Campaign deploys a reverse tunnel through multistage intrusion

A sophisticated TerminalFix campaign, a variant of ClickFix, targets organizations by leveraging compromised websites displaying fake Cloudflare CAPTCHA overlays. Users are tricked into copying and executing malicious PowerShell commands in Windows Terminal. The attack deploys a complex multi-stage chain combining DLL sideloading via LockScreenContentServer.exe, steganographic payload extraction from PNG images, dual persistence mechanisms through Registry Run keys and scheduled tasks, extensive Active Directory reconnaissance including domain trust enumeration and admin discovery, and ultimately a custom Python-based reverse-tunnel implant. This implant establishes encrypted WebSocket communication to attacker infrastructure, providing SOCKS-style TCP proxy access through the compromised host. The combination transforms victims into network pivot points, enabling attackers to access internal systems, escalate privileges, and potentially deploy ransomware across enterprise environments through hands-on-key...

Pulse ID: 6a94c765ccca1cbf809fc70f
Pulse Link: https://otx.alienvault.com/pulse/6a94c765ccca1cbf809fc70f
Pulse Author: AlienVault
Created: 2026-08-31 00:14:29

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CAPTCHA #Cloud #CyberSecurity #InfoSec #OTX #OpenThreatExchange #PowerShell #Proxy #Python #RAT #RansomWare #Rust #SMS #SideLoading #TCP #Windows #bot #AlienVault

🚌🇱🇹 Old bus graveyard, somewhere in Lithuania. These are Soviet-era паз-672 (PAZ-672) buses from the 1960s to 1980s. Their colourful paint flakes and fades and weeds grow around their deflated tyres.

#Photography #Lithuania #UrbanExploration #Transport #Bus #Soviet #WeirdCarMastodon #Rust #PeelingPaint

Alt...

Old red bus, paint peels and it is reflected in a large puddle of water

zizmor 1.30 is released!

this release comes with one new audit (self-repository) and a whole bunch of enhancements (including more pre-commit support) and bug fixes.

full release notes here:

https://docs.zizmor.sh/release-notes/#1300

#rust #opensource

Finished more #Poly #Yuri for #PrideMonth !

It's the same throuple from the previous drawing ( https://vt.social/@ExpiredPopsicle/116687482692933271 ).

#Polyamorous #LGBTQ #Art #MastoArt #ArmoredCore #Rust #Pride #LGBT #RobotGirl #Catgirl

Alt...

A digital illustration of three women cuddling on a couch together. On the left is a catgirl reading The Rust Programming Language (2024 edition). In the middle is an android or robot girl. On the right is a human girl, with her head resting on the robot girl's lap. She's playing Armored Core 6 on a Steam Deck. A speech caption coming off the Steam Deck reads "... I'm with you, Raven." The image on the screen shows a specific ending's boss-fight cutscene from Armored Core 6. The android girl has her arm around the back of the catgirl, and her other hand on the human girl's head. They are all looking towards the scene happening on the Steam Deck. The background is a polyamorous pride flag.

Gram Editor 3.3.0 Released https://lobste.rs/s/rr2irk #editors #rust
https://gram-editor.com/posts/release-3.3.0/

Rust Function Overloading - Call for Experimentation https://lobste.rs/s/rikfb5 #rust
https://blog.rust-lang.org/inside-rust/2026/08/19/overloading-experiment/

Functional State Machines in Rust: Typestate and Newtype Patterns https://lobste.rs/s/udkuqc #rust
https://dl.acm.org/doi/epdf/10.1145/3830438.3830958

Simple Rust Challenge to solve

Given a vector of integers nums, return all unique triplets [a, b, c] such that a + b + c == 0. The solution must not contain duplicate triplets. Order of triplets and order inside a triplet does not matter.

#rustchallenge #rust #rustlang

Alt...

Image: Rust Challenge Given a vector of integers nums, return all unique triplets [a, b, c] such that a + b + c == 0. The solution must not contain duplicate triplets. Order of triplets and order inside a triplet does not matter.

At 10:15 I added a gently condescending toast for IPv4-only visitors. It called ipify, which felt inappropriate for someone running an ASN.

By 13:27 I had built a Rust/Axum IP service, put it behind Caddy, added MaxMind, three DNS names, trusted-proxy handling, an rc.d service, and a dedicated dual-stack FreeBSD VNET jail.

