Roi

Low-level AppSec. y = F @ x + B @ u

[Roi @rmallof]

CVE-2018-1009 | Microsoft DirectX Graphics Kernel Subsystem Elevation of Privilege Vulnerability https://t.co/DIEryjUZQR

[lcamtuf @lcamtuf]

But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

https://t.co/yp5WJxQZF1

[Calif @calif_io]

MAD Bugs: Finding and Exploiting a 21-Year-Old Vulnerability in PHP

@i0n1c was "the PHP security guy" twenty years ago, so we thought it'd be fun to welcome him with a fresh unserialize UAF.

https://t.co/9ErxpKSELx

[Samuel Groß @5aelo]

The fuzzer that found https://t.co/Y5DOo7QGHE (and a number of issues prior to that as well) is now open-source: https://t.co/zCdbHCpJ4z

It uses pkeys, trap-handling and single-stepping to intercept and mutate in-sandbox reads (see trap-fuzzer.h). Definitely had fun writing it!

[chiefpie @cplearns2h4ck]

Some of the bugs I disclosed to MSRC last year is now public on the company's advisory page.

E.g: CVE-2025-47985 Windows Event Tracing Elevation of Privilege

https://t.co/G6eCy2E1kt

[Project Zero Bugs @ProjectZeroBugs]

V8 Sandbox Bypass: Memory corruption during BigInt division https://t.co/HYcPDP1Nz7

[zeb @zebassembly]

The situation in Spain where LaLiga can force ISPs to ban any IP range they want without a court order is ridiculous and so aggressively anti-internet that it's causing real harm to Spain's citizens.

Docker is one thing, but the other comments in this HN post are way worse (anti-theft alarms, apps for helping people suffering from dementia). It's horrible that clouds that serve multiple sites from the same IPs are being strong-armed into either taking down anything LaLiga wants without a court order or suffering mass ip blocks.

[Gergely Orosz @GergelyOrosz]

It's hard to believe that the "~80%+ of the internet is blocked in Spain during football games" claim is true - but it is!! And has been for years.

The government is sabotaging their complete digital economy... for La Liga, a private football org worth €5B. Pure madness

[Theo - t3.gg @theo]

Spain's egregious Cloudflare blocks are breaking Docker now 💀

[Roi @rmallof]

OSS-Fuzz and LLM-powered agents are pushing vulnerability research toward an "efficient market hypothesis" (EMH)-like dynamic

Eventually, will be no longer an artisanal craft but a high-frequency, information-efficient "market" driven by automation, where capital and speed win

[Halvar Flake @halvarflake]

LLMs are reshaping software dev. I don't buy "the end of software dev": Project ambition will grow dramatically.

Ancient Egyptians could build the Pyramids but not the Empire State Building.

Pre-LLM software will be viewed like we view the Pyramids.

[R A Y D E N @soyRayden]

🖤

[Swingtrader @Swingtrader]

Brilliant article by @profplum99 - I don’t think this could have been articulated anyway possibly better.

https://t.co/UpG6MwvmiM

[AIfredo 0rtega @ortegaalfredo]

@FFmpeg So now we have read/write stack-based buffer overflow. Game over.

Fuzzer and complete explanation can be found on my github:

https://t.co/7m0i6Dmvud

[0xor0ne @0xor0ne]

"Compromising Kernel Integrity By Turning System Registers Against the System"

https://t.co/YCjWAo2caC

#Linux #infosec

[Natalie Silvanovich @natashenka]

@__sethJenkins broke kASLR by doing … nothing 😩

https://t.co/hxPzVTC1RN

[Elon Musk @elonmusk]

https://t.co/op5s4ZikGJ is fully open source, so anyone can use it for anything at no cost

[Connor McGarr @33y0re]

Today I am releasing a new blog on Windows on ARM! It comes from the perspective of one, like myself, who comes from an x86 background and is new, but, interested in Windows on ARM! ELs, OS & hypervisor behavior (with VBS), virtual memory, paging, & more!

https://t.co/jUHls4wupu

[Natalie Silvanovich @natashenka]

Serious bugs often occur in third-party components integrated by other software. @ifsecure and I found this vulnerability in the Dolby Unified Decoder. It affects Android, iOS and Windows among other platforms, sometimes 0-click.

https://t.co/LchMIdKP0P

[Lukasz Olejnik @lukOlejnik]

Geostationary satellites are leaking critical data, transmitting sensitive communications in the clear. With just $800 of consumer hardware, researchers intercepted military, telecom, retail, and infrastructure traffic. No state-grade tools required. Captured data included full voice calls, SMS, IMS signaling, SIP, RTP, and GTP tunnels—unencrypted, no IPsec, no TLS. Telecom backhaul exposed user messages, phone numbers, session keys, and IMSIs. Mexican military traffic leaked live telemetry, asset positions, logistics, and narcotics intelligence—broadcast openly across half a continent.