zomg on my primary device:

locate cacert.pem | xargs grep -l 'emSign.*G3' | wc -l

returns 92, mostly in python virtualenvs. what a cancer.

ok, what's next? #gitlab's next. also high value #RCE: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/

RE: https://fosstodon.org/@alpinelinux/117479698877821741

AI crawlers blocking the production and delivery of patched versions of php.

RE: https://social.treehouse.systems/@mgorny/117476539516487756

this, so much this:

i also love the aspect of, how do i update pip without using a pip that is vulnerable to MITM attacks.

RE: https://infosec.exchange/@yossarian/117474308852690763

zomg, this is bad:

> pip always loads the CA certificates from its vendored certifi in addition to the system trust store, and there is no supported way to disable this. REQUESTS_CA_BUNDLE / --cert only add CAs; truststore is used “in addition to certifi” by design. As a result, any pip < 26.2.2 will keep trusting the compromised intermediate CAs regardless of the system trust store, so distrusting them at the OS level is not enough.

why vendor and not use the system cert store? seriously???

announcing a beginner workshop for drunk chainsaw juggling. BYOB (bandages).

fixed a bug in pysodium (and made a new release). the submitter said this:

> And specially thanks to the author for trying to maintain the Python package compatible with ALL versions of libsodium, it is really a notable effort that other crypto libraries do not provide.

unsure if this is an LLM or proper biologically sourced compliment, but it is appreciated.

#ivanti has some #itw #exploited #0day
https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/

/cc @GossiTheDog

https://github.com/h0m3us3r/w1700k-sdr

Turns a Gemtek W1700K Wi-Fi 7 router into a wideband software-defined receiver. The router's MediaTek MT7996 radio captures raw 14-bit IQ at up to 320 Msps, its Airoha AN7581 SoC streams it over 10 GbE, and a Linux host shows it as a live spectrum and waterfall in the browser, with the receiver's controls next to it.

#sdr #radio #hack

i just had the horror idea that the IETF RFCs will now be completely meatproxied. 🤮

#yolo

RE: https://mastodon.sdf.org/@bitmage/117419095710341813

@weirdunits

SecretStack is a Zig library that runs code handling secrets on a separate stack. It wipes the whole stack and the CPU's scratch registers when your function returns.

https://github.com/jedisct1/zig-secretstack

by @jedisct1

#zig #secrets #cryptography #programming

RE: https://mastodon.social/@scalzi/117378303433618604

pre-ordered.

so, uhm, @radicle i'm a huge :fan: but this is embarrassing: https://radicle.dev/2026/09/23/disclosure-of-vulnerability-in-network-protocol.html

is there any chance you get a good security / general code audit please? oh, and a full spec of your protocols would also be extremely useful.

#radicle

reading a baking recipe, and am confused at the temperatures, then it hits me - it's cultural, i wonder why not measure temperature in football fields or library of congress?

stf's law:

when a politician or a political initiative says it's about protecting kids, you can be sure it's either dystopian shit, or some capitalistic colonization of public goods.

(probably both)

dear fedi, i need some help, i remember reading somewhere that #JIT #vulns are dominating the attacks on #browsers, but i cannot find where i read it. if anyone has pointers to #statistics re: JIT vs non-JIT vulns in browsers, i'd be super helped :)

RE: https://mastodon.social/@joxean/117277450350248791

i wish @Mastodon would have a follow thread feature...

RE: https://ec.social-network.europa.eu/@EUCommission/117213231526753454

not only is this a very good initiative (although cash-based, human operated vending would be even more awesome) this is also about the 1st time i see the @EUCommission engage multiple times in a "thread".

nice to have good news, and positive interactions, need moar!