News for hackers. Stuff that matters.

1over137

Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 on Saturday October 31, 2026 @10:41PM (#50322270)
If I'm not mistaken, looks like pfSense (based on FreeBSD) firewall rules also block IP Options by default too.
Dream on Guardian!
Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 on Saturday October 31, 2026 @06:58PM (#50321069)
>How are Ubuntu and RHEL not fixed?

IMNSHO this makes them unfit for purpose. I think this is the nail in the coffin for Ubuntu for me.

Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 on Saturday October 31, 2026 @06:33PM (#50320922)
It could be that it is more YOLO not patching this ASAP. Maybe better to risk some regressions.
Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 on Saturday October 31, 2026 @06:29PM (#50320889)
Is there an RTFM for 'pull it manually'?
> I don't display a plate on my generic vehicle

Sovereign citizen?

Re:We should be more ambitious with the software we build on Sunday October 25, 2026 @02:37PM (#50234637)
Crazy. But this is surely only true in mega corps, it’s nothing I’ve ever seen in small orgs.
Is enabling Brotli a worthwhile performance improvement for, say, wordpress site?
Re:GitLab CVSS 10.0 Integer Overflow issue on Wednesday October 21, 2026 @10:19PM (#50190373)
And it's not even written in C! /s
Re:There isn't an easy exploit for this PHP vulnerability on Wednesday October 21, 2026 @10:11PM (#50190322)
>This is absolutely exploitable...

OK, can you share a working one so we can test that our servers are fixed?

Re:Upcoming Critical PHP Security Release on Wednesday October 21, 2026 @12:47PM (#50183930)
FreeBSD ports tree has the updates in their git now.
Re:Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming on Wednesday October 21, 2026 @12:10AM (#50175989)
This seems to work without an X account: https://nitter.app/k_firsov/status/2112641845926989944
Re:Upcoming Critical PHP Security Release on Tuesday October 20, 2026 @11:59PM (#50175930)
"LB"?
Re:Upcoming Critical PHP Security Release on Tuesday October 20, 2026 @11:55PM (#50175909)
Link to videos?
Tailpipe emissions are only half of it. The brake and tyre dust is the second half, and not solved by EVs.
Re:macOS 15.8.2 Breaks OpenGL on Sunday October 18, 2026 @11:59PM (#50148228)
Your bug reports to Apple get closed wontfix, really? Everything I’ve read says most peoples’ reports just sit unanswered forever.
Re:macOS 15.8.2 Breaks OpenGL on Sunday October 18, 2026 @11:49PM (#50148176)
The beachball arrived with OS X. On Classic MacOS it was a watchface.
Re:macOS 15.8.2 Breaks OpenGL on Sunday October 18, 2026 @02:45PM (#50144048)
Especially since sysdiagnose contain so much info, it’s bad opsec to give that info over. Unless you repro in a fresh VM maybe.
Re:macOS 15.8.2 Breaks OpenGL on Sunday October 18, 2026 @12:22PM (#50142470)
WTH. 15.8.1 is current, 15.8.2 ought to be security fixes only.
Re:How do you deal with AI Output of your boss? on Saturday October 17, 2026 @08:43PM (#50136711)
I don't have any advice, but I sure do feel bad for you!
Re:C++26: The New Debugging Header on Friday October 16, 2026 @11:54PM (#50127767)
I wish the C and C++ standards people would go through open source code out there and standardize all the platform-specific things like this case here.
Re:Ask HN: Need Email Deliverability Expert on Tuesday October 13, 2026 @08:28PM (#50080881)
Did you do blacklist (and other) checks with https://mxtoolbox.com/ ?
Re:Triple-A Minesweeper on Saturday October 10, 2026 @12:10PM (#50034289)
Thanks. I guess you have to be a video game player to fully appreciate!
Re:Triple-A Minesweeper on Saturday October 10, 2026 @10:25AM (#50033343)
I guess there's a joke here somewhere? It's minesweeper but annoying?
Re:No new Ghostty updates since March on Wednesday October 07, 2026 @02:37PM (#49997000)
>...that it needs to constantly be getting new releases...

Well, "needs" is strong, but I do like releases, at least if there is good QA done before the release.

Re:Remove and Disable Apple Macos27 AI Models Tool on Tuesday October 06, 2026 @09:16PM (#49986677)
But what macOS doesn't have is an API for an application to query whether it has 'local network' access or not. If it did, Firefox could report a proper error message.

Safari of course get 'local network' access automatically, with no permission asked of the user. Special treatment for Apple's own apps of course.

The US Congress not declaring a war is the normal thing (for the last many decades).
Re:Remove and Disable Apple Macos27 AI Models Tool on Sunday October 04, 2026 @04:25PM (#49957468)
“You wouldn't run a stranger's code without reading it.” Yes I would. We all do it all the time. macOS itself is closed source, and even if it weren't, there’s way too much code to read.
No one is smart enough to write bug free in any language.
Depends. Ontario ice wine is great.

Older »