Notices by Harry Sintonen (harrysintonen@infosec.exchange)

@dalias If you don't update you will be vulnerable to various exploits. https://en.wikipedia.org/wiki/AGESA and look for "Security fixes"

Heads up to anyone using #AMD CPUs in a setting where Transparent Secure Memory Encryption (TSME) is critical: AMD has disabled this feature for consumer AMD products as of the latest AGESA updates. The feature is now only available for "PRO" CPU variants.

https://arstechnica.com/security/2026/06/users-cry-foul-after-amd-stripped-memory-crypto-from-its-consumer-cpus/

#enshittification

Apparently, AI capacity outages are hitting users big time. You can't get resources even with money. Daily tokens run out in hours, and weekly by Tuesday.

The only remedy for this will be to hike prices by a lot.

Or... just not use AI.

"Github Copilot customers report up to 100-fold price hikes — AI sticker shock bites as Microsoft switches to usage-based pricing"

https://www.tomshardware.com/tech-industry/artificial-intelligence/github-copilot-customers-suffer-from-sticker-shock-as-microsoft-switches-to-usage-based-pricing-customers-report-up-to-100-fold-price-hikes

#Signalapp doesn't actually delete messages when they're deleted (either manually or by automation). The message deletion is written to Write-ahead Log, and the data is only truly deleted once Signal is restarted or threshold of 1000 pages is reached. For macOS Signal application, extra complication arises from the fact that the signal message database can be backed up before the database consolidation occurs. Large amount of the supposedly already deleted messages could be recovered from the device or backups.

This concerns use cases where deleting messages actually getting removed in timely manner is of high importance and recovery of the deleted messages could lead to grave consequences.

TL;DR: If you don't care about deleted messages being actually deleted you don't need to worry.

Full advisory at: https://sintonen.fi/advisories/signal-deleted-but-not-forgotten.txt

#fulldisclosure #infosec #cybersecurity

All my attempts to communicate a vulnerability in #Signalapp have failed - I have not received any response to my multiple messages to them. Good people have tried to forward my concern to them (and I am thankful for your efforts and help), yet this has been to no avail.

I am disappointed in the lack of communication from Signal. I will be disclosing the full details of the issue later today (with end-user mitigations), after the six-month anniversary of the initial report.

Vulnerabilities found from #curl:

#Mythos: 1
Me: 30

- https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerability/
- https://sintonen.fi/advisories/

I've tried to report a security vulnerability to @signalapp for months now (first attempt was 2025-11-23 to the official security-at email address). I haven't gotten any response from them, even after repeated attempts. This is highly frustrating.

Is there a way to reach them? I don't need any kind of special treatment, just someone acknowledging that the message has been received would be okay.

#signalapp

Finland, Denmark, Norway, Sweden, and Estonia are soon enabling offline debit card payments for at least seven days without network connectivity. The change covers payments for essential goods in physical trade, such as food, medicine, and fuel. Each country has made - or is in the process of making - the required changes to their related regulations to enable it.

The motivation for this change is to enable payments even in exceptional situations such as network disruptions due to sabotage or conflict. TL;DR: You can pay for essentials even if Russia cuts the cables.

Plans for this change were announced in May 2025: https://www.reuters.com/business/finance/nordics-estonia-plan-offline-card-payment-back-up-if-internet-cut-2025-05-07/

#resilience #preparedness #infrastructure #payments #banking

#Microsoft sent an email to everyone saying they're listening to people now and they will definitely not pushing AI to everything anymore.

Also Microsoft enabled #github to collect all your "inputs, outputs and associated context to train and improve AI models". This new tickbox is enabled by default, even if you explicitly disabled Copilot before.

Actions speak louder than words.

You can disable the option at https://github.com/settings/copilot/features

#enshittification

This should be obvious for everyone by now, but if you're not from US you must assume that all your use of US AI services (#ChatGPT, #Claude, #Gemini etc) is fed directly to US intelligence services.

