Coinbase initially targeted in GitHub Actions Supply Chain Attack.
The incident came to light on March 14, 2025, when it was found that "tj-actions/changed-files" was compromised to inject code that leaked sensitive secrets from repositories that ran the workflow.
[CVE-2025-30066 (CVSS score: 8.6)]
https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack/
![[ImageSource: Endor Labs]
According to Endor Labs, 218 GitHub repositories are estimated to have exposed their secrets due to the supply chain attack, and a majority of the leaked information includes a "few dozen" credentials for DockerHub, npm and Amazon Web Services (AWS), as well as GitHub install access tokens.
"The initial scale of the supply chain attack sounded scary, considering that tens of thousands of repositories depend on the GitHub Action," security researcher Henrik Plate said.
<https://www.endorlabs.com/learn/blast-radius-of-the-tj-actions-changed-files-supply-chain-attack>
"However, drilling down into the workflows, their runs and leaked secrets shows that the actual impact is smaller than anticipated: 'Only' 218 repositories leaked secrets, and the majority of those are short-lived GITHUB_TOKENs, which expire once a workflow run is completed."](https://nerdculture.de/system/media_attachments/files/114/240/091/413/984/866/original/f06e6943c499199b.jpeg "[ImageSource: Endor Labs]
According to Endor Labs, 218 GitHub repositories are estimated to have exposed their secrets due to the supply chain attack, and a majority of the leaked information includes a \"few dozen\" credentials for DockerHub, npm and Amazon Web Services (AWS), as well as GitHub install access tokens.
\"The initial scale of the supply chain attack sounded scary, considering that tens of thousands of repositories depend on the GitHub Action,\" security researcher Henrik Plate said.
<https://www.endorlabs.com/learn/blast-radius-of-the-tj-actions-changed-files-supply-chain-attack>
\"However, drilling down into the workflows, their runs and leaked secrets shows that the actual impact is smaller than anticipated: 'Only' 218 repositories leaked secrets, and the majority of those are short-lived GITHUB_TOKENs, which expire once a workflow run is completed.\"")
IT Market Saturation: Evolution, Not Decline https://chat-to.dev/post?id=LzlSMFYyWjNndnhuQkt6bFNzSDhPQT09 #tech #technology #programming #engineer
Critical Flaw in Next.js lets Attackers bypass Authorization.
A recent collaborative effort by researchers Rachid Allam and Yasser Allam has exposed a critical vulnerability within the Next.js framework, a widely used JavaScript framework based on React with nearly 10 million weekly downloads.
https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware
![[ImageSource: zhero-web-sec]
The vulnerability, tracked as CVE-2025-29927, carries a CVSS score of 9.1 out of 10.0.
"Next.js uses an internal header x-middleware-subrequest to prevent recursive requests from triggering infinite loops," Next.js said in an advisory. "It was possible to skip running middleware, which could allow requests to skip critical checks [such as authorization cookie validation] before reaching routes."
<https://nextjs.org/blog/cve-2025-29927>
The shortcoming has been addressed in versions 12.3.5, 13.5.9, 14.2.25 and 15.2.3. If patching is not an option, it's recommended that users prevent external user requests that contain the x-middleware-subrequest header from reaching the Next.js application.
⚠️The company also said any host website that utilizes middleware to authorize users without any additional authorization checks is vulnerable to CVE-2025-29927, potentially enabling attackers to access otherwise unauthorized resources (e.g., admin pages).⚠️](https://nerdculture.de/system/media_attachments/files/114/234/341/495/174/533/original/d2d061af71c4a9f2.jpeg "[ImageSource: zhero-web-sec]
The vulnerability, tracked as CVE-2025-29927, carries a CVSS score of 9.1 out of 10.0.
\"Next.js uses an internal header x-middleware-subrequest to prevent recursive requests from triggering infinite loops,\" Next.js said in an advisory. \"It was possible to skip running middleware, which could allow requests to skip critical checks [such as authorization cookie validation] before reaching routes.\"
<https://nextjs.org/blog/cve-2025-29927>
The shortcoming has been addressed in versions 12.3.5, 13.5.9, 14.2.25 and 15.2.3. If patching is not an option, it's recommended that users prevent external user requests that contain the x-middleware-subrequest header from reaching the Next.js application.
