Fabrice Moll

Software Engineer, I love manga, anime, movies and high tech. Come and join my world ;-)

[Fabrice Moll @fabmoll]

https://t.co/MvE1NPLKkQ

[yousukezan @yousukezan]

HTTP/2を利用する主要Webサーバーに、わずかな通信で数十GBのメモリを消費させる新たなDoS攻撃「HTTP/2 Bomb」が公開された。PoCコードも既に公開されており、ApacheやEnvoyなどでは1台のクライアントからサーバー全体を停止状態へ追い込める可能性がある。

この攻撃は、HTTP/2のヘッダー圧縮機構であるHPACKとSlowloris型攻撃を組み合わせたものだ。通常の圧縮爆弾とは異なり、大量データを送るのではなく、極めて小さなヘッダーからサーバー側で大量のメモリ確保を発生させる。さらにゼロバイトのフロー制御ウィンドウを悪用し、確保したメモリを長時間解放させない。

研究者によると、Apache httpdやEnvoyでは単一の攻撃クライアントが約20秒で32GBのメモリを消費させることが可能という。サーバーはクラッシュせずスワップ状態へ陥るため、正規ユーザーのアクセスが極端に遅くなる。

影響は広範囲に及び、nginxは既に対策を実装済みで、ApacheもCVE-2026-49975として修正を公開した。一方でMicrosoft IISやEnvoy、Cloudflare Pingoraなどは記事時点で修正が提供されていないとされる。

対策として研究者は、可能であればHTTP/1.1への切り替えやヘッダー数の制限、コンテナ単位でのメモリ制限設定を推奨している。
https://t.co/FB6DxWNsWt

[Fabrice Moll @fabmoll]

https://t.co/7ZMabuEcVj

[Tom Jøran Sønstebyseter Rønning @L1v1ng0ffTh3L4N]

Microsoft Edge loads all your saved passwords into memory in cleartext — even when you’re not using them.

[Paul Moore - Security Consultant  @Paul_Reviews]

The @EU_Commission has released an update to patch out the issues I raised last week, v2026.04-2 (https://t.co/twlSbndQ0e)

Honestly, I don't know if I should laugh or cry.

Let's review each one:
1. On-device data: database and settings encrypted at rest, with keys protected by the device’s hardware-backed key store.
Sounds great, until you look closer.

They introduced https://t.co/9ejV5P6lqE:security-crypto, deprecated in 2025. Also https://t.co/9ejV5P6lqE.crypto.EncryptedSharedPreferences, deprecated in 2025. Finally, https://t.co/9ejV5P6lqE.crypto.MasterKeys, which were deprecated in 2020.

3 deprecated dependencies introduced following criticism over weak security. These weren't left over and missed during an update... they've added them now to "harden security". Remember, this isn't an isolated app. It's intended to lay the foundation for many production applications; all using deprecated security libraries from the outset.

Worse, they already correctly use KeystoreController in their codebase. The correct answer already existed and they still got it wrong.

2. Runtime: the app checks device integrity on startup and refuses to run on rooted or jailbroken devices. Production deployments should complement it with stronger device-attestation mechanisms appropriate to their infrastructure and compliance requirements.
They check for su, check package manager for root apps, run "which su" and checks if it's a custom ROM.

Paths:
/system/bin/su
/system/xbin/su
/sbin/su
/system/su
/data/local/su
/data/local/bin/su
/data/local/xbin/su
/system/app/Superuser.apk
/system/app/SuperSU.apk

Great... in 2015. These are all trivially bypassed in 2026.

3. Passport onboarding: more stable scanning; the passport photo is stored privately and deleted as soon as it’s no longer needed.
They're still not encrypted, so I'm not sure what "privately" means - but they are deleted correctly now.

4. PIN: stricter rules block easy-to-guess PINs; PINs are salted and hashed, never stored in plain form.
They salt correctly (a true CSPRNG), then use PBKDF2-SHA256 - which is outdated and only recommended where FIPS compliance is required, which doesn't apply here.

To make matters worse, they use just 210,000 iterations.

For those of a NISTy disposition, you're likely already shaking your head. 210,000 seems oddly specific.

It is. It's the @owasp minimum for PBKDF2-SHA512, not SHA256. Right number, wrong algorithm. In reality, OWASP recommended 600,000 iterations as a minimum in 2023.

Worse still, 600,000 is the baseline minimum for passwords, not PINs with 1 million permutations. You could use 1B iterations, you're not measurably increasing security when there are so few attempts required to break it. At the very least, use a modern hash with reasonable brute-force resistance against a 2026 threat model.

All this... cited as a "first hardening step". Again, utter security theatre.

None of this negates my fundamental point. This isn't fixable through code - it's fundamentally ill-conceived and poorly implemented.

[Paul Moore - Security Consultant  @Paul_Reviews]

.@vonderleyen "The European #AgeVerification app is technically ready. It respects the highest privacy standards in the world. It's open-source, so anyone can check the code..."

I did. It didn't take long to find what looks like a serious #privacy issue.

The app goes to great lengths to protect the AV data AFTER collection (is_over_18: true is AES-GCM'd); it does so pretty well.

But, the source image used to collect that data is written to disk without encryption and not deleted correctly.

