Do It by Code

some new updates from Google Chrome that fix some CVEs (mostly sandbox escape in rendering engines):

https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html

CVE-2026-14432
Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-14424
Use after free in Dawn in Google Chrome on Mac prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-14427, CVE-2026-14429, CVE-2026-14419
Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High/Critical)

CVE-2026-14428
Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-14420
Out of bounds read and write in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-14425, CVE-2026-14411
Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-14423
Type Confusion in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

29 viewsedited 02:54

Do It by Code

KDE Plasma Affected By Arbitrary Code Execution To Break Sandboxes With "Open New Window"

A critical arbitrary code execution vulnerability affecting KDE Plasma was disclosed, allowing sandbox escapes via the "Open New Window" action. The exploit, discovered by Kimiblock, lets malicious sandboxed apps execute arbitrary code on the host system. The issue was reported to KDE but remains unpatched, leading to public disclosure after the 90-day embargo. More details and a proof-of-concept are available on the blog.

Phoronix

KDE Plasma Affected By Arbitrary Code Execution To Break Sandboxes With "Open New Window"

A security disclosure has been made public today for a yet-to-be-patched arbitrary code execution vulnerability with the KDE Plasma desktop.

🤓1

25 viewsedited 12:34

Do It by Code

The Qt Company just released official Rust bindings for Qt. 🦀

qtbridge-rust lets you write Qt Quick (QML) UIs with a pure Rust backend, no C++ required.

What this means:
→ QObject, signals, slots, and properties via Rust attribute macros
→ Built on CXX : safe Rust/C++ interop under the hood
→ Tokio integration : async Rust works natively
→ Released directly from the qt org on GitHub

Qt runs everywhere : embedded, automotive, industrial, desktop. That entire ecosystem is now accessible from pure Rust without touching C++.

🔗 http://github.com/qt/qtbridge-rust

#Rust #RustLang #Qt #GUI #Embedded #OpenSource #Automotive #SystemsProgramming

Posted by ayush🔮👨‍💻🔮, 21 hours ago

24 views16:32

Do It by Code

crustc: entirety of `rustc`, translated to C
Article, Comments

GitHub

GitHub - FractalFir/crustc: Entirety of `rustc`, translated to C.

Entirety of `rustc`, translated to C. . Contribute to FractalFir/crustc development by creating an account on GitHub.

30 views16:33

Do It by Code

CVE-2026-14620
webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root, and repeated requests can spawn editor processes and force recompilations that degrade the developer's machine. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: none.

29 viewsedited 18:56

Do It by Code

GPT 5.5 raw CoT achieved at Gnome House

Posted by Sauers, 56 minutes ago

28 views00:55

Do It by Code

BareMetal RAM Dumper – Bare-metal x86 tool for Cold Boot Attack experiments
Article, Comments

This tool was originally developed and successfully tested for experimenting with Cold Boot Attacks. By freezing a laptop's RAM (down to -60°C) and quickly rebooting from a USB drive containing this tool, it is possible to dump the frozen memory contents to the disk before the data decays, allowing for the extraction of sensitive information like encryption keys.

This tool writes raw data directly to the boot drive starting at Sector 64! If you write this to a USB drive containing important data, the RAM dump will overwrite whatever is present at LBA 64 and beyond. Use a dedicated, blank USB flash drive for this purpose.

GitHub

GitHub - pIat0n/BareMetal-RAM-Dumper: A bare-metal x86 utility to dump physical RAM directly to disk. Built and tested for Cold…

A bare-metal x86 utility to dump physical RAM directly to disk. Built and tested for Cold Boot Attack experiments on frozen memory. - pIat0n/BareMetal-RAM-Dumper

28 viewsedited 21:58

Do It by Code

CVE-2026-45045: GoFiber is vulnerable to X-Real-IP Spoofing via Header.Add() call in BalancerForward
Affected versions: <= 2.52.13 and <= 3.2.0

The BalancerForward proxy helper in GoFiber uses Header.Add() instead of Header.Set() when injecting the X-Real-IP header. This appends the real client IP as a second header value rather than replacing any attacker-supplied value. Upstream servers that read the first X-Real-IP header (nginx, Express, most HTTP servers) use the attacker's spoofed IP for logging, rate limiting, and access control.

Data flow:

1. Attacker sends request with X-Real-IP: 10.0.0.1 (spoofed internal IP)
2. BalancerForward handler executes at line 282
3. c.Request().Header.Add("X-Real-IP", c.IP()) APPENDS the real IP as a second header
4. Upstream server receives: X-Real-IP: 10.0.0.1 AND X-Real-IP: <real-attacker-ip>
5. Most HTTP servers (nginx, Node.js, Apache) read the FIRST value
6. Upstream uses 10.0.0.1 for all IP-dependent logic

30 views13:52

Do It by Code

cdc_proof.pdf

317.6 KB

GPT-5.6 Sol Ultra produces proof of the Cycle Double Cover Conjecture [pdf]
Article, Comments

24 views19:23

Do It by Code

Yesterday, we made GPT-5.6 Sol Ultra generally available. Today, we're sharing that it produced a proof of the 50-year-old Cycle Double Cover Conjecture using 64 subagents in just under one hour. We're sharing the prompt and proof below. We're excited to see what you all do with Ultra!

