Gonçalo Ribeiro

@goncalor@infosec.exchange
342 Followers
446 Following
3.4K Posts
Defend. Pwn. Infosec. Free software. Vim nerd. #rustlang #electronics
websitehttps://goncalor.com
GitHubhttps://github.com/goncalor
Gonçalo Ribeiro3h ago
Kymberly5h ago

LLM and AI users and evangelists should offset with personal water use reduction. Similar to the personal carbon reduction campaigns that have seen many city dwellers shift to bikes and public transport.

- One single query is a cup of water. Drink a glass or a cup of tea/coffee less that day.

- Make 20-30 queries in one day? Swap a daily shower or bath for a basin wash.

- Want to spend more water budget on queries? Then cut water usage even more - no basin wash, tooth brushing, toilet flushing, washing up, cleaning, clothes and linen washing, hand washing, car washing, garden watering, cooking.

I’m hesitant to recommend reducing family members’ and pets’ water consumption as they aren’t making the queries, but that will be the result of the regional water pollution and groundwater reduction.

#AI #LLM

Gonçalo Ribeiro5h ago
vitamin schratzeNov 11, 2024
Gonçalo Ribeiro1d ago
Alexandre Dulaunoy1d ago

« Cloudflare 1.1.1.1 Incident on July 14, 2025 »

Perhaps it’s time to return to DNS’s original distributed design.

#dns #distributed #cloudflare

https://blog.cloudflare.com/cloudflare-1-1-1-1-incident-on-july-14-2025/

Cloudflare 1.1.1.1 Incident on July 14, 2025

On July 14th, 2025, Cloudflare made a change to our service topologies that caused an outage for 1.1.1.1 on the edge, resulting in downtime for 62 minutes for customers using the 1.1.1.1 public DNS Resolver as well as intermittent degradation of service for Gateway DNS. We’re deeply sorry for this outage. This outage was the result of an internal configuration error and not the result of an attack or a BGP hijack. In this blog post, we’re going to talk about what the failure was, why it occurred, and what we’re doing to make sure this doesn’t happen again.

The Cloudflare Blog
Gonçalo Ribeiro1d ago
nixCraft 🐧2d ago

Good God. A restaurant uses AI to generate menu and this is what it reads.

Source: Restaurants shouldn't use AI for description https://old.reddit.com/r/mildlyinfuriating/comments/1lzmx3o/restaurants_shouldnt_use_ai_for_description/

Gonçalo Ribeiro2d ago
Jon Henshaw2d ago
Gonçalo Ribeiro3d ago
da_6673d ago
trying nobara on my old origin PC laptop. It's not really that old, but Microsoft thinks it a quad core system with over 1TB of SSD, and 32GB of ram can't run win11 because it lacks a TPM, so now it gets to become my Linux playground before I commit to LInux on my primary desktop. I really hope this goes well.
Gonçalo Ribeiro3d ago
Javier Jimenez Shaw4d ago

At the Comedy Wildlife exhibition in Madrid.

https://www.mncn.csic.es/es/visita-el-mncn/exposiciones/comedy-wildlife-premios-de-fotografia

#wildlife #photography

Gonçalo Ribeiro3d ago
daniel:// stenberg://3d ago

> AI assistance was used to help structure and format this vulnerability report.

That was a really stupid idea.

Gonçalo Ribeiro4d ago
The Wee Owl Art4d ago

Edinburgh Castle stands on Castle Rock, which has been occupied by humans since at least the Iron Age.
https://theweeowlart.etsy.com/listing/1886833786

#FediGiftShop #ScottishArtist #MastoArt #CreativeToots
#Landscape #Edinburgh #Scotland #OriginalArt #Drawing #PenAndInk #ColourPencil #MixedMedia #Painting #Artwork #TraditionalArtist #ArtFromScotland #GiftIdeas #ArtShop

Gonçalo Ribeiro4d ago
vascorsd4d ago

Faking a JPEG | Lobsters

https://lobste.rs/s/s6yydx/faking_jpeg

Faking a JPEG | Lobsters

×
Show threadKevin Beaumont3d ago

Imperva WAF have added detection and blocking for CitrixBleed 2 this weekend.

They see it being widely sprayed across the internet today - almost 12 million requests, log4shell level.

The only major vendor I’ve seen who hasn’t added a WAF rule is Citrix - they sell a WAF upsell module for Netscaler, but failed to add detection for their own vulnerability.

Show threadKevin Beaumont2d ago

Updated Citrix scan results will go on Github in a few days, I've found a bug in the scan results setup which should add ~33% more hosts when fixed.

Spoiler:

Show threadKevin Beaumont2d ago

CitrixBleed 2 update.

- Citrix have finally, quietly admitted exploitation in the wild -- by not commenting to press and then editing an old blog post and not mentioning it on their security update page.

- Orgs have been under attack from threat actors in Russia and China since June

- It's now under spray and pray, wide exploitation attempts.

https://doublepulsar.com/citrixbleed-2-situation-update-everybody-already-got-owned-503c6d06da9f

CitrixBleed 2 situation update — everybody already got owned

The ‘good news’, I suspect, is that most orgs will be too lacking in logs to have evidence. So they get to hope nothing too bad happened, I guess. The reason for this is the exploitation activity…

DoublePulsar
Show threadKevin Beaumont1d ago

Citrix Netscaler internet scan still running, it's found another 1k vulnerable instances so far - will probably update Github later today or tomorrow morning.

