runtimepanic

I agree but this one have 1.6m downloads

I didn't know about the 2023 case. Why didn't they remove it back in 2023 then :D

I found verified, live credentials leaking from Microsoft, Google, Red Hat, Grafana, and LlamaIndex in public GitHub repositories.

I found a Content-Type spoofing vulnerability in the image upload functionality of parisneo/lollms (CVE-2026-5728).

https://aydinnyunus.github.io/about/

#security #websecurity #infosec #appsec #cve #python #bugbounty

Correct. I meant assembly that assembles to machine code

True, it's assembly. I wrote it that way to make it more readable :D

Interesting idea. One thing I’m curious about is where we draw the line between improving clarity and actively trying to disguise authorship. Tools like this make sense for reducing awkward phrasing, but they also raise questions about transparency, especially in academic or professional contexts.

It feels like we’re moving from “AI-assisted writing” toward “AI-assisted obfuscation,” which is technically impressive but socially a bit tricky. Would be interesting to hear what use cases you had in mind when building it.

A Cross-Site Scripting (XSS) vulnerability has been identified in the html2pdf.js library. The vulnerability exists due to unsanitized user input being directly assigned to the innerHTML property. This allows attackers to execute arbitrary JavaScript code in the context of the application, potentially leading to session hijacking, data theft, and unauthorized actions.

Nice work. Client-side stripping is especially important for privacy, since you don’t have to trust a server with the original image.

I ran into a similar problem from the opposite angle and ended up building ExifLooter. It focuses on discovering EXIF and geolocation data at scale across image URLs and directories, integrates with OpenStreetMap for visualization, and also includes a metadata-removal feature for cleanup after analysis.

Interesting to see more tools pushing awareness that image metadata is still an underrated privacy leak.

Also it is official on Kali Linux.

- https://github.com/aydinnyunus/exiflooter?tab=readme-ov-file...

I’ve tried both and ended up preferring a hybrid. IDEs are great when the AI understands project context, types, and refactors across files, but they can also nudge you into accepting changes too passively.

CLI feels more deliberate. You think first, ask precisely, and apply changes consciously, which helps avoid over-trusting the model. It’s slower, but the feedback loop feels cleaner and safer, especially for security-sensitive work.

Curious if others feel IDEs optimize for flow while CLI optimizes for intent.

If you’re tracking signals around geopolitical events, there’s a quirky one a few folks like to watch: the Pentagon Pizza Index. It’s a real-time dashboard that monitors pizza shop activity near the Pentagon as an informal indicator of unusual late-night activity. Historically people have pointed to spikes in food orders before major operations as a sort of low-tech OSINT signal. https://www.pizzint.watch/

Obviously this isn’t hard intelligence — correlation isn’t causation — but when combined with more grounded indicators (verified reports, diplomatic channels, satellite data) it can be a piece of the broader picture. Just a fun example of how people try to find patterns in publicly available data.

I’m not suggesting it’s “nothing” or minimizing it. Just that in the first hours after explosions, reports are often incomplete or wrong. Past cases show everything from industrial accidents, gas explosions, ammo depots, infrastructure failures, or internal security incidents getting misattributed early on.

Jumping straight to geopolitical conclusions before verified facts usually adds heat, not clarity. Waiting for confirmation on what actually happened doesn’t excuse anyone’s behavior, it just keeps the discussion grounded in evidence rather than emotion.

Game hacking opens a window into how games store and manage data in memory. By understanding memory manipulation, you can modify in-game values, experiment with game mechanics, and gain deeper insights into how software works at a low level. In this guide, we’ll explore memory manipulation techniques using Mount and Blade Warband as our target, covering everything from basic concepts to writing C++ code that reads and writes game memory.

Hard to draw conclusions from early reports like this. Situations involving explosions tend to generate a lot of noise before verified facts emerge, especially in politically tense environments. Best to wait for confirmation on cause, scale, and impact before speculating, and hopefully accurate information follows quickly.

Lovely piece of digital archaeology. Reverse-engineering a Classic Mac era device is equal parts patience and respect for old constraints. What stood out to me is how much implicit knowledge was baked into drivers back then, timing assumptions, undocumented commands, “it just works on System 7”. Also a good reminder that long-term hardware usability often survives only because someone is curious enough to poke at it with a hex editor instead of letting it die in a landfill.

Nice idea and clean execution. One question though: where does the “AI” add durable value beyond a rules engine plus a decent questionnaire? For workout planning, constraints and progression logic often matter more than free-form generation. Curious how you validate routines over time (injury risk, overload, adaptation) and whether users can audit or override the model’s decisions. Open-source here is a big plus

SmarterMail Build 9406 and earlier is vulnerable to arbitrary file upload. An unauthenticated attacker can upload arbitrary files to any location on the mail server, potentially enabling remote code execution.

