Loïs Samain🌐

#cybersecurity #CISO #ICS #geopolitics #NBA #TakeNote - Co-founder & Podcaster : @comptoirsecu - Views expressed are my own

[Loïs Samain🌐 @lsamain]

@TrashTalk_fr Oh ouiii

[Loïs Samain🌐 @lsamain]

@TrashTalk_fr j’annonce : Wemby avec le maillot du PSG ce soir pour son arrivée !

[The Hacker News @TheHackersNews]

☢️ Before Stuxnet, fast16 was designed to corrupt nuclear weapons simulations.

The Lua-based sabotage malware tampered with uranium-compression modeling in LS-DYNA and AUTODYN, activating during 💥 detonation runs above 30 g/cm³.

The framework may date back to 2005.

⚡ Read full story: https://t.co/gVOtmjGWDW

[Loïs Samain🌐 @lsamain]

@TrashTalk_fr Très intéressé par le détail des votes !

[Loïs Samain🌐 @lsamain]

@TrashTalk_fr C’est le scénario qui j’imagine depuis 3 mois 😅 Le rêve !

[International Cyber Digest @IntCyberDigest]

‼️🚨 Pwn2Own Berlin 2026 just hit a wall. For the first time in 19-years, ZDI rejected dozens of working zero-day RCE submissions because organizers ran out of contest slots.

Rejected hackers are now going public with PoC demos and direct vendor disclosures, breaking Pwn2Own's usual secrecy.

▪️ AI surfaces a massive wave of 0-day RCEs.
▪️ Submissions overwhelm ZDI past max capacity.
▪️ Slots run out. Researchers with working chains get rejected.
▪️ "Revenge disclosures" begin. ← we are here.

Confirmed casualties so far:
▪️ @xchglabs : 86 vulnerabilities prepared (PyTorch, NVIDIA, Linux KVM, Oracle, Docker, Ollama, Chroma, LiteLLM, llama.cpp). All rejected. Now reporting directly to vendors with writeups dropping as patches land.
▪️ @ggwhyp : full-chain Firefox RCE on Windows. Rejected. Publicly demoed (HTML page → cmd.exe → calc.exe). Responsibly disclosed to Mozilla.
▪️ @yunsu_dev : working RCE chain, rejected. Submitting elsewhere.
▪️ @ryotkak : tried to register for 3+ weeks. ZDI confirmed "at maximum capacity, can't add extra contest days." Considered canceling flight and hotel.
▪️ @anzuukino2802 : Claude Code RCE PoC. Rejected.
▪️ @desckimh : 0-day RCEs in Ollama and LM Studio. Rejected.

Reported impact: a community-estimated 150+ researchers tried to register. Accepted contestants are now being warned about collisions. Rejected vulnerabilities going to bug bounty programs may trigger pre-event patches that invalidate the work of those who got in.

ZDI has not publicly addressed the capacity issue. The event still runs May 14-16 in Berlin.

[Christophe Boutry @Ced_haurus]

🔴 Rappel 👉 A partir d'aujourd'hui, vos messages privés sur Instagram ne sont plus chiffrés.

[TrashTalk @TrashTalk_fr]

« Denver avait la possibilité de choisir son adversaire (en Playoffs), et ils nous ont choisis. Ils n’étaient pas obligés de nous choisir. Ils nous ont choisis. Nos joueurs étaient prêts à relever ce défi. »

- Chris Finch, coach des Wolves

[TrashTalk @TrashTalk_fr]

🎙️ Victor Wembanyama sur la folle ambiance à San Antonio cette nuit :

"C'est génial de voir autant de gens porter leur t-shirt. Les supporters étaient prêts. Je n'ai jamais vu cette salle aussi enthousiaste."

[Paul Moore - Security Consultant  @Paul_Reviews]

Hacking the #EU #AgeVerification app in under 2 minutes.

During setup, the app asks you to create a PIN. After entry, the app *encrypts* it and saves it in the shared_prefs directory.

1. It shouldn't be encrypted at all - that's a really poor design.
2. It's not cryptographically tied to the vault which contains the identity data.

So, an attacker can simply remove the PinEnc/PinIV values from the shared_prefs file and restart the app.

After choosing a different PIN, the app presents credentials created under the old profile and let's the attacker present them as valid.

Other issues:
1. Rate limiting is an incrementing number in the same config file. Just reset it to 0 and keep trying.
2. "UseBiometricAuth" is a boolean, also in the same file. Set it to false and it just skips that step.

Seriously @vonderleyen - this product will be the catalyst for an enormous breach at some point. It's just a matter of time.

[Loïs Samain🌐 @lsamain]

@ABallNeverLies

[Loïs Samain🌐 @lsamain]

@TrashTalk_fr Je trouve qu’au moins, ça montre clairement ceux qui ne veulent pas jouer et ça leur fout une mauvaise image !

[Loïs Samain🌐 @lsamain]

@spurs @wemby Exception that is not the map of France >< It miss a big east part 🧐

[Loïs Samain🌐 @lsamain]

@spurs @TrashTalk_fr

[Loïs Samain🌐 @lsamain]

@TrashTalk_fr Sans compter la pré saison où c’était déjà 4 victoires

[Loïs Samain🌐 @lsamain]

@TrashTalk_fr On a déjà eu une équipe qui a enchaîné les ROY ?

[Loïs Samain🌐 @lsamain]

@TrashTalk_fr C’est la où j’attends Wemby. Prendre le problème en main et montrer que c’est le patron de cette équipe

[Loïs Samain🌐 @lsamain]

@TrashTalk_fr D’un côté ça relance l’intérêt du match 😓

[Loïs Samain🌐 @lsamain]

@diatsch68 @TrashTalk_fr Oui très déçu de la qualité des commentaires de Prime, encore pire sur la mi temps, analyse très bas niveau… après c’est leur première, je leur laisse le bénéfice du doute…