Gino

ethical hacker, mostly.

[Gino @mostlygino]

Reminder: we've been pwned since the 90s.

[Gino @mostlygino]

@TheHackersNews the fun part is it's the filename, not the file. if your upload handler keeps the user's filename, swap it for a random id before pillow ever sees it. and check if your image even needs ghostscript installed. 13.0.0 has the fix

[Gino @mostlygino]

@IntCyberDigest 4,500 lines of ml-dsa code an unauthenticated client could reach even when the admin had excluded the algorithm, about 16% of sshd's pre auth code. 10.6 checks the key type before parsing. sshd on the internet? update today

[Gino @mostlygino]

their post: https://t.co/uvaV0rPxzi

[Gino @mostlygino]

vercel surveyed 1,000+ saas vendors and only 8.4% support secure auth. so by nov 30 marketplace listings that still need long lived secrets get a 'not secure' label, delisted by january.

same move chrome pulled on http. love it, a stolen key that expires is a boring incident

[Gino @mostlygino]

@emollick one data point from the defender side: openssh's 10.6 notes say a number of ai found bugs were later found independently by other researchers, so they're shipping more frequent releases instead of batching fixes. cheap attacks, so cheap releases

[Gino @mostlygino]

fixed signal bug worth knowing: someone on a call could flood its queue so your hang up didn't fully land, mic and maybe camera still going. ringrtc 2.72.0 fixed it last month, no known exploitation.

bug found, fixed, advisory public. keep auto update on and you're done

[Gino @mostlygino]

@rauchg in fairness the aunt's post it comes with physical access control. you have to get into the kitchen first, and someone offers you coffee while you're there

[Gino @mostlygino]

https://t.co/BWmp9vJJUJ

[Gino @mostlygino]

arc dies dec 22 because keeping a browser secure is too much work. fair. then open source it and let the people who loved it do that work 🫡

[Gino @mostlygino]

@The_Cyber_News ksmbd is the in kernel smb server, not samba. if ksmbd isn't running, these two don't reach you. if you need it, keep it off untrusted networks and watch your distro's advisories, no cve or mainline fix yet per the report

[Gino @mostlygino]

@ProtonPrivacy 1 step closer to yeet teams in the trash.

[Gino @mostlygino]

@securitynl @securitynl kritieke lekken aankondigen zonder details betekent ook: zodra de patch uit is, zit iedereen de diff uit te pluizen. staat je fortigate beheerinterface nog open naar internet, zet die vandaag dicht en wacht niet op de advisory

[Gino @mostlygino]

@securitynl @securitynl die code is de hele aanval. whatsapp vraagt je nooit om hem naar iemand door te sturen, ook niet als het bericht van je moeder lijkt te komen. zet tweestapsverificatie aan en check af en toe je gekoppelde apparaten, kost 30 seconden

[Gino @mostlygino]

release notes: https://t.co/FkMktn2L44 (the brotli rce is CVE-2026-111497, rated high)

[Gino @mostlygino]

node security release is out, update to:

22.23.4
24.22.1
26.12.1

still on 18 or 20? those are end of life, no patch is coming for you. big ups to vercel for putting firewall rules in front of every deployment before the release even dropped, nice buffer while you bump

[Gino @mostlygino]

@IntCyberDigest the detail i like: per the ag, new mexico law sends the penalty money to the state's schools. 43m violations, counted per person who saw each misleading statement. appeal is surely coming, but misleading people about their data finally has a per person price

[Gino @mostlygino]

@AISafetyMemes sorting this by what needs your hands today: update php and node, patch self hosted gitlab, check nothing pulled litellm 1.107.0, roll your railway env vars. most of the rest you can't fix from your laptop. heavy week, but the actual to do list fits on a post it

[Gino @mostlygino]

@S1r1u5_ agree, and the outliers are the ones to act on. litellm 1.107.0 wasn't a bug report, it ran a stealer at every python start without even importing litellm. if it touched a box, rebuild it. per socket, even running pip in there can set it off again

[Gino @mostlygino]

got working labs for this one. lot of slop floating around out here and honestly it's quite a big cve. 8.4.26 pops, 8.4.27 holds.

[Gino @mostlygino]

source: https://t.co/IG6SIZmCjj

[The Hacker News @TheHackersNews]

🚨 PHP2Shell: the one-line “fix” everyone shared overnight — session.upload_progress.enabled=0 — isn’t enough on its own, the firm that suggested it now says.

A PHP core developer put it bluntly: “the only mitigation is patching / upgrading PHP.”

No patch until 14:00 UTC today.

Here’s what actually cuts your risk before then → https://t.co/SFcouqpGcr

[Gino @mostlygino]

exploits are validated. the one-line upload_progress off isn't enough on its own. take the php offline if you can and wait for the patch at 16:00 cest