Mastodawn

They finally did it. Microsoft has successfully over-engineered a text editor into a threat vector.

This CVE is an 8.8 severity RCE in Notepad of all things lmao.

Apparently, the "innovation" of adding markdown support came with the ability of launching unverified protocols that load and execute remote files.

We have reached a point where the simple act of opening a .md file in a native utility can compromise your system. Is nothing safe anymore? 😭

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841

#noai #microslop #microsoft #windows #programming #writing #windows11 #enshittification #cybersecurity #infosec #technology

Matthias Luft Nov 7

Moved to @[email protected]Nov 7

Bonfire Social 1.0 is live! A federated, community‑first social network built on the modular Bonfire toolkit, and it’s only the beginning.

It's time to go beyond microblogging and build apps for community organising, open science, mutual aid, and collective decision‑making. Let's take back the internet with open protocols, consent‑based governance, and portability by design.

Back the “last migration” from closed platforms to open networks: https://www.indiegogo.com/projects/bonfire/community?refcode=FVxjqI1kLUOhHXxqyrS6-g

1/2

Matthias Luft Apr 10, 2025

I didn't even think about this yet, but linting file- and directory names in project structures makes a lot of sense - and there is of course a tool for it:

https://ls-lint.org/

ls-lint

An extremely fast file and directory name linter - Bring some structure to your project filesystem

Matthias Luft Apr 2, 2025

Alright AKS, pick a lane:

Kubenet: Pods receive IP from an overlay network. Retires March 2028

Azure CNI Standard: Pods receive IP from VNET

Azure CNI Overlay: Pods receive IP from an overlay network.

Matthias Luft Apr 1, 2025

Great article on using GitHub as a workflow platform:

https://github.blog/engineering/issueops-automate-ci-cd-and-more-with-github-issues-and-actions/

Can absolutely recommend for security workflows and management as well!

IssueOps: Automate CI/CD (and more!) with GitHub Issues and Actions

A look into building IssueOps workflows on GitHub to do everything from CI/CD to handling approvals and more.

The GitHub Blog

Matthias Luft Mar 31, 2025

Quite some #IngressNightmare #CVE-2025-1974 PoCs on GitHub now that look good at a cursory review:

https://github.com/hakaioffsec/IngressNightmare-PoC

https://github.com/yoshino-s/CVE-2025-1974/

https://github.com/Esonhugh/ingressNightmare-CVE-2025-1974-exps/

https://github.com/hi-unc1e/CVE-2025-1974-poc/

https://github.com/lufeirider/IngressNightmare-PoC

https://github.com/zwxxb/CVE-2025-1974

https://github.com/rjhaikal/POC-IngressNightmare-CVE-2025-1974

Quick note on exploits trying to use `nginx.ingress.kubernetes.io/server-snippet`: That annotation has been identified as an issue before and has been disabled to mitigate CVE-2021-25742.

GitHub - hakaioffsec/IngressNightmare-PoC: This is a PoC code to exploit the IngressNightmare vulnerabilities (CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, and CVE-2025-1974).

This is a PoC code to exploit the IngressNightmare vulnerabilities (CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, and CVE-2025-1974). - hakaioffsec/IngressNightmare-PoC

GitHub

Show thread

Matthias Luft Mar 31, 2025

@raesene True, quite some good stuff out now!

Show thread

Matthias Luft Mar 28, 2025

@raesene Hm, the ones I looked at were quite lacking :D But that was two days ago and reliable exploit did not take that long. Will have a look, thx :)

Matthias Luft Mar 28, 2025

I wrote up some details on exploiting #IngressNightmare #CVE-2025-1974:
www.averlon.ai/blog/kuberne...

Where are we at with releasing a full PoC?

Matthias Luft Mar 18, 2025

Wow, GitHub not supporting IPv6 for Webhooks:

https://docs.github.com/en/webhooks/about-webhooks#about-webhooks-on-github

About webhooks - GitHub Docs

Webhooks provide a way for notifications to be delivered to an external web server whenever certain events occur on GitHub.

GitHub Docs