| https://twitter.com/0xakuma | |
| verified | https://twittodon.com/share.php?t=0xakuma&[email protected] |
| Blog | https://appsec.space |
This House is Haunted:
A decade-old bug in the AION client’s housing system let Lua scripts trigger RCE.
A dive into game scripting, sandboxes, and forgotten exploits.
My keyboard was misbehaving so I had to exploit my NAS
Few weeks ago I did a small code review on #CasaOS and #ZimaOS from #IceWhaleTech
Glad to say that web (2.0) vulnerabilities are still a thing 😬
Ended up reporting a bunch of them that are being fixed. One is CVE-2024-39692.
More in a blogpost soon™️
There's A LOT going on (analysis, discussion, vendor notices, etc...) related to the ongoing xz/liblzma compromise so I created a "link roundup" which centralizes and buckets a lot of the awesome links and threads I've seen flying around.
https://shellsharks.com/xz-compromise-link-roundup
I will *try* to keep this up-to-date (ish) for a few days while things are hot but I make no promises beyond that.
#cve20243094 #xz #xzbackdoor #xzorcist #supplychainattack #xz4shell #infosec #cybersecurity
I wrote a post on the xz backdoor. No backdoor analysis, just considerations on what went wrong.
A #backdoor was found in xz/liblzma 5.6.0 to 5.6.1
shellsharks
Viss