𝕗𝕣𝕠𝕟𝕥𝕖𝕟𝕕 𝕖𝕟𝕘𝕚𝕟𝕖𝕖𝕣 👀 / 𝕥𝕖𝕒𝕞𝕃𝕒𝕓 𝕀𝕟𝕔.
Joined August 2021
- Tweets10.4K
- Following203
- Followers58
- Likes3.2K
👀
気持ちは分かるが、主張が感情的で事実を捻じ曲げてる箇所がある。Sectigoの件はeMudhraの件とはそもそも関係なくて、古い鍵を使わないとする決定によるもの。（続く）
blog.jxck.io/entries/2026-10…
👀
figma問題はこの話に尽きる。 ／ 僕らはいつも、「作る」ことと「作業する」ことを分けて考えています。何かを作ろうと思ったら、まず大きな構成を作る。そこから先は空いている穴を埋めたり、きれいに仕上げたりするのが「作業」です。
これが厄介で、作業って楽しいんです。作業をしていると、ものすごく「作っている」満足感がある。でも怖いのは、その作業に満足して、「けっこういいものができた」と勘違いしている自分なんですよ。
だから、AIがいろんな作業をしてくれるようになればなるほど、本当に「作る」とはどういうことなのかを、みんなが真摯に考える機会になる。それは大いにいいことだと思っています。 ／
news.denfaminicogamer.jp/int… @denfaminicogameより
👀
詳細の情報ありがたい。やはり自前ビルドと公式のDockerイメージやUbuntuのりポジトリーなど複数の経路を用意していたのですね / “PHP2Shellへの対応を振り返って - コドモン Product Team Blog” htn.to/3B6zjE4GWo
👀
During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy.
The flaw could let an attacker run their own code on affected systems by sending or replying with malicious compressed data, without any need to create a user account. That is, an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as “curl --compressed”) could be taken over by a malicious server.
This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli. Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software. We disclosed the vulnerability to Brotli and other downstream projects such as Node.js, which released or are currently releasing security updates, and Brotli cut new release versions and published a CVE.
More details on the patch and mitigations below:
patchtheplanet.org/brotli
不正アクセスで「財産失った」FX取引の利用者から被害の声…“口座が430万円→6000円に” PHPショック続く 飲食店アプリ停止など影響も｜T... youtu.be/KVjS83bbh5w?si=gE97… @YouTubeより
👀
mac/iOSでeMudhraブロックできない件、これが原因か。OSCPにemsignが返答しなくなったと。macは手動で証明書をdenyできるけど、iOSは回避策なしか / Safari (on MacOS) remains insecure · Issue #69 · galadran/we-have-a-problem.com github.com/galadran/we-have-…
😭
We've decided to sunset Arc on December 22, 2026.
That's not an easy sentence to write. We spent years building Arc and celebrating each and every release along the way: we have so much pride and love for what we made alongside the Arc community.
Our priority is to deliver best-in-class security for our members. Keeping a browser secure takes constant, dedicated work that is only increasing in the age of AI. Dia was built from the ground up to meet today’s security standards, so that's where our engineering and security teams will focus moving forward.
We've worked to make switching to @diabrowser as easy as possible for Arc members. Here's how:
· Your passwords, bookmarks, extensions and history come over to Dia seamlessly.
· Spaces, Folders, and Tab Groups are in Dia and import over with your data intact.
· Dia now surpasses Arc benchmarks in stability, speed, and security.
· The browser features you use in Arc are free in Dia, and the AI is optional.
Thank you for using Arc, for pushing us to make it better, and for building alongside us. The team that made Arc is the same team behind Dia, and some of our most ambitious work is just ahead. We'd love for you to be there with us when it lands.
ほえー
Today we announce 1Password for Agents platform, building with companies @Muse, SpaceX Super Intelligence Grok @Bot, @AnthropicAI’s @Claudeai, @OpenAI, @TownAI, @Browserbase, @Browser_use, @heydana_ai, Instinct, @usekernel, @Perplexity_ai, @tryramp, @Tomo, and @wajo_ai, with more integrations on the way. 🎉
We've heard from so many of our customers who want to use these new personal AI agents to help them get more done, but want more control over what the agent can access with the same trust and ease of use they get when using 1Password directly.
1Password for Agents gives your agents access without giving up your passwords. When an agent reaches a sign-in form, it requests a credential from your vault. If you approve the request, 1Password directly auto-fills the credential in the destination site so the agent can’t see or take possession of the credentials.
The agent gets the task done, but it doesn’t get your passwords..
You stay in control. 1Password for Agents free and optional for personal and family accounts. Unless you opt-in to an agent connector, agents cannot touch your vault.
➡️Learn more: bit.ly/487da6J
👀
PHPの脆弱性「PHP2Shell」を狙う攻撃は修正公開前から始まった。Amazonは10月17日、匿名化ネットワーク経由の攻撃を観測。21日の修正版公開後には試行が急増し、Cloudflareは公開から2時間以内に数十万件、その後は数百万件の攻撃を確認したと説明している。
問題はCVE-2026-109618とCVE-2026-109619で、10月21日に修正版が公開された。前日の情報流出後には概念実証（PoC）コードが拡散した。 Amazonは公開約12時間前にも異なる攻撃コードを確認し、複数の攻撃者が関与した可能性を指摘。watchTowrは修正公開後の広範な攻撃を確認したが、出回るPoCに遠隔コード実行を成功させるものはないと述べた。JFrogは偽のPoCも確認した。 Censysによると、21日に確認した約158万台のPHPバージョン判別可能な公開ホストのうち、約157万台が未修正だった。米CISAはPHP 8.5.12、8.4.27、8.3.36、8.2.35への即時更新を呼びかけた。
securityweek.com/php2shell-e…
👀
もうサーバ止めようか。
Linuxカーネルに6件の脆弱性「Infinity Core」、5件でroot権限昇格・コンテナ脱出のPoC公開(CVE-2026-98260,CVE-2026-98256)他
rocket-boys.co.jp/security-m…