⚠️The company also said any host website that utilizes middleware to authorize users without any additional authorization checks is vulnerable to CVE-2025-29927, potentially enabling attackers to access otherwise unauthorized resources (e.g., admin pages).⚠️")
I'm an Engineer, not a child
I'm an #engineer, not a child...
What's the problem?
"Excessive de-burring on the buttstrap mating face. We'll probably need a bigger buttstrap."
*Snorts*
New Mac Attack is tricking Users into thinking their Computer is locked.
According to LayerX Labs, who have been tracking this campaign for more than a year, the phishing attack attempts to trick Mac users into thinking that their computers have been “locked” via a fake security warning that pops up while users are browsing the web.
https://layerxsecurity.com/blog/layerx-identifies-new-phishing-campaign-targeted-at-mac-users/
![[ImageSource: LayerX Labs]
The webpage then appears to be frozen which, like most phishing attempts, adds a sense of urgency and fear that something is wrong with your computer. The window that appears displays a warning that the computer has been subjected to a trojan virus and asks the user to enter in their Mac username and password.
The warning message [captured in a screenshot by LayerX Labs], contains some glaring errors that show it’s not legitimate: It does not conform to any of Apple’s styling either in color or general appearance and misspells macOS as “MacOS.”
It also provides a phone number to contact “support,” however, when [Macworld] called this number they only got a message playback that said the recipient was not available and to call back between 8am and 5pm – even though they were calling during that time frame. The number is obviously fake and will likely never be answered.
<https://www.macworld.com/article/2642938/new-mac-phishing-attack-causes-fake-freezes-to-nab-your-apple-id-password.html>](https://nerdculture.de/system/media_attachments/files/114/223/204/816/717/565/original/c3108acab7427601.jpeg "[ImageSource: LayerX Labs]
The webpage then appears to be frozen which, like most phishing attempts, adds a sense of urgency and fear that something is wrong with your computer. The window that appears displays a warning that the computer has been subjected to a trojan virus and asks the user to enter in their Mac username and password.
The warning message [captured in a screenshot by LayerX Labs], contains some glaring errors that show it’s not legitimate: It does not conform to any of Apple’s styling either in color or general appearance and misspells macOS as “MacOS.”
It also provides a phone number to contact “support,” however, when [Macworld] called this number they only got a message playback that said the recipient was not available and to call back between 8am and 5pm – even though they were calling during that time frame. The number is obviously fake and will likely never be answered.
<https://www.macworld.com/article/2642938/new-mac-phishing-attack-causes-fake-freezes-to-nab-your-apple-id-password.html>")
WordPress Security Plugin WP Ghost vulnerable to Remote Code Execution Bug.
The flaw, impacts all versions of WP Ghost up to 5.4.01 and stems from insufficient input validation in the 'showFile()' function. Exploiting the flaw could allow attackers to include arbitrary files via manipulated URL paths.
Minimal Linux OS runs in a 6MB PDF Document in Chrome.
A version of the Linux operating system can now be run inside a PDF opened by a Chromium-based browser. The developer [Ading2210] explains that Linux need a modified version of the TinyEMU RISC-V emulator.
![If you wish to try out the LinuxPDF, it requires a Chromium-based browser to work correctly (I checked, but it didn't work in Firefox on PC).
On the topic of speed and efficiency, [Ading2210] humbly admits that performance might be the largest problem with LinuxPDF. "The Linux kernel takes about 30-60 seconds to boot up within the PDF, which [is] over 100x slower than normal," notes the developer. With Chrome's current PDF engine having its Just-in-Time (JIT) compiler disabled, [Ading2210] sees no way of speeding up the code, for now.](https://nerdculture.de/system/media_attachments/files/114/211/704/385/933/637/original/7142a6047423bdbc.jpeg "If you wish to try out the LinuxPDF, it requires a Chromium-based browser to work correctly (I checked, but it didn't work in Firefox on PC).
On the topic of speed and efficiency, [Ading2210] humbly admits that performance might be the largest problem with LinuxPDF. \"The Linux kernel takes about 30-60 seconds to boot up within the PDF, which [is] over 100x slower than normal,\" notes the developer. With Chrome's current PDF engine having its Just-in-Time (JIT) compiler disabled, [Ading2210] sees no way of speeding up the code, for now.")