For NFC biometric data:
It pulls DG2 and writes a lossless PNG to the filesystem. It's only deleted on success. If it fails for any reason (user clicks back, scan fails & retries, app crashes etc), the full biometric image remains on the device in cache. This is protected with CE keys at the Android level, but the app makes no attempt to encrypt/protect them.

For selfie pictures:
Different scenario. These images are written to external storage in lossless PNG format, but they're never deleted. Not a cache... long-term storage. These are protected with DE keys at the Android level, but again, the app makes no attempt to encrypt/protect them.

This is akin to taking a picture of your passport/government ID using the camera app and keeping it just in case. You can encrypt data taken from it until you're blue in the face... leaving the original image on disk is crazy & unnecessary.

From a #GDPR standpoint:
Biometric data collected is special category data. If there's no lawful basis to retain it after processing, that's potentially a material breach.
https://t.co/PKQ0DWSYzL

[International Cyber Digest @IntCyberDigest]

🚨‼️ BREAKING: Crunchyroll breached through outsourcing partner in India.

A threat actor exfiltrated data from Crunchyroll's ticketing system and also managed to pull 100 GB of personally identifiable customer analytics data.

We've analyzed sample data and it includes IP addresses, email addresses, credit card details, and more.

An employee of their outsourcing partner Telus had executed malware on his system, which gave a threat actor access to Crunchyroll's environment.

[Hedgie @HedgieMarkets]

🦔 Notepad now requires internet connectivity to keep Copilot integration functional. That connectivity enabled a remote code execution vulnerability with a severity rating of 8.8 out of 10.
An attacker can create a malicious Markdown file with specially crafted links. If you open it in Notepad and click a link, a script can download and execute code with your full permissions.

My Take
For 40 years Notepad was the simplest tool on Windows. No internet connection. No fancy features. No way for hackers to get in. People used it specifically because it was basic, just a place to write text without any complexity getting in the way.
Then Microsoft decided it needed AI. To make Copilot work, Notepad now connects to the internet. That connection opened a door that hackers can walk through. If you open the wrong file and click the wrong link, someone can take control of your computer.

This is what happens when you add features nobody asked for to products that worked fine without them. Microsoft fired their testing teams years ago, started using AI to write their code, and decided every single application needs Copilot whether users want it or not. Now a text editor, the most basic program imaginable, has the kind of security hole you'd expect in complex software. They took something simple and reliable and made it complicated and vulnerable. I'm not sure that's progress.

Hedgie🤗

[Tribune Populaire🌐 @TribunePop23]

Il aura fallu plus de 30 ans pour que le circuit politico-médiatique comprenne cette séquence des Guignols de 1993.

Sûrement qu’avant, il y avait de l’argent à gratter, car les Américains nous traitent de la même manière..

[Fabrice Moll @fabmoll]

@Korben Salut Korben, tu vas apprécier cette histoire bien de chez nous ;) https://t.co/1pUc6rmQ6a

[Branko @brankopetric00]

Breaking your monolith into 47 microservices doesn't fix your bad code. It just distributes the pain across more servers.

[Fabrice Moll @fabmoll]

@PsyGuy007 Je me suis arrêté de lire au premier mot...

[Erica 🇺🇸🇺🇸🇺🇸 @EricaRN4USA]

.@TheDemocrats should ad to the logo that they are the Democrat Socialist Hypocrite party of America.

They are so obvious with their hypocrisy. 🙄

[Wise @trikcode]

😂

[Scott Hanselman 🌮 @shanselman]

I’m seeing some hot takes that AI assisted coding means that you don’t have to be technical anymore. That’s only gonna last you until the first database migration, or the first security issue, or the first cloud migration, or the first scale out, or the first major regression, or the first refactor that ends in slop. I am finding that I’m learning more and I have to be as technical or more technical than ever before to get the kinds of high-quality output that I expect of any code, regardless of whether it comes from my fingertips or someone else’s - including an AI.

Whether your source comes from open source libraries, your own hands, or an AI via your clever prompt, there is exactly one responsible person for the output. That is you.

I never want to be accused of gatekeeping AI assisted programming, as non-technical people can get a lot of interesting work done. Until they hit a wall, and it’s gonna surprise them how quickly they either need to get technical, or get a technical person to help untangle the mess they’ve made.

The art and science of programming is taking intent and turning it into shipping products. I will never blame an AI - nor should you - for bad output. Own the code that you ship.

[Recalbox 🎮👾 @recalbox]

✅️ Le saviez-vous ⁉️
#HugoDélire était réalisé sur Commodore Amiga.
Pour réaliser ce miracle : deux Amiga 3000 étaient reliés à un échantillonneur audio qui convertissait les impulsions sonores des touches du téléphone (signalisation DTMF) en... signaux MIDI ! 😱🤯

[Fabrice Moll @fabmoll]

https://t.co/pKF1ljZcGt

[Fabrice Moll @fabmoll]

@Ubiquiti Hi, is there an issue on UDM Pro 4.3.6. I cannot see flows insights (for threats) anymore. The page is empty and in your community page, it seems I'm not the only one to have this issue.

[Fabrice Moll @fabmoll]

https://t.co/9YBj0DOu6g

[Blue Team News @blueteamsec1]

Citrix forgot to tell you CVE-2025–6543 has been used as a zero day since May 2025 https://t.co/Up3kX0vWTo #cyber #threathunting #infosec