Notices by Dr. Christopher Kunz (christopherkunz@chaos.social)

OK, this is an innovative directory traversal vuln:
GET /download/resources/jira.webresources:color-picker-popup/images/..::..::..::..::..::WEB-INF::web.xml HTTP/1.1

This is from CVE-2026-21589, https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/

The "::" gets replaced with "/" by some weird sanitation method, read more about it in the writeup.

Tagging @nynbinary for humorous memeing.

Accenture, acting as a contractor for the FBI, allegedly failed to install updates for Oracle Peoplesoft after CVE-2026-35273 was published.

This was a "Missing Authentication for Critical Function" vulnerability and scored 9.8. If this didn't raise any flags, the CISA KEV listing should have. It was an n-day at release.

But no, interestingly enough the FBI is exempt from BOD 26-04 and wasn't even obliged to update?!

Man, if not even federal agencies fix their vulns, this is all pointless.

As it turns out, Aldi-Nord in Germany is offering mini air coolers (you know, like in this article: https://heise.de/-11346708) from tomorrow. Retail price: 12.99 EUR. Essentially the same device is marketed with aggressive ads for prices between 59.99 and 69.99 EUR (prices vary randomly) by shady businesses.
This exact model is available on Alibaba for around 4.50 EUR (minimum order of 5,000) - so Aldi's still turning a profit, but not ripping customers off.
I might even get one.

@psy Too late. I plan to review it though, so it's not a futile private purchase.

@psy Thanks for the advice! However, I'm feeling like you're missing a little bit of context here. I'm investigating these china-made mini coolers for an article. They are sold with a massive ad campaign as "better than AC", and I'm looking into the specifics of the campaign.
This is my first article about the topic: https://heise.de/-11346708

@wdormann @GossiTheDog Is this a typical approach for these kinds of fixes?

@GossiTheDog Who are all those people?

@HistoPol Google wird diese Sorte von reCaptchas nutzen, um Website-Nutzern de facto Vorschriften zu machen, dass sie ein Mobilgerät und sogar welches sie zu besitzen haben: Ein unmodifiziertes Android oder IOS. Noch ist das nicht in der Form scharfgeschaltet, ich bin aber überzeugt: Das wird kommen. https://heise.de/-11288423

@HistoPol Da kann man nichts empfehlen. Wer Captchas blockiert, muss ohne die durch Captchas abgesicherten Dienste auskommen. Allenfalls den Betreibern schreiben und freundlich bitten, andere Lösungen zu erwägen (z.B. PoW-Captchas wie Anubsi), kann helfen.

Ein weiterer Grund, warum man der Google-AI-Zusammenfassung kein Stück vertrauen darf: Sie befindet sich bei der Erkennung von Black Hat AIEO auf dem Stand, den SEO etwa im Jahr 2002 hatte. Exhibit A (2026, koloriert).

Der angebliche Test ist natürlich Spam auf einer Domain, die sonst reichlich Potenzmittel und weiteren Kram "testet".

Way to go, Google. Way to go. *slow clap*

It should be noted that this CAPTCHA seems to work on GrapheneOS.

So it begins.

@soatok Jeez that thread is a trainwreck. I feel genuinely compelled to have ChatGPT write me a three-paragraph summary. Feels like some kind of "flood the zone with shit" approach by certain list members...

Die Innenministerkonferenz will Indymedia komplett verbieten.

Weil wir als Gesellschaft derzeit keine drängenderen Extremismus-Probleme haben.

In 85 Seiten der Beschlusssammlung wird kein einziges Mal das Wort "rechtsextrem" erwähnt.

Die haben im wahrsten Sinne des Wortes die Schüsse nicht gehört. https://www.innenministerkonferenz.de/IMK/DE/termine/to-beschluesse/2026-06-19_DOK/Freie_Beschl%C3%BCsse.pdf?__blob=publicationFile&v=1

@ryanc Congratulations! You are now unwelcome in Las Vegas.

@GossiTheDog Wait, the Zayo, like AS6461 (ex AboveNet) Zayo?

The simplest of all possible modifications to the original RoguePlanet.cpp (literally interchanging two letters in the source code) defeats the detection and re-enables the exploit in current, fully patched Windows 11 with Definition Update 1.453.20.0 installed.

@wdormann https://github.com/0xABCD01/CVE-2026-41089/blob/main/poc.py#L234

@wdormann https://chaos.social/@christopherkunz/116676523296824499

@wdormann This writeup *seems* to make sense, were it not for the magic two letters in the TLD: https://aretiq.ai/research/vul260513-cve-2026-41089-microsoft-windows-netlogon-buildsamlogonresponse-stack-based-buffer-overflow-rce/