Forensics Don't Lie

DFIR, Cyber Investigations, you got it. opinions are my own, CISSP, Lethal Forensicator, Veteran

[Forensics Don't Lie @idoforensics]

Excellent video here. 🇺🇸

[Natalie Fertig @natsfert]

I’m not crying - you’re crying

The last verse+chorus of this is 10/10 the best USA World Cup song yet.

[Forensics Don't Lie @idoforensics]

@TMobile #pricehike #priceforlife

[Forensics Don't Lie @idoforensics]

@WallStreetApes Just wait until you start paying property tax, a forever tax

[Promethean Action @PrometheanActn]

On his way out, Biden pardoned two people. His son Hunter. And Dr. Tony Fauci. Both pardons start the clock on the exact same month: January 2014.

That's not a coincidence. That's a confession.

@BarbaraMBoyd connects the dots 👇

[Forensics Don't Lie @idoforensics]

❤️🇺🇸

[OutKick @Outkick]

Inject this into my veins 😤🇺🇸

[Forensics Don't Lie @idoforensics]

@TheLastRefuge2 Will the UK survive, or is it destined to end in shame.

[Forensics Don't Lie @idoforensics]

@nettermike Wise words and a great strategy. Always have a plan

[Forensics Don't Lie @idoforensics]

@elonmusk Stunning

[Forensics Don't Lie @idoforensics]

"The American System"

A nation that cannot manufacture what it needs will not remain a sovereign nation

[Promethean Action @PrometheanActn]

Trump agreed with Bernie. Bessent trashed free markets. Wall Street missed the jobs number by 64%. Something bigger is happening.

[Forensics Don't Lie @idoforensics]

@BasilTheGreat A little more information to corroborate the assertion he could have lived if:

https://t.co/N7zpjmJUj4

[Forensics Don't Lie @idoforensics]

@WallStreetApes California took 30 days to count the presidential election votes.

California took 1 night to count the Gavin Newsom RECALL votes

Tells you all you need to know about California.

[Forensics Don't Lie @idoforensics]

THE WRATH OF THE AWAKENED SAXON
by Rudyard Kipling

It was not part of their blood,
It came to them very late,
With long arrears to make good,
When the Saxon began to hate.

They were not easily moved,
They were icy -- willing to wait
Till every count should be proved,
Ere the Saxon began to hate.

Their voices were even and low.
Their eyes were level and straight.
There was neither sign nor show
When the Saxon began to hate.

It was not preached to the crowd.
It was not taught by the state.
No man spoke it aloud
When the Saxon began to hate.

It was not suddently bred.
It will not swiftly abate.
Through the chilled years ahead,
When Time shall count from the date
That the Saxon began to hate.

https://t.co/caYUcDeIVz

[Forensics Don't Lie @idoforensics]

@ABPosse007 @Timcast @rtjob700

[International Cyber Digest @IntCyberDigest]

‼️🚨 BREAKING: An AI found a Linux kernel zero-day that roots every distribution since 2017. The exploit fits in 732 bytes of Python. Patch your kernel ASAP.

The vulnerability is CVE-2026-31431, nicknamed "Copy Fail," disclosed today by Theori. It has been sitting quietly in the Linux kernel for nine years.

Most Linux privilege-escalation bugs are picky. They need a precise timing window (a "race"), or specific kernel addresses leaked from somewhere, or careful tuning per distribution. Copy Fail needs none of that. It is a straight-line logic mistake that works on the first try, every time, on every mainstream Linux box.

The attacker just needs a normal user account on the machine. From there, the script asks the kernel to do some encryption work, abuses how that work is wired up, and ends up writing 4 bytes into a memory area called the "page cache" (Linux's high-speed copy of files in RAM). Those 4 bytes can be aimed at any program the system trusts, like /usr/bin/su, the shortcut to becoming root.

Result: the next time anyone runs that program, it lets the attacker in as root.

What should worry most: the corruption never touches the file on disk. It only exists in Linux's in-memory copy of that file. If you imaged the hard drive afterwards, the on-disk file would match the official package hash exactly. Reboot the machine, or just put it under memory pressure (any normal system load that needs the RAM), and the cached copy reloads fresh from disk.

Containers do not help either. The page cache is shared across the whole host, so a process inside a container can use this bug to compromise the underlying server and reach into other tenants.

The original sin was a 2017 "in-place optimization" in a kernel crypto module called algif_aead. It was meant to make encryption slightly faster. The change broke a critical safety assumption, and nobody noticed for nine years. That bug then rode every kernel update from 2017 to today.

This vulnerability affects the following:
🔴 Shared servers (dev boxes, jump hosts, build servers): any user becomes root
🔴 Kubernetes and container clusters: one compromised pod escapes to the host
🔴 CI runners (GitHub Actions, GitLab, Jenkins): a malicious pull request becomes root on the runner
🔴 Cloud platforms running user code (notebooks, agent sandboxes, serverless functions): a tenant becomes host root

Timeline:
🔴 March 23, 2026: reported to the Linux kernel security team
🔴 April 1: patch committed to mainline (commit a664bf3d603d)
🔴 April 22: CVE assigned
🔴 April 29: public disclosure

Mitigation: update your kernel to a build that includes mainline commit a664bf3d603d. If you cannot patch immediately, turn off the vulnerable module:

echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead 2>/dev/null || true

For environments that run untrusted code (containers, sandboxes, CI runners), block access to the kernel's AF_ALG crypto interface entirely, even after patching. Almost nothing legitimate needs it, and blocking it shuts the door on this whole class of bug...

[mike bski @BskiMike22802]

https://t.co/JvKSQqyhIL

[Forensics Don't Lie @idoforensics]

Apple has released patches for some legacy Apple iPhones and IPads. If you have any or any family that has older devices. Check for updates.

We gotta hand it to them. In response to the recently disclosed Coruna exploit, Apple extended security updates for older iPhones and iPads that can't upgrade further, specifically iOS 15.8.7, iOS 16.7.15, and matching iPadOS versions.

https://t.co/y5VJdqQb9p

[Forensics Don't Lie @idoforensics]

@RealJamesWoods

[Forensics Don't Lie @idoforensics]

Fun look back at a great syfy series and the use of the Amiga 2000

[Commodore Computer Museum 🕹 @MuseumCommodore]

https://t.co/9ckBJhlkS2

[Forensics Don't Lie @idoforensics]

Has anyone else experienced a @rado lcd display failure like this.

[Forensics Don't Lie @idoforensics]

Time to check your tools. Always best to disable auto updates

[The Hacker News @TheHackersNews]

🛑 WARNING - Notepad++ confirmed state-sponsored attackers hijacked its update traffic via a compromised hosting provider. Selected users were redirected to malicious update servers.

The activity ran for months.

🔗 Learn more → https://t.co/5sUF2nJZ09