Man i went so long without losing #Whamageddon. Until this moment.

Well, it was a good run.

Who would have thought that infinite monkeys on infinite keyboards copying bits of code from places where people ask why their code isn't working would need significant amounts of human review?

Here’s a poem called ‘An Invention of Collective Nouns’.

Happy December 13th, the one day of the year that I accept non ISO 8601 date formats without judgement

and it's not like my insurance provider gives a warning of "never forward this email" or whatever so ¯_(ツ)_/¯

also if that link is unique/authy enough for you steal my PII I guess you worked hard and you deserve to have it.

Hey, make sure you click carefully on emails. The links might be phishing scams.

Meanwhile, from my health insurance provider:

@iagox86 @hrbrmstr 🎶 when you want a shelllllll HGUH! 🎶

🚨 With folks (rightfully) abandoning GitHub for other pastures, some are turning to self-hosting. One option is Gogs, and the epic team at Wiz says you gotta patch since there's an 0-day in the wild (pls RT for reach and someone pls post on the stupid fosstodon server b/c the folks there are likely to be doing this)

https://www.wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit

one forum has taken to calling it "the panslopticon" and...it's accurate

☕ & #threatintel: CISA has moved the due date for mitigating CVE-2025-55182 (Meta React Server Components Remote Code Execution Vulnerability) up two weeks. It was initially set for December 26, but it is now due on December 12. IIRC, this is the first time the due date has been modified.

In all honesty, if you haven't already patched this vulnerability, it's likely too late. As a reminder, patching does not boot attackers, so you should check for indicators of compromise.

🎉 runZero is now officially a CVE Numbering Authority!

That means we can assign and publish CVE IDs for the vulnerabilities we dig up during research and customer work. This isn’t just a shiny badge, it’s a big step forward in our commitment to advancing coordinated vulnerability disclosure.

💪 Hear from @todb on how we’re leveling up in the fight to keep your networks safe.

Read the blog: https://www.runzero.com/blog/runzero-cna/

Read the press release: https://www.runzero.com/newsroom/runzero-earns-cna-designation/

Please enjoy today's newsletter with a spicy recap of InternetNZ's 30th event and why other .TLDs in democracies need to pay attention. Also, Portugal exempts good faith hackers from cybercrime laws, we're in the era of identity rental cyberespionage, and cats.

Link: https://www.patreon.com/posts/cybersecurity-9-145397383

Dem projected to flip Georgia seat in district Trump won by double digits - Raw Story

https://www.rawstory.com/georgia-election-results/

GCVE-BCP-02 Published - Version 1.3 (2025-12-09)

We’re pleased to announce the publication of GCVE-BCP-02 – Practical Guide to Vulnerability Handling and Disclosure, now available in its version 1.3.

This Best Current Practice document provides actionable guidance for organisations, researchers, and GCVE Numbering Authorities (GNAs) on managing and disclosing vulnerabilities effectively, both within the GCVE ecosystem and beyond.

🔗 Read it here: (HTML)

https://gcve.eu/bcp/gcve-bcp-02/

🔗 Read it here: (PDF)

https://gcve.eu/files/bcp/gcve-bcp-02.pdf

Thank you to everyone contributing to the improvement and adoption of vulnerability handling and disclosure practice!

@gcve@social.circl.lu
@gcve@discourse.ossbase.org
@circl
@vulnerability_lookup

GREAT STORM⚡️WATCH about 🐚 🥵 with @todb @ntkramer and Noah (+ Overwatch)

We don't edit this thing so it's live if you missed it.

https://www.youtube.com/watch?v=ps5NSQq0ACg

Use @runZeroInc to find the Next.js hidden in all the nooks and crannies of your infra and use our hourly updated block lists to stay ahead of the rapidly changing, brand new source IPs attackers are using.

Hot diggity. I'm on two webcasts today:

Troj.AI's, with my pals Lee and Rebekah, in about 80 minutes, at noon Eastern:

https://us06web.zoom.us/webinar/register/5017646406193/WN_dTgf90S7QYagKFc1CgVZzA#/registration

And then a surprise Storm⚡️Watch episode at 3pm Eastern:

https://www.twitch.tv/greynoiseio

Now to find a clean @runZeroInc shirt.

🔎 Your attack surface isn’t where you think it is.

Cloud, SaaS, IoT, shadow IT, vendors — exposure now lives everywhere, and traditional scanning can’t keep up.

On Dec. 3, SC Media hosted a webcast with @sawaba, @hdm, and @todb on:

✔️ Continuous discovery
✔️ Overlooked external pathways
✔️ Why periodic inventories fail
✔️ How to operationalize ASM

👉 Watch the replay and learn how to see what others miss: https://www.runzero.com/resources/asm-continuous-discovery/

@BarrySweeney @davep what's @beasts ? The Mastodon account gives no hints.

I was leery of Gandi's acquisition a couple years ago but they seem to have remained independent.

@teriradichel good thing executive orders don’t fucking work like that.