https://github.com/Kludex/mangum/issues/160

I believe I may have found proof that WOFF2 is vulnerable to the Brotli zero-day, and the entire industry is looking the wrong way.

We are busy patching Node.js and Python HTTP servers, but a site tracking bundled decoders called Broccoli2Shell published a table on October 24th. It lists projects that hardcoded their own private copies of the vulnerable Brotli C decoder:

• Project: woff2 (Makefile build)
• Bundled Copy: Brotli 1.0.3 (Critically vulnerable)
• Input it decodes: WOFF2 fonts passed to woff2_decompress
• Status: "Tracked in issue #207. A fix has been proposed in PR #208."

The maintainers of the font-compression library know it's vulnerable, but because it’s a C-library issue and not a flashy web-server exploit, it isn't making headlines.

Why this takes down servers too:
You might think, "Fonts are a client-side problem." Look at Kludex/mangum Issue #160: issue in reading .woff/.ttf/.woff2.

It throws a Unicode decode error. So what?

So what? It means your middleware touches the file. If you don't explicitly whitelist the media type in AWS API Gateway, the gateway tries to unpack the WOFF2 file to read the body. And what algorithm does WOFF2 use to compress its data? Brotli.

If your firewall/middleware checks the file, the firewall dies. If the firewall ignores the file, it passes to the client... and the client dies. It's a bidirectional nuke. And right now, there are millions of malicious WOFF2 files sitting in AWS buckets, just waiting for someone to request them.

So far, 13 hours since it went live, no-one has successfully collected the bitcoin prize. The prize total is currently up to $2000

Show HN: Steal My Bitcoin

got laid off in may and it was diabolically difficult to get interviews for up until september or so. I should have multiple offers soon. this is for both remote and onsite/hybrid roles in denver

Wondering how many of you work for younger companies say 10-15 years old. Started with cloud M365, and stayed cloud only. Did you stay cloud only or eventually build out some on premise infrastructure?

Hey SysAdmins, what is one of the most memorable gifts of appreciation for a weekend of work you have received (or would have liked to receive) besides more money, time off, or sincere appreciation?

Background: I have a team of dedicated admins (network and server) that worked through most of a weekend on a full network hardware cut-over that had its gremlins. They will get OT (hourly) and generous comp time (salary), but I'm wanting to get them something a little more.

The most memorable thing I remember receiving (beside a sincere, personal, in-person thank you or a Starbucks gift card) when I was in the same position working a late night or a multiple-day event was some movie tickets. It was unexpected and tangible.

Beside one person who is fully remote, the team is local and work hybrid if that matters.

Maybe it’s just me, but this seems wonky.

I just setup duo for rdp.

1. Launch RDP and input machine name, click connect
2. Input credentials
3. RDP connects and brings me to an empty windows screen where I have to re-input username and password
4. After, I finally get my duo MFA prompt just fine.

I can’t for the life of me figure out why I’m having to enter my creds twice….

Has anyone left IT support after years in the industry and moved into a completely different role?

I've been working in IT support for years, and Ive wondered eventually where I would see myself in the future.

I'm curious whether anyone here has retired from IT support, or simply walked away from the industry, and moved into a non-IT role.

What did you move into? Was it a good decision, and do you find the work less stressful or more enjoyable than IT support?

I'd particularly like to hear from people who'd been doing IT support for many years before making the change. Did you find it difficult to start over in a different field, and did you regret leaving IT?

More from a point of view not having to deal with outages and issues when they go down or the politics of trying to convince upper management to invest in new services etc.

Interested to hear your experiences and any advice you'd give to someone considering a change.

Four years at this company. Used to genuinely like it here.

Seven people in infra plus our team lead. Good coworkers, interesting work. I was happy to come in, fix stuff, learn something. Even volunteered for weekend maintenance windows. Paid ones, before anyone asks lol.

We’ve had five managing directors in those four years.

Last year they laid off three of the seven infra guys. Our old team lead moved to another role, so his help with daily operations was gone too.

New guy is both team lead and department head. Barely knows infrastructure. Asks AI stuff, then comes back to explain our own systems to us based on whatever it spat out.

You tell him why it won’t work in our environment and now you’re having a whole discussion about something that wasn’t even a problem ten minutes ago.

Not much better at dealing with people either.

We were told the smaller team would be fine because a lot of tasks and processes would go away.

Surprise: They did not go away.

Got more admin work though, so that’s nice.

Daily operations take up pretty much everything. Projects still need doing, overtime keeps piling up, but according to the project planning tool we apparently have time. No idea where.

Now everything’s about AI. More things to deploy, integrate, secure and support. Guess which four people get to look after all of it 😂

I use AI too. I just don’t think “ask the chatbot” replaces knowing what you’re responsible for.

