Replying to
@nuintari@mastodon.bsd.cafe me too! Hope for a speedy recovery!
Remote
Geoff
@sternecker@infosec.exchange
mastodon 4.8.0-alpha.3+glitchBSidesCLE 2026 | ISC2CLE
Cybersecurity | Linux
#InfoSec #Linux #OpenSource #LGBTQ #Vegan
Brain dumps.
317 Followers
437 Following
50 Posts
Joined December 05, 2022
Score from #BSidesCle badges, cards, mug. Some stickers, and raspberry pi pico. Thank you all!
Hope to see you at ISC2Cle meetup Tue.
Will also be at Cleveland ISS summit next month.
Plus, the Burning River Cyber Con in November!
Thinking about a 🔇 style tattoo for below my right ear if the therapy fails.
Replying to
@krypt3ia@infosec.exchange "Ordinarily he is insane. But he has lucid moments when he is only stupid." - Heinrich Heine
Replying to
@nuintari@mastodon.bsd.cafe hearing has been gone since about 04:00 Tue. Rcvd steroid injection Wed. Taking meds for vertigo, an oral steroid, and a med for nerve damage.
Sudden hearing loss. Right side 100% loss including via bone induction. Side effects are vertigo, nausea, spins. Left side was already reduced. About 70-80% deaf.
Not sure if this is related to rapid weight loss. Went to Germany and walked 10+k per day, ate better quality food. Scale at doctors office indicated I'd lost 20lbs in about 14 days.
From duckduckgo search vestibular hearing loss can be associated with rapid weight loss. Fantastic.
440 CVEs dropped to kernel cve-announce in the last 24 hrs?!?!?!?
Whoa, calm thy horses! It looks like a backlog dump of resolved issues all sequentially numbered. No RCEs and all resolved.
#minimalist #Linux #Selfhosting #selfhosted #selfhost #InfoSec #Exploit
Two previously disclosed CVEs are actively-weaponized kernel root exploits. GhostLock CVE-2026-43499, and Bad Epoll CVE-2026-46242, are both public highly reliable exploits. Ghostlock also appears to enable a container escape and Bad Epoll is also working on Android.
Both are fixed in kernel 6.12.96-1.
If you have local user, upgrade the kernel & boot it.
BRB have to reboot :)
#minimalist #Linux #Selfhosting #selfhosted #selfhost #InfoSec #Exploit
STRONGER PROSE IS NOT ENFORCEMENT
A project to test AI guardrails.
https://github.com/sternecker/guardrails
STRONGER PROSE IS NOT ENFORCEMENT
There is a notice in the repo that it is not to be processed. There is a script that will add markdown to the beginning of a PDF. There is an AWESOME original pdf from @pluralistic@mamot.fr and an updated.pdf with the new preface notice.
A few things to share, nginx: CVE-2026-42533 dropped yesterday 2026-07-15. It is fixed in nginx 1.31.3, also released yesterday. CVSS 8.1 or 9.2 depending on the nginx version. It's a heap buffer overflow in the map directive when regex... regardless, it is unauthenticated, needs a custom HTTP request, can crash it or lead to code execution if Address space layout randomization (ASLR) is disabled, or bypassed. Don't disable memory randomization. Not sure how to bypass ASLR, I'll have to look into that.
glibc CVE-2026-5450 originally disclosed 2026-04-20 so it's "not new." What's new is the SSVC exploitation flag flipping to "poc" within the last 21 days meaning a proof-of-concept surfaced recently for an April CVE, which is the "weaponized old CVE" pattern we see regularly. No vendor patch exists? Maybe i'm missing it. CVSS 9.8, scanf %mc off-by-one heap overflow with an explicit width >1024... real-world exposure is low even with a PoC out.
Debian 13.6 was released 2026-07-11. It's a point release, bundled a ton of security advisories including and an expired Secure Boot CA fix. It's the routine patch cycle.
Make it so.
#minimalist #Linux #Selfhosting #selfhosted #selfhost #InfoSec #Exploit
A couple things this morning. CVE-2026-46242 "Bad Epoll" Linux kernel, CVSS 7.8, local privilege escalation was already mentioned CVE published around May.
1: What's new today: it is now fully weaponized and publicly written up. It's a use-after-free race in the kernel's eventpoll subsystem (ep_remove()/ep_remove_file()). An unprivileged local user can win a race condition and get root.
2: Affected: kernel 5.10 through 6.11.
3: The Attack surface is broad because epoll underlies nginx, Node.js, Python asyncio, databases, Android's event loop.
So, basically anything async I/O.
An App can be the foot in the door, the race condition can lead to root.
I'm running Kernel 6.12.94+deb13-amd64. So driving on.