![[ImageSource: Ading2210]
The TinyEMU RISC-V emulator runs in the PDF thanks to a technique where its code is compiled "using an old version of Emscripten that targets asm.js instead of WebAssembly." This is embedded and loads in the PDF, subsequently auto-running a minimal Linux kernel targeting that architecture.
In this implementation, once you agree to 'Start Emulator' in your browser, you will see the LinuxPDF UI load, and a welcome message in the Linux viewport, as you wait for the OS to boot.](https://nerdculture.de/system/media_attachments/files/114/211/705/349/712/707/original/513838969c81eb99.png "[ImageSource: Ading2210]
The TinyEMU RISC-V emulator runs in the PDF thanks to a technique where its code is compiled \"using an old version of Emscripten that targets asm.js instead of WebAssembly.\" This is embedded and loads in the PDF, subsequently auto-running a minimal Linux kernel targeting that architecture.
In this implementation, once you agree to 'Start Emulator' in your browser, you will see the LinuxPDF UI load, and a welcome message in the Linux viewport, as you wait for the OS to boot.")
![[ImageSource: Ading2210]
Below the Linux viewport in the PDF is a soft keyboard created by an array of PDF buttons. However, it is likely quicker for everyone with a decent physical keyboard to input commands into the 'type here for keyboard inputs' field to the lower right of the keyboard UI area.](https://nerdculture.de/system/media_attachments/files/114/211/706/326/556/776/original/9f7e2d1a8c32c083.png "[ImageSource: Ading2210]
Below the Linux viewport in the PDF is a soft keyboard created by an array of PDF buttons. However, it is likely quicker for everyone with a decent physical keyboard to input commands into the 'type here for keyboard inputs' field to the lower right of the keyboard UI area.")
Quake ported to Arduino Nano Matter. [Using only 276kb RAM]
Nicola Wrachien with Silicon Labs created this fun handheld, porting Quake using the Arduino Nano Matter. For easy playing a custom controller shaped board was designed with joysticks and a screen.
![[ImageSource: Nicola Wrachien]
For a much tougher challenge, a group from Silicon Labs decided to port DOOM‘s successor, Quake, to the Arduino Nano Matter Board platform instead even though this platform has some pretty significant limitations for a game as advanced as Quake.
<https://community.silabs.com/s/share/a5UVm000000Vi1ZMAS/quake-ported-to-arduino-nano-matter-and-sparkfun-thing-plus-matter-boards?language=en_US>
To begin work on the memory problem, the group began with a port of Quake originally designed for Windows, allowing them to use a modern Windows machine to whittle down the memory usage before moving over to hardware. They do have a flash memory module available as well, but there’s a speed penalty with this type of memory. To improve speed they did what any true gamer would do with their system: overclock the processor. This got them to around 10 frames per second, which is playable, but not particularly enjoyable.
The further optimizations to improve the FPS required a much deeper dive which included generating lookup tables instead of relying on computation, optimizing some of the original C programming, coding some functions in assembly and only refreshing certain sections of the screen when needed.](https://nerdculture.de/system/media_attachments/files/114/206/081/241/901/037/original/72dec8d287dd1c33.png "[ImageSource: Nicola Wrachien]
For a much tougher challenge, a group from Silicon Labs decided to port DOOM‘s successor, Quake, to the Arduino Nano Matter Board platform instead even though this platform has some pretty significant limitations for a game as advanced as Quake.
<https://community.silabs.com/s/share/a5UVm000000Vi1ZMAS/quake-ported-to-arduino-nano-matter-and-sparkfun-thing-plus-matter-boards?language=en_US>
To begin work on the memory problem, the group began with a port of Quake originally designed for Windows, allowing them to use a modern Windows machine to whittle down the memory usage before moving over to hardware. They do have a flash memory module available as well, but there’s a speed penalty with this type of memory. To improve speed they did what any true gamer would do with their system: overclock the processor. This got them to around 10 frames per second, which is playable, but not particularly enjoyable.
The further optimizations to improve the FPS required a much deeper dive which included generating lookup tables instead of relying on computation, optimizing some of the original C programming, coding some functions in assembly and only refreshing certain sections of the screen when needed.")
