pamcake

False dichotomy. There are plenty of other possible approaches outside of "having agent swarms randomly breaking in to environments and then marketing their services in the disclosure" and "do nothing".

Admin interfaces should never have been exposed publicly in the first place (and aren't by default). Remote admin over wireguard or sth if you must.

And again I say unto you, It is easier for a camel to go through the eye of a needle, than for a rich man to enter into the kingdom of God.

Matthew 19:24

It's Supercedes Ictus now

Everyone knows that MediaWiki is exploitable. The story running around is exactly that this is generally exploitable even for simple apps serving static content like this.

Heck, I imagine that 1% would still be a total game-changer.

I think a common mistake when approaching MWI is reading too much into it. These Other Worlds "exist" in similar sense to the number i. MWI does _not_ claim anything about there being infinite alternative equivalent planes of existence where these physically manifest or anything like that.

"Brings in everything from: Arc, Dia, Chrome, Safari, Firefox, Brave"

I'm skeptic.

Where is the source code (with licenses and attributions)?

> what you're saying, if I understand correctly, is that self-hosting this is trivial then

Yes. It comes encouraged.

> so does that mean I could run my own local instance and never get it taken down since traffic would be negligible?

Yes, unless the other end forbids it and really cares about controlling clients. If they do and manage to detect that you are using alternative client they could block based on that. In times where that happens and there are client devs who care, it becomes a cat-and-mouse.

Been for a while now.

https://linmob.net/my-setup-with-danctnix-archlinuxarm/ (2021)

much better!

nit: Page is barely readable with dark color scheme because CSS applies dark-light-aware color to text but not to background, resulting in light-gray on white.

> A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.

---

Replaced post title ("CVE-2026-18963") with the more descriptive one of GitHub Security advisory.

https://github.com/advisories/GHSA-4gv3-mc9p-5wqc

https://nvd.nist.gov/vuln/detail/CVE-2026-18963

https://github.com/keycloak/keycloak/issues/51833

https://github.com/keycloak/keycloak/pull/51844

> Our thought process was that we didn't want to recommend that people roll keys when we couldn't possibly confirm that we confidently plugged the breach and rolled the mitigation(s). I am comfortable to publicly say that this was a highly motivated attacker. Meanwhile, our threat team mitigates DDoSes, CVEs, while been patching everything immediately as dealt with exploits.

> As for this breach in particular, we tried to balance a duty to warn, which we take very seriously... However, it took a significant amount of time on the order of hours to verify, reviewing, and keep up with the attacker as they attempted to move laterally around, and briefly, within the system. We didn't want message anything beyond a shadow of a doubt that there were no further exploit paths.

Once you realize there is compromise, you message accordingly, as soon as you are able. If you can't immediately determine exactly what subset of customers were affected, this means you have to tell everyone. Then you provide follow-up updates to fill in gaps as you develop your understanding of scope+impact and work on remediation.

What you should never do is hold off on reaching out to possibly affected stakeholders that they may be affected by a compromise because you still have uncertainties about current status.

A situation like this does not in any way a constitute a dilemma or tough balance regarding when or to whom to do initial disclosure - you do it as soon as you can, to everyone except those you know are not impacted.

More proactive outreach and better coordination with key downstreams.

You mean like this, from last week? Featuring Qwen, GLM, Gemma.

https://www.anthropic.com/research/self-replicating-ai (https://news.ycombinator.com/item?id=50061603)

That's still making the rounds in mainstream news media.

Previously:

- Musk approached Trump to slow down Starlink in Ukraine (https://news.ycombinator.com/item?id=50122371)

- Order to limit Starshield for Ukraine came from inside White House, sources say (https://news.ycombinator.com/item?id=50113477)

- Zelensky says Musk-owned satellite system still restricted in Ukraine (https://news.ycombinator.com/item?id=50136378)

> It works fine on Firefox.

For now... This warning is logged in browser console and devtools for your page:

> XSLT will be removed from this web browser soon. See https://github.com/mozilla/standards-positions/issues/1287

No relation to Proton AG of ProtonMail.

> © 2026 Collaborators Inc.

> All of those where proven harmless for LLM inference.

Could you share link(s) to those proof(s)?

As it should.

https://www.man7.org/linux/man-pages/man1/rsync.1.html#USAGE

What is the "era of ostriches"? Is that a reference to some meme? Would someone explain the meaning?

Compensated by the cost for companies selling those things increasing, pushing them to move markets or close down as they struggle to stay afloat.

And the ripples don't stop there.

Think more platonic hanging out. Hiking, game night, grabbing a drink.

> It also sounds like "many of" these devices will be supported but not by updating ChromeOS, instead by sidegrading to Googlebook OS.

FTFY

This was already the case, at least for the last few decades.

> Proficiency in counting Rs and proficiency in writing code that counts Rs are different and you can fail one and excel at the other it turns out.

That is not the argument. Emphasis added:

> > They matter when implementing the business logic of the application, when writing tests for a character counting function, etc.

Those are all active.

Also: Tor Browser, Konform Browser, Mullvad Browser

Respect for saying it as it is.