peer

prodsec || prev @Fastly, @SignalSciences, @Rapid7 || he/him.

[blasty @bl4sty]

fresh from the sl0pminez. bind9 DoS nday. wanna leave the office early and/or drive the smelly old neckbearded sysadmin mad? crash your local bind9 using our public service at bind9 dot sl0p dot foo: https://t.co/ik8Jjofp1z !

[ quality subject to scrutiny, works in our vibed docker lab ]

[Calif @calif_io]

We sent Claude Mythos Preview spelunking through Squid’s guts, and it surfaced clutching a 29-year-old bug.

Meet Squidbleed: a Heartbleed-style vulnerability that leaks internal memory from every version of Squid Proxy, in its default configuration.

Full story: https://t.co/xQLKqaSmTn

[Daniel Cuthbert @dcuthbert]

Hoping for all my friends at Semgrep that this isn’t true

[Matt Johansen @mattjay]

hey claude - stop using any packages. write it all yourself big boy.

[peer @ibepeer]

@meatymcsorley THEY CANT KEEP GETTING AWAY WITH THIS.

[Feross @feross]

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.

The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.

This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.

Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:

• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence

If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.

[peer @ibepeer]

@meatymcsorley I’m in

[peer @ibepeer]

@meatymcsorley just to send you hockey clips

[peer @ibepeer]

@meatymcsorley oh nice I was gonna say I’ll pay it.

[peer @ibepeer]

@meatymcsorley how much

[peer @ibepeer]

@meatymcsorley I have depression

[Dave Kennedy @HackingDave]

Hey folks! Holiday Hack Challenge is now live! Every year I love playing this and learning new things. Fully immersive game with a ton of hacker content for all levels from beginner to advanced.

My kids are signed up and pushing through it now!

Check it out!!!

https://t.co/ASo8yVYumy

[GreyNoise @GreyNoiseIO]

https://t.co/IjdUKQPsmq 👀

[RedTeam Pentesting @RedTeamPT]

By intentionally coercing a host to open a share with a virus (or an EICAR test file), Windows Defender re-connects with computer account credentials in order to quarantine/delete it. 🦠😷

[watchTowr @watchtowrcyber]

We're back!

This time, we're analyzing CVE-2025-34028 - a pre-auth Remote Code Execution vulnerability we discovered in Commvault - yet another enterprise-grade Backup and Replication solution.

https://t.co/yJa0bmYdF1

[watchTowr @watchtowrcyber]

Ivanti, Connect Secure, a pledge, and CVE-2025-22457 - the jokes write themselves sometimes.

Enjoy, and happy Friday - speak Monday ;-)

https://t.co/hokOdgjCBL

[Washington Capitals @Capitals]

Round of applause for Big Mac SAUCE

#ALLCAPS

[HD Moore @hdmoore]

Next.js dropped a CVSS 9.1 authentication bypass vulnerability (CVE-2025-29927) over the weekend. This flaw is trivially exploitable by sending the header `x-middleware-subrequest: true`. Over 300k hits in Shodan, find more at:
https://t.co/ewMXHIWyzA