fnix dev

Olá, estou usando o Twitter.

[sui @birdabo]

they’re calling it the black October lmao.

> node.js: security vulnerability.
> PHP: critical RCE vulnerabilities.
> tensorlake: npm package infected.
> liteLLM: malicious PyPI + Docker releases
> Railway: customer secrets exposed
> zeabur - infrastructure breached.
> OpenCode: AI API keys exposed.
> OVHcloud CLI: official binaries backdoored.
> RankMath PRO: malware inside official plugin.
> TeamUpdraft: customer data compromised.
> ConnectWise: cloud backup identities compromised.
> SubQuery: backdoored npm package.
> GhostAction: GitHub repos with malicious workflows (related to the broader Shai-Hulud/ChainDrop activity).
> eMudhra: certificate authority keys compromised (with downstream impact on Tailscale).

this some complete madness bro. 1/3 of the internet is fucked.

[FBI Cyber Division @FBICyberDiv]

Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.

The FBI urges organizations to take the following steps now:

➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.

➡️ Immediately update affected PHP installations following the guidance on https://t.co/rDrPSxB3zX. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.

➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.

➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or https://t.co/iqgVZIbCru. Those reports help us identify the actors involved and warn other organizations before they become victims.

For the latest information, follow PHP’s announcement on https://t.co/rDrPSxB3zX, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.

[Kruptos @KuptoKosmos]

🌐 Tor prend ses distances avec Mullvad à cause d’un don personnel via un co-fondateur à un parti suédois... Mais en parallèle, le projet a été conçu et financé pendant des décennies par des branches du gouvernement américain !

En 2025, Daniel Berntsson (co-fondateur et co-propriétaire de Mullvad) donne 5M SEK (520 k$) à l’Örebropartiet. Ce don représente environ 72% des revenus du parti cette année-là

Le parti prône notamment zéro immigration d’asile (hors cas très limités) et une remigration à grande échelle

Mullvad précise que c’est un don privé, que la société n’est pas impliquée, et que l’autre co-fondateur s’y oppose

Le 9 octobre 2026 Tor réagit...

Ils gardent la collaboration technique (Mullvad Browser = Tor Browser sans le réseau.. ça a amélioré la maintenabilité et l’auditabilité du code)

Mais ils mettent en pause le co-branding et clarifient le langage pour ne plus laisser croire à un alignement de valeurs

"Bien que Tor défende la liberté d’expression, tous les discours ne sont pas également compatibles avec notre mission. Nous nous opposons fermement aux propos qui menacent d’autres droits humains et libertés"

L’onion routing a été inventé dans les années 1990 au Naval Research Laboratory (US Navy) par Paul Syverson et ses collègues

Objectif initial : protéger les communications des agents de renseignement américains

Chiffres (sources Tor + Form 990) :

- 2015 : 85% du budget venait du gouvernement US

- 2021-2022 : 53,5%

- 2023-2024 : encore 35% (2,56 M$ sur 7,3 M$) dont 2,12 M$ du State Department (Bureau of Democracy, Human Rights, and Labor)

Le Broadcasting Board of Governors (BBG, agence issue de la CIA qui gère Voice of America, Radio Free Europe, etc..) a versé environ 6,1 M$ à Tor entre 2007 et 2015 via l’Open Technology Fund

Les documents FOIA ont montré

2500 pages de correspondance :

Plans de déploiement de Tor dans des pays ciblés par Washington (Chine, Iran, Russie..)

Réunions et trainings avec CIA, NSA, FBI, DOJ et State Department

Rapports mensuels détaillés aux financeurs, et contrats avec obligations strictes

Il y a un contraste...

Un don personnel d’un co-fondateur de partenaire à un parti local suédois = distance idéologique et clarification de valeurs

Des millions de dollars récurrents, des origines militaires, des contrats et des réunions documentées avec des agences US de soft power et de sécurité = acceptés depuis le début

Bref... Le code est open source. C’est une vraie protection technique. Mais les priorités, les arbitrages et la dépendance financière restent des faits

Savoir d’où vient l’argent, et quelles paroles sont jugées "incompatibles" avec la mission fait partie de la souveraineté numérique 🔎

[It's FOSS @Itsfoss]

There will be no Linux Mint 23 release.

There will be no more Linux Mint xx.yy releases anymore.

Linux Mint is changing its version number as it switches to an yearly release cycle.

The next Mint release is Linux Mint 27 that will be released at the end of year 2026.

Next Mint release will be in December 27 and it will be Mint 28.

Basically, the year becomes the version number. Similar to what Samsung did with its Galaxy smartphone releases.

Do you like the new version numbering?

[Tuta @TutaPrivacy]

It's #NationalCyberSecurityAwarenessMonth 🌐🔒

To celebrate, we have asked our Tuta community 👥💬 what their favorite browsers, search engines, message and password apps are, and these are the results📊

What are your favorite privacy apps📱? Let us know in the comments 👇

#CyberSecurity #CyberSecMonth #TutaMail #Privacymatters

[The Hacker News @TheHackersNews]

⚠️ No login required. CVSS 10.0. Active exploitation.

