Telerik UI 취약점을 악용한 웹쉘 설치 및 스캐너 실행 공격 사례

Multiple attack campaigns exploiting CVE-2019-18935, a remote code execution vulnerability in unpatched Telerik UI for ASP.NET AJAX servers, have been identified. The first case involved exploiting the vulnerability to execute a reverse shell connecting to 206.82.6.22, attempting privilege escalation using Potato-family tools like SweetPotato, and installing a Godzilla-style memory-based web shell that operates within the w3wp.exe process without requiring separate ASPX files. The second case deployed a Rust-based scanner tool that searches for exposed WordPress installation pages across target systems and reports findings via Telegram. Both attacks targeted Windows IIS servers, enabling attackers to maintain persistent access, collect system information, and identify additional targets for future campaigns.

Pulse ID: 6aba1398c736673eae22c865
Pulse Link: https://otx.alienvault.com/pulse/6aba1398c736673eae22c865
Pulse Author: AlienVault
Created: 2026-09-28 07:13:28

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CVE201918935 #NET #RCE #Rust #OTX #AlienVault

PaintFE: editor di immagini open source ultra-veloce che sfida Photoshop
#OpenSource #SoftwareLibero #GraphicDesign #Rust #Tech #Fotoritocco #Privacy #Linux #AlternativeSoftware @computer @opensource

https://webappsmagazine.blogspot.com/2026/09/paintfe-editor-di-immagini-open-source.html

Syncing Rust GCC backend or how to test Murphy's law via @fanf https://lobste.rs/s/hy7ckt #rust
https://blog.guillaume-gomez.fr/articles/2026-09-22+Syncing+Rust+GCC+backend+or+how+to+test+Murphy%27s+law

Dropping Swift entirely from our Bevy iOS crates https://lobste.rs/s/nmksyw #release #rust
https://rustunit.com/blog/2026/09-04-bevy-ios-crates-objc2/

https://tako8ki.com/posts/looking-for-a-new-role/
#Rust #Rustlang #FediHire

Rusty thoughts on "Parse, don't validate" https://lobste.rs/s/uvmajz #programming #rust
https://eli.thegreenplace.net/2026/rusty-thoughts-on-parse-dont-validate/

Industrial ruins, a delightful mixture of shapes and shadows. Some look like faces; some look like animals. What shapes and forms does your unique imagination see in these scenes?

#Photography #Ruins #Industry #Abandoned #Rust #Urbex #UrbanExploration

Alt...

Abandoned industrial machinery viewed through a broken window. A large blue engine and turbine sit in a decaying brick building.

Alt...

An abandoned Sinter Plant at Cockerill-Sambre-Ougree Ironworks, featuring a massive, triangular suction fan and decaying industrial structures.

Alt...

A wide view of a severely rusted, abandoned industrial interior features a large circular boiler and thick pipes on a metal grating floor.

Alt...

An atmospheric interior shot of an industrial space with a large fan letting light in, casting shadows on the grate floor.

If you're intrigued by what kind of tweaks rustc gets on the regular, here's a small thing that should aid in reading some diagnostics. Some time back I discussed with @muscraft that I've wanted a way to ensure some code appears in diagnostics, but not underline them, because they are useful context but unrelated to the problem. Over time, he proceeded to implement that feature in annotate-snippets-rs *and* migrate rustc to use that crate (closing a ton of tickets for incorrect rendering or inconsistencies, the current codebase for that crate is much better than rustc's ever was). So now that we have that new toy, I've been going around using it! And if I may say so myself, I think it works great:

https://github.com/rust-lang/rust/pull/163383

#Rust #RustLang

This Week's Project Spotlight 🦀

RustCrypto
It contains various utility crates used in the RustCrypto project.

It uses a portable pure Rust implementation that works everywhere, even WASM!

#rustlang #rust

RT @dhh: Ich habe die Screensaver-Engine Omarchy (ttfx) von Rust nach x86-64-Assembler portiert, und sie ist bis zu 17x schneller!! Einmalige Übersetzung mit Opus 5.5. Wir bohren weiter, bis der agentic Bohrhammer das Grundgestein erreicht! https://t.co/SFJXcquMip https://t.co/ZpsAJS7vvl

mehr auf Arint.info

#Assembler #Omarchy #Opus5 #Performance #Rust #x86 #arint_info

https://x.com/dhh/status/2103595410921279635

RT @dhh: Ich habe die Screensaver-Engine Omarchy (ttfx) von Rust nach x86-64-Assembler portiert, und sie ist bis zu 17x schneller!! Einmalige Übersetzung mit Opus 5.5. Wir bohren weiter, bis der agentic Bohrhammer das Grundgestein erreicht! https://t.co/SFJXcquMip https://t.co/ZpsAJS7vvl

mehr auf Arint.info

#Assembler #Omarchy #Opus5 #Performance #Rust #x86 #arint_info

https://x.com/dhh/status/2103595410921279635

The state of SIMD in Rust in 2026 https://lobste.rs/s/iotaty #rust
https://shnatsel.github.io/state-of-simd-rust-2026/

Is your company currently hiring for a role that includes using Rust?