Posted by Ethan Knight, 2 hours ago
see: https://t.me/DoItByCode/1858

29 viewsedited 19:24

Do It by Code

GPT-5.6 Sol overtakes Fable 5 on VoxelBench

the highest scoring model yet with over 1k votes!

Posted by Voxelbench, 7 minutes ago

😱1

34 views16:08

Do It by Code

Microsoft admits Windows 11 has a GDID tracker with no off switch
Article, Comments

Windows Latest

Microsoft admits Windows 11 has a GDID tracker with no off switch, first documented publicly in an FBI hacker complaint

GDID is the persistent Windows ID that helped FBI trace a Scattered Spider hacker despite VPNs. Here's how it works and how to limit it.

37 views01:23

Do It by Code

http://core.telegram.org/bots/serverless

core.telegram.org

Telegram Serverless

Telegram Serverless lets you run backend code for your bot and Mini App directly on Telegram's infrastructure — no servers…

28 views06:05

Do It by Code

Linus jogou a real: AI é útil e vai ser usada no desenvolvimento do kernel Linux, quem achar ruim pode fazer fork e vazar

Posted by Gustavo Noronha, 9 hours ago

source

24 views01:59

Do It by Code

CVE-2026-63030:
WordPress RCE: REST API batch-route confusion and SQL injection issue leading to Remote Code Execution (severity: critical)

WordPress versions 6.9 and higher are vulnerable to a REST API batch-route confusion weakness, which combined with an SQL injection issue (GHSA-fpp7-x2x2-2mjf) leads to Remote Code Execution.

WordPress versions 7.0.2, 6.9.5, and 7.1 beta2 have been released, containing fixes for the vulnerability.
Due to the severity of the vulnerability it is recommended that you update your sites immediately.
Discovered and responsibly disclosed by Adam Kues at Assetnote / Searchlight Cyber.

CVE-2026-60137:
Facilitated SQL injection vulnerability in the author__not_in parameter of WP_Query

WordPress versions 6.8 and higher are vulnerable to an SQL injection issue.
In WordPress versions 6.9 and higher, this combined with a REST API batch-route confusion issue (GHSA-ff9f-jf42-662q) leads to Remote Code Execution.

WordPress versions 7.0.2, 6.9.5, 6.8.6, and 7.1 beta2 have been released, containing fixes for the vulnerability.
Due to the severity of the vulnerability it is recommended that you update your sites immediately.
Discovered and responsibly disclosed as a team by TF1T, dtro, and haongo.

PoCs so far:
- Icex0/wp2shell-poc (no actual rce, pretty useless)
- dinosn/wp2shell-lab
- codeb0ssx/Ultimate-wp2shell

31 viewsedited 00:25

Do It by Code

Cloudflare deployed WAF protections for 2 critical WordPress vulns before public release: unauthenticated RCE + SQLi.

If your WordPress traffic is proxied through Cloudflare, the new rules help reduce exposure while you patch. Fixes are in 7.0.2, with backports to 6.9.5, 6.8.6, and 7.1 Beta 2.

Patch anyway. WAF is not a substitute for updating.

https://cfl.re/4yrOFNH

Posted by Cloudflare, 3 hours ago

32 views00:59

Do It by Code

https://github.com/freebsd/freebsd-src/commit/134a4c78d070f8c4ea43a060a7ae28d22ac39558

GitHub

Retire the GNU subtree · freebsd/freebsd-src@134a4c7

With GNU diff and cdialog gone, this is now an empty shell.

Reviewed by:
markj
Differential Revision:
https://reviews.freebsd.org/D55425

23 views17:33

Do It by Code

https://en.wikipedia.org/wiki/Jacobian_conjecture

hello there the jacobian conjecture is false thanx to my close friend akhil for asking about it and my other close friend fable for working during the world cup final

((1+xy)^3 z + y^2 (1+xy) (4+3xy), y + 3 x (1+xy)^2 z + 3 x y^2 (4+3xy), 2 x - 3 x^2 y - x^3 z): \C^3\to \C^3, has jacobian determinant -2, and sends (0, 0, -1/4), (1, -3/2, 13/2), and (-1, 3/2, 13/2) to (-1/4, 0, 0)

Posted by levent, 1 hour ago

29 views04:12

Do It by Code

1:27

This media is not supported in your browser

VIEW IN TELEGRAM

Last year we announced a partnership with Epic Games to bring Unity to Fortnite - and today, we want to show you where we are.

This is Fantasy Kingdom: a Unity game rendering natively inside @UnrealEngine. Physics, lighting, input: all synchronized between engines🎮👇

🔗 Want to try it out for yourself? Fill out our interest form to be considered for early access: https://on.unity.com/Fortnite_InterestForm

Posted by Unity, 1 hour ago

29 viewsedited 03:56

About

Blog

Apps

Platform