Based on these droopy leaves, I think it's going to be an opalka! 🎉

You remember that time DRAM manufacturers were caught acting as a cartel to fix prices and the fines were smaller than the profit they made as a result? You're never going to guess what happened next!

Pretty much every mobile app update:

Bug fixes and performance improvements

If this were true, apps on your phone will become faster as your phone ages. Why is everything a lie?

“Why is it so?”

TIL Glass is elastic

And the power of whiskey knows no bounds

And somehow I seemed to have missed the message that the original blog site was no longer going to be used. And on seeing the new site, I see a post that indicates that RoguePlanet works even when Defender realtime protection is disabled

And yeah, even on systems that don't have Defender realtime protection enabled, RoguePlanet still works. 😂

OK, I looked at one more, because I had free cycles, and I apparently don't value my own time.

The imagemagick "vulnerability":
If you run imagemagick from a special harness designed to exploit imagemagick, imagemagick will load an EXE file from the path you specify to the harness.

How does the exploit work? It adds a PATH environment variable to the directory where the attacker-provided gswin64c.exe is located, and subsequently executed.

You can replace "imagemagick" with <anything_else> in this exploit. This is how Windows works. If you can set a PATH to an arbitrary directory, Windows will look for things there.

Anyway, I'm calling it. This exploitarium repo is pure slop. But that won't spread people who don't bother looking at the contents from spreading the news.

OK, so it seems that the failing 256GB SATA SSD doesn't falsely report its capacity at least, according to f3.

Rather, it's just a low-quality drive.

  Data OK: 233.66 GB (490011312 sectors)
Data LOST: 0.00 Byte (0 sectors)
           Corrupted: 0.00 Byte (0 sectors)
    Slightly changed: 0.00 Byte (0 sectors)
         Overwritten: 0.00 Byte (0 sectors)
Average reading speed: 374.39 MB/s

Because I'm slightly masochistic, I looked at the ffmpeg PoC.

If you run the compiled C code, it does indeed create a /tmp/ffmpeg_rasc_exec_demo file as proof of exploitation.

Does this actually prove anything? No, not really. The C program you just ran is a contrived application where instead of giving ffmpeg (libavcodec) an image buffer, it gives it a specially crafted struct:

typedef struct DemoChunk {
    uint8_t plane[64];
    demo_callback cb;
    uint8_t palette[1024];
} DemoChunk;

Which when contrived PoC code runs, lands in code that does

    puts("[callback] hijacked callback reached");
    system("touch /tmp/ffmpeg_rasc_exec_demo");

Is there a bug in ffmpeg? Perhaps.
But all this PoC proves is "Contrived harness designed to do <thing> does <thing>. Does this PoC prove that people in the real world have anything to worry about? No. At least not based on this PoC. If your attack involves the victim running a crafted malicious executable, then fine. Have it do that you want. You don't even need ffmpeg.

I didn't think that PoC||GTFO would need clarification about what it means. Yet here we are.

I probably won't look at any more of these, unless a more-masochistic individual has the patience to sift through them and point out what might be of interest.

Somebody posted a bunch of exploits on GitHub that claim to be 0days.
https://github.com/bikini/exploitarium

Let's look at the first one: A 7-Zip MotW bypass.

Problem #1: 7-Zip DOESN'T EVEN WRITE MOTW FOR EXTRACTED FILES BY DEFAULT. This doesn't have a CVE, because apparently CVE is difficult.

Problem #2: If you are a security-conscious person who enabled writing MotW in 7-Zip extracted files (contratulations!), you might notice that the archive contains a :Zone.Identifier:$DATA (MotW ADS) file in it and recognize shenanigans.

Problem #3: When you extract the file, you will be presented by the following dialog asking if you want to overwrite the ::DATA (primary data stream) of the file. And if you got this far, you're a security-conscious person, so you won't do this.

If you get past all of those hurdles, and click Yes in the dialog, then yes, you'll have a file extracted from a RAR that came from the internet that contains an attacker-controlled MotW (that says it didn't come from the internet).

Is this a vulnerability? Sure. But it both relies on a non-default 7-zip configuration, and it also relies on user interaction to succeed. As such, I can't say that I'm terribly interested in it.