The toast looks exactly the same.

https://blog.hofstede.it/i-wanted-an-ipv4-toast-and-accidentally-built-an-ip-service/

#FreeBSD #IPv6 #Rust #SelfHosting

It started as a gag: a tiny popup telling IPv4 visitors that their provider hasn't yet discovered 1998.

To do that honestly I needed something to echo the client address.

Using ipify felt wrong when you run your own AS. So now it's a service. 🙃

curl https://ip.hofstede.it
curl https://v6.ip.hofstede.it/json
curl https://v4.ip.hofstede.it/asn

One Rust binary, server-rendered, zero JavaScript.

https://ip.hofstede.it

#IPv6 #Rust #FreeBSD #SelfHosting #AS201379 /cc @namedbird

Zellij (terminal multiplexer) in v0.45.1 released

https://secburg.com/posts/zellij-v0451-released/

#Zellij #Terminal #OpenSource #Rust #CLI

Cloudflare is hiring Senior Systems Engineer, Cloudflare Data Platform

🔧 #cplusplus #golang #javascript #rust #typescript #api #sql #seniorengineer
🌎 In-Office
⏰ Full-time
🏢 Cloudflare

Job details https://jobsfordevelopers.com/jobs/senior-systems-engineer-cloudflare-data-platform-at-cloudflare-com-aug-6-2026-f6ff5f?utm_source=mastodon.world&utm_medium=social&utm_campaign=posting
#jobalert #jobsearch #hiring

Is your company currently hiring for a role that includes using Rust?

Reply with a link to the opening and any relevant context.

If you're not, we'd appreciate a repost for visibility

#rust #rustlang #programming

The age of software plugins is coming to an end. Thanks #AI!

https://levelup.gitconnected.com/ai-is-killing-the-software-plugins-0349f1324b44

Why pay for someone else's plugin when you can ask AI to code it for you, and keep it forever? Then you ask why now everything is a subscription to *something* in the cloud.

Imagine #PHPUnit was a cloud service. $20/m for 10K assertions.

#Programming #Coding #Code #SourceCode #SoftwareDevelopment #WebDevelopment #VibeCoding #VibeCode #WebDev #AppDevelopment #JavaScript #PHP #Rust #Golang #Go #TypeScript

Note to self: Stop trying to write generic code using `num-traits`.
It never turns out well.
#rust #rustlang

Hey, y'all, we have an opening at #NetBox Labs in our enterprise group. If you'd like to #GetFediHired doing cool stuff with Kubernetes, DevOps, and any number of other Hashtag Keywords then let me know.

We work with #Rust and #Python in our operator and other tools, are based around an open-source product (without strip-mining it!), and are fully-remote.

If you have any questions about NBL, ask away.

https://jobs.ashbyhq.com/netboxlabs/e3fff69b-ab13-4869-95c5-66d018fc43ae

#Kubernetes #DevOps #FLOSS

It's Friday again, so it's time for yet another update on the work on Diesel, a ORM and query-builder for Rust.

There was no new bug report this week, but a massive 13 new PR's.

#rust #rustlang

How I made Rustdoc 33% faster in one week https://lobste.rs/s/ulkqhi #performance #rust
https://noahlev.org/blog/2026/08/27/making-rustdoc-faster/

25x Performance, Three Optimizations via @abnv https://lobste.rs/s/rhto2r #compilers #lisp #performance #rust
https://maplant.com/2025-04-20-25x-Performance,-Three-Optimizations.html

Zero-Cost 'Tagless Final' in Rust with GADT-style Enums via @abnv https://lobste.rs/s/max8q6 #rust
https://inferara.com/blog/rust-tagless-final-gadt/

Inside the AsyncAPI Supply Chain Compromise

In July 2026, Microsoft Threat Intelligence uncovered a supply chain attack targeting the official AsyncAPI NPM organization. Attackers published malicious versions of multiple packages under the trusted AsyncAPI namespace, exploiting developer dependencies to distribute malware. The compromised packages deployed a multi-stage Remote Access Trojan through obfuscated lifecycle hooks that executed during routine build workflows. Upon installation, the malware retrieved second-stage payloads from IPFS gateways, established persistence on infected systems, and initiated command-and-control communications with external infrastructure. The attack leveraged trusted build automation and dynamic package retrieval via npx to bypass traditional security controls, affecting developers executing version-pinned tasks in their CI/CD pipelines.

