eMudhra has been blocking curl/wget/python urllib User-Agent headers from accessing CRLs bugzilla.mozilla.org/show_bu…

Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing... The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer. - TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely. - LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap. - OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for. These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure. foxio.io/blog/choose-your-ba…

Folks, I left Microsoft three months ago to start my own company. Two weeks after I left, my whole team in Australia was let go. I see the hurt it’s causing my ex-colleagues, their families and their kids. Layoffs, forced relocations, PIPs. It’s brutal and I don’t want to brush past that. But here’s my honest take. Microsoft needs fewer people. I’ve been on the inside. I’ve seen how things get built. Lots of small orgs. Layers on layers. Silos everywhere. Here’s a real example. The Entra team shipped managed identities back in 2017. No more secrets in code. A clear security win. Then they tried to get the rest of Microsoft to adopt it. Very few teams did, and the ones that did moved at a snail’s pace. Every org had its own priorities and its own decision makers. It took Microsoft getting hacked, and the Secure Future Initiative that followed, before things really moved. Today almost every Microsoft app and service supports managed identity. Six years, and a major breach, to get there. In a world with agents and fewer people, that rollout would be possible across Microsoft in months, not years. Microsoft already has everything else. The customers. The infrastructure. The scale. What it needs is fewer people, leaning hard into agentic work. Right now OpenAI and Anthropic are shipping at a pace Microsoft can’t match. Microsoft has to change to survive.

‼️ Cisco says its IOS XR routers and Meraki cameras trust eight eMudhra certificate authorities whose private keys were numbers below 256. Anyone can recover those keys in seconds and forge HTTPS certificates for any website. Cisco is still investigating its ASA firewalls.

Chat, I don't wanna sound like a hater, but this guy fucking STINKS at being a criminal - caught in a few weeks - only made $210 - ??? We've got Threat Actors on Roblox making more money than him

How is the internet less private than in 2006, when the whole family shared one computer? Back then, the internet was weird, personal, and all of ours. So, we got your favorite meme legends back together to say it louder: What happened to the internet? 1/3