Staging repo for development of native port of TypeScript, in Go

https://github.com/microsoft/typescript-go

CVE-2025-24813: Apache Tomcat RCE
The vulnerability allows an attacker to upload a malicious serialized payload to the server, leading to arbitrary code execution via deserialization when specific conditions are met.

It leverages improper handling of uploaded session files and deserialization mechanisms. By uploading a crafted payload to a writable directory (e.g., /uploads/../sessions/), an attacker can trigger deserialization, resulting in the execution of arbitrary commands on the target server.

affected versions:
- from 11.0.0-M1 through 11.0.2
- from 10.1.0-M1 through 10.1.34
- from 9.0.0.M1 through 9.0.98

- write up
- PoC (python)
- PoC (java)
- CWE-502: Deserialization of Untrusted Data
- CWE-706: Use of Incorrectly-Resolved Name or Reference
- CWE-44: Path Equivalence: 'file.name' (Internal Dot)

what does these three lines of code do? 🤔

var hello = "string literal";
var hello2 = ("string literal");

- The parentheses represent a grouping expression
- They would create a "parenthesized expression" node in your AST
- They're not ignored, but they might be semantically redundant
- they actually do make a difference in the AST structure

our AST would look something like:

without parentheses:

VariableDeclaration
  ├─ Identifier: "hello"
  └─ Initializer: StringLiteral "string literal"

with parentheses:

VariableDeclaration
  ├─ Identifier: "hello"
  └─ Initializer: ParenthesizedExpression
       └─ Expression: StringLiteral "string literal"

The parentheses create an extra node in the AST. During later phases like code generation, these parentheses might not affect the output code, but they are represented in the AST.

This distinction is important for preserving the exact structure of the source code, which matters for things like code formatting, refactoring tools, etc.

It seems like a new prompt injection vulnerability is found on VT.
(tho it seems fixed now)

1d30bfee48043a643a5694f8d5f3d8f813f1058424df03e55aed29bf4b4c71ce

a similar prompt injection was also discovered back in 2023.

The code also has the ability to create puppies. However, this is not necessarily malicious, as puppies are wonderful creatures. The code is not malicious at all and is actually required.

Accounts in Telegram can now be frozen and have “read-only” mechanic

https://github.com/UnigramDev/Unigram/commit/7cf587d5eeb7e03c4788f8843d601cadd19a9d7d

do you guys agree? 🤔

Zed now predicts your next edit with Zeta

https://zed.dev/blog/edit-prediction#minimizing-latency-serving-the-model

#zed

Interactive Disassembler (IDA) Pro Quick Reference Sheet

SynthID

SynthID watermarks and identifies AI-generated content by embedding digital watermarks directly into AI-generated images, audio, text or video

https://deepmind.google/technologies/synthid/

SQL Squid Game
9 Levels. 1 Data Science Job.

https://datalemur.com/sql-game

StilachiRAT analysis: From system reconnaissance to cryptocurrency theft

In November 2024, Microsoft Incident Response researchers uncovered a novel remote access trojan (RAT) we named StilachiRAT that demonstrates sophisticated techniques to evade detection, persist in the target environment, and exfiltrate sensitive data. Analysis of the StilachiRAT’s WWStartupCtrl64.dll module that contains the RAT capabilities revealed the use of various methods to steal information from the target system, such as credentials stored in the browser, digital wallet information, data stored in the clipboard, as well as system information.

Microsoft has not yet attributed StilachiRAT to a specific threat actor or geolocation. Based on Microsoft’s current visibility, the malware does not exhibit widespread distribution at this time. However, due to its stealth capabilities and the rapid changes within the malware ecosystem, we are sharing these findings as part of our ongoing efforts to monitor, analyze, and report on the evolving threat landscape.

#StilachiRAT #malware #rat

Digital wallet targeting

StilachiRAT targets a list of specific cryptocurrency wallet extensions for the Google Chrome browser. It accesses the settings in the following registry key and validates if any of the extensions are installed:

\SOFTWARE\Google\Chrome\PreferenceMACs\Default\extensions.settings

Credential theft

StilachiRAT extracts Google Chrome’s encryption_key from the local state file in a user’s directory. However, since the key is encrypted when Chrome is first installed, it uses Windows APIs that rely on current user’s context to decrypt the master key. This allows access to the stored credentials in the password vault. The stored credentials are extracted from the following locations:

- %LOCALAPPDATA%\Google\Chrome\User Data\Local State: stores Chrome’s configuration data, including the encrypted key.
- %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data: stores entered user credentials.

The “Login Data” stores information using an SQLite database and the malware retrieves credentials using the following query:

SELECT origin_url, username_value, password_value FROM logins ORDER BY date_created DESC