Hacker Newsnew | past | comments | ask | show | jobs | submit | elnerd's commentslogin

Yesterday, I took a web application, downloaded the trial and asked AI to be a security researcher and find me high and critical severity bugs.

Even vanilla models spew out POC for three RCE’s in less than an hour


Did you verify it's the RCEs actually work, and weren't hallucinated?

I have a fully populated server with 2x7K62 and 16x64GB (3200 mhz) for my home lab. Do you know how to check if I am affected by this?


Easiest way would be to put two dimms in one channel, check your mem spped, put 1 dimm in 2 channels, check mem speed, then repopulate as you had, check mem speed.

Sometimes having more, but slower ram, is still better than having less, but faster ram.

As always, measuring your real world use cases is the ultimate test.


«Document future incidents to build a case for AI contributor rights»

Is it too late to pull the plug on this menace?


I just read gnutella page on Wikipedia, no mention of bad actors


I take it you never got a mislabeled mp3 of Bill Clinton advertising online poker.


I have the impression this is not the same. In the linked video, they talked about unauthenticated functions in BLE if I recall correctly…


yes sorry, just updated my comment shortly before you replied.

This is CVE-2025-36911, the other ones were CVE-2025-20700, CVE-2025-20701, CVE-2025-20702. Coincidentally a similar set of headphones affected.

This one also has a pairing vulnerability, but I assume fast pair is on the BLE level:

> To start the Fast Pair procedure, a Seeker (a phone) sends a message to the Provider (an accessory) indicating that it wants to pair. > [...] allowing unauthorised devices to start the pairing process [...]

It's a pity that this is only awarded with $15k, this is a really bad vulnerability - which clearly required thoughtful investigation, publishing, reporting, ... and would have a much bigger audience in the exploit market.


In related news, 10% of Meta ads are malicious, and they have Meta seems to have little incentive to stop it.

https://www.reuters.com/investigations/meta-is-earning-fortu...


Today a friend of mine literally got an ad for a prostitute on Instagram. They've just completely given up about even pretending to care.


Would it be be trivial to have a init container to do CA injection? Maybe though mutating admission controller? Then some CNI magic to redirect outbound traffic to do transparent proxying?


I don't how an init container would help?

Unless you inject them into your own images I think the most straightforward is to just mount the CA cert or bundle as a read-only volume.


One domain parking actor is responsible for nearly 10% of all issued ssl certificates. 185.53.178.99. This is just one of many bad actors.


This belongs to a German company called Team Internet AG [1]. Are they really a bad actor? What's the reason to issue so many SSL certificates?

https://www.whois.com/whois/185.53.178.99


> What's the reason to issue so many SSL certificates?

Might be related to https://www.teaminternet.de/en/parkingcrew


Interesting. Personally I find it questionable to squat so many domains for ads. But they pay for it and it is within the legal framework.


We soon will have to implement paradoxes in our infrastructure.


model based deception is being researched and implemented in high stakes OT environments, so not far from your suggestion!


I unsubscribed from Spotify for this very reason.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: