<![CDATA[#copyfail]]>

just to chime in on the copyfail thing, while, yes, it is a very big deal, the prerequisite is that you have a shell on the box you wish to exploit.

so keep that in mind when doing risk register stuff.

attackers will aim for shit like jumpboxes, shared hosting environments, multi-tennancy environments, and places they can get a shell, then move laterally to get you.

shops doing yolo devops are gonna get targeted, and I wouldnt be surprised to see openclaw malicious skills too

]]>https://board.circlewithadot.net/topic/e0eb5c5b-2f06-4c15-8649-44f57b555667/copyfailRSS for NodeFri, 15 May 2026 05:06:28 GMTWed, 29 Apr 2026 23:13:26 GMT60<![CDATA[Reply to #copyfail on Thu, 30 Apr 2026 16:21:37 GMT]]>@nyanbinary its like our brains are touching again ๐Ÿ˜„

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116494571755605065https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116494571755605065Thu, 30 Apr 2026 16:21:37 GMT<![CDATA[Reply to #copyfail on Thu, 30 Apr 2026 07:20:03 GMT]]>@Viss yip, thats pretty much the summary I shit out this morning for the folx that will have to talk to management - patch is a must but due to our environments nature this isnt a "all hands on deck" thing, especially as most of the distros we use havent pushed versions yet afaik

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/nyanbinary/statuses/116492442208613266https://board.circlewithadot.net/post/https://infosec.exchange/users/nyanbinary/statuses/116492442208613266Thu, 30 Apr 2026 07:20:03 GMT<![CDATA[Reply to #copyfail on Thu, 30 Apr 2026 02:52:18 GMT]]>@FritzAdalis if theres a way to inject a command or run code, yep

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116491389384361503https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116491389384361503Thu, 30 Apr 2026 02:52:18 GMT<![CDATA[Reply to #copyfail on Thu, 30 Apr 2026 02:50:46 GMT]]>@Viss
So you mean that Internet-facing Debian 8 box they refuse to turn off is fucked?

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/FritzAdalis/statuses/116491383361241315https://board.circlewithadot.net/post/https://infosec.exchange/users/FritzAdalis/statuses/116491383361241315Thu, 30 Apr 2026 02:50:46 GMT<![CDATA[Reply to #copyfail on Thu, 30 Apr 2026 02:35:31 GMT]]>@bhhaskin ot may have shit so old it predates this bug, but also most ot is weird custom bullshit and not the linux kernel, which is largely already a massive problem for ot

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116491323416243313https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116491323416243313Thu, 30 Apr 2026 02:35:31 GMT<![CDATA[Reply to #copyfail on Thu, 30 Apr 2026 02:31:36 GMT]]>@Viss what do you think, about a billion dollars in OT tonight?

(Just kidding, IT doesn't get OT)

]]>https://board.circlewithadot.net/post/https://social.bitsofsimplicity.com/users/bhhaskin/statuses/116491308038788637https://board.circlewithadot.net/post/https://social.bitsofsimplicity.com/users/bhhaskin/statuses/116491308038788637Thu, 30 Apr 2026 02:31:36 GMT<![CDATA[Reply to #copyfail on Thu, 30 Apr 2026 02:29:49 GMT]]>@bhhaskin oh im 100% sure theres some absolute shithouse madness going on behind the scenes somewhere.

theres probably also a teeeeenyy tiny subset of folks whove been sitting on this bug for ten years who are now super fuckin pissed its burned

and if any of them can see this, my condolences and hat tip me somewhere incase vault7 ever happens again. nerds love it when they get quiet shoutouts like that.

