Layer 8½

XSS in Cloudflare's /cdn-cgi/image/

The cybersecurity industry needs to calm down. There is no cyber AI apocalypse. There is a lot of crying wolf. The ratio of vulns to CISA KEVs (Known Exploited Vulnerabilities) actually went down last year, and continues to be super low. The clamour for budget and money will backfire.

Girls who use the terminal will be like "you can just do that in the terminal"

this is categorically insane

Trick or treat! Like this post to give me candy. You can create your own costume on mu.social

The Visionaries are those who see a better future and are working to build it. They are the researchers, regulators, advocates, engineers, and executives who believe that software can and must be safer.

www.theguardian.com/society/2026... this is scary... If someone is prepared to go to this level for disposable vapes - imagine what levels they will go for when it's really important (like an election or a referendum....)

FortiBleed 2.0 Reveals Thousands of Fortinet VPN and Active Directory Credentials in Exposed Configurations

Bluesky seem to have had some problems this morning, our Eurosky infrastructure has been operating as normal. On @mu.social go to settings -> networks services -> content service and select ‘Eurosky’. Remember this next time you get an error :)

It's Anti-FUD software. Hyberbole Detection and Response. Your Insecurity Information and Event Management.

It's Anti-FUD software. Hyberbole Detection and Response. Your Insecurity Information and Event Management.

I’m not terribly worried about this, as there are a number of factors that have to be in place for it to be useful to attackers, but this is yet another example of a botched embargo on disclosure of a vulnerability.

This is happening to me, but with "tips" about a huge range of crypto-related issues (or perceived issues) people are personally struggling with. The volume is genuinely challenging to deal with.

The Federal Election Commission doesn't administer US elections, but it does track spending by candidates and political committees. A lengthy outage could harm transparency only a week out from the midterms, as @dawnkopeckinews.bsky.social's story indicates: www.reuters.com/technology/h...

Huh, I just got an infomail about this. I'll be watching that.

Cybercriminals are targeting U.S. universities with job scams, fake scholarship offers, and account takeover (ATO) attacks. Our new Discarded podcast episode shares what you need to know. 🎧 www.proofpoint.com/us/podcasts/...

Does this make "4" the most common independently generated private key in production use?

sigh

we're fucked www.derstandard.at/story/300000...

Tracking attempted exploitation is not what I thought the KEV did. It's not the Known Attempted Exploitation Database? I guess it's good to clarify but I'm left confused and judging by other stories on this, there is a LOT of confusion out there on this addition

Great work from Joe Slowik on rationally handling the vulnpocalypse.

🧵

I’d love for someone to run the numbers on U.S. hospital, state government and government org breaches before and after the various cuts to CISA, etc.

Hackers repeatedly breached suppliers holding UK police data, watchdog finds

You can be aware and still get compromised. Prevention matters, but limiting damage, stopping attackers from spreading, and recovering quickly matter just as much. Part 4 wraps up my case for replacing Cybersecurity Awareness Month with Cybersecurity Readiness Month. semgrep.dev/blog/2026/cy...

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by Thursday.

"AI agents are agents of the person or organization that deploys them—and should be treated by the law as such. ... To allow businesses to hide behind the excuse of faulty AI ... would introduce disastrous incentives for corporate misbehavior" www.schneier.com/blog/archive...

The EU's Cyber Resilience Act (Regulation 2024/2847) is the first EU-wide law imposing binding product security requirements on software and connected hardware, regardless of where the manufacturer is based.

Today, noyb filed 5 complaints against Scale AI, which operates the AI training platform Outlier. The company illegally tracks its platform workers - and forces them to (repeatedly) go through an invasive biometric verification process. noyb.eu/en/ai-traini...

Allein durch die mitgehörten Telefonate im ICE zur it-sa könnte ich ein Opsec-Fail-Blog füllen.

I’m seeing people reacting by pointing out that he’s obviously wrong. I appreciate that, but it’s also a pointless exercise. The problem isn’t that he’s wrong. The problem is that this is normal in American politics — and it’s been normal for a while.

"47% were already in haveibeenpwned.com"

Ich bin als #Arbeiterkind aufgewachsen. Dass Chancen ungleich verteilt sind, wusste ich lange vor meinem Politikstudium. Heute protestieren weltweit Menschen gegen fehlende Perspektiven. Wir reden über brennende Autos. Warum so wenig über ihre Forderungen? perspective-daily.de/article/5385

Oh Windows is going to be BAD bad, I see

The US government has imposed severe sanctions on the International Criminal Court, because it is not happy with some of its judgment (and presumably, judges). [1/3]

Elon Musk has spent more money on American elections in the last two years than George Soros has in his entire life.

I wrote about how two bugs in PHP almost burned the internet to the ground, why it broadly hasn't (yet), but how the PHP-ocalypse is likely to be the first in a wave of aging internet tech that *will* inevitably break — it's a matter of time. Bypass for ad-blockers: web.archive.org/web/20261026...