Fredrik Dahlgren

CVE-2026-29000: Critical Auth Bypass in pac4j-jwt: Full PoC Using Only a Public Key CodeAnt AI found a critical authentication bypass in pac4j-jwt where an attacker can impersonate any user using only the RSA public key. Full PoC and disclosure.

A complete authentication bypass in pac4j-jwt. 😬

www.codeant.ai/security-res...

Abstract. End-to-end cloud storage solutions are deployed at large scale, yet recent works have demonstrated severe attacks against their confidentiality and integrity. Motivated by this, a first formal treatment of secure cloud storage was given at CRYPTO 2024 by Backendal, Davis, Günther, Haller and Paterson (BDGHP). They define syntax and security notions, capturing client-to-client security of cloud storage schemes with respect to a password distribution. They also give an efficient construction using the Two-Hash Diffie-Hellman (2HDH) OPRF and standard cryptographic building blocks, which they prove secure under selective corruptions in the random oracle model. However, several aspects of practical security guarantees remain open. We extend and refine the work of BDGHP along multiple dimensions, advancing the analysis of secure cloud storage schemes. First, we prove that their construction can be proven secure against adaptive corruptions (with a slight modification), circumventing technical challenges posed by file sharing. Second, we modularize the scheme further by introducing an abstraction for the authentication procedure. This allows us to identify the concrete role of 2HDH and alternative instantiations. Third, we introduce a weaker model that captures adversaries who can arbitrarily control the network, except during registration. This allows us to prove concrete guarantees about online password guessing attacks, whereas the stronger model inherently allows for offline guessing. Finally, we formalize and prove explicit authentication, relying on the security of our new authentication abstraction and the MAC scheme, where the latter was previously not used in the security analysis.

Image showing part 2 of abstract.

Secure Cloud Storage: Modularization, Network Adversaries and Adaptive Corruptions (Jonas Janneck, Doreen Riepel) ia.cr/2026/434

Två citatrubriker med tillhörande bilder: 1. ”Jag var inte färdig med målningen” + bild på Jesusmålningen i en spansk kyrka som förstördes av en amatörmålare. 2. ”Romina Pourmokhtari (L): ’Vi är inte färdiga med klimatarbete i Sverige’” + bild på nöjd klimat- och miljöminister.

GitHub - trailofbits/skills: Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows - trailofbits/skills

I'm a Trail of Bits fan. Can you blame me? A couple of days ago they released Claude Code skills, from reversing and vuln research to burnout detection.

github.com/trailofbits/...

come on become a world power [EU]

On the Coming Industrialisation of Exploit Generation with LLMs Recently I ran an experiment where I built agents on top of Opus 4.5 and GPT-5.2 and then challenged them to write exploits for a zeroday vulnerability in the QuickJS Javascript interpreter. I adde…

Interesting post/research by Sean Heelan investigating the current state of exploit generation using frontier models like GPT-5.2 and Opus 4.5.

sean.heelan.io/2026/01/18/o...

It is no longer safe to move our governments and societies to US clouds - Bert Hubert The very short version: it is madness to continue transferring the running of European societies and governments to American clouds. Not only is it a terrible idea given the kind of things the “King o...

I do appreciate the US state department strengthening my case here with their sanctions on former EU officials & other supporters of EU digital safety acts just now: berthub.eu/articles/pos...

Internships in MPC available, for both recent PhD graduates and current PhD students...

mpcinthewild.github.io

This is a project funded by the Zama Cryptanalysis Grant program

Interested in the security of MPC implementations?

Peter Scholl (@schollster.bsky.social) and I are looking for research interns to study the theory/practice gap for MPC. We can host multiple interns in Aarhus for the summer 2026.

More information: mpcinthewild.github.io

Help us spread the word!

what people think hacking is like: Mr. Robot

what hacking is actually like: Hmm. That’s weird

We should all be using dependency cooldowns
https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns
#security #oss

That being said, I think it probably makes sense to report all vulnerabilities in messaging apps used by the US. I’m assuming they’re not talking about bugs in WeChat or VKontakte.

I think it would make more sense to draw the line between vulnerabilities that only allow targeted exploitation (against a single device), and vulnerabilities that could allow for mass-exploitation. 🤷‍♂️ Cryptographic vulnerabilities can be either.

