Recent searches

No recent searches

Search options

Only available when logged in.
toad.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
Mastodon server operated by David Troy, a tech pioneer and investigative journalist addressing threats to democracy. Thoughtful participation and discussion welcome.

Administered by:

Server stats:

273
active users

toad.social: AboutProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.4.1

#vulnerabilities

6 posts6 participants1 post today
Schneier on Security RSS

Google Project Zero Changes Its Disclosure Policy

Google’s vulnerability finding team is again pushing the envelope of responsible disclosure:
Google’s Project Zero team will... schneier.com/blog/archives/202

Schneier on Security · Google Project Zero Changes Its Disclosure Policy - Schneier on SecurityGoogle’s vulnerability finding team is again pushing the envelope of responsible disclosure: Google’s Project Zero team will retain its existing 90+30 policy regarding vulnerability disclosures, in which it provides vendors with 90 days before full disclosure takes place, with a 30-day period allowed for patch adoption if the bug is fixed before the deadline. However, as of July 29, Project Zero will also release limited details about any discovery they make within one week of vendor disclosure. This information will encompass: The vendor or open-source project that received the report ...
#vulnerabilities#Uncategorized#disclosure
*
Kyiv Independent Daily Headlines

Sunday, August 3, 2025

Russian troops resort to ‘total infiltration’ tactics in front-line Pokrovsk — Inside the Battle of Kostiantynivka, as Ukrainian forces brace for three-sided Russian assault — Ukrainian drones target Shahed storage site, industrial facilities in Russia — Ukraine’s drone strike reportedly sparks fire at oil depot in Russia’s Sochi … and more

activitypub.writeworks.uk/2025

#airspace#akhmat#anticorruption
Replied in thread
Zach

@spocko it’s #conspiracytheory. #Reuters reports #Microsoft is looking whether a leak from MAPP enabled #Chinese to exploit #SharePoint #vulnerabilities b4 fixes were fully in place.notifications went out on 6/24, 7/3, and 7/7; attack signs began on 7/7—the same day the final notification was issued. #TrendMicro called it the “likeliest scenario” that someone in the program weaponized that info. They pulled the trigger on the #exploit they had at hand bc time was running out.

Schneier on Security RSS

Spying on People Through Airportr Luggage Delivery Service

Airportr is a service that allows passengers to have their luggage picked up, checked, and delivered to their destinations. As you might expect, it’s used by wealthy or important people. So if the company’s website is <a href="https:/... schneier.com/blog/archives/202

Schneier on Security · Spying on People Through Airportr Luggage Delivery Service - Schneier on SecurityAirportr is a service that allows passengers to have their luggage picked up, checked, and delivered to their destinations. As you might expect, it’s used by wealthy or important people. So if the company’s website is insecure, you’d be able to spy on lots of wealthy or important people. And maybe even steal their luggage. Researchers at the firm CyberX9 found that simple bugs in Airportr’s website allowed them to access virtually all of those users’ personal information, including travel plans, or even gain administrator privileges that would have allowed a hacker to redirect or steal luggage in transit. Among even the small sample of user data that the researchers reviewed and shared with WIRED they found what appear to be the personal information and travel records of multiple government officials and diplomats from the UK, Switzerland, and the US...
#vulnerabilities#Uncategorized#airtravel
Soh Kam Yung

Interesting. If on-board SRAM can be kept alive while rebooting the CPU, you can extract information stored in it.

"This paper presents Volt Boot, an attack that demonstrates a vulnerability of on-chip SRAM due to the physical separation common in modern system-on-chip power distribution networks."

cacm.acm.org/research-highligh

Communications of the ACM · SRAM Has No Chill: Exploiting Power Domain Separation to Steal On-Chip SecretsBy David Roman
#SOC#Computers#Security
Schneier on Security RSS

Microsoft SharePoint Zero-Day

Chinese hackers are exploiting a high-severity vulnerability in Microsoft SharePoint to steal data worldwid... schneier.com/blog/archives/202

#vulnerabilities #Uncategorized #Microsoft #exploits #zero-day #hacking

Schneier on Security · Microsoft SharePoint Zero-Day - Schneier on SecurityChinese hackers are exploiting a high-severity vulnerability in Microsoft SharePoint to steal data worldwide: The vulnerability, tracked as CVE-2025-53770, carries a severity rating of 9.8 out of a possible 10. It gives unauthenticated remote access to SharePoint Servers exposed to the Internet. Starting Friday, researchers began warning of active exploitation of the vulnerability, which affects SharePoint Servers that infrastructure customers run in-house. Microsoft’s cloud-hosted SharePoint Online and Microsoft 365 are not affected. Here’s...
Benjamin Carr, Ph.D. 👨🏻‍💻🧬

#AIslop and fake reports are exhausting #security #bugbounties
The world of #cybersecurity is not immune to this problem. In last year, people across the cybersecurity industry have raised concerns about #AI #slop #bugbounty reports, meaning reports that claim to have found #vulnerabilities that do not actually exist, because they were created with a #largelanguagemodel (#LLM) that simply made up the #vulnerability, and then packaged it into a professional-looking writeup
techcrunch.com/2025/07/24/ai-s

TechCrunch · AI slop and fake reports are exhausting some security bug bounties | TechCrunch"We're getting a lot of stuff that looks like gold, but it's actually just crap,” said the founder of one security testing firm. AI-generated security vulnerability reports are already having an effect on bug hunting, for better and worse.
TrendingLive feeds
About