Login

Recent searches

No recent searches

Search options

Not available on mastodon.xyz.
mastodon.xyz is one of the many independent Mastodon servers you can use to participate in the fediverse.
A Mastodon instance, open to everyone, but mainly English and French speaking.

Administered by:

Server stats:

714
active users

mastodon.xyz: AboutProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.4

#infosec

392 posts162 participants29 posts today
Public
Harry Sintonen

Several months ago, I found a #vulnerability from #MantisBT - Authentication bypass for some passwords due to PHP type juggling (CVE-2025-47776).

Any account that has a password that results in a hash that matches ^0+[Ee][0-9]+$ can be logged in with a password that matches that regex as well. For example, password comito5 can be used to log in to the affected accounts and thus gain unauthorised access.

The root cause of this bug is the incorrect use of == to match the password hash:

if( auth_process_plain_password( $p_test_password, $t_password, $t_login_method ) == $t_password )

The fix is to use === for the comparison.

This vulnerability has existed in MantisBT ever since hashed password support was added (read: decades). MantisBT 2.27.2 and later include a fix to this vulnerability. mantisbt.org/download.php

Root cause of CVE-2025-47776 vulnerability: Use of == instead of === to compare password hashes.
#CVE_2025_47776#infosec#cybersecurity
Public
BeyondMachines :verified:

NHS Lothian staff member charged following unauthorized access to patient medical records

NHS Lothian reported a data breach on October 31, 2025, after monitoring systems detected that a staff member inappropriately accessed approximately 100 patient medical records. Police Scotland charged the individual with criminal offenses. All affected patients received notification letters about the unauthorized access.

****
#cybersecurity #infosec #incident #databreach
beyondmachines.net/event_detai

BeyondMachinesNHS Lothian staff member charged following unauthorized access to patient medical recordsNHS Lothian reported a data breach on October 31, 2025, after monitoring systems detected that a staff member inappropriately accessed approximately 100 patient medical records. Police Scotland charged the individual with criminal offenses. All affected patients received notification letters about the unauthorized access.
Public
ZaufanaTrzeciaStrona.pl

Jak przypisać cyberatak konkretnemu państwu? Marcin Ratajczyk (@znanyproblem) opowiedział na #OMH 2024 o metodach atrybucji cyberoperacji, wyzwaniach analityków i ograniczeniach „cyfrowych odcisków palców” - na przykładach ataków wymierzonych w Polskę.

▶️ youtube.com/watch?v=2A5pilyypW8

Sprawdź, jakie tematy pojawią się na #OhMyHack w tym roku! 👉️ omhconf.pl/#agenda

YouTubeMarcin Ratajczyk: Kto to zrobił? I dlaczego (tu wstaw dowolny kraj), ale tylko na 21,37%? | OMH 2024By PROIDEA Events
#OMHconf#cyberbezpieczenstwo#infosec
Public
BeyondMachines :verified:

CISA warns of actively exploited old Linux kernel vulnerability

CISA is warning that ransomware groups are actively exploiting a decade-old Linux kernel privilege escalation vulnerability (CVE-2024-1086) in the netfilter nf_tables component affecting kernel versions 3.15 through 6.8-rc1. The flaw enables local attackers to escalate privileges to root level through a use-after-free weakness.

**If you run Linux servers or systems, plan an update to your kernel or rebuild from latest version. Ransomware groups are actively exploiting this flaw to gain complete control of systems once they gain initial access. As usual, strong passwords, network isolation and awareness of social engineering are a must. If you can't update right away, blocklist the nf_tables module and restrict access to user namespaces until you can patch.**
#cybersecurity #infosec #attack #activeexploit
beyondmachines.net/event_detai

Public
BeyondMachines :verified:

University of Pennsylvania email system compromised in cybersecurity incident

The University of Pennsylvania suffered a cybersecurity incident on October 31, 2025, when attackers gained access to the university's Salesforce Marketing Cloud mailing list platform (connect.upenn.edu) and sent mass fraudulent emails from official Penn addresses threatening to leak student records and institutional data. No actual data exposure has been confirmed.

****
#cybersecurity #infosec #incident #databreach
beyondmachines.net/event_detai

BeyondMachinesUniversity of Pennsylvania email system compromised in cybersecurity incidentThe University of Pennsylvania suffered a cybersecurity incident on October 31, 2025, when attackers gained access to the university's Salesforce Marketing Cloud mailing list platform (connect.upenn.edu) and sent mass fraudulent emails from official Penn addresses threatening to leak student records and institutional data. No actual data exposure has been confirmed.
ExploreLive feeds
About