CIRCLE WITH A DOT

Somebody released a PoC for Firefox CVE-2026-8389, and it works.The PoC doesn't include a sandbox escape, and claims that poc-win-sbx.html includes the escape. This file was not shared in the repo.The python server on localhost seems unnecessary, as the exploit web server can surely serve up primer.js the first time that payload.js is requested, and the actual payload.js the second time.

@wdormann fingers crossed none of the drives in my pool take a crap

@GossiTheDog At least in my case, that's covered by the \\example.com\pwned.exe case.

Once in a blue moon, I see something on Temu that I might consider buying.And then I'm bombarded by spinning wheels that land on "one more spin", and then "(up to) 100% off", explosions, confetti, yelling in ALL CAPS, required app install with notifications. At which point I power off my phone and go outside.I'm afraid to ask if there is a customer base out there that enjoys this sort of stuff, or if it's merely willing to put up with to maybe get a good deal. Surely it's the former, as otherwise why would the company subject potential customers to it? ‍️

@sysop408 You mean Outlook (classic) or Outlook (new)?

@wdormann "that is the greatest function and UI in the world", said no one ever. Anywhere.

CIFSwitch has been assigned CVE-2026-46243.

The openSUSE peeps have figured out some crazy compression, it seems. 107.0 B for everything!

I'm used to having volunteer ground cherry plants in every single container I own.But this is a new one. A volunteer tomato in a crack in front of the car side of the garage! We'll see if it survives transplantation...

@AwkwardTuring I've been using SwiftKey for so many years, I suspect I won't know how to use the default keyboard.

@wdormann Uncoordinated disclosures that put proof-of-concept code for unpatched vulnerabilities into the hands of bad actors are never justifiable...Assertion not supported by currently available data. There are plenty of historical examples of vendors which have refused to act on vulnerabilities which impact customers until their arms are twisted via public disclosure.

@wdormann My brain wants to file this away for future use:The structural smell in the decompile is unmissable...

Stolen from the bad site.

"We'll just add an awning in post", said the awning commercial director to the sunburned actor that is squinting into the sun.

@wdormann This must be another income source for Paper Street Soap Co's anarchist side-projects!

There's another LInux LPE (of course):pintheftSadly, the RDS kernel module this requires is only default on Arch Linux among the common distributions we tested.CVE unknown.

Also, the Dirty frag mitigation protects against this variant as well:sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; echo 3 > /proc/sys/vm/drop_caches; true"

New from Nightmare-Eclipse, we have MiniPlasmaWorks reliably to get a SYSTEM cmd.exe prompt on Win11 with May's updates. Is reportedly a failure to properly fix CVE-2020-17103. I'll note that it does not seem to work on the latest Insider Preview Canary Windows 11, and with RTM Win11 26H1, it claims to fail, but actually succeeds.

@wdormann I agree that this example sucks but I also argue that most UNIX/GNU-ish things go way way too far in the other direction and sacrifice a lot of clarity to save a keystroke or two. (And very few shell things work correctly whenever paths contain a space)

Grok kind of cracks me up with it's inability to recognize popular pictures.For this one it was definitely:Tank from the Matrix (didn't grab a screenshot)Patrick StewartWalter from Star Trek: First Contact (James Cromwell)An unidentified older man (not a famous celebrity or character from a well-known movie/TV show)It's Ed Harris from the Truman Show.These answers all came within the period of about 5 minutes.