"We may share your Personal Data, including information about your interaction with our Services, with government authorities ... in compliance with the law (i)" (OpenAI)

"We may disclose personal data to governmental regulatory authorities as required by law" (Claude)

"We will share personal information outside of Google ... to: Respond to any applicable law, regulation, legal process, or enforceable governmental request" (Gemini)

The amount of valuable information fed to the systems voluntarily is staggering. It's not a matter of "if" it is happening, but "of course it is". It would be outright negligent if they weren’t capturing and disseminating it all.

https://en.wikipedia.org/wiki/Foreign_Intelligence_Surveillance_Act#Without_a_court_order
https://en.wikipedia.org/wiki/Foreign_Intelligence_Surveillance_Act#Amendments

#privacy

Retroactively changing the role of a token or key is a very bad idea.

https://trufflesecurity.com/blog/google-api-keys-werent-secrets-but-then-gemini-changed-the-rules

#google #googleapikeys #infosec #cybersecurity

You can do the following to remove the scheduled task that executes the vulnerable AMDAutoUpdate:

1. Run cmd.exe as administrator

2. schtasks /delete /TN AMDAutoUpdate /F

This prevents the AMDAutoUpdate from executing.

#infosec #cybersecurity #amd #ryzenmaster

Apparently AMD's AutoUpdate downloads the updates over HTTP and executes them without any validation (presumably as SYSTEM user). AMD was notified of the vulnerability but according to them "attack requiring physical access to victim's computer/device, man in the middle or compromised user accounts" are out of scope.

Madness.

source: https://mrbruh.com/amd/

#vulnerability #infosec #cybersecurity

This is a reminder to everyone that security is more than just memory safety. https://www.phoronix.com/news/sudo-rs-security-ubuntu-25.10

#rust #vulnerability #sudo_rs

Several months ago, I found a #vulnerability from #MantisBT - Authentication bypass for some passwords due to PHP type juggling (CVE-2025-47776).

Any account that has a password that results in a hash that matches ^0+[Ee][0-9]+$ can be logged in with a password that matches that regex as well. For example, password comito5 can be used to log in to the affected accounts and thus gain unauthorised access.

The root cause of this bug is the incorrect use of == to match the password hash:

if( auth_process_plain_password( $p_test_password, $t_password, $t_login_method ) == $t_password )

The fix is to use === for the comparison.

This vulnerability has existed in MantisBT ever since hashed password support was added (read: decades). MantisBT 2.27.2 and later include a fix to this vulnerability. https://mantisbt.org/download.php

#CVE_2025_47776 #infosec #cybersecurity

#Microsoft is clearly becoming desperate due to low adoption rates of #Copilot.

Apparently, Microsoft is now pushing Copilot to all #Microsoft365 personal subscribers and calling it a "subscription price increase". Only when you decide to cancel your subscription are you presented with the option to switch to "Microsoft 365 Personal Classic" without Copilot (and nearly the old price). The classic plan is not presented as an option unless you try to cancel your subscription.

This is a classic scammy trick: Modify the existing plan and add the feature no one wants and hide the old plan from view. Presto, now you have an insane adoption rate you can present to investors as a great success.

I personally don't use Microsoft subscription services, so I don't know if they tried this bullshit in the EU, but if they did, they're asking for trouble. They got sued in Australia over this already: https://www.accc.gov.au/media-release/microsoft-in-court-for-allegedly-misleading-millions-of-australians-over-microsoft-365-subscriptions "Microsoft in court for allegedly misleading millions of Australians over Microsoft 365 subscriptions"

I would be glad to donate to the #Python project, but doing so requires me to divulge my name and contact information as per their 501(c)(3) charitable organisation status:

"Contact information is required for tax reporting purposes and will be shared only with the US government."

Considering the current status of the US government, I don't feel comfortable doing this. Are there some other ways to donate to Python project without getting the US government involved?

- https://pyfound.blogspot.com/2025/10/NSF-funding-statement.html
- https://psfmember.org/civicrm/contribute/transact/?reset=1&id=2

@ThePSF

A lot of services that are supposedly running in EU are currently having significant issues due to AWS US-EAST-1 being impacted. But surely this is just some dependencies that are down and all our data is really stored in EU. Right?

https://health.aws.amazon.com/health/status

IRC is working just fine. As always.