ぴょっ！

鳥好きのシステムエンジニアです

自宅ではボタンインコとウロコインコなどと生きてます

情報セキュリティ関係を中心に、気になった事を勝手に呟いています
理想論より現実論を支持します

誤字脱字多めですがご容赦下さい

[ぴょっ！ @Pyo0072]

家のランサム、ぼたさんです
暗号化はしないですが、障子の枠を破壊します
身代金はトンガリコーンか新聞紙
気を抜くと知らないうちに起動します

[ぴょっ！ @Pyo0072]

@ONRYOUonsen むしろ葉っぱがうまいと思う

[ぴょっ！ @Pyo0072]

@tweetsoku1 至極当然！

[ぴょっ！ @Pyo0072]

中国製ルーター20機種にバックドア、外部から完全制御のおそれ(CNET Japan)
#Yahooニュース
https://t.co/fx5ZqeEWlT

[ぴょっ！ @Pyo0072]

@Izumi_Sunagawa ことも家庭庁みたいな使途不明組織を解体すれば予算は取れると思うが

[ぴょっ！ @Pyo0072]

@koremiteyaseru なんの仕事か分からないのですが、上司であるなら自らフォローすべきかと…

[ぴょっ！ @Pyo0072]

@tweetsoku1 母国の年金で生活しており、日本になじみ迷惑をかけないような外国人であれば、さもありなんと思うが、生活支援より帰国支援の方が効率的だと思います

[ぴょっ！ @Pyo0072]

「脳のゴミ」は鼻から排出されていた　老化で詰まる経路…鼻から薬投与で改善　韓国チーム https://t.co/8Zij8El1I2 @Sankei_newsより

[Cyber Security News @The_Cyber_News]

‼️A single malicious page may be enough to compromise Tor Browser, according to new research into the Firefox flaw CVE-2026-10702.

The bug allows arbitrary code execution in the browser renderer, and researchers say it also worked against Tor Browser before patches landed.

Source: https://t.co/PAmPs0tPEb

#cybersecurityawareness #cybersecuritynews

[The Hacker News @TheHackersNews]

🛑 One malicious webpage visit was enough to compromise Tor Browser. No settings changes. No extra clicks.

Firefox JIT flaw, CVE-2026-10702, runs code inside the browser’s renderer process and forms the first stage of an Android 17 root chain.

Read how the exploit works: https://t.co/92ObVWyORg

[ぴょっ！ @Pyo0072]

個人情報3万7000人分漏洩か　生命保険協会　氏名や住所、電話番号、メアド閲覧可能に https://t.co/88m0G4SRkh @Sankei_newsより

[The Hacker News @TheHackersNews]

‼️ BREAKING — Claude AI found a working HAWK-256 key-recovery attack.

HAWK is a NIST post-quantum cryptography candidate. It also made an impractical 7-round AES-128 attack up to 800x faster.

Read this here: https://t.co/JbDhrTjjt2

[The Hacker News @TheHackersNews]

🛑 ALERT - WordPress sites are under active attack.

Attackers are exploiting the #wp2shell chain to gain unauthenticated RCE on vulnerable stock installations, with no plugins required. Public exploit code is now fueling mass scanning and web shell deployments.

Read what defenders should check: https://t.co/p6S8ILrUw0

[Calif @calif_io]

We've reproduced the pre-auth RCE chain in Wordpress (wp2shell). It's real, patch!

Shoutout to @hash_kitten at Assetnote for catching such an awesome bug!

[ぴょっ！ @Pyo0072]

@pirooooon3 普通に二皿頼む人だっているし、客側のエラーだと思うけど
タブレット注文というのもこういった問題が出やすいですよね

その後の態度は客側が圧倒的に悪いと思う

[IT Guy @T3chFalcon]

Yes, the software is called LG OnScreen Control Plus. it runs silently in the background. it tracks which applications you use, when you use them, and how long. it phones home to LG servers. it cannot be uninstalled through normal means without leaving registry traces.

gamers noticed because some anti-cheat systems flagged it as suspicious software. the monitor was getting people banned from games.

now the TV side:

LG also updated its webOS terms of service. if you use the AI voice features on your LG TV, the company says you may need to inform guests in your home that conversations could be recorded.

not LG informing your guests.

you. the homeowner. legally responsible for notifying anyone who walks into your living room that the television is listening.

LG built a surveillance device. sold it to you. and made the disclosure your legal problem.

so to recap what LG shipped this year:

a monitor that installs tracking software on your PC without asking.

a TV that records conversations in your home and requires you to warn your guests.

both devices look exactly like a monitor and a TV.

neither one tells you what it actually is at the point of sale.

you found out when your game banned you.

or when you read the terms.

Credit: @GamersNexus for the discovery.

[The Hacker News @TheHackersNews]

🛑 Hugging Face, the world’s largest AI model repository, says an autonomous AI agent breached its production systems through a malicious dataset.

It accessed internal data and service credentials, then moved across several clusters through thousands of actions in short-lived sandboxes.

Full story: https://t.co/ULJfbJfhmW

[ぴょっ！ @Pyo0072]

@Izumi_Sunagawa 民事でもきっちり賠償請求して欲しい

[Co11ateral @co11ateral]

Chinese Backdoor for Telecom Systems

A while ago we showed the backdoor that the Chinese have been using to maintain persistence across telecom systems.

The backdoor attaches itself to a raw network socket and inspects incoming traffic. It sees packets before firewall rules have a chance to process them. So even if your firewall is configured correctly, the backdoor can still see traffic that should have been blocked.

To access the system hackers send a magic byte to get a reverse shell

We also showed how you can detect it

https://t.co/fBXtksn2Ju

@three_cube @_aircorridor

[辻 伸弘 (nobuhiro tsuji) @ntsuji]

WordPressで、未認証で任意コード実行に至る攻撃チェーン「wp2shell」が発見されました。

標準構成・追加プラグイン不要で、外部から任意コード実行に至る恐れがあり、公開PoCも出回っており、実環境での悪用も報告されています。

CISA KEV未掲載でも待たずに、対象バージョンは直ちに更新を。

[ぴょっ！ @Pyo0072]

@livedoornews 客観的に見てトイレを借りた側は常識の範囲で利用したのだろうか

損害賠償と言ってる感じからすると単に利用しただけとは思えないのだけど