How we avoided side-channels in our new post-quantum Go cryptography libraries We’ve released open-source Go implementations of ML-DSA and SLH-DSA.

Come for the Go implementations of ML-DSA and SLH-DSA, stay for the introduction to side-channel mitigation techniques.

blog.trailofbits.com/2025/11/14/h...

#golng #crypto #cryptography #postquantum

Why is it excellent policy? Do you mean they report vulnerabilities that don’t require active measures? 🤔

The call for talks for CAW 2026 (a workshop affiliated with Eurocrypt) is out!

This year's motto is "cryptography under real-world constraints and threat models", but other applied cryptography is also very welcome.

All info is on: caw.cryptanalysis.fun.

EU vill korta tågresan Stockholm–Köpenhamn till fyra timmar En ny handlingsplan från EU-kommissionen kan ge snabbare tåg över gränserna och förbättra resandet mellan europeiska storstäder

Uppfriskande att se att någon har visioner som inte handlar om att utvisa människor eller sätta barn i fängelse.

www.dn.se/varlden/eu-v...

Omni Klimathotet/Svenska krisberedskapen Rubrik: Klimatanpassning på paus: Elva tjänster kvar i landet

Steg 1
Regeringen tar bort anslaget för klimatanpassning

Steg 2
Två av tre tjänster inom förebyggande klimatarbete försvinner

Steg 3
Klimatrelaterade katastrofer blottar luckor i krisberedskapen

Steg 4
Klimatministern läxar upp länsstyrelserna

Steg 5
[inget händer]

¯\_(ツ)_/¯

omni.se/a/73Xzmo

Good post on Merkle tree certificates.

Dina pensionspengar finansierar världens koldioxidbomber Överskrider kvarvarande koldioxidbudget med 1000 procent • ”Förstör svenska pensionssparares framtid”

Överskrider kvarvarande koldioxidbudget med 1000 procent • AP-fonderna försvarar sina fossilinvesteringar.

Snabba klipp blir Europas undergång Jonas Algers: Från folkhem till hustlarkapitalism

ABB:s robotikförsäljning till Japan är ett tecken på Sveriges och Europas industriella förtvining.

Där tänker man långsiktigt – här jagar man snabba klipp, skriver @jonasalgers.bsky.social.

Improving the trustworthiness of Javascript on the Web Today, there's no way to audit a site’s client-side code as it changes, making it hard to trust sites that use cryptography. We preview a specification we coauthored that adds auditability to the web.

WAICT builds on subresource integrity to create an end-to-end transparency solution for web applications. It is still early days, but this looks like great news for web application auditability and trust! 🎉

blog.cloudflare.com/improving-th...

Geostationary satellites are leaking critical data, transmitting sensitive communications in the clear. With just $800 of consumer hardware, researchers intercepted military, telecom, retail, and infrastructure traffic. satcom.sysnet.ucsd.edu/docs/dontloo...

Vad bra Moderaterna mår. (Återigen: Underlaget jag skriver utifrån är alltså officiell SCB-statistik!)

Fattigdomen fördubblad i Sverige på tre år | Dagens Arena Andelen fattiga i Sverige har fördubblats sedan 2021 och är nu nära 7 procent av befolkningen. 700 000 personer klarar inte att betala nödvändiga utgifter.

Påminnelse. År 2025 lever 700 000 människor i materiell och social fattigdom i Sverige. Det är en ökning med 120 000 på ett år. Bara sedan 2021 har andelen fattiga nästan fördubblats, från 3,5% till 6,6%. Ojämlikheten skenar

www.dagensarena.se/innehall/fat...

Ett screenshot med texten ”Min avsikt: Med denna inloggning kommer FinShark AB komma åt följande tjänster i 180 dagar: - Titta på transaktionskonton och kortkoppladekontokopplade kort - Initiera betalningsuppdrag från transaktionskonton”

Jag försökte bli månadsgivare till en organisation jag stödjer, men för att godkänna autogirot var jag tvungen att ge något som heter FinShark tillgång till mitt konto i 180 dagar!? Det känns ju helt bananas! Är det här verkligen det bästa vi kan åstadkomma 2025?

We are alarmed by reports that Germany is on the verge of a catastrophic about-face, reversing its longstanding and principled opposition to the EU’s Chat Control proposal which, if passed, could spell the end of the right to privacy in Europe. signal.org/blog/pdfs/ge...