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116491300981505366https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116491300981505366Thu, 30 Apr 2026 02:29:49 GMT<![CDATA[Reply to #copyfail on Thu, 30 Apr 2026 02:23:57 GMT]]>@Viss I am betting some state sponsored agencies are not very happy tonight. Same with sys admins and IT departments everywhere lol

]]>https://board.circlewithadot.net/post/https://social.bitsofsimplicity.com/users/bhhaskin/statuses/116491277917229304https://board.circlewithadot.net/post/https://social.bitsofsimplicity.com/users/bhhaskin/statuses/116491277917229304Thu, 30 Apr 2026 02:23:57 GMT<![CDATA[Reply to #copyfail on Thu, 30 Apr 2026 02:20:31 GMT]]>@Viss you donโ€™t need to depmod

]]>https://board.circlewithadot.net/post/https://toot.mirbsd.org/users/mirabilos/statuses/01KQE3052TP9H2J5RQ9BA3NVCEhttps://board.circlewithadot.net/post/https://toot.mirbsd.org/users/mirabilos/statuses/01KQE3052TP9H2J5RQ9BA3NVCEThu, 30 Apr 2026 02:20:31 GMT<![CDATA[Reply to #copyfail on Thu, 30 Apr 2026 02:13:43 GMT]]>@paul_ipv6 @rootwyrm @cR0w @da_667 @reverseics i am eager to see godaddy catch fire sometime in the near future

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116491237669359442https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116491237669359442Thu, 30 Apr 2026 02:13:43 GMT<![CDATA[Reply to #copyfail on Thu, 30 Apr 2026 02:13:15 GMT]]>@bhhaskin yeah now you can shell the host its on, theeeeeeeen its a party

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116491235847972341https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116491235847972341Thu, 30 Apr 2026 02:13:15 GMT<![CDATA[Reply to #copyfail on Thu, 30 Apr 2026 02:12:51 GMT]]>@onyxraven there are so many angles on this thing

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116491234250656301https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116491234250656301Thu, 30 Apr 2026 02:12:51 GMT<![CDATA[Reply to #copyfail on Thu, 30 Apr 2026 02:00:35 GMT]]>@Viss or be ready for supply chain exploits doing this to dependencies or typosquats. Then pushing that into containers. Thatโ€™s the path Iโ€™m concerned about

]]>https://board.circlewithadot.net/post/https://hachyderm.io/users/onyxraven/statuses/116491186061551429https://board.circlewithadot.net/post/https://hachyderm.io/users/onyxraven/statuses/116491186061551429Thu, 30 Apr 2026 02:00:35 GMT<![CDATA[Reply to #copyfail on Thu, 30 Apr 2026 01:27:51 GMT]]>@Viss just think of all the WordPress sites with RCE there where pretty useless up until now.

]]>https://board.circlewithadot.net/post/https://social.bitsofsimplicity.com/users/bhhaskin/statuses/116491057303486001https://board.circlewithadot.net/post/https://social.bitsofsimplicity.com/users/bhhaskin/statuses/116491057303486001Thu, 30 Apr 2026 01:27:51 GMT<![CDATA[Reply to #copyfail on Thu, 30 Apr 2026 01:00:35 GMT]]>@Viss @rootwyrm @cR0w @da_667 @reverseics

*what*? perimeter and middleware boxen as platforms to exploite? surely not. they are *security* devices, so they must be more secure!

*choke* *gasp* *cough*

ok. couldn't get that all out with a straight face...

๐Ÿฟ๐Ÿฟ๐Ÿฟ

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/paul_ipv6/statuses/116490950112319597https://board.circlewithadot.net/post/https://infosec.exchange/users/paul_ipv6/statuses/116490950112319597Thu, 30 Apr 2026 01:00:35 GMT<![CDATA[Reply to #copyfail on Thu, 30 Apr 2026 00:13:38 GMT]]>@Viss @cR0w @rootwyrm @reverseics and I'm tired of pretending its not

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/da_667/statuses/116490765470167381https://board.circlewithadot.net/post/https://infosec.exchange/users/da_667/statuses/116490765470167381Thu, 30 Apr 2026 00:13:38 GMT<![CDATA[Reply to #copyfail on Thu, 30 Apr 2026 00:07:50 GMT]]>@cR0w @rootwyrm @da_667 @reverseics yes

