HD Moore<p>Next.js dropped a CVSS 9.1 authentication bypass vulnerability (CVE-2025-29927) over the weekend. This flaw is trivially exploitable by sending the header `x-middleware-subrequest: true` and causes the request to skip all middleware processing, including any authentication steps. </p><p>Shodan reports over 300,000 services with the `X-Powered-By: Next.js` header alone.</p><p>You can find links to the advisory and queries for runZero at: <a href="https://www.runzero.com/blog/next-js/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="">runzero.com/blog/next-js/</span><span class="invisible"></span></a></p>
mastodon.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
The original server operated by the Mastodon gGmbH non-profit
Administered by:
Server stats:
355Kactive users
mastodon.social: About · Status · Profiles directory · Privacy policy
Mastodon: About · Get the app · Keyboard shortcuts · View source code · v4.4.0-nightly.2025-03-25
Taneli Waltari@twaltari@mastodon.social
Software development, security, democracy
- Joined
- Oct 29, 2022
Jonathan Wright :almalinux:<p>Meta disclosed a high-priority remote code execution vulnerability in freetype earlier this week, CVE-2025-27363. Patches are available for testing in <a href="https://fosstodon.org/tags/AlmaLinux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AlmaLinux</span></a></p><p><a href="https://almalinux.org/blog/2025-03-13-cve-2025-27363-patches/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">almalinux.org/blog/2025-03-13-</span><span class="invisible">cve-2025-27363-patches/</span></a></p><p>PRs are open against CentOS Stream 8 and 9, but unmerged at this time.</p>
Markus Tacker<p>Well, that gets me excited, because I go a lot of extra ways to avoid tsc as much as possible because it is terribly slow.<br><a href="https://github.com/microsoft/typescript-go" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/microsoft/typescrip</span><span class="invisible">t-go</span></a><br><a href="https://chaos.social/tags/TypeScript" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>TypeScript</span></a></p>
The New Oil<p><a href="https://mastodon.thenewoil.org/tags/Google" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Google</span></a> paid $12 million in bug bounties last year to security researchers</p><p><a href="https://www.bleepingcomputer.com/news/security/google-paid-12-million-in-bug-bounties-last-year-to-security-researchers/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">bleepingcomputer.com/news/secu</span><span class="invisible">rity/google-paid-12-million-in-bug-bounties-last-year-to-security-researchers/</span></a></p><p><a href="https://mastodon.thenewoil.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybersecurity</span></a> <a href="https://mastodon.thenewoil.org/tags/BugBounty" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>BugBounty</span></a></p>
Taggart :donor:<p>Another banger from WatchTowr. Turns out a lot of software projects register, then abandon, cloud storage accounts. These accounts can be re-registered and made to deliver <em>whatever the registrant wants</em>: </p><p><a href="https://labs.watchtowr.com/8-million-requests-later-we-made-the-solarwinds-supply-chain-attack-look-amateur/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">labs.watchtowr.com/8-million-r</span><span class="invisible">equests-later-we-made-the-solarwinds-supply-chain-attack-look-amateur/</span></a></p>
Michael Veale<p>“Everyone knows your location: tracking myself down through in-app ads” - a very interesting hands-on blog post about contemporary location data flows and sales <a href="https://timsh.org/tracking-myself-down-through-in-app-ads/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">timsh.org/tracking-myself-down</span><span class="invisible">-through-in-app-ads/</span></a></p>
Anil Dash<p>I think everyone who has an opinion, positive or negative, about LLMs, should read how <span class="h-card" translate="no"><a href="https://fedi.simonwillison.net/@simon" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>simon</span></a></span> summed up what’s happened in the space this year. He’s the most credible, most independent, most honest, and most technically fluent person watching the space. <a href="https://simonwillison.net/2024/Dec/31/llms-in-2024/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">simonwillison.net/2024/Dec/31/</span><span class="invisible">llms-in-2024/</span></a></p>
Alec Roberts<p>Study Shows Incredible Results of Pairing Solar Panels With Agriculture: ‘Getting more from the land’<br><a href="https://www.goodnewsnetwork.org/another-study-shows-incredible-results-of-pairing-solar-panels-with-agriculture-getting-more-from-the-land/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">goodnewsnetwork.org/another-st</span><span class="invisible">udy-shows-incredible-results-of-pairing-solar-panels-with-agriculture-getting-more-from-the-land/</span></a><br><a href="https://mastodon.energy/tags/agrivoltaics" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>agrivoltaics</span></a></p><p>The international study found certain crops, such as maize, Swiss chard and beans, thrived under the partial shade provided by solar panels.</p><p>The shade helped to reduce water loss through evaporation, while additionally using the rainwater harvested from the panels to supplement irrigation needs.</p>
