NOTE
PHP critical release: defensive telemetry during reported active exploitation
PHP has shipped fixes for CVE-2026-109618 and CVE-2026-109619. What the advisories confirm, where vendor packages stand, and what the YARA rules can and can’t see.
I look at security stuff and write down what it actually does.
Vulnerabilities, malware, threat actors, AI, incident response, and the products allegedly handling all of the above. Sometimes chairs. Maybe some games when I’m bored.
latest writing
THREAT ACTOR
BRITTLE COMPASS
A fake-indie-game delivery cluster that swapped one stealer kit for another behind the same download button.
MALWARE
EXASTEALER 2.0.0: a commercial stealer panel moves in
The third BRITTLE COMPASS build. Command and control moves from a Discord bot to a licensed panel, with a UAC bypass, wallet theft, a SOCKS proxy and a Settings lockout.
MALWARE
MICROSTEALER 1.2.6: a Discord-bot RAT in a game’s clothing
The second BRITTLE COMPASS build. A Java remote access tool that runs its operator’s commands from a Discord server and keeps a ransomware option.
MALWARE
BRITTLE COMPASS 1.2.5: an Electron stealer that rewrites Discord
The first BRITTLE COMPASS build. Asks for admin, steals browsers, wallets and files, and leaves a modified Discord client behind.
OFF-TOPIC
Herman Miller Aeron
It’s a chair. The armrest bolts snap.
OFF-TOPIC
Factorio achievements after cheats
Hex-edit the save, keep the achievements.
There will be technical details and unnecessary opinions. Every so often, more evidence that the computer industry was a mistake and we should all live on farms instead.