I hacked the planet - opinions are my own - Mastodon: https://xitter.cf/t.co/FTAelGh7DO
Vienna, Austria
Joined June 2009
- Tweets8.4K
- Following2.6K
- Followers3.4K
- Likes5.1K
Pinned Tweet
Proud to release a new tool called STUNNER to test TURN servers (mostly used in WebRTC). It can open a local socks server and relay all traffic over vuln devices into the internal network
github.com/firefart/stunner
Also found some vulns in Cisco Expressway: firefart.at/post/multiple_vu…
C:\hristian Mehlmauer retweeted
Leaving this here, PHP 8.5.12 security patch is incomplete. ( needs further validation )
Readers added context they thought people might want to know
The PHP 8.5.12 release fixes the two specific CVEs (via state/bailout changes) detailed in official advisories; referenced "surviving paths" (e.g. var_destroy UAF) are separate pre-existing unserialize issues unrelated to this patch.
php.net/archive/2026.p…
github.com/php/php-src/se…
github.com/php/php-src/se…
github.com/dinosn/php-8.5…
C:\hristian Mehlmauer retweeted
‼️ Austrian smart-building firm Loxone confirmed a cyberattack on its internal systems.
A ransom note briefly posted on its own website claimed 201.6GB was "copied and encrypted."
Loxone says the Miniservers in its customers' buildings are not affected.
C:\hristian Mehlmauer retweeted
It seems like someone already knew (xitter.cf/insidedarknet/status/2…). We officially have a date for #BSidesVienna 0x7EB. Safe the date 26.06.2027! Stay tuned for more information. In the meantime you might want to check out the latest episode of Inside Darknet at open.spotify.com/episode/7qH…
I have heard rumours that next year's @BSidesVienna is going to happen on the 26th of June, 2027.
But shhh, don't tell anyone.
C:\hristian Mehlmauer retweeted
UPDATE: I can confirm that the Ledger supply chain is compromised in Europe as well. @Ledger should initiate an immediate product recall to protect users.
I just purchased a second device from a different Mediamarkt location today, recorded the unboxing process, and discovered spyware once again (video linked in the second tweet).
The device was compromised in the exact same manner, featuring identical modifications (such as additional cables and an LTE module). This indicates its a widespread issue rather than an isolated incident, potentially affecting Ledger inventory across MediaMarkt and Saturn stores throughout Europe (comprising over 1,000 stores across 11 countries).
My initial hypothesis was that these devices were returns that looked unopened to the employees and were just sold again as new however, a MediaMarkt employee confirmed that the device I purchased was not a return, and that returned Ledgers are sent directly back to the manufacturer rather than resold.
Store records show the inventory originated from Aqipa GmbH. While Ledger's CTO was unsure if Aqipa serves as the direct distributor between Ledger and MediaMarkt, it appears to be the case. Given that Aqipa distributes across Europe, any physical retail store receiving stock through them may be at risk.
I sent the first ledger to mark and the second one is going to ledger now, so that they can analyse it.
If you purchased a ledger from anyone other than the official ledger store, make sure to check your device!!
C:\hristian Mehlmauer retweeted
I got $90,000 for a RCE in Google.
simonkoeck.com/writeups/goog…
C:\hristian Mehlmauer retweeted
50 legendary internet rabbit holes you can spend hours exploring👇
1. zoom.earth — Watch the world via live satellite imagery
2. flightradar24.com — See every plane currently in the sky
3. marinetraffic.com — Track all ships at sea in real time
4. windy.com — Live map of winds and storms
5. lightningmaps.org — Watch lightning strikes hitting Earth in real time
6. earthquake.usgs.gov — Live list of recent earthquakes
7. submarinecablemap.com — Ocean cables carrying the internet
8. globalforestwatch.org — Watch forests disappear from space
9. worldometers.info — The world's statistics, second by second
10. internetlivestats.com — Current number of tweets and searches being posted
11. thetruesize.com — Compare the true sizes of countries
12. oldmapsonline.org — Maps from centuries ago
13. davidrumsey.com — Archive of 150,000 historical maps
14. openstreetmap.org — World map drawn by volunteers
15. window-swap.com — Look out the window of a random person around the world
16. virtualvacation.us — Virtual walks through cities
17. mapcrunch.com — Teleport to a random spot on Earth
18. atlasobscura.com — Catalog of the world's strangest places
19. neal.fun — Interactive knowledge experiences
20. htwins.net/scale2 — Scale journey from atom to universe (Updated HTML5 link)
21. eyes.nasa.gov — Explore the solar system in 3D
22. stellarium-web.org — Real sky map in your browser
23. apod.nasa.gov — NASA's astronomy picture of the day
24. images.nasa.gov — NASA's entire visual archive, free
25. pudding.cool — Visual articles told through data
26. ourworldindata.org — The state of the world with real data
27. gapminder.org — What we mistakenly think we know about the world
28. informationisbeautiful.net — Visualizing complex data
29. data.worldbank.org — World Bank's open data
30. data.tuik.gov.tr — Turkey's official statistics database
31. archive.org — Archive of millions of books, films, and software
32. gutenberg.org — 70,000 free books whose copyrights have expired
33. openlibrary.org — Record of every book in the world
34. loc.gov — U.S. Library of Congress digital archive
35. europeana.eu — Europe's cultural heritage archive
36. dp.la — America's digital library collection
37. artsandculture.google.com — Tour museums from home
38. rijksmuseum.nl — Download artworks in high resolution
39. wikiart.org — Archive of 250,000 artworks
40. publicdomainreview.org — Forgotten visual treasures of history
41. openculture.com — Free archive of culture and education
42. metmuseum.org — Met Museum's open collection
43. musicmap.info — Family tree of music genres
44. radiooooo.com — Pick a country and decade to listen to that era
45. listen.hatnote.com — Turn Wikipedia edits into audio
46. wikipedia.org — Random knowledge well
47. timeanddate.com — Time, sunrises, and sky events
48. sciencedaily.com — Live stream of science news
49. arxiv.org — Free preprints of scientific papers
50. observablehq.com — Visualize data with live code
Save this. You’ll definitely need some of these later. 🔖
Follow @Amelia_With_Ai for more useful websites, AI tools & tech resources.