Reply with a link to the opening and any relevant context.

If you're not, we'd appreciate a repost for visibility

#rust #rustlang #programming

Rust statt Ruby – Rails-Gründer Hanssons neues Projekt

Ruby-on-Rails-Erfinder David Heinemeier Hansson (DHH) verzichtet in seinem neuesten Projekt auf Rails und löst damit Unruhe in der Community aus.

https://www.heise.de/news/Rust-statt-Ruby-Rails-Gruender-Hanssons-neues-Projekt-11465387.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#IT #Linux #Programmiersprachen #Ruby #Rust #Softwareentwicklung #news

Rust instead of Ruby – Rails founder Hansson’s new project

Ruby on Rails creator David Heinemeier Hansson (DHH) is foregoing Rails in his latest project, causing unrest in the community.

https://www.heise.de/en/news/Rust-instead-of-Ruby-Rails-founder-Hansson-s-new-project-11465884.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#IT #Linux #Programmiersprachen #Ruby #Rust #Softwareentwicklung #news

“This former Google engineer has endeavoured to turn #Rust into a library that other languages can build from, demonstrating a way to pass generic #DataTypes and #functions between Rust and another language, an action the C #ABI doesn’t support.”

#RustLang / #EvanOvadia / #ElReg <https://theregister.com/devops/2026/09/25/valen-creator-drives-golden-spike-to-connect-new-languages-with-rust/5299273>

A Type Stronger than the Sum of its Components https://lobste.rs/s/tasulj #rust
https://www.schneems.com/2026/09/24/a-type-stronger-than-the-sum-of-its-components/

Ok what's up with all the vibe coders using #Rust for like everything?

This Month in Redox - August 2026 https://lobste.rs/s/kc8t26 #osdev #rust
https://www.redox-os.org/news/this-month-260831/

Linux developer who used AI to fix bottlenecks that caused problems when building the kernel says the LLM generated a lot of "hideous" code

https://www.linux-magazine.com/Online/News/AI-Fixes-Linux-Bottlenecks-Using-Hideous-Code?utm_source=mlm

#AI #LLM #kernel #Linux #code #patch #Rust

Alt...

Linux Magazine News

----------------

🛠️ Tool
===================

Trail of Bits released coop, a Rust CLI that manages disposable, isolated virtual machines for running Claude Code and Codex with full tool access. Each VM gets Docker, git, compilers, and package managers without risking the host machine.

🔹 Key Features
• Isolation: Each VM is sandboxed from the host, so an agent running rm -rf / stays inside the VM.
• Reproducibility: VMs are built from a template image, making environments consistent across runs.
• Disposable: Creating and destroying VMs is cheap and fast.
• Backend support: Uses Firecracker on Linux (installed automatically during coop setup) and Lima on macOS (must be pre-installed via brew install lima).

🔹 Technical Implementation

The tool is written in Rust and distributed as a binary plus a companion coop-proxy. Building from source requires Rust (via rustup) and CMake. The coop setup command builds the VM template image and, on Linux, fetches a guest kernel.

🔹 Usage

Basic workflow:

cd ~/code/my-project
coop up
coop claude

🔹 or

coop codex

The tool also supports multi-instance setups, editor integration, and workspace sync between host and VM.

🔹 Platform Support
• Tested: macOS arm64 (Apple Silicon), Linux x86_64
• Available but untested: Linux arm64
• macOS setup fails without Lima pre-installed

🔹 Limitations

The arm64 Linux build exists but is untested by the developers. The trust model and architecture are documented in the repo, but the tool is relatively new. Haven't tested personally.

🔹 References

Documentation covers configuration, images and profiles, workspace sync, Claude Code and Codex integration, editor integration, and platform backends. Architecture and trust model docs are included.

🔹 tool #coop #TrailOfBits #Rust #AI

🔗 Source: https://github.com/trailofbits/coop

This Week in Security: FBI Gets Hacked, Muse Vulnerable to ClickFix, Popular Rust Developers at Risk, Attacking the RP2350, and New Attacks Against RSA https://hackaday.com/2026/09/25/this-week-in-security-fbi-gets-hacked-muse-vulnerable-to-clickfix-popular-rust-developers-at-risk-attacking-the-rp2350-and-new-attacks-against-rsa/
#HackadayColumns #SecurityHacks #Clickfix #Fbi #Lasers #Muse #Rpi2350 #Rsa #Rust #Shinyhunters #Supplychain

All those employment finding sites are just shitty resume mills showing the same (or fake) postings. Even freelancer.

IHireTechnology’s #resume customizer is a joke so I started knocking out my own in python (prototype) and am now building clean in #rust.

What:
Locally generate custom ATS relevant resumes from the dataset of your own work experience and job posting details (copy/paste the job posting).

Cost:
Donate if you want. Not paying them to fuck us all is enough.💕

#SuitUp #ComingSoon

It's Friday again, so it's time for another update on the work on Diesel, a ORM and query-builder for Rust.

This week I released diesel-full-text-search 2.3.1 fixing a potential unbound allocation while deserializing a malformed buffer from the database.

