Lightnews — Scholar-powered news

dragosr

@dragostech.bsky.social

If you ordered anything from Canada Computers on-line in the last month or longer, call your credit card company and lock your card. Their commerce site was dinged with a malware card skimmer.

www.reddit.com/r/bapccanada...

From the bapccanada community on Reddit: Canada Computers online card skimmer

Explore this post and more from the bapccanada community

www.reddit.com

January 23, 2026 at 9:37 PM

Reposted by dragosr

conputer dipshit

@davidcrespo.bsky.social

the new best practices for Claude Code doc is really good. they chose their #1 rec very well. every CC user should be typing "Give Claude a way to verify its work" over and over on a typewriter in an empty hotel while their wife thinks they're working on a book
code.claude.com/docs/en/best...

Give Claude a way to verify its work
Include tests, screenshots, or expected outputs so Claude can check itself. This is the single highest-leverage thing you can do.
Claude performs dramatically better when it can verify its own work, like run tests, compare screenshots, and validate outputs. Without clear success criteria, it might produce something that looks right but actually doesn’t work. You become the only feedback loop, and every mistake requires your attention.

January 22, 2026 at 4:13 PM

Reposted by dragosr

vermaden

@vermaden.bsky.social

KDE removed FreeBSD support from Plasma login manager stating that KDE/Plasma relies systemd(1)/logind(1) Linux daemons.

FreeBSD should not waste time to work on adding KDE/Plasma desktop install button in bsdinstall(8) installer.

Use MATE/XFCE instead.

github.com/KDE/plasma-l...

January 21, 2026 at 1:24 PM

dragosr

@dragostech.bsky.social

Some people treat "I don't use AI" as a badge of honor. Others recognize it as a self-imposed handicap.

January 19, 2026 at 7:35 PM

dragosr

@dragostech.bsky.social

This is some quality work detailed in this in-the-wild VM/sandbox escape campaign.

The 0-day was used for about a year before disclosure to the vendor, according to campaign artifacts.

www.huntress.com/blog/esxi-vm...

Flowchart depicting a VMware ESXi VM escape exploit chain with six stages:
Stage 1 - Disable VMware Drivers: exploit.exe (MAESTRO) runs devcon.exe to disable vmci.sys driver, allowing direct hardware communication.
Stage 2 - Load Exploit Driver (BYOVD): kdu.exe loads unsigned MyDriver.sys into Windows kernel, gaining kernel privileges inside VM.
Stage 3 - Leak VMX Memory Address: HGFS drag-drop request with 50KB payload triggers VMX out-of-bounds read bug, leaking memory pointer (0x7ff...) to MyDriver.sys.
Stage 4 - Write Shellcode to VMX: Shellcode and ELF backdoor written to VMX memory; function pointer overwritten to point to shellcode.
Stage 5 - VM Escape: MyDriver.sys sends VMCI request triggering callback. VMX follows corrupted pointer, executing Shellcode 1. Shellcode queries kernel objects via syscalls to obtain vmkernel base address, escaping VMX sandbox.
Stage 6 - Install VSOCKpuppet: Shellcode 2 runs in kernel with full ESXi control. Writes VSOCKpuppet to /var/run/a, hijacks port 21 via inetd.conf modification, sends SIGHUP to inetd. VSOCKpuppet listens on VSOCK 2:10000, connecting to client.exe (GetShell Plugin).
Dashed line separates guest VM operations (above) from ESXi host compromise (below). Color coding: yellow=Windows tools, pink=exploit components, purple=VMware components, green=info leak results, red=shellcode execution, teal=final implant.

January 9, 2026 at 6:31 AM

Reposted by dragosr

Jen Gentleman

@jenmsft.bsky.social

In case you didn't see, in the Insider builds, we're currently working on adding the ability to share an audio stream to two Bluetooth audio accessories at the same time 😊

Details here: blogs.windows.com/windows-insi...

I look forward to you trying it if you haven't already!

Showing quick settings in windows open to a new shared audio page, where you can select two output devices to share audio

January 6, 2026 at 1:23 PM

Reposted by dragosr

Jen Gentleman

@jenmsft.bsky.social

Merry Christmas 😊

December 25, 2025 at 12:49 PM

Reposted by dragosr

The Hacker's Choice (1995)

@hackerschoice.bsky.social

THC Release 💥: The world’s largest IP<>Domain database: ip.thc.org

All forward and reverse IPs, all CNAMES and all subdomains of every domain. For free.

Updated monthly.

Try: curl ip.thc.org/1.1.1.1

Raw data (187GB): ip.thc.org/docs/bulk-da...

(The fine work of messede 👌)

December 17, 2025 at 1:33 PM

dragosr

@dragostech.bsky.social

Took 5 years. (spoiler: unsafe race) www.phoronix.com/news/First-L...
Had to happen eventually, and won't be the last.