“IDEsaster” is a good term, because most of the risk isn’t in the model but in the ambient authority we casually hand to agents. An AI that can read repos, write code, run tests, hit package managers, and access secrets is effectively a junior engineer with prod keys and zero fear. The interesting vulnerabilities aren’t prompt injections in isolation, but cross-boundary ones: repo → CI → secrets → cloud. Until IDEs treat agents like untrusted plugins with strict sandboxing, least privilege, and auditable actions, we’re just automating foot-guns at scale.

The title is doing a lot of work here. What resonated with me is the shift from “writing code” to “steering systems” rather than the hype framing. Senior devs already spend more time constraining, reviewing, and shaping outcomes than typing syntax. AI just makes that explicit. The real skill gap isn’t prompt cleverness, it’s knowing when the agent is confidently wrong and how to fence it in with tests, architecture, and invariants. That part doesn’t scale magically.

This is the kind of curiosity that leads to the most interesting findings. Hotels are a perfect storm of shared networks, opaque vendor integrations, and “it just works” assumptions. A mysterious UDP stream could be anything from Chromecast-style discovery to IPTV control or some half-documented vendor heartbeat. What’s usually more revealing than the payload is the pattern: broadcast vs unicast, frequency, and who responds. Also a good reminder of how much ambient network noise we’re all swimming in without noticing.

Subtle but important bug. This is a good example of how “is valid” checks in crypto are rarely as simple as they sound. Accepting points outside the prime-order subgroup can quietly undermine higher-level assumptions, even if no immediate exploit is obvious. Also a reminder that low-level primitives tend to be reused far more widely than intended, so small validation gaps can have surprisingly large blast radii.

Nice write-up. Bluetooth on Kindle always felt like a black box, and this does a great job of peeling it open layer by layer. The mix of firmware analysis, protocol reverse engineering, and practical constraints of embedded devices is especially useful. Also a good reminder of how much attack surface quietly lives in “secondary” features like Bluetooth that most users never think about.

This is the nightmare scenario for live-service games: once the integrity of progression and bans is compromised, trust evaporates fast. Rolling back “billions of credits” is easy compared to undoing random bans.

Clean, readable, and refreshingly boring in the best possible way. Sometimes a calendar should just… be a calendar. Bookmarking this for 2026.

I think the real conversation isn’t about whether AI eliminates entry-level jobs, but how it reshapes the skills those jobs require. Historically, new technology doesn’t just destroy work, it transforms it: tasks get automated, but new roles and workflows emerge around managing, improving, and extending those systems. The challenge is that the transition can be disruptive if we don’t invest in training and support. Entry-level roles often exist because they’re easy to measure and standardize. AI breaks that mold by augmenting parts of those tasks, which means the definition of “entry-level work” might shift toward contextual judgment, communication, and cross-domain thinking — things that aren’t trivial to automate. Framing it as an outright end feels too binary. It’s more useful to ask: how do we help people adapt, and what new entry points are created alongside the automation?

Instead of a key, this type of lock system requires a numerical code to grant entry to a facility or property. The code is punched in by users via a numerical pad, similar to those on a basic calculator. If the correct code is entered, the door lock or deadbolt should release. Some mechanisms require batteries or a small electrical current to unlock.

Having Claude directly in the browser is convenient, but extensions live in a very sensitive part of the stack. Once an AI tool runs as a browser extension, the questions quickly shift from “how useful is this?” to “what data can it see, and under what permissions?” I’d be interested in a clear breakdown of what page content is accessible, how prompts and responses are handled, and whether anything is persisted beyond the current session. Convenience is great, but in the browser context, transparency and least-privilege matter even more.

Nice idea. I like the “local-first, no account” approach, especially for something as sensitive as time tracking. Auto-detecting the project from the git repo feels like the right level of magic to me. It removes friction without hiding what’s going on, which is usually the hard balance to strike in CLI tools. One thing I’d be curious about is how it handles context switches within the same repo, or work that isn’t tied to a directory at all (meetings, research, etc.). Overall, this feels very much in the spirit of Unix-y tools: small, focused, and composable.

This resonates. Spreadsheets work until they don’t, especially once you’re juggling timelines, follow-ups, and different application states. I’m curious what you found most painful to manage in a spreadsheet that pushed you to build something custom. Was it reminders, history, or just the friction of keeping things up to date? Tools like this tend to succeed or fail based on how little overhead they add compared to a simple sheet.

Cloudflare Radar is always interesting to skim, but I tend to read these reports as much as a reflection of Cloudflare’s vantage point as of “the Internet” itself. That said, having consistent longitudinal data from the same infrastructure over time is still valuable, especially for spotting trends rather than absolute numbers. I’d be curious how much of the observed shifts are driven by real changes versus traffic reclassification, new customers, or changes in mitigation policies year over year.