DuckDuckGo leans Further into GenAI as its AI Chat Interface exits Beta.
The non-tracking search engine has been dabbling with expanding the role of AI assistance in its product for the past year, including launching a chatbot-style interface last fall [available at Duck.ai]. In a blog post, the company said the service is now exiting beta.
![Another feature DuckDuckGo is offering to make it easier to integrate GenAI into user’s search workflows is the ability to easily switch between its conventional search engine interface to AI chat and vice versa.
A chat button displayed below the search box of its search engine [see screengrab] instantly transports the user to the AI chat interface — with the prompt-field there pre-filled with whatever they had just been searching for on DuckDuckGo’s search engine, making it easy to hit the send button and get an AI-generated answer to the same query.
Reversing this flow just requires tapping on the same [now highlighted] chat button to flip back to its conventional web search interface. So this is a best-of-both-worlds approach to tapping GenAI in search.
“We’re finding that some people prefer to start in chat mode and then jump into more traditional search results when needed, while others prefer the opposite,” DuckDuckGo writes, suggesting “some questions just lend themselves more naturally to one mode or the other, too.”
“So, we thought the best thing to do was offer both. We made it easy to move between them, and we included an off switch for those who’d like to avoid AI altogether,” the search engine company adds.](https://nerdculture.de/system/media_attachments/files/114/200/439/726/610/102/original/cf82b7695103c680.png "Another feature DuckDuckGo is offering to make it easier to integrate GenAI into user’s search workflows is the ability to easily switch between its conventional search engine interface to AI chat and vice versa.
A chat button displayed below the search box of its search engine [see screengrab] instantly transports the user to the AI chat interface — with the prompt-field there pre-filled with whatever they had just been searching for on DuckDuckGo’s search engine, making it easy to hit the send button and get an AI-generated answer to the same query.
Reversing this flow just requires tapping on the same [now highlighted] chat button to flip back to its conventional web search interface. So this is a best-of-both-worlds approach to tapping GenAI in search.
“We’re finding that some people prefer to start in chat mode and then jump into more traditional search results when needed, while others prefer the opposite,” DuckDuckGo writes, suggesting “some questions just lend themselves more naturally to one mode or the other, too.”
“So, we thought the best thing to do was offer both. We made it easy to move between them, and we included an off switch for those who’d like to avoid AI altogether,” the search engine company adds.")
End-to-End Encryption for RCS, enabling Secure Cross-Platform Messaging.
Text messages sent between iOS & Android devices will soon benefit from end-to-end encryption, after the GSM Association published new specifications for the RCS protocol that include support for cross-platform E2EE.
![The new GSMA specifications for RCS include E2EE based on the Messaging Layer Security [MLS] protocol via what's called the Rich Communication Services [RCS] Universal Profile 3.0.
"The new specifications define how to apply MLS within the context of RCS," Tom Van Pelt, technical director of GSMA, said. "These procedures ensure that messages and other content such as files remain confidential and secure as they travel between clients."
<https://www.gsma.com/newsroom/article/rcs-encryption-a-leap-towards-secure-and-interoperable-messaging/>
This also means that RCS will be the first "large-scale messaging service" to have support for interoperable E2EE between different client implementations from different providers in the near future.
The development comes nearly six months after the GSMA said it was working towards implementing end-to-end encryption [E2EE] to secure messages sent between the Android and iOS ecosystems. The move followed Apple's decision to roll out support for RCS in its own Messages app with iOS 18.
Google said, "We've always been committed to providing a secure messaging experience, and Google Messages users have had end-to-end encrypted [E2EE] RCS messaging for years. We're excited to have this updated specification from GSMA and work as quickly as possible with the mobile ecosystem to implement and extend this important user protection to cross-platform RCS messaging."](https://nerdculture.de/system/media_attachments/files/114/194/978/375/605/770/original/ae19ccf056d1258e.jpeg "The new GSMA specifications for RCS include E2EE based on the Messaging Layer Security [MLS] protocol via what's called the Rich Communication Services [RCS] Universal Profile 3.0.
