Mitigation:

1. if you are not using any windows vpn (most people don't, really); just disable the service:

Stop-Service -Name "IKEEXT" -Force
Set-Service -Name "IKEEXT" -StartupType Disabled

2. Update and apply the security fix during the April 2026 Patch Tuesday cycle
3. or you can also block inbound traffic on UDP ports 500 and 4500 on your firewall

how to see the network service is actually listening on the target ports
(ports 500 and 4500 are the most common ports used by this service)
you can run this read-only powershell command:

Get-NetUDPEndpoint | Where-Object { $_.LocalPort -eq 500 -or $_.LocalPort -eq 4500 } | Select-Object LocalAddress, LocalPort, @{Name="ProcessName";Expression={(Get-Process -Id $_.OwningProcess).ProcessName}}

If you see an output like this:

LocalAddress LocalPort ProcessName
------------ --------- -----------
::                4500 svchost
::                 500 svchost
0.0.0.0           4500 svchost
0.0.0.0            500 svchost

it means you are probably affected.

Here are the powershell commands to block inbound traffics to these ports: (not readonly; requires admin perm):

New-NetFirewallRule -DisplayName "Block CVE-2026-33824 (Port 500/4500)" -Direction Inbound -Action Block -Protocol UDP -LocalPort 500,4500

Last post about the Minecraft clone running on a custom CPU

GPT-5.6 Sol upgraded the CPU to support 256 KiB of RAM, along with a few other changes

This is about as far as it could push it within Turing Complete’s limits without everything breaking

Posted by Angel 🌼, 17 minutes ago

People asked for DOOM so here's DOOM running on GPT-5.6 Sol's custom CPU, it called it Codex-R32

"The CPU is built from primitive logic components and wires inside Turing Complete. DOOM uses the C-based PureDOOM port, compiled into native RV32IM machine code that runs directly on the custom Codex‑R32 CPU"

Posted by Angel 🌼, 1 hour ago

In powershell:
if you accidentally type $LogPath = "C:\logs" but later write Remove-Item $LogPth\*, normal PowerShell treats $LogPth as null and evaluates the path to \* and attempts to delete your root directory.

Strict mode stops the script instantly on the typo (Set-StrictMode -Version 1.0 (or higher))

Z.ai confirms Ox Alpha is a new GLM-series model and will release its weights
Article, Comments

frontier of the Artificial Analysis Intelligence Index v4.1.1
All 59 models from Artificial Analysis · cost per Intelligence Index task

Re: GLM-5.3-Flash

July 16th: The "Kimi K3 moment" - China has caught up to Opus!

4 weeks later: GLM 5.3 - Same performance, but cut the amount of parameters and cost to a third!

12 days later: GLM 5.3 Flash - Almost GLM5.3 performance but cut the parameters in half, cut prices to a fifth and serving on Chinese chips!

bertili, 1 day ago

We found a preauth rce in @whmcs 9.0.0 to 9.0.6, since this has been already fixed in 9.0.7, I'll drop the details soon.

Posted by azizk, 7 hours ago

sorry, but glm-3.5-flash needs to be steered a lot by a smarter model. and don't get me wrong, i'm really a fan of fast, affordable and smart flash models, but the hype and artificially blowing it up as if it were on the same level as gpt sol or fable just isn't true.

Posted by Kevin Kern, 2 hours ago

tip: if you want to compare games made by different engines listed on Steam (and their stats like Peak, Online, Released, etc):

- Unreal
- Unity
- Godot

click on each column to change the sorting

list of Engines/SDKs/AntiCheats: https://steamdb.info/tech/

* alternative: search filter

A significant amount of Suno AI's source data has been leaked. Upon investigation, it was found that:
Their primary tech stack is MERT25, and they’ve used web crawlers to gather a large amount of YouTube Music content....

Posted by 青龍聖者, 1 hour ago

Tencent has released and open-sourced Tencent Hy4 preview, a next-generation large language model with 770B total parameters and 49B active parameters, and a context window exceeding 1M tokens.

Article, Comments

Privilege escalation from IIS AppPool to NT Authority/SYSTEM

By default, IIS Application Pools (like IIS APPPOOL\DefaultAppPool) operate with a special permission called SeImpersonatePrivilege. This privilege is granted by design so the web server can impersonate connecting clients when needed.

The attack exploits this by targeting a Remote Procedure Call (RPC) endpoint related to AD-CS. If an attacker gains basic access to your web server (for example, through a file upload vulnerability in your website), they get code execution as the low-privileged IIS AppPool user.

They can then use a script to trick the local AD-CS RPC endpoint, which runs as the highest privileged user (NT Authority\SYSTEM), into authenticating back to a fake service controlled by the attacker. Because the IIS AppPool holds SeImpersonatePrivilege, it intercepts that SYSTEM authentication token and applies it to itself. The attacker instantly goes from a restricted web user to complete administrative control over the server. This is a new variation of what the security community calls Potato attacks.


Comments

Proxmox VE 7.x authentication bypass (pre-auth RCE)
Posted by NebuSec, 2 hours ago

PoC: https://gist.github.com/nebusecurity/65fe90dd673d395b7926278d7eaf5849

Proxmox 7 is EOL but still significant

The API login call (POST /api2/json/access/ticket) accepts a 'tfa-challenge' parameter. It carries the signed, half-authenticated TFA challenge ticket that a client receives when logging in as a user with two-factor authentication, and is used to complete the second factor.

In the affected versions, this parameter was not validated for users without configured second factors, while its presence also caused the verification of the submitted password to be skipped entirely. As a result, an attacker with access to the API could authenticate as any existing, enabled user without configured second factors (by default this includes root@pam), without knowing any credentials, by passing an arbitrary value in the 'tfa-challenge' parameter.

Exploitation requires access to the API port (8006), directly or through a reverse proxy.