Linux Kernel Rust Code Sees Its First CVE Vulnerability

The first CVE vulnerability has been assigned to a piece of the Linux kernel's Rust code.

www.phoronix.com

December 17, 2025 at 9:01 PM

Reposted by dragosr

Dr Paris Buttfield-Addison

@hey.paris

posted a few updates on the #appleid situation

hey.paris/posts/appleid/

#apple

20 Years of Digital Life, Gone in an Instant, thanks to Apple

Summary: A major brick-and-mortar store sold an Apple Gift Card that Apple seemingly took offence to, and locked out my entire Apple ID, effectively bricking my devices and my iCloud Account, Apple De...

hey.paris

December 15, 2025 at 9:55 PM

dragosr

@dragostech.bsky.social

be wary of gift cards in the Apple ecosystem: hey.paris/posts/appleid/

20 Years of Digital Life, Gone in an Instant, thanks to Apple

Summary: A major brick-and-mortar store sold an Apple Gift Card that Apple seemingly took offence to, and locked out my entire Apple ID, effectively bricking my devices and my iCloud Account, Apple De...

hey.paris

December 13, 2025 at 7:16 PM

dragosr

@dragostech.bsky.social

39% of Cloud instances need to patch urgently for 100% reliable unauthenticated RCE in React and Next.js www.wiz.io/blog/critica...

Critical RCE Vulnerabilities Discovered in React & Next.js | Wiz Blog

React and Next.js are exposed to critical unauthenticated RCE via CVE-2025-55182 and CVE-2025-66478. Learn which versions are impacted and how to mitigate.

www.wiz.io

December 3, 2025 at 7:19 PM

dragosr

@dragostech.bsky.social

Mixpanel was compromised. Includied some OpenAI usage data.

openai.com/index/mixpan...

What to know about a recent Mixpanel security incident

OpenAI shares details about a Mixpanel security incident involving limited API analytics data. No API content, credentials, or payment details were exposed. Learn what happened and how we’re protectin...

openai.com

November 28, 2025 at 11:59 AM

Reposted by dragosr

Phil Plait

@philplait.bsky.social

A *huge* vaccine victory. I've been writing on this for years; Australia has seen remarkable progress in cervical cancer prevention with the HPV vaccine. I love seeing science triumph like this.

Kelly @broadwaybabyto.bsky.social · Nov 27

Australia recorded ZERO cases of cervical cancer in women under 25 for the first time since they started tracking the cancer in the 80s.

This is the power of vaccines.

The HPV vaccine is extremely effective at preventing cancer.

Viruses can be oncogenic. Get your vaccines and protect yourself!

newsGP - Australia set for world-first cervical cancer elimination

Vaccination programs have played a key role, and GPs remain ‘instrumental’ in boosting screening rates to reach the 2035 target.

www1.racgp.org.au

November 27, 2025 at 6:12 PM

Reposted by dragosr

Mike Masnick

@mmasnick.bsky.social

Some of us have been advocating this going back since chatGPT launched. It also has other benefits: correcting someone else's work is actually a really good way to learn something yourself.

November 23, 2025 at 9:24 PM

Reposted by dragosr

Mira of Kyiv 🇺🇦

@reshetz.bsky.social

So there’s a website called Deer Of St Nicholas which posts Christmas wish letters from Ukrainian children who had their childhood stolen by the war, anyone can pick a child and get them their present and it’s that time of the year again to achingly scroll it for hours again

November 7, 2025 at 8:21 AM

dragosr

@dragostech.bsky.social

I have a new favorite place in Shibuya, Tokyo - Taco Fanatico, amazing tequila collection. Delicious!

渋谷で新しいお気に入りの店を見つけた - Taco Fanatico。テキーラの品揃えが充実している。おいしい！

Three tiers of rustic wood shelves, lit by warm LED strips, display an extensive agave spirits collection; between the bottles are calavera skull flasks, small skeleton statues, and a La Catrina figurine, while a row of tall white-and-blue ceramic decanters lines the top shelf and boxes and bar tools sit on the counter below.

From a bar seat looking into an open kitchen: a round low tequila bottle with a black cap sits beside a square Herradura Anejo bottle on a wooden ledge amid glasses and a metal towel bucket, additional Don Julio bottles line the left edge, cooks work under hanging pans and warm strip lighting, and a windowed wall with shelves and equipment runs along the right.

Close-up at a wooden bar: a handled yellow dish holds nachos covered in melted cheese, seasoned ground meat, pico de gallo, and a dollop of sour cream; behind it are Firelli and Cholula hot sauces, stacked plates, a skull-print container with napkins and cutlery, a menu labeled TEQUILA, and drinks including two small pours of clear liquor and a tall orange mixed drink.

Printed sign in Japanese and English promoting a "UKRAINE SUPPORT CHARITY DRINK" titled "SLAVA UKRAINE," price 400 yen (440 yen with tax); the center image shows tall shot glasses layered yellow and blue, each topped with a lime slice and ignited; footer note states a 200 yen donation per drink.

November 9, 2025 at 5:57 AM

dragosr

@dragostech.bsky.social

We trusted images because they were hard to fake. That assumption is dead. Authentication must shift to cryptographic signatures from photographers and publishers. Trust becomes transitive: you trust the image only to the extent you trust its signer.

October 29, 2025 at 1:33 AM