Days since somebody dropped a huge 0-day on the oss-security mailing list: 0

seclists.org/oss-sec/2026...

I've gotta say.. playing SANS Holiday Hack Challenge (#hhc) this year and seeing that the entire thing was AI generated was so disappointing.. when I worked there, the human touch was the most important part. Now it's 100% slop.

I guess capitalism comes for everything eventually..

Developer attempts to replicate "Liquid Glass" in CSS, and once finished realizes what she'd actually created is an exploit for a fundamental, previously unknown, and rather serious browser vulnerability

lyra.horse/blog/2025/12...

"CSS hack accidentally becomes regular hack"

here's an updated guide on how to remove all of the AI from Firefox

There is zero chance I can terminate a LAN cable in under two minutes, let alone 52 seconds. @saintcon.bsky.social

Scathing, but all too obviously accurate, take on the AWS outage by @quinnypig.com.

You're engaging in professional malpractice if you don't share this with your stakeholders. Corey may be an engineer, but he communicates about the issues in an accessible manner.
www.theregister.com/2025/10/20/a...

Klaus and Glen are ridin' into Wild West Hackin' Fest - Deadwood 2025 with their talk "Dungeons & Dragons: The Security Tool You Didn’t Know You Needed Klaus and Glen" Don't ya go missin' it, virtual con and virtual training tickets are still available! wildwesthackinfest.com/register-for...

When a SSRF is enough: Full Docker Escape on Windows Docker Desktop (CVE-2025-9074) blog.qwertysecurity.com/Articles/blo...

SpaceFromSpace now features over 500 declassified Cold War era spy satellite images from all over the world! Each one fully browsable, interactive, and free for anyone to view.

spacefromspace.com/declassified...

Gerrymandering: the art of mathematically disproving majority rule.

so someone broke into my apartment at night and stole all of my swords and im kind of. in shock

why did it take me so long to find out about @bennjordan.bsky.social these videos are so good
youtu.be/xMYm2d9bmEA

Meta’s track record on privacy was already spotty, but the newest web-to-app trick is particularly brazen. Here’s what to do next.

Our highly popular and technical training, "Malware and Memory Forensics with Volatility", has been fully converted to @volatilityfoundation.org 3 and significantly updated, including many new sections and 8 new, in-depth labs. Available online & in VA in October

memoryanalysis.net/courses-malw...

“If the reports about Flock Nova are true, this is precisely the kind of dystopian panopticon we’ve warned about,” EFF’s @mguariglia.bsky.social told Government Technology News.

Y'know, I've never taken any sponsorships, I'm very skeptical at the best of times and no sponsorship I've ever been approached about has ever passed my sniff test, so I thought I knew where this was going, but this is bigger scam than I'd expected.

www.youtube.com/watch?v=vc4y...

Nick Frichette’s research shows how gaining EC2 access can let you intercept and modify AWS SSM communications. By spoofing the SSM Agent, it’s possible to manipulate EC2 messages or sessions. Check out the tools and techniques explored in this fascinating deep dive: