🚨 BREAKING: More than 400 Arch Linux User Repository packages have been compromised with infostealer malware and a rootkit. Attacker posed as a trusted maintainer and "adopted" orphaned packages. Arch maintainers are purging infected packages now. Audit your AUR installs.

Good lord 🤮

1/ WHEREAMI: Built a Chrome-based geolocation red team tool (bash script😅). whoami tells you who. whereami tells you where. Living-Off-the-Land (#LOLbins), no new binaries, no permissions prompts. Relevant for proximity based attacks, e.g. @Volexity's nearest neighbor

We’ve now seen at least four nginx RCEs that require non-default configs: nginx rift, nginx poolslip, and two of our own (including the one in the last tweet). The configs involved are unusual, which raises the obvious question: do these attacks actually work in real-world deployments? We asked Claude to download and analyze more than 4,000 nginx config files from GitHub. The result was embarrassing: none of them were vulnerable to nginx rift or our own attacks. We can’t say anything about nginx poolslip yet, since it hasn’t been published. So don't worry about your nginx yet. Moral of the story: AI can generate FUD, but also help fight FUD. Embrace it!

𝟲𝟬𝟬.𝟬𝟬𝟬€ kostet es, zwei Kinder großzuziehen (Direktkosten Verdienstausfall). Fast genau so viel bezieht ein kinderloser Mensch im Alter an Rente, Gesundheit und Pflege aus dem Umlagesystem. Ein einseitiges Geschäft: Eltern investieren, Kinderlose profitieren. 🧵

Unfortunately, Tao Yan & Edouard Bochin of Palo Alto Networks could not get their exploit of Apple Safari – Renderer Only working within the time allotted. #Pwn2Own #P2OBerlin