zer0luck retweeted
As promised, here is the blogpost for code execution on the meta rayban 😎 p0pcycle.com/2026/11/06/hack…
zer0luck retweeted
Changing one letter bypassed an entire admin API in @huggingface chat.
One request could trigger bulk internal exports of every user’s private chats, completely unauthenticated.
Here’s how. 🧵
zer0luck retweeted
Introducing GPT‑6 Cyber: a major advance in security research that pairs stronger capabilities with better model alignment.
The model powered the Linux kernel research we announced yesterday, and security teams at companies like Mozilla, Palo Alto Networks, Calif, and Cisco—alongside our own at OpenAI—are already putting it to work.
GPT-6 Cyber is available to select Daybreak Red customers and we are expanding access over time.
openai.com/index/introducing…
zer0luck retweeted
git.musl-libc.org/cgit/musl/…
openwall.com/lists/musl/2024…
When crypt() fails in musl libc: • If it returns NULL: lazy apps don't check for NULL, pass it straight to strcmp(), and segfault.
So in 2012, musl changed it to return "*" to prevent crashes.
Fast forward to 2024: security-conscious apps (like Linux-PAM) try to zero out the returned string in memory after checking the password. Since "*" is a string literal in read-only memory (.rodata), trying to overwrite it causes a segfault anyway.
then 2026: sshhole
pw=$(awk 'BEGIN { for (i=0; i<257; i++) printf "A" }')
sshpass -p "$pw" ssh user@ip
zer0luck retweeted
*sshole is out
if you run sshd on alpine, openwrt or any musl box with password auth on: update now
official writeup: sshhole.com
zer0luck retweeted
Security release pre-alert:
We will release new versions of Node.js 22, 24, and 26 release lines on or shortly, after 2026-11-11 in order to address security vulnerabilities.
The highest severity issue fixed in this release is HIGH.
nodejs.org/en/blog/vulnerabi…
zer0luck retweeted
The pipeline finds security-relevant code, scans for vulnerabilities, reproduces them in isolated environments, tests whether they can be exploited, and generates candidate patches.
Human researchers review the results before reporting vulnerabilities and propose fixes to maintainers.
zer0luck retweeted
🚨 BREAKING: A flaw in APT, the tool that installs software on Debian Linux, lets an attacker on the network tamper with a package after it passes verification and run code as root.
The bug, CVE-2026-109518, sits in resumed HTTP downloads. APT can merge two different downloads when a redirect gives them the same address, and a man-in-the-middle can then alter the file after its check.
Debian fixed it in apt 3.0.4, shipped to Debian 13 security updates on 4 November. Users should upgrade now.
Per Debian's changelog, the fix is four words long. "Open target files exclusively."
zer0luck retweeted
Playwright and browser security reminder.
We saw a post suggesting that you delete Playwright because it bundles browsers with CVEs. That is a misconception. Do not delete Playwright🙃. Here is how it works and what you should do.
No Playwright package bundles a browser. Agents on Playwright MCP or CLI run your stable Chrome, which gets Chrome's security updates, with the sandbox on.
🤖 If you use Playwright MCP or the Playwright CLI
They use the stable Chrome / Edge on your machine, so it gets its normal updates. No config edit is needed.
🧪 If you use the test runner
When you run npx playwright install, Playwright downloads Chrome for Testing, pinned to the build we tested that release against. The pin is on purpose. Your tests run on the same browser on every laptop and CI machine, and a browser
update cannot suddenly break your suite. You choose when to move by upgrading Playwright. New releases usually pin a build ahead of stable Chrome, so you see breakage before your users do.
We recommend this for full e2e test suites on your own trusted app. This build can miss Chrome security fixes until the next Playwright release, and by default it runs with the sandbox off. Do not use it on the hostile web.
📚 If you use the library API
chromium.launch() has the same defaults: the pinned build with the sandbox off. If your code visits pages you don't control (scrapers, agent scripts), max out protection:
chromium.launch({ channel: 'chrome', chromiumSandbox: true })
🔒 Always keep Chrome / Edge updated. Some bugs can escape a sandbox.
Happy testing!
zer0luck retweeted
A critical vulnerability went undetected through multiple security audits. Hacktron found it in 10 minutes.
The vulnerability was in Dassault Systèmes' DELMIA Apriso, manufacturing software used by Boeing, Airbus, Lockheed Martin, and previously Apple.
It became CVE-2025-5086. Three months after disclosure, CISA confirmed it was being actively exploited.
Security assessments capture a point in time. Attackers don't work on your schedule.
Full research: hacktron.ai/blog/dassault-de…
zer0luck retweeted
The FBI is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor."
The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.
How You Can Help:
FBI, USSS, and IRS-CI are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets.
A list of addresses associated with this activity is available here: fbi.gov/investigate/cyber/al…
ALT FBI public service announcement with Department of Justice seal in the background on a gold gradient.
zer0luck retweeted
Introducing CVE-2026-106378: Chrome GPU Sandbox Escape to full Remote Command Execution using synthetic keyboard injection
By combining it with common GPU bugs, it becomes a full chain. Binance DevOps was most likely pwnd with a zeroday chain affecting the browser 😬
zer0luck retweeted
x86 formal verification is coming!
The (first?) published machine-checked proof of a security property for the end-to-end execution of a Linux process running an x86 binary statically linked against glibc.
And we believe it scales!
A joint research project with @zellic_io 🧵👇
zer0luck retweeted
微软搞了个专门给 Claude Code、Codex 省钱的开源插件，实测成本降低 18.4%～30.9%。
项目叫 TokenEconomizer，不换模型，也不用修改 Agent 本身。
主要做三件事：
记住经验：同一个项目踩过的坑，下次不再重复
精简工具：自动移除长期不用的工具，减少 Token 消耗
打断死循环：发现 Agent 反复报错，提醒它换个思路
支持 Claude Code、Codex、Copilot CLI 和 Pi。
微软在 277 个 SWE-Bench 任务上测试，5 组模型配置全部降低了平均成本，其中 4 组任务成功率还有提升。
我觉得最实用的是打断死循环。AI 有时候一个 Bug 能反复折腾几十轮，Token 就这么烧没了。
你更希望 Agent 省 Token，还是宁愿多花点钱，确保任务一次做对？
github.com/microsoft/TokenEc…
#agent #ClaudeCode #Codex #AI #OpenSource
