Lightnews — Scholar-powered news

dmnk @dmnk.bsky.social · 21m

That's a lot of 🤑

Dan Underwood @underwood.digital · 13h

We're updating our bounty program with the top award now set at $2 million for zero-click remote exploit chains. In addition - there are increased awards for proximate wireless attacks, WebKit, and Gatekeeper

security.apple.com/blog/apple...

A major evolution of Apple Security Bounty, with the industry's top awards for the most advanced research - Apple Security Research

Today we’re announcing the next major chapter for Apple Security Bounty, featuring the industry’s highest rewards — up to $2 million and a maximum payout in excess of $5 million — expanded research categories, and a flag system for researchers to objectively demonstrate vulnerabilities and obtain accelerated awards.

security.apple.com

Reposted by dmnk

Matthew Garrett @mjg59.eicar-test-file.zip · 1h

Current status: oh god why am I in the BRCM2837 interrupt controller docs all I wanted was a higher degree of graphical fidelity in Doom

1 2 25

Reposted by dmnk

Marcel Böhme @mboehme.bsky.social · 2d

After 5 years, we are back at NDSS in San Diego!

Looking forward to submissions from the Security and the Software Engineering community!

Yannic Noller @yannicnoller.bsky.social · 2d

#FUZZING'26 CALL FOR PAPERS
──────
✨ After 5 years, we will be again co-located with NDSS!

🔗 fuzzing-workshop.github.io
📅 11. Dec (Submission)

//cc @mboehme.bsky.social (MPI-SP), @ruijiemeng.bsky.social (CISPA), @rohan.padhye.org (CMU), László Szekeres (Google)

2 4

Reposted by dmnk

Mark Dowd @mdowd.bsky.social · 2d

I have a spare hexacon ticket if anyone wants it

2 2

Reposted by dmnk

Suzanne Smalley @suzannesmalley.bsky.social · 4d

Signal to leave EU rather than comply w/ Chat Control, which would scan all messages sent over end-to-end encrypted platforms. Vote on Chat Control's future Oct 14. Germany is the swing vote. Officials there opposed the measure in past but new govt silent re position
therecord.media/signal-calls...

Signal calls on Germany to vote against ‘Chat Control,’ saying it would leave EU market

The head of the Signal Foundation raised concerns around Germany now refusing to say whether it will support Chat Control in an upcoming vote.

therecord.media

13 20

dmnk @dmnk.bsky.social · 6d

We ported Rust to the Sega Megadrive for the finals 🦀🦀🦀
(Times are off by one)

dmnk @dmnk.bsky.social · 6d

Hackceler8 live stream will start on 2025-10-04 21:15 UTC / 14:15 PST

Schedule (PST)
14:15 - Live stream start
14:30 - Semifinals #1
16:30 - Semifinals #2
18:30 - Finals

www.youtube.com/watch?v=xN1W...

Hackceler8 2025

YouTube video by Hackceler8

www.youtube.com

7

dmnk @dmnk.bsky.social · 6d

Ah times are in Mexican time, do off by one

dmnk @dmnk.bsky.social · 6d

My "friend"/coworker

1

dmnk @dmnk.bsky.social · 6d

I got volunteered to be a commentator on semifinal 1 and the final 😅

1 1

dmnk @dmnk.bsky.social · 6d

Hackceler8 live stream will start on 2025-10-04 21:15 UTC / 14:15 PST

Schedule (PST)
14:15 - Live stream start
14:30 - Semifinals #1
16:30 - Semifinals #2
18:30 - Finals

www.youtube.com/watch?v=xN1W...

Hackceler8 2025

YouTube video by Hackceler8

www.youtube.com

2 1 2

dmnk @dmnk.bsky.social · 10d

A beer leak?

Lorenzo Franceschi-Bicchierai @lorenzofb.bsky.social · 10d

NEW: A cyberattack has forced Japan's beer maker Asahi to suspend operations at its plants in the country since Monday.

For now, the company said it's experiencing a "system failure" but did not confirm "leakage of personal information or customer data to external parties."

Japan's beer-making giant Asahi stops production after cyberattack | TechCrunch

A day after one of Japan's biggest brewers, Asahi Group, announced it suspended production due to a cyberattack, the company said it has no timeline for its recovery.

techcrunch.com

Reposted by dmnk

Lorenzo Franceschi-Bicchierai @lorenzofb.bsky.social · 10d

NEW: A cyberattack has forced Japan's beer maker Asahi to suspend operations at its plants in the country since Monday.

For now, the company said it's experiencing a "system failure" but did not confirm "leakage of personal information or customer data to external parties."

