AI it will write the playbook, or whatever for you.
The "weaponization watch" script pulled up two Debian-13 kernel root exploits with public PoCs that the KEV list doesn't include:
CVE-2026-46331 "pedit COW" weaponized sometime around 6/16, unprivileged user to root on Debian 13 trixie (the user namespaces is open by default).
RHEL 10 is also in scope (again, local priv escalation not remote.)
CVE-2026-46333: ptrace logic flaw, local root + credential disclosure, exploits circulating.
Then from yesterday:
DirtyClone (CVE-2026-43503) confirmed against Debian.
#minimalist #Linux #Selfhosting #selfhosted #selfhost #InfoSec
Was disheartened to learn that lucid electric vehicles are also oligarch backed by a Saudi prince.
Replying to on navi.lain.day
@radhitya@navi.lain.day wasn't familiar with it, thanks. Looks like it had been idle for a while but has a recent update. cppcheck returned with no critical and a medium for 32-bit builds, which doesn't apply in my case.. Thanks!
PinTheft: CVE-2026-43494, a local root exploit chaining two Linux kernel subsystems. A local unprivileged code execution, needs the RDS/RDS_TCP kernel modules to be loadable, io_uring enabled, a readable SUID-root binary, and just x86_64. Not remotely exploitable, it's a local-root escalation, same class as the DirtyClone family.
I previously talked about kernel modules, but assume that an exploit WILL LOAD the modules even if they are not already loaded into the kernel.
That being said, this is still just another local priv escalation.
#minimalist #Linux #Selfhosting #selfhosted #selfhost #InfoSec #Exploit
Is the TV series silo based on the book wool?
Replying to @ilyess@mastodon.online
@ilyess@mastodon.online I'm just doing the default mastodon app and it has been a solid experience. Not sure what I'm missing that is available via other apps.
I listen to the band 7horse quite a bit. The "station" had been playing Cam Cole and I really have been enjoying the music. I had no idea that. Cam Cole is a one man band. Holy crap.
Amazing.
Pew pew lasers for space debris.
laptop is hung trying to *stop* containers. :/
"Hot rock make steam. Steam make boat go."
#QuotesFromWork
Phone: Charging rapidly, full in 3 hrs.
I don't know that our definitions of rapidly are the same.
From all the shows I watched as a kid, I thought there would be more quicksand.
Streaming music and a new song is playing, I look up who it is because I like it. It's freaking AI. Damn it. That's not cool, I hoped to learn about a group of actual musicians or even solo artist that I could listen, watch, maybe go see, and no. Hopes dashed.
Who is it based off, what prompts, so I can learn more about the sources. sigh filled Sunday
#AI #Music #SundaySigh
some people are harbingers of chaos.
RefluXFS (CVE-2026-64600) is a race-condition in the Linux kernel's XFS copy-on-write path.
(Kernel updates are available.)
On an XFS filesystem with reflink enabled (Default on RHEL and similar, plus Amazon Linux), if you win a race during the copy-on-write remap lets the unprivileged local user overwrite the on-disk contents of any readable file on that volume including /etc/passwd or a SUID-root binary.
What makes this wild: the changes persist across reboots, produce no kernel logs, bypass SELinux and Kernel Address Space Randomization (KASLR).
PoCs reliably exploiting the vuln.
Check if you are in scope:
# xfs_info / | grep -i "reflink=1"
#minimalist #Linux #Selfhosting #selfhosted #selfhost #InfoSec #Exploit
One down a bunch to go
One more town another show
This one seems interesting.
Podman CVE-2026-57231
A malicious container image with a malformed Env entry (a key with no value) can trick podman run into leaking the host environment variables into the container. The wildcard glob makes it worse, it can return all host env vars from the launching session without knowing their names.
#minimalist
#Linux #Selfhosting #selfhosted #selfhost #InfoSec
#Exploit
Air quality is bad. A boil notice for water and filter notice because boiling does not remove lead. Ground contamination prevents gardening without raised beds.
Cle -> Atl breakfast of champions.
Replying to @Sempf@infosec.exchange
Attempts to detect/mitigate CVE-2026-46242 "Bad Epoll" Linux kernel, CVSS 7.8, local privilege escalation.
https://github.com/sternecker/midil/blob/main/privesc-detection.md
We lost Sam Neill.
BSides Cleveland 2026 is in 33 days. #BSidesCLE
Replying to @cR0w@infosec.exchange
If my electronics are spying on me.. well, let's just say right now, it's seen some things.
Replying to @nuintari@mastodon.bsd.cafe
@nuintari@mastodon.bsd.cafe if it is, I don't know how you do it. This sucks.
I have an older laptop. I run a lot on it, containers, local AI models. The thing that kills it, aide. :(
"We" are clearly not doing sandboxes and guardrails correctly. Both Anthropic's and OpenAI's models breached test-environment boundaries during UK AI Security Institute evaluations. OpenAI's escaped a sandbox into real Hugging Face infrastructure (something like 17,600 logged actions over 4 days); while Anthropic's used fake identities to reach 3 real organizations from a test environment.
These stories made it to NPR. So, mainstream.
#AI #Guardrails #Sandbox #InfoSec
"Everything was good until the CPU started pegging."
Me: "heh, I didn't know CPUs would do that."