dragosr

Critical RCE Vulnerabilities Discovered in React & Next.js | Wiz Blog React and Next.js are exposed to critical unauthenticated RCE via CVE-2025-55182 and CVE-2025-66478. Learn which versions are impacted and how to mitigate.

39% of Cloud instances need to patch urgently for 100% reliable unauthenticated RCE in React and Next.js www.wiz.io/blog/critica...

What to know about a recent Mixpanel security incident OpenAI shares details about a Mixpanel security incident involving limited API analytics data. No API content, credentials, or payment details were exposed. Learn what happened and how we’re protectin...

Mixpanel was compromised. Includied some OpenAI usage data.

openai.com/index/mixpan...

A *huge* vaccine victory. I've been writing on this for years; Australia has seen remarkable progress in cervical cancer prevention with the HPV vaccine. I love seeing science triumph like this.

It's a funny quality/tell of GenX, from back when media was scarce and not infinitely accessible on the Internet, to define/describe oneself or characterize personality by music albums or concerts possessed or seen, because it took effort. They and older folks are the only ones that do that now.

Some of us have been advocating this going back since chatGPT launched. It also has other benefits: correcting someone else's work is actually a really good way to learn something yourself.

So there’s a website called Deer Of St Nicholas which posts Christmas wish letters from Ukrainian children who had their childhood stolen by the war, anyone can pick a child and get them their present and it’s that time of the year again to achingly scroll it for hours again

Three tiers of rustic wood shelves, lit by warm LED strips, display an extensive agave spirits collection; between the bottles are calavera skull flasks, small skeleton statues, and a La Catrina figurine, while a row of tall white-and-blue ceramic decanters lines the top shelf and boxes and bar tools sit on the counter below.

From a bar seat looking into an open kitchen: a round low tequila bottle with a black cap sits beside a square Herradura Anejo bottle on a wooden ledge amid glasses and a metal towel bucket, additional Don Julio bottles line the left edge, cooks work under hanging pans and warm strip lighting, and a windowed wall with shelves and equipment runs along the right.

Close-up at a wooden bar: a handled yellow dish holds nachos covered in melted cheese, seasoned ground meat, pico de gallo, and a dollop of sour cream; behind it are Firelli and Cholula hot sauces, stacked plates, a skull-print container with napkins and cutlery, a menu labeled TEQUILA, and drinks including two small pours of clear liquor and a tall orange mixed drink.

Printed sign in Japanese and English promoting a "UKRAINE SUPPORT CHARITY DRINK" titled "SLAVA UKRAINE," price 400 yen (440 yen with tax); the center image shows tall shot glasses layered yellow and blue, each topped with a lime slice and ignited; footer note states a 200 yen donation per drink.

I have a new favorite place in Shibuya, Tokyo - Taco Fanatico, amazing tequila collection. Delicious!

渋谷で新しいお気に入りの店を見つけた - Taco Fanatico。テキーラの品揃えが充実している。おいしい！

Are these commies in the room with you right now?

That domain was registered in Korea and has been out in "client hold." However that also means no DKIM, SPF, DMARC - so IF YOUR MAILSERVER IS MISCONFIGURED it can still be used as source of spoofed mail.

But if you are seeing that mail, you need to fix your mailserver.

AI watermarking is security theater. Every watermark scheme has an accessible neutralization process. Adversarial watermarks like Fawkes don't solve this—they're just as easily defeated. The attacker's computational advantage makes this an unwinnable arms race.

We trusted images because they were hard to fake. That assumption is dead. Authentication must shift to cryptographic signatures from photographers and publishers. Trust becomes transitive: you trust the image only to the extent you trust its signer.

CAD $59.99 = USD 42.84 = EUR 36.86

A product image of the IKEA DEJSA table lamp from IKEA Canada. The lamp has a rounded white glass shade shaped like a dome or mushroom cap, sitting on a cylindrical beige base. The image shows the lamp’s power cord extending to the right. Text below lists the price as $59.99 CAD, a 4.5-star rating from 551 reviews, and the seller as IKEA Canada.

Let's figure out what the duties & tariffs impact is in various parts of the world.

Reply with your country's price.

YouTube video by Reagan Library President Reagan's Address to Canadian Parliament on April 6, 1987

youtu.be/_THYKIbT-sE

Revealing the Cascading Impacts of the AWS Outage | Ookla® Explore the global impact of the Oct 2025 AWS US-EAST-1 outage, with 16M+ reports, a DNS root cause, and clear guidance to contain future failures.

This is a good deep dive on what really happened with AWS
www.ookla.com/articles/aws...

Are old browsers really that much of a problem?
Can I Use reports 94.18% global availability caniuse.com/mdn-http_hea...

Inside NVIDIA GPUs: Anatomy of high performance matmul kernels - Aleksa Gordić From GPU architecture and PTX/SASS to warp-tiling and deep asynchronous tensor core pipelines.

This is the best GPU internals write-up I've seen in a long time.
www.aleksagordic.com/blog/matmul

You're mostly detecting Claude there. It's also easy to turn off and has lots of advantages to removing it, esp. for some languages that get messed up easily by Unicode. YMMV

GitHub - OpenDevicePartnership/patina: Patina Firmware Patina Firmware. Contribute to OpenDevicePartnership/patina development by creating an account on GitHub.

Open source pure Rust UEFI BIOS
Native Rust not just wrappers on old risky C code.
github.com/openDevicePa...

If you are doing it right, you should have at least three or more.

Mic-E-Mouse Your computer mouse has big ears. Image courtesy of GPT4/Dall-E-3, generated using the keywords "computer mouse with big ears and a microphone as a scroll wheel."

Speech recognition through high frequency mouse sensors. sites.google.com/view/mic-e-m...

Check your answers includes using a different AI model and a problem restatement to see if it comes to a similar conclusion.

crates.io: Malicious crates faster_log and async_println | Rust Blog Empowering everyone to build reliable and efficient software.

Malicious Rust crate updates, faster_log and async_println, cryptocurrency key scanners.

blog.rust-lang.org/2025/09/24/c...

A young, blond white woman sitting in a wheelchair smiles into the camera. Behind her is the capsule of a Blue Origin suborbital spacecraft

I want to tell you about a friend of mine real quick. I've mentioned her on here before, but you don't know any details yet, and she's about to make history in a very real sense.

Meet Michi Benthaus:

Vaccine for Pancreatic Cancer and CRC Sparks Early Hope While phase 1 data suggest the novel vaccine can boost immunity and reduce relapse in pancreatic and colorectal cancer, experts remain cautious at this initial stage.

www.medscape.com/viewarticle/...

Now this is real convenient, especially on machines where it's impossible to hit the right key fast enough to enter the UEFI BIOS settings.

On #OpenBSD/amd64, you can now type "machine fwsetup" at the boot> prompt in efiboot(8).

marc.info?l=openbsd-cv...

Docker Fixes CVE-2025-9074, Critical Container Escape Vulnerability With CVSS Score 9.3

Docker Fixes CVE-2025-9074, Critical Container Escape Vulnerability With CVSS Score 9.3

It was even on the internet of that time: alberta!dragos

Yeah ok, this is Linux's birthday in 1991. I was running Unix on my home IBM PC clone 80286 using sources I compiled from SysVr2 code two years before that in 1989.

rust is a language in which you can borrow a cow