Regor Tegruob

It feels like Raspberry Pi all over again with Grok Bot. 80-90% of most people’s usage would be better offloaded to a $2/mo VM running a few python scripts on recurring cron jobs. But it’s cheap(ish) and exponentially more easy to have AI do it. If you want to blink an LED, all you need is 1 capacitor, 1 resistor, and 1 transistor. Maybe you want to get fancy and throw 500,000 transistors (CPU & Ram) at it with a microcontroller (Arduino, etc). But that feels difficult to most people. So… You can get a raspberry pi to do it. 30,000,000,000 transistors. It’s a full computer running an OS that feels familiar, so now it’s really easy to blink that LED. The Pi feels like such a waste for a lot of projects when you know how to accomplish it with way less. But the Pi makes its much easier, and that means way more people get into them.

Huge thanks to our sponsor this week, @intruder_io ! @intruder_io built a zero-day vending machine: AI tokens in, zero-days out. First find: a multi-step blind SQLi in a WordPress plugin with 300k+ installs. Fully automated from discovery through exploitation, no human in the loop. More are already going through disclosure. Full breakdown: intruder.io/research/a-0-day…

🚨 UPDATE: 19 MILLION exposed NGINX instances hit by the 18-year-old NGINX RCE found by AI. Top exposure by country: - United States: 5,340,011 - China: 2,540,008 - Germany: 1,871,780 Note on ASLR as added security: not all of these instances will have ASLR disabled, but every one of them is running a version inside the vulnerable band. The vulnerability is a heap buffer overflow. ASLR randomizes memory layout, which makes reliable RCE much harder because the attacker cannot predict where their payload or useful gadgets land. But the overflow itself still happens. The corrupted memory still causes the NGINX worker process to crash. ASLR-enabled hosts are still trivially DoS-able. ASLR-disabled or non-PIE builds are RCE-able. Either way, patch ASAP!

❗️🚨 Microsoft Edge keeps every saved password in process memory as cleartext from the moment it launches. Microsoft's responsed when reported: "by design." All of them. Including credentials for sites you won't open this session. Researcher @L1v1ng0ffTh3L4N tested every major Chromium browser. Edge is the only one that behaves this way. Chrome decrypts credentials on demand, and App-Bound Encryption locks the keys to an authenticated Chrome process so other processes can't reuse them. In Chrome, plaintext surfaces only during autofill or when a password is viewed, making memory scraping far less useful. What makes this extra weird is that Edge still demands re-authentication before revealing those passwords in its Password Manager UI, while the same browser process already holds every one of them in plaintext. In shared environments, this turns into a credential harvest. On a terminal server, an attacker with admin rights can read the memory of every logged-on user process. In the published PoC video, a compromised admin account lifts stored credentials from two other logged-on (and even disconnected) users with Edge running. Microsoft's official response when notified: "by design." The finding was disclosed April 29 at BigBiteOfTech by PaloAltoNtwks Norway, alongside a small educational tool that lets anyone verify the cleartext storage for themselves.