\"The new specifications define how to apply MLS within the context of RCS,\" Tom Van Pelt, technical director of GSMA, said. \"These procedures ensure that messages and other content such as files remain confidential and secure as they travel between clients.\"
<https://www.gsma.com/newsroom/article/rcs-encryption-a-leap-towards-secure-and-interoperable-messaging/>
This also means that RCS will be the first \"large-scale messaging service\" to have support for interoperable E2EE between different client implementations from different providers in the near future.
The development comes nearly six months after the GSMA said it was working towards implementing end-to-end encryption [E2EE] to secure messages sent between the Android and iOS ecosystems. The move followed Apple's decision to roll out support for RCS in its own Messages app with iOS 18.
Google said, \"We've always been committed to providing a secure messaging experience, and Google Messages users have had end-to-end encrypted [E2EE] RCS messaging for years. We're excited to have this updated specification from GSMA and work as quickly as possible with the mobile ecosystem to implement and extend this important user protection to cross-platform RCS messaging.\"")
17 MarchL #TEPCO "Regarding the submission of "Decommissioning Implementation Plans" based on the Decommissioning Reserve Fund System" www.tepco.co.jp/press/releas... #Fukushima #genpastu #nuclear #energy #tech #engineer #policy
tepco.co.jp/press/release/...
️ Millions of Android TVs hijacked in Massive Botnet — How to see if Yours is at Risk.
The Vo1d malware botnet found on 1.3 million devices back in September 2024 has grown significantly. According to a report from Xlab, a new variant has infected an additional 1.6 million Android TVs across 226 countries.
![[ImageSource: Shutterstock]
How to stay safe from the Vo1d botnet.
Since the infection chain remains unknown, the recommendations are to follow a “holistic approach” meaning to sidestep the threat at its source. This means you'll want to stick to buying streaming devices only from reputable vendors. Resellers and retailers who are trustworthy minimize your likelihood of a device arriving pre-loaded with malware.
A Google spokesperson commented: “These off-brand devices discovered to be infected were not Play Protect certified Android devices. If a device isn’t Play Protect certified, Google doesn’t have a record of security and compatibility test results.
“Play Protect certified Android devices undergo extensive testing to ensure quality and user safety. To help you confirm whether or not a device is built with Android TV OS and Play Protect certified, our Android TV website provides the most up-to-date list of partners. You can also take these steps to check if your device is Play Protect certified.”
⚠️Additionally, users should always make sure to keep their firmware up to date and install the latest security patches as soon as they become available.⚠️](https://nerdculture.de/system/media_attachments/files/114/183/625/804/373/262/original/081175babbd664b1.png "[ImageSource: Shutterstock]
How to stay safe from the Vo1d botnet.
Since the infection chain remains unknown, the recommendations are to follow a “holistic approach” meaning to sidestep the threat at its source. This means you'll want to stick to buying streaming devices only from reputable vendors. Resellers and retailers who are trustworthy minimize your likelihood of a device arriving pre-loaded with malware.
A Google spokesperson commented: “These off-brand devices discovered to be infected were not Play Protect certified Android devices. If a device isn’t Play Protect certified, Google doesn’t have a record of security and compatibility test results.
“Play Protect certified Android devices undergo extensive testing to ensure quality and user safety. To help you confirm whether or not a device is built with Android TV OS and Play Protect certified, our Android TV website provides the most up-to-date list of partners. You can also take these steps to check if your device is Play Protect certified.”
⚠️Additionally, users should always make sure to keep their firmware up to date and install the latest security patches as soon as they become available.⚠️")
They are upgrading the #software running a #radar I work with. One of the tests is obviously how good the data looks. The new software has higher standard deviations than the old software (#statistics)
And that's it. They are trying to debug it based on just the std dev.
I looked at one of the tracks and there was clearly a time dependent trend.
I keep telling them and telling them that just thinking in terms of "standard deviation" is making them assume gaussian #noise sources.
But if you look at the #data as a *time series*, you will start thinking about the processing and what would be happening at different points in a track and how it might go wrong starting at certain points.
It's a purely software #engineer team--they know about radar (more than I do!), but aren't #system engineers.
It's been going on long enough that I want to say something to someone higher up. But I don't want to adopt another project....
GitHub uncovers new Ruby-SAML Vulnerabilities allowing Account Takeover Attacks.