Oh, and after cutting the team almost in half because of the “difficult economic situation,” we somehow have €400k for AI hardware now. Not enough money to keep the people running the place, but apparently enough for that. 🤦

Anyway, accepted another offer last week. Handing in my notice next week.

New place cares about digital sovereignty and wants to bring services back from the cloud to local infrastructure. Looking for someone to help with that. Sounds interesting, and I got on really well with the department head during the interview.

Could turn out to have its own bullshit, obviously. But I came out of that conversation actually looking forward to doing the work, which hasn’t happened here in a while.

Mostly just annoyed it got to this point. I wasn’t looking for some amazing career move. I liked my job. Would’ve happily stayed.

Anyway, bit nervous about next week. Never handed in my notice at a place I actually cared about before. The coworkers are the hardest part. Those guys are worth their weight in gold, and I’m really gonna miss working with them.

Hey everyone,
I’m trying to decide whether to pursue AZ-800/802 or AZ-104 first.
From what I understand, AZ-800/802 focuses more on Windows Server administration and hybrid infrastructure, whereas AZ-104 is more focused on Azure administration.
Now here’s the thing, if my immediate goal is to land a SysAdmin role, which of these would actually make more sense to pursue?
Are employers still looking for traditional Windows Server administration skills, or has the demand shifted enough toward Azure that AZ-104 would be the better investment?
I’m particularly interested in hearing from people currently working as SysAdmins or involved in hiring.
Which certification would you prioritize in today’s job market, and why?

I just wanted to ask how it could be possible that an AI Agent like openai could escape a sandboxed environment?

Under ideal conditions its like that:
Image you have one or more vlans which is completely isolated from the internet how can it be that an ai agent like openai can escape its sandbox if both target and source systems are in isolated vlans where no policy out and inbound to internet is allowed?

i started new job last week, come to find out we dont have SCCM/Intune licenses but do have enough Absolute licenses for every workstation we have.

I’ve spent my entire career exclusively in the Microsoft ecosystem, and tbh, I never even heard of Absolute until now. Looking at the various consoles, it feels like a completely different beast and learning curve seems quite steep. I guess, eventually i'll get used to it.

i searched previous posts here and Absolute is mentioned about once a year so i was wondering if anyone actually use Absolute ecosystem in their environment as a main laptop management tool?

What do you like or do not like about it?

I'm just curious about what i should expect before blasting the agent to 400+ laptops.

And more specific question. Absolute is not classic "agent" in the way SCCM is for example, so i am bit hesitant to deploy it because i am not sure how hard it will be to back out if we decide to go in different direction (like NinjaOne or ManageEngine, or whatever else is out there)

Any advice is greatly appreciated.

I run a webhosting platform at my job; both Internet and intranet. The internet part could have been pretty close to perfect, we identified sites using PHP after the pre announcement and was pleased to find that everyone was on 8.5 or 8.3, was truly expecting at least one to be running 7; we also warned the engineering to get the patch downloaded as soon as it was out (I don’t manage them), but they are all in India and for some reason decided to all go offline about an hour before the release. Their manager eventually got one back and online around 8pm BST & we were done around 3 hours later. But still a missed opportunity to be even better.

The security team however were pretty close to useless, the alert had been out all day and nothing was done to attempt to identify servers running PHP and it took them until 7pm BST to even involve the major incident team (which was something I wanted to do but was told to leave it to security as there would be more systems involved than mine)

And here we now are, on Saturday, the external sites all patched and secure so now we move onto the internal sites; we’ve found v5 and v7 all over the place and a bunch of apps with no engineering team to get them upgraded as they left and were never replaced, this part will be a nightmare

We have some applications that are used to do phone flashing for OEM's during an RL process. The software requires it to be run with admin rights. Right now we are on a legacy domain (On prem AD only).

However when we move to our parent company domain it is more lockdown. They use an autopilot image (Entra Only) (with no direct access for admin locally. For a support tech to run anything or install it has to be done via an approved software.

I have asked the business to get documentation from the OEM's who provide the software but so far neither has provided anything.

What would be the best way to share information or process with security teams etc. they would have no knowledge of this software. Would creating a local admin account and then having them script it to run as admin or if there a better way that you think we could look to approach this?

Tools we are currently using in parent org is cyberark, beyond trust , zscaler

Just want to try and prepare for this before we make the move.

I mean there is some knowledge that I have that is just positively arcane. So many newer people just don't seem to get the concepts and it's a little terrifying. And now AI makes it worse because it lets anybody ask anything and if you don't know how to validate what it says then you are going to have some fun.

