Recent computer adventure, triggered by my Whonix VM no longer connecting to Tor, presumably by being too old of a version:

While I was able to get an x86 version of the Whonix VM working fine on my Mac (after tweaks to switch it to properly boot using UEFI), it is incredibly slow when emulated on this old M1 computer. So why not try building my own ARM Whonix VM? (They don't offer a pre-built VM in anything other than x86). How hard could it be??

I'm used to the standard building-open-source software workflow:

1. Start build
2. Run into error due to dependencies or other problems/incompatibilities.
3. Fix <problem>
4. Lather, rinse, repeat until you give up.

As it turns out, the Build your own Whonix instructions had a trivial set of missing dependencies, that was clearly indicated by the build script as the cause of the problem (sq, sqop, and sequoia-git), and it also was missing a command-line argument that was also clearly indicated as the problem (--freshness frozen)

After over a half hour of running countless commands and building components and doing things with them, the build command completed with zero errors, and I had a .vdi image ready for use with VirtualBox!

Because I'm not particularly fond of VirtualBox, I imaged the disk with CloneZilla so that I could restore it to a newly created Parallels VM.

And, after reconfiguring the WAN-side network, and installing/configuring isc-dhcp-server to provide IP connectivity to any client on the LAN side, I now have an internet-providing VM that's guaranteed to have all traffic go through Tor. All transparently at the network layer to the client machine.

What can we do with this? Now I can have any VM where the internet is provided by Tor, so that any malware or sketchy code that is running will:

1. Not come from my home IP address.
2. Not have access to any other system on my trusted home network.

And unlike my old emulated x86 Whonix VM, it actually starts up and runs incredibly fast. And if I want to intercept HTTPS traffic, I can pair it with a Tapioca VM, which gives me the combo of Tor isolation/anonymity via the Whonix VM and also HTTPS inspection/modification via the Tapioca VM. 🎉

Props to the Whonix devs for making an incredibly complex/involved built script that simply works, without a single error.

Now, I'm not an expert on theology but

our disappearing night skies …

Photo of 14,000 satellite trails shows how busy space is becoming

Astrophotographer and teacher Brendan Larsen spent 2 hours taking 578 photos of one section of sky in New Zealand to see how satellites are changing our night skies. These shocking images reveal their impact

https://www.newscientist.com/article/2595529-photo-of-14000-satellite-trails-shows-how-busy-space-is-becoming/

I would be quite pleased if I never ended up in a situation where I was reporting a vulnerability via @Hacker0x01 again.

we're currently in 2024

The confidence of this AI is just <chef's kiss>!

I was required to trick the AI by changing my title from including CVE-2026-114820 to CVE-[redacted]-114820 before I was allowed to submit it.

Basically we have here a case of HackerOne solving the AI slop problem by introducing a layer of AI slop.

I've written a blog - Anthropic have been hacked to deliver remote access malware to millions of endpoints where developers use Claude Code.

https://doublepulsar.com/anthropic-hacked-to-deliver-remote-access-trojan-to-claude-developer-laptops-worldwide-1148a92baae2

I just ran a check across / on my mac and found 43 #emudhra vulnerable vendored bundles.

That's:
- 30 (!) bundles from different versions of certifi across the 8 different versions of python and in the various venvs
- Apple provided /Library/Perl/5.34/Mozilla/CA/cacert.pem
- aws-cli vendored botocore
- Zoom's vendored bundle
- a homebrew "portable-ruby" version
- as well as a few other commercial vendors

So yay. This is going to linger everywhere for a very long time to come.

I suppose I have two wishes:

1) I would really like it if I never had to troubleshoot this ever again.
2) If Windows believes that a signed WDAC policy isn't to be trusted for any reason, then:

• Tell me that this is why Windows won't boot and any repair is guaranteed to fail.
• Tell me that temporarily disabling SecureBoot will let me get into Windows to clean up anything that may have gone sideways.

kthxbye

/me files four UI bugs at https://github.com/mastodon/mastodon/issues

I quite dislike the new Mastodon UI.
Sure, nobody likes when things change how they look. Familiarity is comforting.

But I'm quite certain that I used to be able to type / and the cursor would go directly to the on-screen "Search" box. Now I need to use my pointer device to manually click on the "🔍Explore" button and then type what I'm looking for. 🤦‍♂️

Aside from the extra click required, I as an English-speaking person clearly understand that "Search" is probably what I want to use when I want to search for something. But "Explore" ???

I find it odd that SpaceX chose Starlink as the name for their communications platform, when Subaru already had a communications platform called Starlink.

And apparently fully updated macOS curl will happily use the eMudhra certs today. 😂

If you want to manually remove trust for these certs in various macOS CLI components, you can do it, apparently

Reminder to everyone to let a speaker know if you enjoyed their talk or learned something from it. It really means the world.

It’s 1986 and my mother is shouting at me to stop touching the computer, I’m wasting my life.

It’s 2016 and I am fixing mother’s computer, regaling her about the variety of rich opportunities computer touching has given me in my life.

It’s 2026 and I am cursing my mother for ever letting me touch a computer. I have wasted my life.

Dream Group on php2shell exploitation of a firewall vendor's management interface:

The affected devices run specific versions of a large vendor’s firewall software. For security purposes, we are not disclosing the vendor or the affected versions, and the vendor has been notified.

Palo Alto:

We are aware of heightened threat actor activity targeting internet exposed management interfaces of PAN-OS devices (NGFW and Panorama) and recently disclosed vulnerabilities.

🤔

Palo-Alto just sent out a customer alert about PHP2Shell:

“We are aware of heightened threat actor activity targeting internet exposed management interfaces of PAN-OS devices (NGFW and Panorama) and recently disclosed vulnerabilities. If you haven't already done so, we strongly advise you to immediately protect your devices by following management interface best practice”

Somebody posted a github repo that claims to have about a dozen or so PHP 0days.

Based on vulnerability count, words per document, and the self-congratulatory Publication-ready security research right at the top, I have to say that it has a preponderance of the AI slop smells.

I mean, it could be real, but they've somehow managed to put together a pile of stuff that should be a goldmine for a vulnerability researcher, yet presented it in a way that I have no desire to look at any of it.

"RedEye Security" did a blog post about it two days ago, yet nobody noticed.

For those with more mental fortitude than I: Thoughts?

@hanno @alanc @sleevi @wdormann I think I found other bypasses: https://sylvainpelissier.gitlab.io/posts/2026-10-26-java-certificate-blocklists/

There we go. Release notes are live

There are 163 fixed CVEs.

iOS 27.2 is out.
Presumably there will be some CVEs for it, but the Apple security releases page doesn't have 27.2 (yet?)

There was a steal my bitcoin challenge which offered some bitcoin if the PHP instance could be compromised. It was won after 19.28 hours.

The solution exploit has been posted, which I've confirmed to work.

From the exploit:

The offsets and multipart shapes are calibrated for the challenge's observed Alpine PHP 8.4.26 layout.

Which was presumably observable from the live server. The exploit targets a combination of stock nginx:1.27-alpine and php:8.4.26-fpm-alpine3.23 docker images that talk to each other via the php development CLI server. Note that this is probably not representative of what you might see in the real world, and more like what you might see in a CTF.

However, what you might see in the real world with a real product might be even more terrifying, such as current products that are built on FreeBSD versions too old to even support ASLR.