P • lefou

Cyber Security Professional | Chef @ TheSewingTinNYC | ig: lefou_

[P • lefou @lefou880]

Estoy chillando 🍷

[The Touchline | 𝐓 @TouchlineX]

📺 Telemundo TV commentator: "We are one of the only networks in the world to NOT show ads during the World Cup cooling breaks."

"We prefer the old school way. We should be able to see what the players do. We show fans, people enjoying, not the corporate direction of football."

[International Cyber Digest @IntCyberDigest]

AI isn't taking our jobs. It's keeping cybersecurity people employed for life.

[P • lefou @lefou880]

Green line theory is for mfs that get no bitches

[Matthew J. Thompson🇬�� @realMJThompson]

Green line theory. You’re lost, Lamine

[P • lefou @lefou880]

This is why you mind your business

[RTN @RTNToronto]

In Toronto, a man pulls up to stop a bike thief from getting beat up, then the bike thief tried to steal his scooter and he had to beat him up.

[P • lefou @lefou880]

I’ve replaced my coffee with morning cyber security news to wake up me up

[International Cyber Digest @IntCyberDigest]

🚨 UPDATE: 19 MILLION exposed NGINX instances hit by the 18-year-old NGINX RCE found by AI.

Top exposure by country:
- United States: 5,340,011
- China: 2,540,008
- Germany: 1,871,780

Note on ASLR as added security: not all of these instances will have ASLR disabled, but every one of them is running a version inside the vulnerable band.

The vulnerability is a heap buffer overflow. ASLR randomizes memory layout, which makes reliable RCE much harder because the attacker cannot predict where their payload or useful gadgets land. But the overflow itself still happens. The corrupted memory still causes the NGINX worker process to crash.

ASLR-enabled hosts are still trivially DoS-able. ASLR-disabled or non-PIE builds are RCE-able. Either way, patch ASAP!

[P • lefou @lefou880]

Bro can yall chill for like a fucking day please omg every time I scroll it’s like 10 new zero days

[International Cyber Digest @IntCyberDigest]

‼️🚨 BREAKING: A new npm supply-chain attack uses a dead-man's switch. The payload plants a watcher on your machine that nukes your home directory the second you revoke the GitHub token it stole from you.

The compromise happened today, across 42 official tanstack npm packages, 84 malicious versions in total. tanstack/react-router alone pulls more than 12 million weekly downloads.

The attacker forked TanStack's repository and pushed a single hidden commit. From there, they tricked TanStack's own release system into signing the malicious packages as if they were the real thing. To npm, and to anyone checking the cryptographic proof of origin (SLSA provenance), the poisoned versions looked 100% legitimate.

Maintainer Tanner Linsley confirmed the whole team had 2FA enabled. It didn't matter. This is the first documented npm worm in history that ships with a valid, signed certificate of authenticity, the same one defenders rely on to know a package wasn't tampered with.

[Iggmeister @iggidigit]

In Williamsburg if you don't wear Salomons they take you to the back of Joe's Pizza and shoot you in the head

[P • lefou @lefou880]

No one��s ever said “Ayo put that new Yachty on!” in their life

[P • lefou @lefou880]

happy Wednesday

[International Cyber Digest @IntCyberDigest]

‼️🚨 CRITICAL: Palo Alto Networks has disclosed CVE-2026-0300, a buffer overflow in PAN-OS that is already being exploited in the wild.

CVSS 4.0 score: 9.3.

Unauthenticated attackers can hit the User-ID Authentication Portal (the Captive Portal service) with crafted packets and pop a root shell on the firewall.

The flaw is an out-of-bounds write (CWE-787) in PA-Series and VM-Series firewalls. Prisma Access, Cloud NGFW, and Panorama are not affected. The vulnerability only triggers when the User-ID Authentication Portal is enabled and reachable from untrusted networks.

Affected branches:

- PAN-OS 10.2 below 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, 10.2.18-h6
- PAN-OS 11.1 below 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, 11.1.15
- PAN-OS 11.2 below 11.2.4-h17, 11.2.7-h13, 11.2.10-h6, 11.2.12
- PAN-OS 12.1 below 12.1.4-h5, 12.1.7

Patches roll out between May 13 and May 28, 2026. A Threat Prevention signature for PAN-OS 11.1 and above shipped on May 5.

Mitigations before patches roll out:

- Restrict Authentication Portal access to trusted internal IPs only
- Disable the User-ID Authentication Portal entirely if not needed

Compromising a perimeter firewall as root opens the door to lateral movement, traffic interception, credential harvesting, and full network takeover. Audit Device > User Identification > Authentication Portal Settings and treat any internet-exposed portal as an emergency.

[P • lefou @lefou880]

Even my remote colleagues hop on meetings w me and ask for fit checks lol

[P • lefou @lefou880]

Music blasting from the stoops again 🙏🏼

[P • lefou @lefou880]

What the fuck do they know about AI?

[Wall Street Rollup @WallStRollup]

Allbirds has raised $50mm to pivot its business to AI compute infrastructure

Allbirds now has a long-term vision to become a fully integrated GPU-as-a-Service (GPUaaS) and AI-native cloud solutions provider

[Mel @Villgecrazylady]

I literally had to go see this for myself. Sure enough. Apple Maps has removed almost every town in Lebanon from the map while keeping every podunk town in Israel and Syria clearly marked.

[Abhz 💭 @Aabbhhz]

whoever was responsible for this rebrand was obsessed and insane.

this is the pinnacle of a good brand.

[P • lefou @lefou880]

Brother what

[New York Post @nypost]

Another mysterious NASA death as ninth scientist linked to secret programs dies https://t.co/pHz2k7qFCt

[P • lefou @lefou880]

Bedstuy ain’t been the same since they took the aquarium away

[Kaguya’s Top Gal @hayasaka_aryan]

This was an antisemitic conspiracy theory yesterday

[P • lefou @lefou880]

ShinyHunters ransoming Hall Mark,
Axios gets overly fcked, Lapsus breaches Mercor AI and its only Monday

[P • lefou @lefou880]

Let it be known

[Reclaim The Net @ReclaimTheNetHQ]

The Supreme Court ruled unanimously that ISPs can't be forced to cut off your internet just because the recording industry's automated system accused someone of piracy.

Sony Music Entertainment wanted to have people's internet access cut off, just over the accusation.