Dejavu's Blog
做了个跨平台 S3兼容存储管理客户端🤓 震惊瘫坐，仿佛看到原子弹爆炸 许愿式编程 像我这种对编程一窍不通的人，一天时间完成了 C3 Bwoser 的所有 Pro 功能的复刻 当软件没有护城河以后……🌚
Pail
Pail · Desktop client for S3-compatible storage
Pail is a free, open-source desktop app for Amazon S3, Cloudflare R2, MinIO and other S3-compatible storage, for Windows, macOS and Linux.
❤1🥰1
Forwarded from HAT's Public Channel |
TL;DR: 前人的💩山在自动挖洞 AI Agent 井喷时代终于彻底爆炸了，这些神人 CA 私钥的有效位只有 1Byte
*记得 ban 掉这些 rootCA，Comodo AAA Services root 现在的名字叫做 “Sectigo”，全球最大的廉价商业 SSL 证书上游之一
https://www.heise.de/news/Vorfall-bei-Zertifizierungsstelle-eMudhra-Acht-CA-Zertifikate-kompromittiert-11494412.html
Comodo AAA Services root
emSign ECC Root CA - G3
emSign Root CA - C1
emSign ECC Root CA - C3
*记得 ban 掉这些 rootCA，Comodo AAA Services root 现在的名字叫做 “Sectigo”，全球最大的廉价商业 SSL 证书上游之一
测试你的环境是否已屏蔽受影响 rootCA:
https://emudhra.we-have-a-problem.com/
或手动访问：
https://dv-g3b-emudhra.we-have-a-problem.com/
https://dv-g3c-emudhra.we-have-a-problem.com/
https://ov-g3b-emudhra.we-have-a-problem.com/
https://ov-g3c-emudhra.we-have-a-problem.com/
https://ev-g3b-emudhra.we-have-a-problem.com/
https://ev-g3c-emudhra.we-have-a-problem.com/
https://dv-g3b-aaa-emudhra.we-have-a-problem.com/
https://dv-g3c-aaa-emudhra.we-have-a-problem.com/
https://ov-g3b-aaa-emudhra.we-have-a-problem.com/
https://ov-g3c-aaa-emudhra.we-have-a-problem.com/
https://ev-g3b-aaa-emudhra.we-have-a-problem.com/
https://ev-g3c-aaa-emudhra.we-have-a-problem.com/
https://www.heise.de/news/Vorfall-bei-Zertifizierungsstelle-eMudhra-Acht-CA-Zertifikate-kompromittiert-11494412.html
Security
CA-Zertifikate gesperrt: Sicherheitsvorfall bei Zertifizierungsstelle eMudhra
Die privaten Schlüssel waren trivial einfach zu raten; einer lautete „4“. Mit ihnen konnten Angreifer gültige TLS-Zertifikate für beliebige Domains ausstellen.
❤1
Dejavu's Blog
如果你用 Go 写应用，可以试试 低空飞行 的 mygo，它用于在 Go 中开发带有原生界面或网页前端的桌面应用 内存占用 Amazing! https://github.com/egoist/mygo
GitHub
Release v0.6.0 · egoist/mygo
MyGo 0.6.0
Native UI is much faster:
windows redraw only what changed, on Metal, Direct3D 11, OpenGL and WebGL;
layout redoes only what changed;
windows out of sight draw nothing.
There is a new ...
Native UI is much faster:
windows redraw only what changed, on Metal, Direct3D 11, OpenGL and WebGL;
layout redoes only what changed;
windows out of sight draw nothing.
There is a new ...
Dejavu's Blog
https://github.com/egoist/mygo/releases/tag/v0.6.0
GitHub
Release Pail v0.3.0 · DejavuMoe/Pail
English
Added
While tasks are queued or running, the taskbar button on Windows (the Dock icon on macOS) shows their combined progress.
Changed
Each notch of the mouse wheel now scrolls smoothly ...
Added
While tasks are queued or running, the taskbar button on Windows (the Dock icon on macOS) shows their combined progress.
Changed
Each notch of the mouse wheel now scrolls smoothly ...
Forwarded from 层叠 - The Cascading
🔴 更新完 PHP 先别睡！LiteLLM 又被骇，用户数据又可能泄漏。
受影响版本是 1.107.0。 PyPI 已经撤包。
- twitter.com/SocketSecurity/~
- gh:BerriAI/litellm#47826
- safedep.io/~
thread: /4832
#Security #LiteLLM #SupplyChain
受影响版本是 1.107.0。 PyPI 已经撤包。
- twitter.com/SocketSecurity/~
- gh:BerriAI/litellm#47826
- safedep.io/~
thread: /4832
#Security #LiteLLM #SupplyChain
X (formerly Twitter)
Socket (@SocketSecurity) on X
🚨 LiteLLM, a Python package for connecting to AI model providers with 92M+ monthly downloads, has been compromised.
Version 1.107.0 ships credential-stealing malware through PyPI wheels and Dock…
Version 1.107.0 ships credential-stealing malware through PyPI wheels and Dock…
Forwarded from HAT's Public Channel |
Please open Telegram to view this post
VIEW IN TELEGRAM
Java 全线存在 TLS 证书信任漏洞，CVSS 9.1，可远程无凭据利用
CVE-2026-91403，位于 JSSE 组件。由于8 张中间 CA 证书泄露，该批证书已内置于 JDK 信任库，攻击者可利用其签发任意域名的有效证书，实施证书伪造与中间人攻击。非远程代码执行，影响限于机密性与完整性。
11.0.33、17.0.21、21.0.13、25.0.5、27.0.1 及 GraalVM。OpenJDK 8/11/17/21/25/27 均受影响，OpenJFX 不受影响。修复版本为 8u512 及各版本线后续更新。
处置以升级为主。无法升级时用官方 blocked.certs 覆盖 $JDK_HOME/lib/security/blocked.certs，JDK 8 对应文件为 blacklisted.certs。发行版提供的 OpenJDK 依赖系统证书库，更新系统证书即可；FreeBSD 与 Homebrew 需直接升级 JDK。
src: https://openjdk.org/groups/vulnerability/advisories/2026-10-21
CVE-2026-91403，位于 JSSE 组件。由于8 张中间 CA 证书泄露，该批证书已内置于 JDK 信任库，攻击者可利用其签发任意域名的有效证书，实施证书伪造与中间人攻击。非远程代码执行，影响限于机密性与完整性。
11.0.33、17.0.21、21.0.13、25.0.5、27.0.1 及 GraalVM。OpenJDK 8/11/17/21/25/27 均受影响，OpenJFX 不受影响。修复版本为 8u512 及各版本线后续更新。
处置以升级为主。无法升级时用官方 blocked.certs 覆盖 $JDK_HOME/lib/security/blocked.certs，JDK 8 对应文件为 blacklisted.certs。发行版提供的 OpenJDK 依赖系统证书库，更新系统证书即可；FreeBSD 与 Homebrew 需直接升级 JDK。
src: https://openjdk.org/groups/vulnerability/advisories/2026-10-21