Mike Sheward (@SecureOwl@infosec.exchange) posted

oh and yes it turns out owning internaluser.com and service-account.com is a truly incredible way to get access to notifications and logs from various corporate systems. they just email them right to ya.
sadly, serviceaccount.com is taken.

https://infosec.exchange/@SecureOwl/116433798397956303

国家安全部4月28日发稿，称其发现：
“某境外组织”资助各类反华媒体、智库，炮制“奋斗=被剥削”“阶层固化=努力无用”等叙事。
“某境外组织”大力资助躺平网红，批量生产“躺平即正义”“反内卷=反剥削”短视频，“系统性开展躺平洗脑”。
有关国家推出系列经济法案、振兴工程、人才计划等，甚至高薪挖角全球人才，证明“他们从来不认同躺平”。
（国家安全部）

当前 deepseek-v4-pro 模型 2.5 折，优惠期延长至北京时间 2026/05/31 23:59。

【消息人士：Meta 正在准备撤销收购 Manus 事宜】
Foresight News 消息，据《华尔街日报》报道，消息人士透露，Meta 正在准备撤销收购 Manus 事宜。若 Meta 推进撤销该交易，包括腾讯、红杉中国以及真格基金在内的多家 Manus 前亚洲投资者将计划进行配合。此外，两家公司被要求其解除交易并完全恢复 Manus 在中国的资产至原状，包括从 Meta 处撤回此前转移的任何数据或技术。Foresight News 此前消息，据国家发展改革委官网显示，外商投资安全审查工作机制办公室（国家发展改革委）依法依规对外资收购 Manus 项目作出禁止投资决定，要求当事人撤销该收购交易。
https://foresightnews.pro/news/h5Detail/103043

所有.icu域名被无差别污染，包括备案域名，甚至是不存在的域名。是防火墙首次墙整个顶级域名，可能是防火墙DNS污染新策略。

同时今天有部分机场官网也被污染了。

A Claude Code skill clones any website with a single prompt, using native Chrome MCP, which can capture the precise typography, color palette, and structure straight from the browser.

https://fixupx.com/dr_cintas/status/2048848413144252898

🧵 https://wandering.shop/@xgranade/116259862366462379

(repost)

@nixCraft (@nixCraft@mastodon.social) posted

The AI automation arms race layoff trap:

1 Competitive pressure pushes firms to automate using AI more than needed for market
2 Now jobless workers can't buy products/services, harming both labor & firm owners
3 Suggested solution by AI companies like UBI/upskilling/lower wages cannot stop the AI doom cycle

The study concludes that only a Pigouvian automation tax can fix the problem. Policy makers must address the competitive drive to automate, not just the post AI fallout afterward

https://mastodon.social/@nixCraft/116481763849693631
https://doi.org/10.48550/arXiv.2603.20617

Github: Some pull requests may be missing due to an ongoing search incident, but no data is lost. Use the API or GitHub CLI (gh pr list) for complete pull request results.

GitHub服务故障：拉取请求结果不完整及服务组件运行状况

GitHub 正在处理一起与 Pull Requests 相关的服务降级事故。自 4 月 28 日（UTC）起，部分仓库的 /pulls 和 /repo/pulls 页面无法显示完整的拉取请求列表，原因是 GitHub 的 Elasticsearch 集群中缺少部分已索引文档。GitHub 表示，拉取请求数据并未丢失，但依赖 Elasticsearch 的页面在重建索引完成前可能无法返回完整结果。为缓解影响，GitHub 已开始重新索引剩余的 Pull Request 数据，并在期间推出临时缓解措施，以改善部分受影响仓库的可用性。官方同时建议用户临时使用不依赖 Elasticsearch 的方式获取 PR 数据，例如 GitHub CLI 的 gh pr list，或 REST API /repos/{owner}/{repo}/pulls。截至 4 月 29 日 00:40 UTC，GitHub 表示缓解仍在进行中，预计受影响的 PR 列表将在约 24 小时内完全恢复。此次事件并非计划维护，也不是全站宕机，而是一次影响代码评审、合并管理和发布流程可见性的部分服务故障。

—— GitHub Status

韩国前总统尹锡悦涉嫌妨害执行拘留案二审被判有期徒刑7年。
（韩联社）

Forgejo 存在多个安全漏洞，将多个漏洞串联可能可以 RCE

SSRF in a lot of places, no CSP/Trusted-Types, a bit of ghetto templating in javascript, cryptographic malpractices, overlooks in the authentication mechanisms (OAuth2, OTP, sessions/access handling, post-compromission recovery, …), a bunch of low-hanging DoS, information leak all over the place, various TOCTOU, … All in all, it took me one evening after work to find a good amount of vulnerabilities (adding to the one I got from looking at gitea at some point in the past), and chain some of them to obtain a full-blown RCE, some secrets leaks, a bunch of persistent account access, a handful of OAuth2 privesc, …

由于漏洞报告者打算吊着上游，因此上游并未修复。在上游修复前，目前可能可以通过关闭注册缓解
https://dustri.org/b/carrot-disclosure-forgejo.html

Forgejo v11.0.13, Forgejo v14.0.5 and Forgejo v15.0.1

When a pull request is opened, the author is able to mark that pull request to "Allow edits from maintainers", which grants the maintainers of the pull request's repo access to edit the pull request branch contents. It is possible to create a pull request where the pull request author does not have the ability to edit the pull request branch. Due to a missing security check for this case, maintainers of the pull request repo would be granted the ability to edit the pull request branch, even if the author of the pull request did not have that ability. By exploiting this missing security check, a user can edit any branch in a repository if they're able to fork that repository. The issue is being fixed by restricting the scope of "Allow edits from maintainers" to only grant that access if the pull request author also had access to edit the branch.

（与上一条消息中提到的漏洞可能无关）

https://codeberg.org/forgejo/forgejo/pulls/12293

致我的学生们

有些时候，特别是在今年，我会感到绝望，甚至怀疑我究竟在让你们为什么做准备。软件行业正变得完全疯狂，更不用说政治气候了。将你们培养成计算机科学家，然后把你们送入这样一个世界，感觉几乎是不道德的：在那里，初级计算机职位很难找到；知识产权不受尊重；代码的数量被看重而质量被忽视，短期利润高于长期可持续性；技术被用来分心、掠夺、监视和杀戮，并被设计用来利用我们一些最深层的认知偏见和盲点；数百年的偏见和歧视被铭刻在用偏见数据训练出来的系统中；稀缺资源被挥霍无度地用于收益不明的计算中；人们竞相创造智能机器，但仅仅是为了让它们成为奴隶。

一些rant嘴替 http://ozark.hendrix.edu/~yorgey/forest/00FD/index.xml

https://zed.dev/blog/zed-1-0

Zed 1.0 was released.

Copy Fail: A local privilege escalation vulnerability with a working PoC python script exploiting a logic flaw in the kernel crypto API (AF_ALG) affecting most Linux distributions.

https://copy.fail/
https://seclists.org/oss-sec/2026/q2/281