RE: https://infosec.exchange/@mayahustle/117406250925641406

I have an unlocked Frontier AI model at home, and I’ve spent the past month generating literally thousands of malware samples doing all kinds of things, and running them through AV scanning and EDR tools.

Basically 100% detection rate across every major vendor. Out of the box, default settings on the security tools.

It didn’t help as an attacker at all, if anything it made me easier to detect.

No idea what Jimmy’s presentation is going to be but I’d suggest attending if you’re there.

@GossiTheDog

Qnap....
https://www.qnap.com/en-us/security-advisory/qsa-26-18

Synology...

https://www.synology.com/en-global/security/advisory/Synology_SA_26_14

Asustor...

https://www.asustor.com/en-gb/security/security_advisory

Terramaster...

RE: https://infosec.exchange/@ciaranmartin/117486889924241077

Checking on Twitter takes of the PHP vulns was a mistake.

#東京カメラ部
#tokyocameraclub

Also hp system management homepage (installed on HPE Proliant servers) all ship with PHP.. with no ASLR. There doesn’t appear to be a patch for that, you can use it to surf around flat networks as it drops you as SYSTEM/root.

Thursday. What a concept.

Also update Citrix Netscaler boxes for PHP vuln, particularly if you have mgmt interface facing Internet. Why? You guessed it - ASLR is disabled.

If you use Palo-Alto firewalls, make sure you upgrade for the PHP vulns.

In particular, if you have the mgmt interface facing the internet upgrade those now. The Palo-Alto firewall VMs have ASLR disabled which makes exploitation trivial.

When Claude becomes your vulnerability info tool. https://www.reddit.com/r/fortinet/s/GT78N9O6m3

https://www.csoonline.com/article/4093949/fortinet-criticized-for-silent-patching-after-disclosing-second-zero-day-vulnerability-in-same-equipment.html

There’s a long history of this - example. https://cyberscoop.com/fortinet-delayed-disclosure-exploited-vulnerability/

I love infosec drama

https://phpbleed.com/

RE: https://cyberplace.social/@tangallio/117486288094240832

There are some clues into Fortinet’s thinking about not issuing CVEs until much later in this, a long running issue.

Fellow customers - is this how you want your vendors to function?

I’ve seen some interesting takes on the PHP thing out of the US.

One is from an official saying the US must win the ‘AI race’ as China definitely wouldn’t have told the world about the vulnerability like the NSA did.

The NSA were late to the party, literally days after me. They were also beat by.. Chinese government cyber authorities, who already had an advisory out.

Yep. https://infosec.exchange/@mayahustle/117485672263060599

eMudhra says it will voluntarily exit the global SSL/TLS certificate business.

They also promised a root-cause report, but "our cryptography was built on vibes and hopes" should cover it.

https://emudhra.com/en/press-release/emudhra-to-exit-global-ssl-tls-certificate-business

Has anyone been able to successfully convince their execs that the takeaway from all this "Vulnpocalypse" or whatever is that architecture is actually important and to not blindly trust the claims of vendors? I've been trying unsuccessfully. The general consensus seems to be "We can fix this exposed attack surface by purchasing more attack surface."

Oh no

Regarding the rumours the PHP patches don’t fix the vulnerabilities - it’s not true, they patched the vulnerabilities of issue.

The rumours are also separate issue which people are mixing up. Don’t panic about that one.

https://fedi.katze.sh/@elise/117480160480660575