It looks like we're back up to 18% of boxes being still vulnerable when the new list is out. It looks like a lot of orgs are patching from my list.

Show threadKevin Beaumont1d ago

New CitrixBleed 2 scan data:

https://raw.githubusercontent.com/GossiTheDog/scanning/refs/heads/main/CVE-2025-5777-CitrixBleed2-ElectricBoogaloo-patching.txt

+7000 extra hosts added this round, host list is so large you need to use the raw view to see it.

Next set of data publication likely Friday, a month since the patch became available.

3832 orgs/hosts still unpatched.

Show threadKevin Beaumont14h ago
GreyNoise blog just out about #CitrixBleed2, they see exploitation from IPs in China from June 23rd targeting specifically Netscaler appliances https://www.greynoise.io/blog/exploitation-citrixbleed-2-cve-2025-5777-before-public-poc
Exploitation of CitrixBleed 2 (CVE-2025-5777) Began Before PoC Was Public

GreyNoise has observed active exploitation attempts against CVE-2025-5777 (CitrixBleed 2), a memory overread vulnerability in Citrix NetScaler. Exploitation began on June 23 — nearly two weeks before a public proof-of-concept was released on July 4.

Show threadKevin Beaumont14h ago

I’m fairly certain the threat actor is Chinese and they reversed the patch to make the exploit.

Citrix continue to be MIA. They still have no detection guidance for customers, and haven’t told customers the extent of the issue.

#CitrixBleed2

Show threadKevin Beaumont14h ago

With the #CitrixBleed2 patch data I publish it's possible to view the history on Github for each new scan and see when hosts change from vuln to patched.

It's proving incredibly effective at getting orgs to patch. I tried private notifications via HackerOne and such for CitixBleed1 in 2023 and it took months to get orgs to patch. Putting the data public brings accountability for orgs who later get breached - so there's a rush to patch.

It's definitely interesting and may need a scale out.

Show threadVickie Gray 🍁14h ago
@GossiTheDog Definitely. Refreshing transparency.
Show threadJP14h ago
@GossiTheDog providing the data to cyber insurers to wash against their customer base.
Show threadDick Telder14h ago
@GossiTheDog
Not sure how often the list is updated, but the orgs I emailed 24h ago are still listed as vulnerable.
Show threadKevin Beaumont14h ago
@dtelder rescan is running at the moment
Show threadleakix7h ago
@GossiTheDog 😇 sure does work. Any take-down requests yet ? 🤔
Show threadKevin Beaumont5h ago
@leakix I had one org asking not to appear, I said no
Show threadCyberFrog6h ago
@GossiTheDog another day, another example of full disclosure working better than the alternatives lol
Show threadOracleOfApollo1d ago
@GossiTheDog are you using the PoC exploit to determine if systems are vulnerable or basing it off timestamps to infer build numbers instead?
Show threadAlex1d ago
@OracleOfApollo @GossiTheDog probably checking the version or something. I don't see fingerprinting being that difficult and exploit even defanged might be problematic in the legal sense.
Show threadAlan Miller  🇺🇦1d ago
@GossiTheDog this is probably a silly question, but are you scanning netblocks most likely to have affected devices first? Eg I'm guessing not a lot likely in AWS, GCP, Azure, China, residential, etc address spaces.
Show threadDavid Penington1d ago
@GossiTheDog "it looks like a lot of orgs are patching from my list" eek! Organisations hane so little knowledge of what they have that it takes you to tell them?
Show threadChristoffer S.2d ago

@GossiTheDog Perhaps time to refer to it using the more appropriately descriptive word... Wild.

This vulnerability is WILDLY EXPLOITED.

As a bonus "exploited in the wild" can be changed to "wild exploitation observed".

Show threadSuzanne Aldrich (she/her)1d ago

@GossiTheDog Shitrix, amirite?

I’ve been referencing network security device vulnerabilities as the #1 identified breach vector in my latest talk. Guess I need to update my greatest hits already.

https://www.slideshare.net/slideshow/futurecon-seattle-2025-presentation-slides-you-had-one-job/281147331

FutureCon Seattle 2025 Presentation Slides - You Had One Job

In 2024, attackers didn’t need phishing emails to compromise enterprises — they just waited for the latest zero-day in your firewall to be weaponized. Mandiant’s M-Trends 2025 report reveals that most intrusions now start with exploited vulnerabilities in edge security devices. Meanwhile, credentials are stolen by malware faster than MFA can save you, and security vendors themselves are being turned into initial access brokers — unintentionally. This talk is a call to get back to basics. We’ll walk through the top 10 ways organizations are still failing at foundational security, and provide a clear, no-nonsense roadmap for how to fix it. Aligned to NIST, PCI DSS, and C2M2 frameworks, this approach avoids complexity, avoids buzzwords, and avoids blaming users. You don’t need another vendor — you need to configure what you already have properly, document it, and follow through. Because at the end of the day, no one wants to explain to leadership how your “security box” was the reason you got owned. - Download as a PDF or view online for free

SlideShare
Show threadJacob Pedersen1d ago
@GossiTheDog Ohh boy... 
Show threadSystem Adminihater3d ago
@GossiTheDog "The only major vendor I’ve seen who hasn’t added a WAF rule is Citrix - they sell a WAF upsell module for Netscaler, but failed to add detection for their own vulnerability." WHAAAAAAAA