Two high-severity security flaws have been disclosed in the open-source ruby-saml library that could allow malicious actors to bypass Security Assertion Markup Language (SAML) authentication protections.
![[ImageSource: GitHub]
"Attackers who are in possession of a single valid signature that was created with the key used to validate SAML responses or assertions of the targeted organization can use it to construct SAML assertions themselves and are in turn able to log in as any user," GitHub Security Lab researcher Peter Stöckli said in a post.
The Microsoft-owned subsidiary also noted that the issue boils down to a "disconnect" between verification of the hash and verification of the signature, opening the door to exploitation via a parser differential.
Versions 1.12.4 and 1.18.0 also plug a remote denial-of-service (DoS) flaw when handling compressed SAML responses (CVE-2025-25293, CVSS score: 7.7).
⚠️Users are recommended to update to the latest version to safeguard against potential threats.⚠️
The findings come nearly six months after GitLab and ruby-saml moved to address another critical vulnerability (CVE-2024-45409, CVSS score: 10.0) that could also result in an authentication bypass.](https://nerdculture.de/system/media_attachments/files/114/177/947/075/555/612/original/721ecee68734690f.jpeg "[ImageSource: GitHub]
\"Attackers who are in possession of a single valid signature that was created with the key used to validate SAML responses or assertions of the targeted organization can use it to construct SAML assertions themselves and are in turn able to log in as any user,\" GitHub Security Lab researcher Peter Stöckli said in a post.
The Microsoft-owned subsidiary also noted that the issue boils down to a \"disconnect\" between verification of the hash and verification of the signature, opening the door to exploitation via a parser differential.
Versions 1.12.4 and 1.18.0 also plug a remote denial-of-service (DoS) flaw when handling compressed SAML responses (CVE-2025-25293, CVSS score: 7.7).
⚠️Users are recommended to update to the latest version to safeguard against potential threats.⚠️
The findings come nearly six months after GitLab and ruby-saml moved to address another critical vulnerability (CVE-2024-45409, CVSS score: 10.0) that could also result in an authentication bypass.")
Deutschland …
Land der Dichter und Denker und Ingenieure.
Damals und heute. Bewahren und die #Innovationen.
#GottliebDaimler #Engineer. Happy Birthday Sir zum 191. Geburtstag.
Und der Mainstream damals:
„Das Pferd wird bleiben, aber die Automobilie ist nur eine vorübergehende Erscheinung.“
Build a Parametric Speaker of Your Own.
At the Hacker Hotel conference in the Netherlands, [Orange_Murker] presented an ultrasonic parametric speaker. It projects an extremely narrow beam of sound over a significant distance, but it’s not an audio frequency speaker at all.
![[ImageSource: Orange_Murker]
Those of you familiar with radio will recognize its operation; an ultrasonic carrier is modulated with the audio to be projected, and the speaker transfers that to the air. Just like the diode detector in an old AM radio, air is a nonlinear medium and it performs a demodulation of the ultrasound to produce an audio frequency that can be heard.
[Orange_Murker] spends a while going into modulation schemes, before revealing that she drove her speaker with a 40 kHz PWM via an H bridge. The speaker itself is an array of in-phase ultrasonic transducers, and she demonstrates the result on her audience.
<https://media.ccc.de/v/2025-201-build-your-own-parametric-speaker>](https://nerdculture.de/system/media_attachments/files/114/172/381/612/832/329/original/419ed72e02265621.png "[ImageSource: Orange_Murker]
Those of you familiar with radio will recognize its operation; an ultrasonic carrier is modulated with the audio to be projected, and the speaker transfers that to the air. Just like the diode detector in an old AM radio, air is a nonlinear medium and it performs a demodulation of the ultrasound to produce an audio frequency that can be heard.
[Orange_Murker] spends a while going into modulation schemes, before revealing that she drove her speaker with a 40 kHz PWM via an H bridge. The speaker itself is an array of in-phase ultrasonic transducers, and she demonstrates the result on her audience.
<https://media.ccc.de/v/2025-201-build-your-own-parametric-speaker>")
10x Engineering
Generate impressive-looking terminal output to look busy when stakeholders walk by and become an irreplaceable 10x developer in 30 seconds flat.
With rust-stakeholder.
