ignore the news
make yourself a 3 cheese garlic bread focaccia loaf!

know whats funny, that i just realized about 'risk acceptance forms'?

even if some business unit signs one and says they accept the risk for whatever it is...

guess whos problem it is if it gets popped?
guess who has to do IR?

not them

yeah this is like java rhino all over again, except in reverse. instead of:
- user goes to site
- java applet runs and executes arbitrary code
its
- malware hits site with unauth rce against php
- site runs command

it wont let me attach videos and stills at the same time.

here's some info about the giant php bug dropping tomorrow:

https://www.openwall.com/lists/oss-security/2026/10/20/34

hopefully mastodon doesnt absolutely destroy the video quality, but it appears to be unauth php rce.

which means every firewall on the planet thats not patched thats just php under the hood and has its management interfaces exposed is potentially a target

wtf is happening

microsoft doesnt want you using exchange

https://www.theregister.com/software/2026/10/19/admin-i-spent-all-weekend-on-my-servers-after-microsoft-breaks-exchange-server-with-october-updates/5303724

@flyingpenguin @tychotithonus seems like, yeah - and it ... doesnt make sense

@theregister @TechCrunch @briankrebs @metacurity

it does not bode well that when i explained what the issue was, and several other folks chimed in, frenk, HA's lead dev, closed the issue and told us all to get stuffed. closed/wontfix.

hey @theregister @TechCrunch @briankrebs @metacurity

you all wanna have a look at this?
home assisstant is doing some incredibly dumb stuff here and its worth getting the word out, because im sure nobody wants to be opted into some plumbing that scans their HA install, finds secrets and just .... sends them places without consent

this is unacceptable

HA is sending credentials up the line without opt-in, and their head dev refuses to acknowledge that this is a problem.

this is the ssh xz issue all over again.
someone is gonna drop code into HA to abuse this mechanism and its going to be a big ugly disaster.

stop updating home assistant immediately

hey @homeassistant

what the fuck

https://github.com/home-assistant/home-assistant.io/issues/49314#issuecomment-6222899100

RE: https://infosec.exchange/@kcarruthers/117441120036526489

been screaming this for months now

theres been a ton more news that i could add to this thread, but heres todays newest: https://www.theregister.com/paas-and-iaas/2026/10/13/cheap-chinese-and-open-source-llms-could-trigger-trillion-dollar-ai-infrastructure-reset/5302774

it basically supports this whole 'musical chairs when the music stops nobody gets a chair' concept.

the supposition i have is that some org somewhere down near the datacenter / construction layer will refuse to finance the next round, and the valuation for the orgs depending on that datacenter will crater, and it will cascade upwards

that was like 2 years ago. if i were to get the same request today?

id probably use the dji mic mini 2 or 3 and put the same olympus recorder in an adjacent room on the 'capture when you hear audio' setting, then pipe it all to a tts tool and stream the output via websocket or some js log-tailer with maybe a blonk sound and a push notification so i could tune in when it heard stuff

and thats not even getting into 'real surveillance equipment'.

for a while i had a vc customer in sf.
they asked me to plant bugs expressly to see if the staff ever found them, because onsite security was tasked with doing some light searching.

one bug was the hdmi mitm thing from hak5 that sends screenshots. totally not found.

the other was, straight up, an olympus personal dictation recorder gafftaped to the underside of a table.

the whole affair was to throw a dart to see just how advanced these things needed to be in order to be found..

they werent

https://www.businessinsider.com/openai-security-threats-hidden-recording-device-planted-offices-2026-10

oh, someone planted a bug in an openai meeting room?

color me surprised

RE: https://infosec.exchange/@BleepingComputer/117434375619586973

people still use ivanti?!

here internet, i made you a gif!

you can use it for .. lots of stuff