Pekka Tahkola<p>1000 out of 1200 kids in this school in <a href="https://mas.to/tags/Oulu" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Oulu</span></a>, <a href="https://mas.to/tags/Finland" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Finland</span></a>, arrive by <a href="https://mas.to/tags/bicycle" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>bicycle</span></a>, even in winter. 100-150 walk, rest by ski, kicksleds and car. This day it was -17°C, some days it can be colder than -30°C.</p><p>Note that this is only one of the four bicycle parking areas of this school 🤗</p><p><a href="https://mas.to/tags/Wintercycling" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Wintercycling</span></a> <a href="https://mas.to/tags/MeanwhileInOulu" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MeanwhileInOulu</span></a></p>
BleepingComputer<p>A new Linux rootkit malware called Pumakit has been discovered that uses stealth and advanced privilege escalation techniques to hide its presence on systems.</p><p><a href="https://www.bleepingcomputer.com/news/security/new-stealthy-pumakit-linux-rootkit-malware-spotted-in-the-wild/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">bleepingcomputer.com/news/secu</span><span class="invisible">rity/new-stealthy-pumakit-linux-rootkit-malware-spotted-in-the-wild/</span></a></p>
BleepingComputer<p>The first UEFI bootkit specifically targeting Linux systems has been discovered, marking a shift in stealthy and hard-to-remove bootkit threats that previously focused on Windows.</p><p><a href="https://www.bleepingcomputer.com/news/security/researchers-discover-bootkitty-first-uefi-bootkit-malware-for-linux/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">bleepingcomputer.com/news/secu</span><span class="invisible">rity/researchers-discover-bootkitty-first-uefi-bootkit-malware-for-linux/</span></a></p>
BleepingComputer<p>MITRE has shared this year's top 25 list of the most common and dangerous software weaknesses behind more than 31,000 vulnerabilities disclosed between June 2023 and June 2024.</p><p><a href="https://www.bleepingcomputer.com/news/security/mitre-shares-2024s-top-25-most-dangerous-software-weaknesses/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">bleepingcomputer.com/news/secu</span><span class="invisible">rity/mitre-shares-2024s-top-25-most-dangerous-software-weaknesses/</span></a></p>
BleepingComputer<p>Hackers are targeting Windows machines using the ZIP file concatenation technique to deliver malicious payloads in compressed archives without security solutions detecting them.</p><p><a href="https://www.bleepingcomputer.com/news/security/hackers-now-use-zip-file-concatenation-to-evade-detection/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">bleepingcomputer.com/news/secu</span><span class="invisible">rity/hackers-now-use-zip-file-concatenation-to-evade-detection/</span></a></p>
BleepingComputer<p>After being used in Akira and Fog ransomware attacks, a critical Veeam Backup & Replication (VBR) security flaw was also recently exploited to deploy Frag ransomware.</p><p><a href="https://www.bleepingcomputer.com/news/security/critical-veeam-rce-bug-now-used-in-frag-ransomware-attacks/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">bleepingcomputer.com/news/secu</span><span class="invisible">rity/critical-veeam-rce-bug-now-used-in-frag-ransomware-attacks/</span></a></p>
Tony Arcieri 🌹🦀<p>Pretty much all versions of bcrypt are vulnerable to second preimage attacks because they truncate the input to the first 72 bytes, meaning the hashes for messages longer than that will collide.</p><p>This resulted in a login bypass against Okta.</p><p><a href="https://www.theverge.com/2024/11/1/24285874/okta-52-character-login-password-authentication-bypass" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">theverge.com/2024/11/1/2428587</span><span class="invisible">4/okta-52-character-login-password-authentication-bypass</span></a></p>
securityaffairs<p>International law enforcement operation dismantled <a href="https://infosec.exchange/tags/RedLine" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>RedLine</span></a> and <a href="https://infosec.exchange/tags/Meta" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Meta</span></a> infostealers<br><a href="https://securityaffairs.com/170369/cyber-crime/law-enforcement-operation-disrupted-redline-and-meta-infostealers.html" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">securityaffairs.com/170369/cyb</span><span class="invisible">er-crime/law-enforcement-operation-disrupted-redline-and-meta-infostealers.html</span></a><br><a href="https://infosec.exchange/tags/securityaffairs" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>securityaffairs</span></a> <a href="https://infosec.exchange/tags/hacking" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>hacking</span></a></p>
