26 | 🇦🇺🇩🇪 | He/Him | Bi | CyberSec Coyote 👾🐺 | Artist, Musician, Nerd | 🪡 @grayestREM
Sydney, New South Wales
Joined November 2013
- Tweets13.5K
- Following1.1K
- Followers566
- Likes55.5K
When researchers analyzed how Pegasus spyware infected iPhones without the user tapping anything, they found something wild. The attackers sent an iMessage with a fake GIF that targeted Apple's image decompression engine. The decompression math was so flexible that the exploit chained arithmetic operations together to construct a literal, functioning software CPU using over 70,000 segment commands that defined logical bit operations (AND, OR, XOR, XNOR, etc.) entirely inside the image parser. This created a small computer architecture with registers, a full 64-bit adder, and a comparator, running raw code before the phone even buzzed with a notification
Maybe trump should’ve just kept doing this.
The Dune sting at the end elevates this clip to incredible levels
Atlas 🌵🇦🇺 retweeted
The Indian security company that used 4 as a private key also lacks basic account security.
To sign into your account, you enter your email and receive a 4 digit code.
There are no limits on login attempts. You can try all 10,000 combinations.
The Indian government uses this.
eMudhra login to download customer's certs can be cracked
Their 1FA login generates a OTP & sends it. It also sends a RSA public key to front end
They haven't rate limited checks, so you can offline brute force 0 to 9999 encrypted with public key & find the OTP
@ni5arga
Another one????
🚨 Oracle patches critical unauthenticated Java vulnerability; CVE-2026-91403
A critical vulnerability in the Java Secure Socket Extension component affects Oracle Java SE and multiple GraalVM releases.
The flaw carries a CVSS score of 9.1 and can be exploited remotely without credentials or user interaction.
⠀
Successful exploitation could allow attackers to access, create, delete or modify critical data available to the affected Java or GraalVM deployment.
Affected products include:
• Oracle Java SE 8, 11, 17, 21, 25 and 27 releases listed by Oracle
• Oracle GraalVM for JDK 17.0.21 and 21.0.13
• Oracle GraalVM Enterprise Edition 21.3.20
⠀
Oracle released a security patch on October 21 and recommends applying the available updates.
Source:
oracle.com/security-alerts/a…
Make it stop
⚠️ Node.js is vulnerable to remote code execution.
CVE-2026-111497 (high): A Node.js process that decompresses attacker-controlled Brotli data can be made to leak memory or run arbitrary code.
You’re exposed if your app or a library decompresses bad Brotli data (e.g. the built-in fetch(), body-parser)
Aikido detects this. Patches are available.
Got my Victoria cross for hosting a shadow file server and Minecraft servers on the school network back in ‘11-‘12
Put some respect on my name