Attackers are exploiting a Bricksforge WordPress flaw (CVE-2026-85097) that enables arbitrary PHP code execution through crafted file-upload metadata.

Patchstack observed attack activity from 63 IPs. Update to version 4.0.1.

Read - https://t.co/GMJnf0PB2u

[fnix dev @fnix_dev]

@Redot_Engine Oh, thanks. I will install and use it.

[Tuta @TutaPrivacy]

#DeGoogled Maps? Yes, it's possible. 📍🗺️

The Big Tech does not need to track your every step 👉 Use a Google Maps alternative instead. 

Find out which open source maps are available: https://t.co/oXKGWLLfxo

#GoogleMaps #GoogleMapsAlternative

[It's FOSS @Itsfoss]

Gentoo Linux is asking for new infrastructure sponsors after multiple long-time contributors quietly pulled out.

No names have been confirmed yet. But the timing is hard to ignore: just weeks after DigitalOcean ended its Open Source Credits program, cutting free cloud infrastructure for projects like Node.js and Pidgin without a public announcement.

Are we watching the early signs of an open source infrastructure crisis?

Here is what has changed. AI has sent demand for server capacity through the roof. GPUs and data center space that used to be relatively affordable are now being fought over by cloud providers, AI startups, and hyperscalers.

The cost of running infrastructure has climbed sharply, and the generous "free tier for open source" that companies offered in better times is now a line item that finance teams are scrutinizing.

Giving away server capacity when it cost almost nothing was an easy PR win. Giving it away when every rack is spoken for and margins are under pressure is a different calculation.

Open source projects have always depended on this corporate goodwill. Gentoo, one of the oldest and most respected Linux distributions, is now scrambling for sponsors.

The question is how many other projects are in the same position but have not said anything yet.

[Kruptos @KuptoKosmos]

🇨🇦📱 Signal n'a pas l'intention"discuter" avec le Canada... Si Ottawa exige les clés, Signal ferme !

En ce début octobre, Udbhav Tiwari le vice-président de Signal l’a définitivement confirmé à des sénateurs

Le projet C-22 Lawful Access Act peut :

> Ordonner les clés de chiffrement
> Forcer la collecte de métadonnées au-delà du minimum
> Les stocker 6 mois
> Exiger une version plus faible du produit

Signal dit que ça casse l’app et c'est évident

Le choix est simple selon Tiwari :

> Servir le Canada avec le même chiffrement que partout

> Ou une version trouée

Ils prennent la première... Et s’il faut couper le pays, ils coupent !

Ce n’est pas une menace pour un coup de com... C’est le modèle, point

Pas de backdoor locale
Pas de Signal canadien

Soit le protocole tient
Soit Signal n’est plus là

Bref... Le chiffrement ne se négocie pas par pays. Il se casse, ou il reste et les acteurs des alternatives fiables comme @signalapp et @GrapheneOS n'hésitent pas à partir des pays réclamants des backdoor... Soutien et Merci pour votre travail 👏

[fnix dev @fnix_dev]

@Pirat_Nation @screenshotbot_ screenshot this

[It's FOSS @Itsfoss]

Happy 43rd Birthday, GNU!🎉

The GNU Project was founded by Richard Stallman on September 27, 1983, to bring free and open software to everyone. 💻🌐

[𝐇𝐚𝐦𝐳𝐚 | Networking Guy @Hamzaonchain]

