Xavier ยซXยป Santolaria  

1.9K Followers
656 Following
307 Posts

๐Ÿ‘จโ€๐Ÿ‘ฉโ€๐Ÿ‘งโ€๐Ÿ‘ฆ Husband. Proud Father. He/Him.โ€ฉ

๐Ÿ‘๏ธ ๐Ÿ โ“‚๏ธ IBM Inventor and Cloud Security Solution Architect | Open Innovation Community.

Member of the IBM Academy of Technology (AoT).

 ex-#OpenBSD (xsa@). Hacker. Open Source Advocate.

โ€ฉ๐Ÿ’ฌ My Own Views. Always.

#ibm #infosec #cloudsecurity #fedi22 #wehackhealth #crossfit #emtb #fieldhockey #porsche #nobot

๐Ÿ“ Location๐Ÿ‡ง๐Ÿ‡ช๐Ÿ‡ช๐Ÿ‡ธ @ ๐Ÿ‡จ๐Ÿ‡ญ
๐ŸŒ Websitehttps://0x58.santolaria.net
:github: GitHubhttps://github.com/xsa
๐Ÿ”‘ Keybasehttps://xsa.keybase.pub/mastodon.html
๐Ÿ“จ Newsletterhttps://infosec-mashup.santolaria.net/?utm_source=mastodon&utm_medium=social
๐Ÿ—“๏ธ {Cyber,Info}Sec Eventshttps://xsa.github.io/infosec-events/

Another session announcement for BSides Luxembourg!

๐Ÿ’ป ๐—ง๐—›๐—ข๐—ฆ๐—˜ ๐—ช๐—›๐—ข ๐——๐—ข๐—กโ€™๐—ง ๐—Ÿ๐—˜๐—”๐—ฅ๐—ก ๐—™๐—ฅ๐—ข๐—  ๐—–๐—ฉ๐—˜๐—ฆ ๐—”๐—ฅ๐—˜ ๐——๐—ข๐—ข๐— ๐—˜๐—— ๐—ง๐—ข ๐—ฅ๐—˜๐——๐—œ๐—ฆ๐—–๐—ข๐—ฉ๐—˜๐—ฅ ๐—ง๐—›๐—˜๐—  - Louis Nyffenegger (@snyff ) ๐Ÿ’ฅ

Real vulnerabilities donโ€™t appear in isolation, theyโ€™re rooted in code, context, and human error. This session walks through actual CVEs, analyzing the code where they were introduced. You will see the patterns, assumptions, and language quirks that led to the flaw - not just the exploit, but the moment it couldโ€™ve been caught.

Louis Nyffenegger https://bsky.app/profile/snyff.pentesterlab.com is the founder of PentesterLab and AppSecSchool, application security expert, and hands-on trainer with experience at the National Bank of Australia, Australia Post, and Fitbit.

๐Ÿ“… Conference Dates: 6โ€“8 May 2026 | 09:00โ€“18:00
๐Ÿ“ 14, Porte de France, Esch-sur-Alzette, Luxembourg
๐ŸŽŸ๏ธ Tickets: https://2026.bsides.lu/tickets/
๐Ÿ“… Schedule Link: https://pretalx.com/bsidesluxembourg-2026/schedule/

#BSidesLuxembourg #CVE #CodeReview #SecureCoding #PenTest #SecurityEducation #DevSecOps

That really made my day @MorningBrew

[...] Stocks continued to be as volatile as a Real Housewife after too many margaritas yesterday [...]

 

#stocks #economy

pilfered from around the web
Puffy sighted outside Wharf Chambers in Leeds

If this was your doing, lemme know :)

#openbsd

Yeah. Not wrong.

๐Ÿ“ท (c) NLBeeld

#uspol

The FBI and @EUCommission confirmed respective breaches.

No one is safe. Make sure you expect the unexpected.

#infosec #cybersecurity

RSA Conference was in full swing in San Francisco this week โ€” booths, buzzwords, and billion-dollar pitches as far as the eye can see. Meanwhile, out in the real world, threat actors didn't get the memo. Iran-linked hackers are using Telegram to hunt down dissidents and journalists, while TeamPCP's supply chain worm is deploying Kubernetes wipers that specifically target Iranian clusters. Two sides of the same geopolitical coin, playing out in parallel โ€” and neither one is buying a vendor badge.

โ†’ Week #13/2026 also covers:

๐Ÿชฑ TeamPCP's worm ;

๐Ÿ‡ฎ๐Ÿ‡ฑ ๐Ÿ‡ฎ๐Ÿ‡ท Iran's hacked cameras ;

๐Ÿ†™ โœ… A Tycoon 2FA that just won't die ;

โŒ ๐Ÿ‡บ๐Ÿ‡ธ The FCC has banned the sale of new consumer routers made outside the USA;

๐Ÿ’ฐ๏ธ #OpenAI launched a public safety bug bounty for #AI-specific abuse and safety risks;

Full issue ๐Ÿ‘‰ https://infosec-mashup.santolaria.net/p/infosec-mashup-13-2026-rsa-week-real-world-problems

If you find it useful, subscribe to get it in your inbox every weekend ๐Ÿ“จ #infosecMASHUP #cybersecurity #infosec #threatintel

๐Ÿ•ต๐Ÿปโ€โ™‚๏ธ [InfoSec MASHUP] 13/2026 - RSA Week, Real World Problems

Plus: TeamPCP's worm, Iran's hacked cameras, and a Tycoon 2FA that just won't die. The real RSA keynotes.

Xโ€™s InfoSec Newsletter
GitHub hits CTRL-Z, decides it will train its AI with user data after all

: As of April 24 you'll be feeding the Octocat unless you opt out

The Register

Iran-linked hacking group Handala says it breached FBI director Kash Patelโ€™s personal Gmail .. ๐Ÿ˜ต

#infosec #cybersecurity #iran

Wow, TeamPCP is hacking open-source developers faster than we can report on them. The latest (that I'm aware of, anyway) is LiteLLM. They worked with Trivy but didn't bother to change their credentials after Trivy was hacked, despite an ample amount of advice to do so.

Folks, if any of you used LiteLLM, now is the time to change your credentials, in an atomic way. Now, as in immediately.

https://news.ycombinator.com/item?id=47501729

LiteLLM Python package compromised by supply-chain attack | Hacker News