Kali Linux

Go and donate to dnsmasq to tor to openwrt to wikipedia to vlc.. Some of them you might've already heard of, and some of them you might not even know. But these are the very infrastructure of our world. Have you ever used Wikipedia? probably yes. Have you ever donated them? probably not. If you ever used Youtube, if you ever watched a video on whatever the device you have, you've certainly been involved with ffmpeg. If you ever connected to a router a modem or whatever alike, you have certainly used dnsmasq and there's a high chance you've used openwrt somewhere in the process. So they are already serving you. Why not donating them? by doing so, you're encouraging transparency, and encouraging those who are respecting your privacy, those who are already serving you without even asking for anything in return. So don't throw your money at Adobe subscription, discord nitro telegram premium shit; support those whose work is making a transparent and better future for you, who are already serving you without you even noticing. They are trying to make a better future. So it's like an insurance for your kids, for you, for the future! You're ensuring that you're gonna face less hostile governments, less of those hostile institutions and corporations and platforms, and have more of the better free, open source, transparent platforms and institutions who are not feeding on the last drop of your private data. As our homie 2pac once said: "Don't support the phonies". It is buying the future. Donate to some open source projects of your liking today. Thanks @Kalilinux

No, AI isn’t making you “forget” how to code source @Kalilinux

The Insider, together with Der Spiegel, and Le Monde, has obtained a cache of documents containing previously undisclosed details about the growing military cooperation between Russia and China. Secret documents from a series of clandestine Russian-Chinese military forums reveal a joint plan to defeat Elon Musk’s Starlink and a weapons development partnership far deeper than either country will admit. From air- and missile-defense systems to AI-enhanced drone capabilities, cooperation between Moscow and Beijing is allowing Russian forces to keep pace with Ukrainian innovations while China gains the opportunity to test its wares under combat conditions. The Guangzhou documents include a presentation devoted entirely to countering Starlink. It involves anything from joint legal and diplomatic pressure, to a joint electromagnetic-jamming architecture (“power suppression and adaptive interference”) to selectively block Starlink in chosen geographic areas, merging the two countries’ separate anti-satellite programs into a single system with common technical standards and complementary coverage, to the physical destruction of Musk’s satellite network and raging a full cyber war - "access spoofing, virus infection, and the exploitation of vulnerabilities” to push malware through end-user terminals and propagate it across the network, thereby “paralyzing” it Source: https://theins.press/en/inv/294635 @kalilinux youtube.com/watch?v=dfuuLmDSOLI

🛑 WARNING - A new critical NGINX vulnerability that has existed for 15-years lets unauthenticated attackers crash worker processes with crafted HTTP requests. CVE-2026-42533 affects specific regex map configurations. F5 says it may also allow pre-auth RCE if ASLR is disabled or bypassed. Read how the bug works: https://thehackernews.com/2026/07/critical-nginx-vulnerability-can-crash.html

Linus Torvalds told Linux kernel developers this week that Linux is not one of those anti-AI projects and that AI is now a clearly useful tool. He says AI's usefulness was still arguable a year ago but no longer is, and that the doubters simply haven't used the tools. Nobody is forced to use AI, but he will ignore anyone trying to stop others from using it. Anyone who wants an anti-AI project, he says, can fork the code or walk away. @kalilinux lore.kernel.org/all/CAHk-%3Dwi4zC%2BZe8e%2Bp3tMv8TtG_80KzsZ1syL9anBtmEh5Z40vg@mail.gmail.com

Weeks after the exploit code dropped, Redmond has finally shipped a fix for the Defender zero-day Microsoft has quietly fixed the “RoguePlanet” zero-day in Microsoft Defender, closing the latest hole exposed by security researcher Nightmare Eclipse after months of public sparring over the company's handling of vulnerability reports. According to Nightmare Eclipse, RoguePlanet affects fully patched Windows 10 and Windows 11 devices, allowing attackers to spawn a command prompt with SYSTEM privileges via a Microsoft Defender race condition. "Microsoft has released an update to the Microsoft Malware Protection Engine that addresses the vulnerability identified by CVE-2026-50656. Please see the FAQ for more information on how to check if the new version has been installed," Microsoft noted. Source @kalilinux

AI Hacking and the Critical Shift in Privacy: They now have sophisticated AIs that find bugs in very hardened code bases like the Linux kernel and our other vital infrastructures that are the backbone of our society. They find the bugs in an hour now, they'll soon find them in a minute. And if they couldn't find the 0-day bug, they'll elevate on already known bugs to chain them in a way that was never thought of. They will penetrate and you ain't got no escape! they can ruin your service, make your costumers mad etc. but privacy-wise the question is what you have to offer when they're in? These vicious intruders mainly render the struggle to write safe code, mostly ineffective, it will be just a filtering mechanism to make them burn more juice, not a prevention mechanism which safeguards your code. Consequently, the struggle will shift more and more toward writing optimized code with less to no memory leaks and such. In a threat landscape like this, the database, the way that data is handled or stored is of matter now; so that when the intruders got in, there's nothing left for them to steal. This is not entirely a new concept. The security industry has long believed that advanced hackers will eventually find a way in, and that it is always better to leave nothing behind for them in the first place. The difference is in the pace of it; human hackers get tired, go to sleep, they sometimes let go if it's a tough target, AIs on the other hand are fast, focused, available 24/7 and hyper-logical thinkers when it comes to deep code analysis. This reality emphasizes the absolute necessity of adopting zero-knowledge architectures, deploying post-quantum cryptography, and being far more cautious about our digital choices than ever before. We can no longer afford to build digital fortresses out of paper-thin promises of "unhackable" perimeters. If you are a developer, an architect, or a business leader, the mandate is clear: Assume the breach has already occurred. Stop relying solely on the application layer to protect your users' most sensitive assets. We must collectively pivot to data-centric security models. Enforce zero-knowledge architectures where you hold the data but never the keys. Implement post-quantum cryptographic standards today to protect tomorrow's history. Build systems where a compromised server yields nothing but useless, encrypted noise to an intruder. The AI codebreaking revolution is already here. It is time to stop trying to lock an unlockable door, and start ensuring that when the door swings open, the vault is entirely empty. @kalilinux