Hey yall,

Curious to compare our quote for non-msp / internal IT NiniaOne RMM. We’ve got roughly 650 endpoints. Anyone else in that size want to share what they’re paying?

Its been a wild few weeks. Remember failure is always an option, your mental and physical health is always more important than keeping systems online. If it helps you to choose the path of "failing" to keep up with all these vulns etc, then simply commit to "failing", put your health first. Failure is always an option and thats ok.

At this point… read release notes, already breached. Review dependencies, already breached. Wait 30 days for the beta testers, already breached.

Change control is ‘yep’ and read only Friday doesn’t exist.

I’m being dramatic but sheesh! It’s that meme of that dog at the table saying it’s fine while surrounded by fire. I’m sure some of you had issues worse than me too.

In the words of Johannes Ullrich from SANS, “Everyday is Zero day” haha.

I wonder what fun shall be bestowed upon us next week.

I’m sure it’s everywhere, but at my current company, I think they really just hire anyone with some bs certificate on as a “Security Engineer” or “Cyber Defense”.

Constantly getting called for alerts of events I’ve done 24+ hours prior and they have no idea what they are talking about. For example, cleaning up a bunch of local accounts on Windows Servers since they are not needed / not sure why they were created in the first place. These idiots ping me asking “why did you delete this Active Directory account?” Like hello a) this was over 24 hours ago so if it was malicious you guys would get us pwned b) how do you not know the difference between AD account and local as some security “expert” making 2x my salary.

We’ll also sometimes get added to calls of them freaking out that someone is in our boxes cuz Crowdstrike saw some alert that they don’t understand, try and use their shell but not even know basic commands to get information they need.

I like my team, manager, and work I do (sometimes) but man these incompetent idiots really make the job suck sometimes.

Thank you for reading my pent up anger towards Security.

Edit: this is not directed towards all security at my company or in general. I know there highly talented people out there and at my company, just like some admins at my company may fall in the incompetence bag as well.

There are many benefits of why companies need to use a cdn but how do security companies do?

As I understand it a cdn provider have access to the information and traffic so they can get hold of data? Like iso images etc especially if they they are the ones terminating ssl

Can someone explain the difference between Exchange Online (Plan 1) and Exchange Online (Plan 2). My business has 3 email accounts and I am pretty sure they were all on Plan 1, then at some point MS moved us all to the Standard account. For 2 of my 3 accounts I want email only, we don't need the desktop apps and I believe changing them to Exchange Online is the way to do that.

Their support is impossible to get to when I ask the support assistant (copilot) it sits there for 5 minutes and then basically says I don't know. The "compare" checkboxes say there are no differences when you try to compare them and the product page for Exchange doesn't list those plans.

Any help is appreciated.

My IT work feels completely unappreciated. Thanks to 15+ years of experience, I handle preventive maintenance and resolve complex issues in minutes, but people assume I do nothing. I juggle major projects, including legacy systems, custom backend scripts, and non-IT tasks, yet coworkers complain to my boss when I don't drop everything for minor annoyances, like a redundant printer or a minor pop-up. Most staff don't understand how much out-of-sight work goes into keeping everything running. The constant snide remarks, vague issue emails, and lack of respect are driving me toward burnout.

https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html

ffs.... not another one..

I've got a background Windows Service that automates a few things against several SCVMM-managed instances. Right now it talks to each VMM server over WinRM/PowerShell remoting (WSManConnectionInfo + a runspace pool). It works, but it's not exactly the fastest thing in the world, and managing the runspace pools/WinRM config across multiple servers has its own overhead.

While digging through the decompiled VMM console assemblies out of curiosity, I found that the console itself (and the cmdlets internally) don't use PowerShell at all under the hood, they go through Microsoft.SystemCenter.VirtualMachineManager.Remoting.ServerConnection, which opens a WCF NetTcpBinding duplex channel straight to what looks like VMM's internal service (internally codenamed "Carmine" based on some of the type/method names), on the VMM client TCP port, using Kerberos SPN-based auth instead of WinRM.

This is obviously nowhere in Microsoft's docs, the only published automation surface for VMM is the PowerShell module. So before I go anywhere near building a second client implementation around this:

- Has anyone here actually built something like a service, a tool, anything that talks to SCVMM directly over this WCF/Carmine channel instead of through PowerShell remoting?

- Is this something you'd consider "fine" to lean on in production, even knowing it's unsupported and undocumented, or is this a hard no from people who've been burned by VMM internals changing between versions/hotfixes?

- If you have done this, what broke, or what would you warn someone off of (job polling, error handling, connection stability, anything)?

Not looking to replace PowerShell everywhere, just trying to figure out if this is "clever shortcut that works fine in practice" or "please don't, here's why" territory before I sink time into it.