I noticed today that my MinIO docker image had been updated and the UI was stripped down to just an object browser. After some digging I found this disgusting PR that removes away all the features in the UI. 110k lines effectively removed and most features including admin functions gone. The discussion around this PR is locked and one of the developers points users to their commercial product instead.

A privilege escalation flaw has been demonstrated in Windows Server 2025 that makes it possible for attackers to compromise any user in Active Directory (AD).

"The attack exploits the delegated Managed Service Account (dMSA) feature that was introduced in Windows Server 2025, works with the default configuration, and is trivial to implement," Akamai security researcher Yuval Gordon said in a report.

A new account type known as delegated Managed Service Account (dMSA) is introduced in Windows Server 2025 that allows migration from a traditional service account to a machine account with managed and fully randomized keys, while disabling original service account passwords. Authentication for dMSA is linked to the device identity, which means that only specified machine identities mapped in Active Directory (AD) can access the account.

.NET 10 Preview 4 introduces file-based apps, allowing direct execution of C# files using dotnet run. This feature streamlines development, especially for beginners, and supports directives, NuGet packages, and cross-platform scripting.

#:package Humanizer@2.14.1

using Humanizer;

var dotNet9Released = DateTimeOffset.Parse("2024-12-03");
var since = DateTimeOffset.Now - dotNet9Released;

Console.WriteLine($"It has been {since.Humanize()} since .NET 9 was released.");

Unauthenticated API Access in vBulletin:
vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025.

Recursive mutex misuse occurs when a thread incorrectly attempts to acquire a recursive mutex multiple times from the same thread without first unlocking it, leading to a deadlock or unexpected behavior.

• A recursive mutex (also known as a reentrant mutex) allows a thread to acquire the same mutex multiple times from the same thread without causing a deadlock.
• Each time the mutex is locked, an internal counter is incremented. The mutex is only released when the counter reaches zero, which happens when the thread unlocks the mutex the same number of times it locked it.

#include <mutex>
#include <iostream>

std::recursive_mutex rmutex;

void unsafe_function() {
    // This function doesn't properly handle the mutex
    // Maybe it was written by another team or uses a C library
    
    // It tries to lock the mutex but doesn't unlock it properly
    rmutex.lock();
    
    // Maybe it throws an exception or returns early
    throw std::runtime_error("Something went wrong!");
    
    // The unlock never happens!
    rmutex.unlock();
}

void normal_function() {
    // Lock the recursive mutex
    rmutex.lock();
    
    std::cout << "Doing some work with the lock held" << std::endl;
    
    try {
        // Call the unsafe function while holding the lock
        unsafe_function();
    } catch (const std::exception& e) {
        std::cout << "Caught exception: " << e.what() << std::endl;
    }
    
    // We think we only need to unlock once, but the unsafe function
    // has left the mutex in an inconsistent state
    rmutex.unlock();
}