I'm on the server floor of a "highly secure data center with 24/7/365 surveillance, direct access control and robust perimeter security".

An actual duck just walked by. 🦆

The panic is absolutely glorious. I think this just became one of the highlights of my life.

Cursor is now using Open VSX to install code editor extensions from. You must understand the implications of this!

There has been an attack campaign happening for more than a month with extensions that install ScreenConnect.

I found a Linux kernel security bug (in AF_UNIX) and decided to write a kernel exploit for it that can go straight from "attacker can run arbitrary native code in a seccomp-sandboxed Chrome renderer" to kernel compromise:
https://googleprojectzero.blogspot.com/2025/08/from-chrome-renderer-code-exec-to-kernel.html

This post includes fun things like:

• a nice semi-arbitrary read primitive combined with an annoying write primitive
• slowing down usercopy without FUSE or userfaultfd
• CONFIG_RANDOMIZE_KSTACK_OFFSET as an exploitation aid
• a rarely-used kernel feature that Chrome doesn't need but is reachable in the Chrome sandbox
• sched_getcpu() usable inside Chrome renderers despite getcpu being blocked by seccomp (thanks to vDSO)

Told y'all we were cooking.

Say hello to Conjured Ink ( https://conjured.ink ): an #IndieWeb-based, #decentralized ecosystem of shops networked together to resist the kind of nonsense Itch and Steam have been dealing with.

We're a collective designing and building the software needed for folks who aren't techies to basically self host without feeling like they're self-hosting. Because you shouldn't need to be a sysadmin to free yourself from this yoke.

Join us!

#ConjuredInk

do I know anyone who knows a bunch about Firebase auth?

I've got a target where I have full control over one of the domains in the "authorizedDomains" list reported by the identitytoolkit /v1/projects REST API.

the target supports a bunch of different authentication flows - Google, OIDC, password, some others.

what can I do with control over an "authorised domain"? the docs are frustratingly vague. I tried a bunch of stuff and nothing worked.

(no guess responses please)

#infosec #firebase