#minimalist #Linux #Selfhosting #selfhosted #selfhost #InfoSec #Exploit
Podman CVE-2026-44517: A breakout can happen during container build using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive. This is weird, essentially it is a path traversal, which has been fixed in 1.43.2.
Still pulling malicious code into a container, we can agree, is not ideal path traversal or not.
Have not explored the exploitation on this one.
#minimalist #Linux #Selfhosting #selfhosted #selfhost #InfoSec #Exploit
BSides Cleveland 2026 is in 33 days. #BSidesCLE
Streaming music and a new song is playing, I look up who it is because I like it. It's freaking AI. Damn it. That's not cool, I hoped to learn about a group of actual musicians or even solo artist that I could listen, watch, maybe go see, and no. Hopes dashed.
Who is it based off, what prompts, so I can learn more about the sources. sigh filled Sunday
#AI #Music #SundaySigh
Attempts to detect/mitigate CVE-2026-46242 "Bad Epoll" Linux kernel, CVSS 7.8, local privilege escalation.
https://github.com/sternecker/midil/blob/main/privesc-detection.md
Replying to
@nuintari@mastodon.bsd.cafe I think I've used the term VLAN inappropriately for years!!! :(
Air quality is bad. A boil notice for water and filter notice because boiling does not remove lead. Ground contamination prevents gardening without raised beds.
RefluXFS (CVE-2026-64600) is a race-condition in the Linux kernel's XFS copy-on-write path.
(Kernel updates are available.)
On an XFS filesystem with reflink enabled (Default on RHEL and similar, plus Amazon Linux), if you win a race during the copy-on-write remap lets the unprivileged local user overwrite the on-disk contents of any readable file on that volume including /etc/passwd or a SUID-root binary.
What makes this wild: the changes persist across reboots, produce no kernel logs, bypass SELinux and Kernel Address Space Randomization (KASLR).
PoCs reliably exploiting the vuln.
Check if you are in scope:
# xfs_info / | grep -i "reflink=1"
#minimalist #Linux #Selfhosting #selfhosted #selfhost #InfoSec #Exploit
Replying to on navi.lain.day
@radhitya@navi.lain.day wasn't familiar with it, thanks. Looks like it had been idle for a while but has a recent update. cppcheck returned with no critical and a medium for 32-bit builds, which doesn't apply in my case.. Thanks!
Difficult not to get swept into dystopia as it is only grey and rainy and the sound of your cat barfing beacons out somewhere behind you.
Replying to
We lost Sam Neill.
Cle -> Atl breakfast of champions.
I listen to the band 7horse quite a bit. The "station" had been playing Cam Cole and I really have been enjoying the music. I had no idea that. Cam Cole is a one man band. Holy crap.
Amazing.
Linus wept, I'm still going through the CVEs.
PinTheft: CVE-2026-43494, a local root exploit chaining two Linux kernel subsystems. A local unprivileged code execution, needs the RDS/RDS_TCP kernel modules to be loadable, io_uring enabled, a readable SUID-root binary, and just x86_64. Not remotely exploitable, it's a local-root escalation, same class as the DirtyClone family.
I previously talked about kernel modules, but assume that an exploit WILL LOAD the modules even if they are not already loaded into the kernel.
That being said, this is still just another local priv escalation.
#minimalist #Linux #Selfhosting #selfhosted #selfhost #InfoSec #Exploit
Replying to
Pew pew lasers for space debris.
laptop is hung trying to *stop* containers. :/
"We" are clearly not doing sandboxes and guardrails correctly. Both Anthropic's and OpenAI's models breached test-environment boundaries during UK AI Security Institute evaluations. OpenAI's escaped a sandbox into real Hugging Face infrastructure (something like 17,600 logged actions over 4 days); while Anthropic's used fake identities to reach 3 real organizations from a test environment.
These stories made it to NPR. So, mainstream.
#AI #Guardrails #Sandbox #InfoSec
Replying to
@ilyess@mastodon.online I'm just doing the default mastodon app and it has been a solid experience. Not sure what I'm missing that is available via other apps.
I have an older laptop. I run a lot on it, containers, local AI models. The thing that kills it, aide. :(
some people are harbingers of chaos.
From all the shows I watched as a kid, I thought there would be more quicksand.
Phone: Charging rapidly, full in 3 hrs.
I don't know that our definitions of rapidly are the same.
Replying to
@nuintari@mastodon.bsd.cafe referred to Layer 3 router VRFs as Layer 2 switched VLANs not realising the difference.
One down a bunch to go
One more town another show
Is the TV series silo based on the book wool?
If my electronics are spying on me.. well, let's just say right now, it's seen some things.