A new Linux kernel exploit (CVE-2026-46331) gets root without modifying a single file on disk. It poisons the cached copy of /bin/su in memory. The binary on disk stays untouched. File-integrity checks come back clean. The root shell is already open! thehackernews.com/2026/06/new-linux-pedit-cow-exploit-enables.html @kalilinux

F5 has released security updates to address not just one, but two critical security flaws in #NGINX Open Source that could be exploited to achieve code execution on affected systems. https://thehackernews.com/2026/06/f5-patches-two-critical-nginx-open.html @kalilinux

Here goes nginx-quicburst (CVE-2026-42530), a new RCE in Nginx discovered by Nebula Security's security agent VEGA and demonstrated by them. This is only the third NGINX vulnerability since 2014 to receive NGINX’s “major” severity rating. If you use Nginx 1.31 with QUIC enabled, they recommend upgrading to the latest version. This bug has been patched in the latest Nginx release. They will publish the technical writeup, including the ASLR bypass, on July 18 together with the previous nginx-poolslip writeup. source @kalilinux

AI just took my fucking job source @kalilinux

https://socket.dev/blog/152-chrome-live-wallpaper-extensions-hid-ad-tracking @Kalilinux

https://www.phoronix.com/news/Arch-Linux-AUR-More-Malware @Kalilinux

Over 400 Arch Linux packages compromised to push rootkit, infostealer Attackers hijacked 400+ Arch #Linux AUR packages by taking over abandoned projects and changing their build scripts. The compromised packages are modified with preinstall scripts that download and execute a malicious npm package called atomic-lockfile The payload stole developer secrets, targeted tokens and SSH keys, and could hide with an eBPF rootkit if it ran as root. https://www.bleepingcomputer.com/news/security/over-400-arch-linux-packages-compromised-to-push-rootkit-infostealer/ @Kalilinux

Starting September 2026, a silent update, nonconsensually pushed by Google, will block every #Android app whose developer hasn't registered with #Google, signed their contract, paid up, and handed over government ID. Every app and every device, worldwide, with no opt-out. Please take your time, read the link below and do your part for the community and for the humanity as a whole 🕊 https://keepandroidopen.org @Kalilinux

https://www.bleepingcomputer.com/news/security/new-fragnesia-linux-flaw-lets-attackers-gain-root-privileges @Kalilinux

Dirty Frag, a new copy.fail like vulnerability has been disclosed due to an embargo break Dirty Frag vulnerability class, first discovered and reported by Hyunwoo Kim, can obtain root privileges on major Linux distributions by chaining the xfrm-ESP Page-Cache Write vulnerability and the RxRPC Page-Cache Write vulnerability. Dirty Frag has been tested on the following distribution versions Ubuntu 24.04.4: 6.17.0-23-generic RHEL 10.1: 6.12.0-124.49.1.el10_1.x86_64 openSUSE Tumbleweed: 7.0.2-1-default CentOS Stream 10: 6.12.0-224.el10.x86_64 AlmaLinux 10: 6.12.0-124.52.3.el10_1.x86_64 Fedora 44: 6.19.14-300.fc44.x86_64 ... For detailed technical information and the timeline, see here. @Kalilinux

https://itsfoss.com/news/ubuntu-twitter-compromised @kalilinux

Just recently found out that the Microsoft Edge browser loads all the saved passwords in plain text into memory, even while they're not being used! This made me think again of the world we live in. We must be so desperately alone and of no matter; and it must be a crazy world if its defaults are Edge and alike. "The Car That Watches You Back" is the story of a gradual adaptation to these forms of hostilities for the sake of an advertised "comfort" which is deforming the meaning of the actual word, replacing it with agitation. https://nobodyaskedforthis.lol/posts/connected-car @kalilinux

This week, an emergency update for WHM and cPanel was released to fix a critical authentication bypass flaw that allows attackers to access control panels. Soon after its release, it was reported that the flaw was being actively exploited in the wild as a zero-day, with exploitation attempts dating back to late February. Internet security watchdog Shadowserver now reports that at least 44,000 IP addresses running cPanel have since been compromised in ongoing attacks. https://www.bleepingcomputer.com/news/security/critrical-cpanel-flaw-mass-exploited-in-sorry-ransomware-attacks @kalilinux