C:\hristian Mehlmauer retweeted
All WordPress users need to update their WordPress installations immediately 💯
There is a 9.2 CVE that discloses a remote code execution vulnerability that affects versions all the way back to 2016 😬
Here's the official notice github.com/WordPress/wordpre…
C:\hristian Mehlmauer retweeted
Sponsor Spotlight: We would like to thank the City of Vienna for supporting #BSidesVienna. You can help make the city's digital offerings safer by participating in their public bug bounty program. Find out more at digitales.wien.gv.at/bugboun…. And yes, they even pay out bounties!
ALT A minimalist logo on a white background. On the left is a bright red shield divided into four sections by a white cross, creating a stylized heraldic emblem. To the right of the shield is a thin vertical red line. The remainder of the logo appears in black, but the text is not visible against the dark background in this image. The design is clean and formal, with the red shield serving as the primary visual element and suggesting an official, governmental, or institutional identity.
C:\hristian Mehlmauer retweeted
Attention: someone opened the ticket sale overnight. We are as suprised as you are. Hurry to get a fresh ticket from the first batch!
ALT Bold black glitter-text on an orange square background reading "TICKETS on sale now" with a subtle drop shadow and a thin black speckled border.
C:\hristian Mehlmauer retweeted
It's official: #BSidesVienna 0x7EA will take place on 27 June 2026. The call for papers/workshops will be open soon. Thank you to all the sponsors who have offered their support to make this event possible at such short notice!
ALT Meme: Squirrel stands on its hind legs with front paws raised; text reads, "When you can finally share a secret #BSidesVienna."
C:\hristian Mehlmauer retweeted
The Head of Claude Code at Anthropic said he hasn’t written code by hand in months.
In 2 days he shipped 49 full features. All written 100% by AI.
He just dropped a 30 min talk on exactly how he does it.
Worth more than any $500 vibe coding course. Bookmark it:
Readers added context they thought people might want to know
This is not the head of Claude Code as can be seen in the beginning of the video under his name
This is the head of Claude Code:
anthropic.com/webinars/claud…
C:\hristian Mehlmauer retweeted
Jira and Confluence is badass
They're going to train off your data unless you opt-out by August, 17th
Thank you AI overlords for draining us of literally everything
C:\hristian Mehlmauer retweeted
We're back from our slumber early and have exciting news! If we can secure enough sponsorship, we might be able to hold a #BSidesVienna event in the summer. Consider this your call for sponsors! We only have a few weeks to organize everything. Spread the word and stay tuned!
C:\hristian Mehlmauer retweeted
Quickly enumerate all Microsoft 365 tenant domains, no login, new method > ourcloudnetwork.com/how-to-e… 🥷
I quickly spun up this site, powered by GitHub Pages, backed by a Cloudflare worker, that enumerates all Microsoft 365 domains in a tenant using a new endpoint, after last year's patch by Microsoft. It's simple, free and fast.
#Microsoft #Domains #Security
C:\hristian Mehlmauer retweeted
Worked yesterday and this morning on a real fix for my workaround that's currently the joke of Twitter. If you're interested: github.com/microsoft/node-pt…
Why is pasting into VSCode Terminal slow? Because it sleeps for 5ms every 50 characters.
ALT + // Writing large amounts of data can be corrupted for some reason, after looking into this is + // appears to be a race condition around writing to the FD which may be based on how powerful the + // hardware is. The workaround for this is to space out when large amounts of data is being written + // to the terminal. See https://github.com/microsoft/vscode/issues/38137 + const WRITE_MAX_CHUNK_SIZE = 50; + const WRITE_ INTERVAL_MS = 5; + export class TerminalProcess extends Disposable implements + + + + + + // Queue the next write this. writeTimeout = setTimeout ( () →> { this. writeTimeout = undefined; this._ startWrite(); WRITE_INTERVAL_MS) ;
C:\hristian Mehlmauer retweeted
#BSidesVienna is now live on #HackerTracker (hackertracker.app/). You can use the app to manage your own schedule for not only this event but for many more. hackertracker.app/schedule?c…
C:\hristian Mehlmauer retweeted
Sponsor Spotlight: A big thanks goes out the the city of Vienna (@Stadt_Wien) for supporting #BSidesVienna. Check out their new public bug bounty over at bugcrowd.com/engagements/cit…, they pay out bounties!
