Link roundup for the week of 2026-10-11 to 2026-10-18: zero-click spyware through ad slots, a BeyondTrust zero-day, MSP supply-chain fallout, and the channels we stopped questioning.

Written for veilid_core version 0.5.7 This post presents DHTKEM-DH: a D istributed H ash T able K ey E ncapsulation M echanism using D iffie- H ellman, a system which implements secure secret sharing…

风冷输在物理上，同样带走 100 kW 的热，要的空气体积大约是水的 3500 倍。机房费不费水，要看哪个环路是开着的，闭环的机柜后面照样可能接着一座天天蒸发的冷却塔。

I’ve upgraded Coolify twice this week, on two different servers, and both times the dashboard was unusable afterwards. The fix both times was purging two JavaScript files from the Cloudflare cache.…

What an attacker can assemble about your organization from public sources in 2026, the tools that still work post-API-lockdown, the deepfake pretexting threat, and how a defender should think about…

We are entering an epoch where it may become easy for small pieces of self-replicating code to permanently infest Internet-connected devices in a way that is hard to undo. Such a world would be…

There are a growing number of start-ups and incumbents using AI capabilities to provide tooling for CISOs and teams to help them run their security programs at various scales. Some of these are well…

At the end of the year, Codeberg will shut down its old Codeberg Pages server , in favor of the already deployed, git-pages -based alternative. 1 . For many deployments, migration will be quite…

Intro: (No AI was involved in writing, research, etc...) If you see weird fonts and spacing, blame Blogger. Skip to "In the wild exploitation" if you just care about that part. It's just a…

That’s all to say: a sloppy, careless approach to interface design not only hurts your brand in terms of customer perception, but it can be an attack vector. The easier it is to sloppily reproduce…

As every responsible Internet user, I use two-factor authentication (2FA) for my important accounts. For a long time, I depended on Google's Authenticator app, but because early versions of the app…

Auto-checkpoints for Hyper-V virtual machines You know how Hyper-V has an automatic checkpoint option, and how it's completely useless because what it actually does is "make sure there is at…

Eloquia is a Windows box hosting a Django blogging platform that supports OAuth login through a Google clone. I’ll find an AngularJS template injection in article bodies and use AngularJS directives…

Europe's cloud sovereignty package includes capacity targets, assurance levels, and an open-source strategy. The practical test is whether operators can move critical work and recover when a supplier…

Restricting API access The Vulkan Hardware Database offers a number of public apis. These can be used to fetch information like report details in a structured way using the JSON format. But with the…

I have seen the same story play out several times: the organisation suffers a major incident or security breach, and it is decided that to prevent it happening again, all systems must check a list of…

Why we left GitHub Actions for Buildkite, and how I built a Python interface for our CI/CD pipelines.

Connect VS Code over SSH to an sbx sandbox built from kits, for a devcontainer-like workflow with microVM isolation, secrets protection and network policies.

So a company or project lists a nice looking privacy policy, but can you really trust that?

My Linux mini PC can run web apps, but CGNAT stops me from sharing them with a router port forward.

Every way an Office document attacks: macros, remote templates, embedded objects, hyperlinks, QR handoffs and invoice fraud, plus the signals that catch each.

Completing the trilogy of Trigon blog posts by adopting a unique arm64e exploit strategy.

I’m chanop on several IRC channels. Most of the time this makes no difference on how I interact with a channel. A few months ago I was asked to configure a Matrix bridge for a channel on OFTC,…

I have been seeing a lot of people online, successfully using the latest versions of agents to make very impressive 3D models. The agent seemingly uses Blender and other tools to make highly…

Second of eight posts on how I keep everything up to date without trusting fresh releases. Part one set the rule: a release waits a week, a minor release two weeks, unless it fixes a vulnerability in…

When Baker Hughes deployed Leucipa across Expand Energy's 5,782 gas wells in January 2026, the press announcement omitted 23 Marcellus wells — not from oversight, but because their Honeywell SCADA…

Thanks to @jasper@dystopianpresent.club for a great Docker intro and for sending me some files to learn from. I learned the basics and got Immich running on my Mac Studio to see if I want to stick…

Made the decision this week to pull the plug on kollektivavtal.codeberg.page and move it back to kollektivavtal.github.io. Not an easy decision to make as I’d come to really love Codeberg.

The week's biggest cybersecurity stories, filtered for defender impact, patch urgency, active exploitation, and what IT teams should actually do next.

We now know how the seeds of the NIST elliptic curves were generated: they’re not the hash of some saucy sentence, but the output of drand48() seeded with the time, which was indeed in 1997–98.

Or: another reason why we should feed every AI exec into a [large bouncy castle]

I have a new main server! A huge upgrade from my R210 II.

Recently, reception reports of several US Navy stations (Barford, Niscemi, Lualualei, Diego Garcia, among others) appeared on the UDXF mailing list. These stations seem to use the MS-110A waveform…

How LLM Sandbox runs each command in a fresh native Linux sandbox while keeping session files, plus controlled benchmarks against Docker and the tradeoffs that matter.

If you have ever tried to export a SQL Server database to a .bacpac file with sqlpackage, you have most likely run into the dreaded SQL71627 error, complaining about a Windows user or login. I ran…

Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware - The Citizen Lab The inimitable Wolfie Christl: "Discover-Tech, a company deeply embedded…

Two Hetzner VMs, a Mac mini and an agent-operated deployment workflow: what I moved, how I check it works, and the maintenance I still own.

Photo by Hasan Almasi on unsplash This post is the long-form version of the talk I gave at Hexacon in Paris on October 16th, 2026. A general public documentation page has been published at…

I recently came across this Cloudflare blog article on Quick Tunnels. They seem like lightweight ngrok tunnels, but without needing any auth. The article suggested they were great to use with agentic…

My server is almost fully converted to be managed by Uncloud, except for one service: atomdns. Which at first I didn’t mind, but now find annoying, because: uc ps doesn’t list it; my…

When accessing a website protected by HTTP Basic or Digest Authentication (such as router dashboards or private services behind htaccess), the browser displays a native authentication dialog, but the…

263.925 active with Fear 46 calling Fear 45 on CONR-2 for VSAT radio checks.

How do you make a NixOS instance on Oracle Cloud? Previously, I had used this method. This is the new, and much easier way to install it. This blog is based on: Install NixOS on a Free Oracle Cloud…

As part of my plan to move from Digital Ocean to alternative hosting, I need to start picking away at some of the services hosted on my droplets. I may as well start with the oldest first: I've got a…

A trivial ReDoS in symfony/http-foundation, reachable by default and unauthenticated through Cache-Control: on Laravel + nginx it turns into an application-layer DoS

A coding agent running in your terminal can use every credential that terminal can reach. heldkeys is an open-source CLI that lists those credentials on your laptop, inside a sandbox or in a CI job,…

Every Evolu release waits on npm until I approve it with a Trezor, so a stolen push key, token, or GitHub session can't publish it. Here is how it works and why a Trezor.

One port forward to Nginx Proxy Manager, a small certificate authority of my own and one nginx rule. From outside, only my devices get an answer; at home, nothing changes. No VPN, no tunnel, no third…

If you run transmission-daemon, the somewhat popular (in small circles) Torrent client, any website you visit can talk to it, and execute arbitrary scripts/programs on your system. Oops! The GTK and…