I also released pq-sys 0.7.6 and pq-src 0.3.12/13 to fix copying the right bindings file for builds using *-pc-windows-gnu targets and to bump the bundled libpq version to 18.6.

See the release announcement for more details:

https://github.com/diesel-rs/diesel_full_text_search/releases/tag/v2.3.1
https://github.com/sgrif/pq-sys/releases/tag/v0.7.6

This week we received two new bug reports and 17 new PR's.

#rust #rustlang

So I noted that topcoat is being reported on quite a bit. From my understanding that crate is fully vibecoded. Stay away if you at all care about what you are building your project on #rust #noai #nollm

Topcoat is pushing the boundary of server applications with Rust https://lobste.rs/s/hvatmp #rust #vibecoding
https://tokio.rs/blog/2026-09-24-topcoat-server-applications

so I had a quick look on Rust web frameworks, trying to see if there really are no non-slopped crates out there. I found this thing:

https://github.com/ohkami-rs/ohkami

While it doesn't appear to have an LLM-policy the commit history looks clean and there are no artifacts such as AGENTS.MD or a skills folder in the repo. The naming of the crate and components aside, does anyone have any experience using it?

#rust #nollm #noai

Reltio is hiring Principal Architect-Platform

🔧 #golang #java #python #rust #scala #api #aws #azure #cicd #druid #elasticsearch #gcp #kafka #kubernetes #nosql #principalengineer #solutionsarchitect
🌎 United States
⏰ Full-time
🏢 Reltio

Job details https://jobsfordevelopers.com/jobs/principal-architect-platform-at-reltio-com-jun-22-2026-815002?utm_source=mastodon.world&utm_medium=social&utm_campaign=posting
#jobalert #jobsearch #hiring

Syncing Rust GCC backend or how to test Murphy's law https://lobste.rs/s/eryeed #rust
https://blog.guillaume-gomez.fr/articles/2026-09-22+Syncing+Rust+GCC+backend+or+how+to+test+Murphy's+law

Pencils Down, Eyes Open: A Rails Developer After Rails World https://lobste.rs/s/jiv1c5 #ruby #rust #vibecoding
https://caio.ca/blog/pencils-down-eyes-open-rails-world

Rust

#photography #plants #nature #rust #pentax

Alt...

A close upimage of a bright green leaf with holes in it seen next to a red rusting wagon wheel.

We Have Named Arguments at Home https://lobste.rs/s/4cbau4 #rust
https://corrode.dev/blog/named-arguments-at-home/

Tiny touchscreen drawing app w/ @ratatui_rs 🐁

Running bare-metal Rust on an ESP32-S3 🦀

#rust #embedded #ratatui #esp32

100 Exercises to Learn Rust, Updated
#RustLang #Rust #Learningcourses #Rustrover #Jetbrainsacademy #Learnrust #Plugin #Rustcourse

https://blog.jetbrains.com/rust/2026/09/23/100-exercises-to-learn-rust/

GitHub Actions leaking secrets when Miri output is cached https://lobste.rs/s/acz9kk #rust #security
https://blog.rust-lang.org/2026/09/21/github-actions-leaking-secrets-when-miri-output-is-cached/

Awesome Links Of Last Week 🧵

Check thread below 👇

#rustlang #rust

Writing Rust code that's faster than state-of-the-art libraries by asking agents to make the code faster https://lobste.rs/s/bg9j71 #rust #vibecoding
https://minimaxir.com/2026/09/agentic-iteration/

#photography #moss #rust #pentax #textureTuesday

Alt...

Yellow and white moss is seen growing on this close image of a rust covered wall of metal.

Neovim & Rust installieren - Ein Leitfaden für Manjaro

hyperblog.de/hoergen/posts/202…
#demhoergen #hyperblog #neovim #rust #manjaro #linux #installation #rustup

Wie ich Neovim und Rust unter Manjaro installiere - von den Paketquellen über Rustup bis zur Einrichtung der Entwicklungswerkzeuge. Mit Installationsscript - Mit Vorsicht zu genießen!

Fearless SIMD v1.0 is here https://lobste.rs/s/wx3qsm #release #rust
https://linebender.org/blog/fearless-simd-1-0/

ok, fixed the large table issue! :)

cell reuse was only part of the problem... the main thing was that SQLite LIKE returns case insensitive matches! comparing on lowercase and then applying the highlight fixed it completely.

index column width is stable now too and moved the search entry back to the header bar.

getting there.

#linux #gnome #circle #bobby #rust #sql #sqlite #gtk

Alt...

Bobby window in search mode highlighting all cells containing "market".

#Bobby 51.0.0 is out!

Adding search and bumping to the #GNOME 51 runtime, as well as fixing a memory leak.

https://flathub.org/apps/studio.planetpeanut.Bobby

#linux #rust #sqlite #sql #flathub #flatpak #arm

Wow, the #pydantic team goes hard. They wrote their own #rust crate docs.rs/jiter for their JSON parsing, and it beats the commonly used Rust deserializer #serde and all existing JSON parsers in the #python world.

#jiter

Named and Optional Arguments are Awesome https://lobste.rs/s/xlbphk #plt #rust
https://botahamec.dev/named-optional-args