Charles Green

I'm just a kid.

[Charles Green @amorozsh]

Absolutely magnificent write up of #HardwareHacking a coffee machine.

[hackaday @hackaday]

This Coffee Machine is DOOMed https://t.co/gpyAAbWTFX

[Charles Green @amorozsh]

@MalwareTechBlog Marvellous story indeed. Thanks for the write-up.

[Charles Green @amorozsh]

@zoecyber001 What the fRAX?!

[Dieter Plaetinck @Dieter_be]

Remote code execution in MS Paint.
https://t.co/l03uiMTzjr
yup....

[It's FOSS @Itsfoss]

Unix was born on Nov 3, 1971. 🎂

Respect to legends Ken Thompson & Dennis Ritchie, the world runs on their vision. 🫡✨

[bread.mega @bread_]

Tired of these DPRK hacks. So I built the ultimate defense.

DPRKaptcha[.]com

Simple questions with existential outcomes (for them).

Live now to protect the internet from North Korea.

[Marcus Hutchins @MalwareTechBlog]

Would you look at that. Binance was hacked via phishing (Contagious Interview), not zero-day exploits written by abliterated AI models. Exactly as I predicted.

I may shitpost a lot, but I do actually know some things about some stuff.

[⭕ Brock Pierson @brockpierson]

Good morning to everyone who used Winamp

[Marcus Hutchins @MalwareTechBlog]

Update on the 9.8 CVSS TCP/IP RCE in the Linux kernel (CVE-2026-98432): we've detected what appears to be a threat actor activity scanning the entire internet for exposed affected systems. Our own scanning also suggests that the number of potential targets is high, therefore there is an increased likelihood of threat actors attempting to develop exploits for the vulnerability.

while CVE-2026-98432 is believed to require MPTCP to be enabled in the kernel, as well as a listening app/service which binds an MPTCP socket, which many have suggested should be rare, several kernels including Debian enable MPTCP by default.

Additionally, Go 1.24+ binds MPTCP sockets by default if the option is enabled in the kernel, so anything built on top of Go (including Caddy) will create the required MPTCP listener.

The mitigation of setting net.mptcp.enabled=0 disabled MPTCP, but does not apply to existing sockets, so any applications that have bound MPTCP sockets need to be restarted, otherwise the system remains exploitable.

You can check if your server is running any MPTCP listeners with the following command: sudo ss -Mlnp

On 2026-10-30 our preliminary internet-wide scan of port 443 confirmed that there are approximately 2,102,043 servers that are successfully reachable via an MPTCP connection. A deeper scan which attempts to connect to each endpoint on port 443 and negotiate a full TLS connection with MPTCP enabled returned about 762,774 systems.

Neither scan can confirm that these are unpatched kernels, just total exposure, but it's a lot more systems than expected. Since a valid HTTP connection is not required to exploit the vulnerability, the total attack surface is likely closer to the 2.1 million number than the 763k one.

As of today (2026-11-02), we've picked up several residential proxies and VPNs scanning the internet on port 443 using MPTCP-enabled connections. Since regular scanners do not negotiate MPTCP by default, and no data is being sent to the HTTP server over 443, we strongly suspect this activity is scanning for CVE-2026-98432 specifically. The use of residential proxies and RU-based VPN servers suggests that this is likely threat actor scanning, rather than security researchers.

Currently there are no known publicly available remote code execution exploits, but there are several denial of service proof-of-concepts floating around. This code gives threat actors a starting point to begin attempting to weaponize the vulnerability. Building exploits for the vulnerability is reported to be extremely difficult, but several state-sponsored threat actors likely have the resources required to succeed.

[Florian Roth ⚡️ @cyb3rops]

We've reached a point where installing a browser extension, IDE plugin or software library deserves the same scrutiny as opening a TCP port on a DMZ server.

Except this attack surface can be spread across thousands of hosts inside your org... and you can't map it with a port scan.

[Costin Raiu @craiu]

Pray that the defenders get access to more powerful models than the attackers - or we’re heading into some very dark times.

[Jens Nylander @nylanderjens]

We replaced these with our own - we're open-sourcing:
🕸️ Graph: Neo4j/Memgraph → Traverse
✉️ Email: Postfix → Sentio
⚡ Cache: Redis → Forge
📦 Storage: S3 → Trove
🔍 Search: Typesense/Algolia → Torque
🗄️ DB: PostgreSQL → BoldSQL
🧠 Inference: vLLM/SGLang → Paddock

[André Baptista @0xacb]

CTFs ain't dead!

We organized a speed pwning CTF at @Bsideslisbon. No AI, human-only.

Congrats to the winners!

1st- s1gn3rs
2nd- h11p13
3rd- tmv11

[Charles Green @amorozsh]

If Mikko says so, that is the truth.

[@mikko @mikko]

THE LAST PROGRAMMER
HAS ALREADY BEEN BORN

Photo by Rene Siegl

[vxdb @vxdb]

POV you just hacked Binance

[Florian Roth ⚡️ @cyb3rops]

CVE-2026-98432 is a good example of something that really concerns me about the future of cybersecurity.

https://t.co/BJbXLKLFNq

The vulnerability was introduced in October 2015, more than 11 years ago, by a performance optimization in the Linux TCP/IPv4 networking stack. One of the most fundamental components of an operating system used by millions of servers.

Now Anthropic reports that Claude discovered this flaw and developed a working exploit that allows remote code execution as root, without authentication, against a server with an MPTCP listener.

https://t.co/j00p4TKS0a

Think about what that means.

For decades, we’ve been building critical infrastructure out of enormous amounts of complex, memory-unsafe code. Humans wrote it. Other humans reviewed it, tested it and searched for vulnerabilities. All working with the same fundamental limitations: limited time, limited attention, incomplete visibility and an inability to reason about every possible interaction and race condition.

And perhaps that’s what protected us to some extent. Attackers had the same limitations as the people developing and defending these systems.

A vulnerability could remain undiscovered for 11 years, even in such a widely used component.

Now AI is changing that balance.

The ability to inspect code, identify subtle weaknesses and develop working exploits is becoming less dependent on a small number of highly skilled researchers. These activities can increasingly be scaled with compute, automated testing and tokens.

And that’s what worries me about the next few years.

We’ve accumulated decades of complex, memory-unsafe code in operating systems, network services, applications and libraries. Much of it has never been assessed with anything close to the capabilities that are now becoming available.

We may have massively overestimated the security of our software simply because the people looking for vulnerabilities were as limited as the people who introduced them.

That balance is breaking down, and I don’t think we’re prepared for what follows.

[Slashdot @slashdot]

EMACS Turns 50 https://t.co/0oPjXzSrXm

[Cohere @cohere]

Trace, raw tokens, & minimal reproduction script found here on @huggingface: https://t.co/JzIfUazjg4

[Charles Green @amorozsh]

2026-10-26: the #PHP2Shell added to KEV.

[DuckDuckGo @DuckDuckGo]

We're proud to donate $1M to a diverse group of organizations around the world that promote privacy, digital rights, access to information online, and a healthier online ecosystem.

This is made possible through your support of DuckDuckGo, thank you! 🎉

https://t.co/SgAYWp1BYN