Japan's beer-making giant Asahi stops production after cyberattack | TechCrunch

A day after one of Japan's biggest brewers, Asahi Group, announced it suspended production due to a cyberattack, the company said it has no timeline for its recovery.

techcrunch.com

1 9 13

Reposted by dmnk

Michael A. Specter 👻 @mikespecter.com · 11d

Today, my research group @ Georgia Tech released a paper on vulnerabilities in Tile --- the second largest device finding network after Apple's AirTags.

You can read about it in Wired, reporting by @kimzetter.bsky.social!
www.wired.com/story/tile-t...

1 34 60

dmnk @dmnk.bsky.social · 12d

We still have strong guardrails for the model (i.e., the agent has to prove it found a valid bug, it's not allowed to change the harness (yet), ...) else we had to deal with false positives left and right.
However, it finds complex bugs that a fuzzer would never find, so I would say it's a net win..

2

Reposted by dmnk

Natalie Silvanovich @natashenka.bsky.social · 14d

Super cool potential ASLR leak involving dictionary hashes! googleprojectzero.blogspot.com/2025/09/poin...

Pointer leaks through pointer-keyed data structures

Posted by Jann Horn, Google Project Zero Introduction Some time in 2024, during a Project Zero team discussion, we were talking about how...

googleprojectzero.blogspot.com

6 10

Reposted by dmnk

Tanner Rowlett @trowlett0.bsky.social · 16d

GUIFuzz++ is the first general-purpose fuzzer for desktop GUI software! Fuzzing by translating AFL++ random input into user interaction with GUIs, leading to the discovery of 23 new bugs!

Paper: futures.cs.utah.edu/papers/25ASE.pdf
Source: github.com/FuturesLab/GUIFuzzPlusPlus

Go test some GUIs!

1 11 16

dmnk @dmnk.bsky.social · 27d

Adobe premiere - davinci resolve, it's what professionals use, contains features Adobe holds back for after effects, and for everyday tasks the **free** version is enough!

Photoshop, I've been using affinity photo and it gets the job done

Light room: capture one

Reposted by dmnk

WIRED @wired.com · Aug 28

Academics once loved Twitter—but in the age of X they’ve abandoned it in droves. www.wired.com/story/bluesk...

Scientists Are Flocking to Bluesky

Academics once loved Twitter—but in the age of X they’ve abandoned it in droves.

www.wired.com

67 600 2.3K

Reposted by dmnk

evacide @evacide.bsky.social · Aug 28

"Meta originally scrapped the facial recognition feature for the first generation of the Ray-Ban Meta AI glasses over ethical concerns."

mashable.com/article/meta...

Meta forges ahead with facial recognition for its AI glasses

Are big tech companies embracing surveillance over privacy?

mashable.com

9 35 90

Reposted by dmnk

Lorenzo Franceschi-Bicchierai @lorenzofb.bsky.social · Aug 20

Yesterday my life changed forever. I discovered that the deli on the corner of my apartment sells these.

2 2 28

Reposted by dmnk

Ivan Lozano @ivanlozano.bsky.social · Aug 19

Very excited to see this

www.trustedfirmware.org/blog/rf-a-blog

#rust #memory-safety

Introducing Rusted Firmware-A (RF-A) - A Rust-Based reimagination of Trusted Firmware-A

Why Rusted Firmware-A?

www.trustedfirmware.org

1 2

Reposted by dmnk

Nicolas Grégoire @agarri.fr · Aug 19

I use USB daily but I have no idea how it works 🤔

USB 2 vs USB 3, USB-A vs USB-C, the PD standard… this talk is full of interesting details 💎

And now I even understand why my USB-C power bank doesn’t work with *this* cable unless flipped 🙃

media.ccc.de/v/why2025-25...

USB: the most successful interface that also brings power

We use it every day, but how does it really work? USB has been around for almost 30 years and it evolved into really universal interface ...

media.ccc.de

9 32

Reposted by dmnk

joern @jrn.bsky.social · Aug 19

Today I have a more serious topic than usual, please consider reposting for reach:

My wife and I are urgently looking for a specialist in neuropediatrics or a similar field for our autistic child with a diagnosed, but not further specified, movement disorder [1/4]

1 23 4

Reposted by dmnk

Emma (IPG) @invoxiplaygames.uk · Aug 19

This repo is hype moments and aura honestly github.com/sensepost/bl...

GitHub - sensepost/bloatware-pwn: LPE / RCE Exploits for various vulnerable "Bloatware" products

LPE / RCE Exploits for various vulnerable "Bloatware" products - sensepost/bloatware-pwn

github.com

3 10 59