📂 ETHICAL HACKING TOOLS
┃
┣ 📂 Reconnaissance
┃ ┣ 📂 Shodan
┃ ┣ 📂 theHarvester
┃ ┣ 📂 Maltego
┃ ┣ 📂 Amass
┃ ┣ 📂 Subfinder
┃ ┗ 📂 WHOIS
┃
┣ 📂 Scanning & Enumeration
┃ ┣ 📂 Nmap
┃ ┣ 📂 Masscan
┃ ┣ 📂 RustScan
┃ ┣ 📂 enum4linux
┃ ┣ 📂 SNMPwalk
┃ ┗ 📂 Netcat
┃
┣ 📂 Web Application Testing
┃ ┣ 📂 Burp Suite
┃ ┣ 📂 OWASP ZAP
┃ ┣ 📂 Nikto
┃ ┣ 📂 Gobuster
┃ ┣ 📂 ffuf
┃ ┗ 📂 Dirsearch
┃
┣ 📂 Exploitation
┃ ┣ 📂 Metasploit
┃ ┣ 📂 Searchsploit
┃ ┣ 📂 BeEF
┃ ┣ 📂 SQLmap
┃ ┣ 📂 Commix
┃ ┗ 📂 RouterSploit
┃
┣ 📂 Credential Attacks
┃ ┣ 📂 Hashcat
┃ ┣ 📂 John the Ripper
┃ ┣ 📂 Hydra
┃ ┣ 📂 Medusa
┃ ┣ 📂 CeWL
┃ ┗ 📂 Crunch
┃
┣ 📂 Wireless Security
┃ ┣ 📂 Aircrack-ng
┃ ┣ 📂 Kismet
┃ ┣ 📂 Wifite
┃ ┣ 📂 Bettercap
┃ ┣ 📂 Reaver
┃ ┗ 📂 hcxdumptool
┃
┣ 📂 Network Analysis
┃ ┣ 📂 Wireshark
┃ ┣ 📂 tcpdump
┃ ┣ 📂 Ettercap
┃ ┣ 📂 Bettercap
┃ ┣ 📂 TShark
┃ ┗ 📂 Scapy
┃
┣ 📂 Active Directory
┃ ┣ 📂 BloodHound
┃ ┣ 📂 NetExec
┃ ┣ 📂 Impacket
┃ ┣ 📂 Certipy
┃ ┣ 📂 Rubeus
┃ ┗ 📂 Mimikatz
┃
┣ 📂 Cloud Security
┃ ┣ 📂 ScoutSuite
┃ ┣ 📂 Prowler
┃ ┣ 📂 Pacu
┃ ┣ 📂 Trivy
┃ ┣ 📂 kube-hunter
┃ ┗ 📂 kube-bench
┃
┣ 📂 Reverse Engineering
┃ ┣ 📂 Ghidra
┃ ┣ 📂 IDA Free
┃ ┣ 📂 x64dbg
┃ ┣ 📂 Radare2
┃ ┣ 📂 Cutter
┃ ┗ 📂 Binary Ninja
┃
┣ 📂 OSINT
┃ ┣ 📂 SpiderFoot
┃ ┣ 📂 Sherlock
┃ ┣ 📂 Recon-ng
┃ ┣ 📂 PhoneInfoga
┃ ┣ 📂 GHunt
┃ ┗ 📂 Holehe
┃
┣ 📂 Containers & DevSecOps
┃ ┣ 📂 Trivy
┃ ┣ 📂 Dockle
┃ ┣ 📂 kube-bench
┃ ┣ 📂 kube-hunter
┃ ┣ 📂 Docker Bench
┃ ┗ 📂 Checkov
┃
┣ 📂 Reporting
┃ ┣ 📂 Dradis
┃ ┣ 📂 Ghostwriter
┃ ┣ 📂 Serpico
┃ ┣ 📂 CherryTree
┃ ┣ 📂 Obsidian
┃ ┗ 📂 Markdown
┃
┣ 📂 Practice Labs
┃ ┣ 📂 Kali Linux
┃ ┣ 📂 Parrot OS
┃ ┣ 📂 Hack The Box
┃ ┣ 📂 TryHackMe
┃ ┣ 📂 PortSwigger Academy
┃ ┗ 📂 VulnHub
┃
┗ 📂 Security Resources
┣ 📂 CyberChef
┣ 📂 Exploit-DB
┣ 📂 SecLists
┣ 📂 GTFOBins
┣ 📂 LOLBAS
┗ 📂 VirusTotal

[Baldly Rudy @baldlyrudy]

Qualcomm just made a major Linux commitment for Snapdragon X2.

-Official Linux Early Developer Preview
-Debian support targeted by end of 2026
-Ubuntu certification targeted for H1 2027
-Freedreno / Turnip / Rusticl GPU support
-Hexagon NPU support through FastRPC
-Upstream kernel + driver development
-HP, ASUS + HUMAIN planning Linux support in Q1 2027

This goes well beyond just getting Linux to boot.

[Qualcomm Developer @Qualcomm_Dev]

You asked. We listened.

The @Linux on @Snapdragon X2 Series Early Developer Preview is here. It's an early milestone, with support rolling out in phases, but developers can start exploring, testing, and providing feedback already today: https://t.co/Gfcdp1cqjw

Join our Discord and help shape the future of Linux on Snapdragon: https://t.co/vshrWqqKuz

[The Hacker News @TheHackersNews]

🚨 A public exploit now targets an unpatched Ubuntu 26.04 kernel flaw that can escape containers and gain root on the host.

The AF_UNIX bug is reachable through syscalls allowed by default Docker and Kubernetes seccomp profiles. No attacks are confirmed.

How it works: https://t.co/AsNPkMC4eR

[Smartphones sans Google (GAFAM) @Sans_Google]

F-Droid 2.0 is finally here.

After more than a year of work and 14 test releases, it’s the biggest update to the app in 10 years.

What’s new:
🔹completely redesigned interface
🔹better search
🔹more detailed categories
🔹new filters
🔹automatic updates
🔹easier app installation
🔹still no tracking

And yes, F-Droid still wants to help you escape the Play Store.

One small catch: the “panic” feature that could wipe apps isn’t back yet.

If you use F-Droid, have you already made the jump to 2.0?

https://t.co/WQoi6vl7QQ

#FDroid #FOSS #Android #OpenSource

[fnix dev @fnix_dev]

Não consigo acessar meu acesso de outro dispositivo, mesmo aceitando a solicitação no meu aparelho móvel.

@instagram

[International Cyber Digest @IntCyberDigest]

‼️ Google Search is now hiding where its results lead. Links point to google[.]com/goto?, followed by an opaque string only Google can resolve.

You can no longer inspect a destination before clicking it, or copy the address out of the page.

Every click now travels through Google first.