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116490742721227820https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116490742721227820Thu, 30 Apr 2026 00:07:50 GMT<![CDATA[Reply to #copyfail on Thu, 30 Apr 2026 00:05:28 GMT]]>@Viss @rootwyrm @da_667 @reverseics you think it's funny? joker quote

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/cR0w/statuses/116490733417534751https://board.circlewithadot.net/post/https://infosec.exchange/users/cR0w/statuses/116490733417534751Thu, 30 Apr 2026 00:05:28 GMT<![CDATA[Reply to #copyfail on Thu, 30 Apr 2026 00:01:04 GMT]]>@rootwyrm @cR0w @da_667 @reverseics its amusing that "firewall appliances" are going to have more surfaces exposed to exploit this thing than linux boxes

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116490716095810843https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116490716095810843Thu, 30 Apr 2026 00:01:04 GMT<![CDATA[Reply to #copyfail on Wed, 29 Apr 2026 23:55:46 GMT]]>@Viss @cR0w @da_667 @reverseics well yeah, I thought that was kinda obvious when I said basically anything that uses the crypto API could be exploited and www:www still has access to ../../../bin/bash

]]>https://board.circlewithadot.net/post/https://weird.autos/users/rootwyrm/statuses/116490695213074411https://board.circlewithadot.net/post/https://weird.autos/users/rootwyrm/statuses/116490695213074411Wed, 29 Apr 2026 23:55:46 GMT<![CDATA[Reply to #copyfail on Wed, 29 Apr 2026 23:53:08 GMT]]>@rootwyrm the nation states are 100% gonna go for those edge cases tho. and its gonna hit shit like fortinets and ciscos and panw and ... hey @cR0w and @da_667 and @reverseics get in here, we're back to ../ again!

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116490684904485066https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116490684904485066Wed, 29 Apr 2026 23:53:08 GMT<![CDATA[Reply to #copyfail on Wed, 29 Apr 2026 23:52:02 GMT]]>@rootwyrm im sure youre right, and that there will be edge cases where some one-off webhosted thinger or weirdo node app bullshit or custom binary doodad will have some path to trigger this thing - but the most commonly exploited scenario based on what ive seen the last few years in consulting land is gonna be shops with very lax security, shared accounts, injectable automated processing, ci/cd pipelines, and llm craps

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116490680557642721https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116490680557642721Wed, 29 Apr 2026 23:52:02 GMT<![CDATA[Reply to #copyfail on Wed, 29 Apr 2026 23:51:26 GMT]]>@Viss I keep saying at work "it should be considered production the second it's on the network", but it gets shot down because of ... existing PROCESSES. The easy, human, tribal knowledge shit that we could fix with the snap of our fingers and a couple meetings.

]]>https://board.circlewithadot.net/post/https://mastodon.clitheroe.ca/users/scott/statuses/116490678201881939https://board.circlewithadot.net/post/https://mastodon.clitheroe.ca/users/scott/statuses/116490678201881939Wed, 29 Apr 2026 23:51:26 GMT<![CDATA[Reply to #copyfail on Wed, 29 Apr 2026 23:47:53 GMT]]>@Viss so, yeah, about that?

You actually 100% do not need a shell to exploit. Maybe to gain root, but not necessarily.

You just need something that calls the crypto API in a way that creates a scatterlist with the broken function.

Which can be done by literally any program in userland.

If anyone needs me, I'm going to be chugging bottles of hemlock and strychnine and bleach.

]]>https://board.circlewithadot.net/post/https://weird.autos/users/rootwyrm/statuses/116490664222474224https://board.circlewithadot.net/post/https://weird.autos/users/rootwyrm/statuses/116490664222474224Wed, 29 Apr 2026 23:47:53 GMT