BrianKrebs<p>Since Sept 2016, when krebsonsecurity.com was hit w/ something close to a world record DDoS from Mirai, my site has been behind Google Shield, a free program that Google offers to journalists, news outlets and human rights groups that might otherwise be DDoSsed into silence in one form or another. On the one hand, I don't have as much visibility into who's attacking me or when, because I mostly never notice any disruption. But when I do hear from the Shield team about an attack, it's usually something interesting (e.g. <a href="https://krebsonsecurity.com/2021/09/krebsonsecurity-hit-by-huge-new-iot-botnet-meris/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">krebsonsecurity.com/2021/09/kr</span><span class="invisible">ebsonsecurity-hit-by-huge-new-iot-botnet-meris/</span></a>)</p><p>Anyway, Google said today it is expanding the Shield offering to include "organizations representing marginalized groups and non-profit organizations supporting the arts and sciences." </p><p><a href="https://cloud.google.com/blog/products/identity-security/project-shield-expands-free-ddos-protection" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">cloud.google.com/blog/products</span><span class="invisible">/identity-security/project-shield-expands-free-ddos-protection</span></a></p><p>I gave Google this feedback long ago, but I'll add it here b/c it should be the default if you're on Shield and also using other Google services (Gmail, etc): If you or your organization is eligible for this free protection, it probably also means you are a giant target. IMHO, turning on Advanced Protection for Google Accounts should be automatic for Shield users.</p>
Iván<p>“We don't have a cyber security problem – we have a software quality problem. We don't need more security products – we need more secure products."</p><p><a href="https://www.theregister.com/2024/09/20/cisa_sloppy_vendors_cybercrime_villains/" target="_blank" rel="nofollow noopener" translate="no"><span class="invisible">https://www.</span><span class="ellipsis">theregister.com/2024/09/20/cis</span><span class="invisible">a_sloppy_vendors_cybercrime_villains/</span></a></p><p><a href="https://mastodon.social/tags/cybersecurity" class="mention hashtag" rel="tag">#<span>cybersecurity</span></a></p>
Jeremiah Lee<p>Oxford PV is now shipping its first commercial-scale perovskite-on-silicon tandem solar panels that have 24.5% module efficiency to produce 20% more energy than standard silicon panels. The technology has a theoretical 43% efficiency compared to silicon’s <30%. This is the first gen. They’re manufacturing in Havel, Deutschland. It took nearly a decade to go from university research to commercialization, but this is a giant leap forward for solar.</p><p><a href="https://electrek.co/2024/09/05/oxford-commercializes-its-20-more-powerful-solar-panels-in-the-us/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">electrek.co/2024/09/05/oxford-</span><span class="invisible">commercializes-its-20-more-powerful-solar-panels-in-the-us/</span></a></p><p><a href="https://alpaca.gold/tags/climateAction" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>climateAction</span></a> <a href="https://alpaca.gold/tags/solar" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>solar</span></a></p>
Alan Cordova<p>"Four years ago this week, California’s power grid was so strained by a heat wave that rolling blackouts hit hundreds of thousands of residents over two days. It nearly happened again two years ago, when state officials issued 11 'flex alerts' asking businesses and homeowners to voluntarily reduce electricity use to avoid power disruptions. But this year when a record heat wave scorched the state over three weeks from mid-June to July — sending temperatures across the Bay Area and the Central Valley soaring over 110 degrees — there was plenty of power. No warnings. No shortages. No flex alerts. A big part of the reason, experts say, is a boom in the construction of giant battery projects." <a href="https://www.mercurynews.com/2024/08/18/a-gamechanger-how-giant-batteries-are-making-californias-power-grid-stronger-and-reducing-the-risk-of-blackouts-during-heat-waves/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">mercurynews.com/2024/08/18/a-g</span><span class="invisible">amechanger-how-giant-batteries-are-making-californias-power-grid-stronger-and-reducing-the-risk-of-blackouts-during-heat-waves/</span></a> <a href="https://sfba.social/tags/energystorage" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>energystorage</span></a></p>
ExploreLive feeds
Mastodon is the best way to keep up with what's happening.
Follow anyone across the fediverse and see it all in chronological order. No algorithms, ads, or clickbait in sight.
Create accountLoginDrag & drop to upload