How about the other 22 exploits in the repo? I skimmed through a few, and some seem quite contrived (sort of like the 7-zip one), but some may be legit.

But alas, I don't have the mental fortitude to sift through it all, based on what I've seen. Maybe somebody else here will.

I think my membership to the Tinned Fish Club is one of the best gifts I've received.

Drink coasters should:

• Be inexpensive
• Absorb condensation
• Prevent liquid from reaching the table

After much searching, I found zero products that meet all of these requirements.
My solution:

1. Get some cheapo felt coasters
2. Brush the bottom with Flex Seal.

Is this the point that I go on Shark Tank? 😂

As for the actual vulnerability, there's code in shell32.dll that will call AddZoneIdentifier() IFF Windows feature 2578215227 is not set. In March, Windows feature 2578215227 was enabled, resulting in the vulnerability where files extracted from CAB files will not be tagged with MotW.

In April, feature 2578215227 was turned back off again, returning Windows to pre-March behavior, where contents extracted from CAB files from the internet will carry a MotW, as expected.

I don't know if Microsoft is planning on updating their code to allow feature 2578215227 to be turned back on, whatever it is.

OK, so my "Defense in Depth" credit in April's update was not for the MotW regression in CAB files. It was for another thing I reported to MSRC in September:
Despite being listed in the perpetually-out-of-date Microsoft recommended driver block rules, some drivers are still allowed to load. This was addressed in April's updates. No CVE or public mention of the problem, but I was acknowledged for reporting something.

The March 2026 Windows regression where CAB file contents were no longer tagged with MotW was indeed reverted to pre-March behavior with April's updates, but received neither a CVE nor an acknowledgement for me reporting the problem to MSRC.

Good times.

Remember:
While there are indeed some good Prime Day deals out there, those deals are mixed in with the not-deals. But the Prime Day Deal decorator is used quite liberally, for obvious reasons.

Before clicking that purchase button on your incredible deal, check the product listing on the CamelCamelCamel website to actually see how much money you're saving.

It does lie about Power_On_Hours, though. (It apparently uses days instead).

SMART Self-test log structure revision number 1
Num  Test_Description    Status                  Remaining  LifeTime(hours)  LBA_of_first_error
# 1  Short offline       Completed without error       00%         2         -
# 2  Short offline       Completed without error       00%         1         -
# 3  Short offline       Completed without error       00%         0         -

I suppose it avoids the integer overflow that I see on long-lived devices. 😂

Note that not all .URL files go completely undetected by AV products.
Here is one that's detected by 3 out of 60 AV products on VirusTotal (Avast, AVG, and NANO-Antivirus).

It gets a .vbs file from a known-malicious domain, which retrieves and executes a known-malicious EXE

Do yourself a favor and neuter .URL files as outlined in my blog post. Nobody needs this nonsense.

I'm so old that I remember when Check for updates... in VMware checked for updates.

Now the only option is a Learn More... button in the resulting dialog.

Which dumps you at https://techdocs.broadcom.com/us/en/vmware-cis/desktop-hypervisors.html
Which redirects you to the top-level Broadcom documentation page https://techdocs.broadcom.com/
Where you can manually do a search that's handled by AI.

Note: I primary use Parallels on my mac, but I had to test something in VMware for reasons.

"The data you share has a way of coming back to bite you,” EFF’s @falsemirror told the BBC. “Even if you trust the business collecting it, there is always a risk of them sharing that information with other businesses or governments.”
https://www.bbc.com/news/articles/cpwerjy20kyo

I deleted a post about Claude asking for PII due to my bad memory. It apparently was OpenAI that wanted such nonsense.

I guess the days of anonymous internet are over. We had a decent run.

In a new privacy policy, Anthropic says Claude will soon require you to upload your driver's license or passport for a variety of reasons. The ID checker is Persona, a firm funded by Trump ally Peter Thiel. As a U.S. company, Persona is also subject to gov't demands for people's verification data. 👀

https://techcrunch.com/2026/06/22/anthropic-says-claude-may-want-to-see-your-id/