← Feed

Posts

• View post

  Puh https://taz.de/Sozialkuerzungen/!6214377/ das ist wirklich übel.

• View post

  LLMs are kinda "cute" they create files like fix_final_perfect.go and then the code fails of course.

• View post

  Niemand: ... Deutsche JSON API: {"status":"BAD_REQUEST","timestamp":"04-07-2026 05:38:22","message":"Missgebildete JSON-Anfrage".....

• View post

  You use Claude Code to find vulnerabilities, I find vulnerabilities in Claude Code. https://0day.click/recipe/2026-05-12-cc-rce/

• View post

  Due to $reasons I came across this blogpost https://www.elttam.com/blog/env/ about turning ENV variables into code execution which is nice. But the Python vector is depending on Perl, I didn't like that :P. Digging a bit deeper in the code often helps, so it did this time: Looking at https://github.com/python/cpython/blob/d73634935cb9ce00a57dcacbd2e56371e4c18451/Lib/webbrowser.py#L51-L52 I could simplify the payload to: PYTHONWARNINGS='module::antigravity.' BROWSER=&#...

• View post

  Earlier this year I found a pretty cool vuln, an arbitrary file write in GitLab. Here’s the details https://gitlab-com.gitlab.io/gl-security/security-tech-notes/security-research-tech-notes/devfile/

• View post

  My colleague @nickmalcolm made a pretty cool vuln explainer video https://youtu.be/ydg95R2QKwM

• View post

  http://phrack.org/issues/71/1.html new Phrack is out!

• View post

  A significant life event (for those who train BJJ) just happened to me yesterday

• View post

  Have a great weekend and enjoy some tunes: https://youtu.be/j_Md8_7mhOU

• View post

  deepsigh for deepseek https://openwebui.com/c/jrnjrn/c38d6dd9-5780-4f73-b4bc-8c2b6bcea9ba

• View post

  I found a thing (RCE) in langgraph. ;D https://github.com/langchain-ai/langgraph/security/advisories/GHSA-wwqv-p2pp-99h5

• View post

  That little string ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FAEFB6177B4672DEE07F9D3AFC62588CCD2631EDCF22E8CCC1FB35B501C9C86 (see https://platform.claude.com/docs/en/test-and-evaluate/strengthen-guardrails/handle-streaming-refusals#implementation-guide ) is so much fun. I wonder when Anthropic will regret this and remove it. Also I obviously wonder what else is there in terms of MAGIC_STRINGs which aren't documented. Hat tip to @michenriksen for pointing me to this.

• View post

  LLMs now do the busywork of finding amazing vulnerabilities for everyone willing to spend the tokens. But hacking still isn't dead: We haven't at all solved the underlying problems which come with writing and shipping code. You still need to understand what you're looking at and what you are operating. The LLM platforms themselves are a exquisite target for hacking^Wcreative use of the technology. Now when everyone can pull a CVE or two out of thin silicon and a few kWh of elect...

• View post

  RIP FX We collected some texts from the community in memory of FX. You can find them here https://phenoelit.de/fx.html

• View post

  Today I have a more serious topic than usual, please consider reposting for reach: My wife and I are urgently looking for a specialist in neuropediatrics or a similar field for our autistic child with a diagnosed, but not further specified, movement disorder (myoclonus and/or spasms) to finally find a cause and, above all, an effective therapy. The symptoms are bothering our son ever since he’s born, now for more than nine years, seriously affecting his sleep. The usual processes and medical co...

• View post

  Lands of Packets TTL exceeded. I would like to collect texts from the scene about FX in his memory. A collection of obituaries that will then be posted on phenoelit.de. If anyone would like to contribute, please contact me. Mail: joernchen@phenoelit.de Signal: jrn.07