All posts in Uncategorized

■■■■□ Graphene-OS allegedly compromised by Catalonian police via custom malware. An interesting thread: https://discuss.grapheneos.org/d/23823-security-breach-by-catalan-police https://www.mobil.se/nyheter/pixel-telefoner-vacker-brottsmisstankar/1639898

■■□□□ Exploitation speed has reached record highs, with the window between CVE announcement and attack shrinking from months to mere hours. Attackers are now reverse-engineering repositories to exploit vulnerabilities before they are even public, while AI agents are discovering and exploiting zero-days in a continuous loop.

■□□□□ Data-Leak: 🇵🇰 Alleged Askari Bank Customer Database Advertised on Underground Forum, Breached. A threat actor is claiming to be selling an alleged Askari Bank customer database containing approximately 40,000 records. According to the forum post, the dataset reportedly includes: * Bank name * Branch name * CNIC / National ID * Customer names *…

■■■■■ In conducting a 0-day research project against #SharePoint, Rapid7 Labs discovered 2 new vulns that, when chained together, achieve RCE against a vulnerable server. Today, Rapid7 and Microsoft are disclosing CVE-2026-55040 – the first vuln in this chain: r-7.co/4f2HpQO (https://www.rapid7.com/blog/post/ve-cve-2026-55040-microsoft-sharepoint-jwt-token-authentication-bypass-fixed/)

■■■□□ The world’s smallest Arduino-compatible USB-C board. Meet Moddo Pinch – The world’s smallest 32-bit Arduino-compatible board (2026 Edition) The moddo Pinch measures just 10.9 x 10.5 mm, and features a Microchip Technology Inc. SAMD11 Cortex-M0+ microcontroller with 4 KB SRAM and 16KB flash, an RGB LED, reset/bootloader button, 3.3 V LDO, and a total…

■■■■■ Using Claude to reproduce an ElectroMagnetic (EM) glitch privilege escalation attacks (x.com/raelizecom). https://raelize.com/blog/ai-fi-reproducing-adb-to-root-on-googles-tv-streamer-using-claude/

■■■□□ Unauthenticated RCE in Motorola’s MR2600 Router https://mrbruh.com/motorola/

■■□□□ Intruding thread on privacy. https://x.com/i/status/2075226136229863475

■■■□□ no-gdid: Read, understand, and silence the Windows Global Device Identifier (GDID) — the hidden per-account device ID that helped the FBI locate a suspect who was using a VPN. 👮 the best option is to switch Microsoft products out of environment completely. At ckure, we use Fedora. https://github.com/Korben00/no-gdid

■■■□□ Proxyware actor behind fake 7-Zip is bigger than most assumed. Fake Installers, Fake Reviews, Fake Services – Real Proxies, Real Victims