Pulse ID: 6a90b738237841eddd8428c7
Pulse Link: https://otx.alienvault.com/pulse/6a90b738237841eddd8428c7
Pulse Author: AlienVault
Created: 2026-08-27 22:16:24

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #InfoSec #Malware #Microsoft #NPM #OTX #OpenThreatExchange #RemoteAccessTrojan #Rust #SupplyChain #Trojan #bot #developers #AlienVault

This change by Noah Lev will probably save a zillion dollars in docs\.rs and CI jobs everywhere. Really nice work!
https://noahlev.org/blog/2026/08/27/making-rustdoc-faster/

#rust #rustlang

More good news: Jess Izen is stepping into an Engineer in Residence role with the Rust Foundation!

She's done so much good work for the ecosystem already (see the post!) and I can't think of a better person to wear this hat 🦀
https://rustfoundation.org/media/welcoming-jess-izen-as-engineer-in-residence-at-the-rust-foundation/

#rust #rustlang

Announcing our first Maintainers in Residence https://lobste.rs/s/oshbjt #rust
https://blog.rust-lang.org/2026/08/26/announcing-our-first-maintainers-in-residence/

This Week's Project Spotlight 🦀

Rayon

Rayon is a data-parallelism library for Rust. It is extremely lightweight and makes it easy to convert a sequential computation into a parallel one. It also guarantees data-race freedom.

#rustlang #rust

RE: https://mastodon.social/@rustfoundation/117162487148480491

The first batch of Rust maintainers in residence has been announced!

A lot of Rust will get even more love and attention: clippy, rustup, rustdoc, Windows support, standard library, and compiler internals 💖🦀

#rust #rustlang #funding

rustfoundation » 🌐 2026-08-26
@rustfoundation@mastodon.social

Head over to the Rust project blog for a deeper dive announcement on this Rust maintenance funding news, including the selection methodology and more details on this amazing initial cohort of Rust Maintainers in Residence:

https://blog.rust-lang.org/2026/08/26/announcing-our-first-maintainers-in-residence/ #rustlang

ClickFix Phishing Hidden in Malicious npm Packages

OX Security identified a campaign distributing fake Cloudflare Captcha pages through 24 malicious npm packages. The threat actors exploit npm mirrors like unpkg, yarn, and npmmirror as free hosting infrastructure for phishing content. Each package contains an HTML page that displays a fraudulent Cloudflare verification interface. When accessed through mirror sites, these pages appear on trusted domains, increasing their credibility. The initial versions redirected victims to a typosquatted Microsoft domain, while later iterations used legitimate key-value storage services to dynamically retrieve redirection targets. Although downloading the packages is harmless, accessing the HTML files through mirror URLs can lead to ClickFix delivery or other phishing attacks. The campaign demonstrates infrastructure abuse where npm registries serve as persistent, validated storage for malicious payloads.

Pulse ID: 6a8e42ad990953414676533f
Pulse Link: https://otx.alienvault.com/pulse/6a8e42ad990953414676533f
Pulse Author: AlienVault
Created: 2026-08-26 01:34:37

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CAPTCHA #Cloud #CyberSecurity #HTML #InfoSec #Microsoft #NPM #OTX #OpenThreatExchange #Phishing #RAT #Rust #bot #AlienVault

RMM Phishing Campaign: Malware Analysis

A sophisticated phishing operation initially appearing to target Canadians with fake Canada Revenue Agency T4 tax documents has evolved into a global campaign spanning 46 countries, with 45% of activity concentrated in the United States. Attackers impersonate trusted organizations including the Social Security Administration, Adobe, and various tax authorities to deliver legitimate Remote Management and Monitoring software that is then abused for unauthorized remote access. The campaign employs a reusable delivery kit featuring password-protected archives, browser fingerprinting, and Telegram-based victim filtering. Infrastructure rotates rapidly across 240 hosts, predominantly using Vercel deployments that provide legitimate TLS certificates and domain reputation. The operation leverages signed commercial RMM tools including GoTo Resolve, LogMeIn Rescue, ScreenConnect, ConnectWise, and ITarian, making signature-based detection ineffective. Activity has remained steady from January 2026 onwards, targeting ...

Pulse ID: 6a8edcdfbe73c1e4ce16cdf2
Pulse Link: https://otx.alienvault.com/pulse/6a8edcdfbe73c1e4ce16cdf2
Pulse Author: AlienVault
Created: 2026-08-26 12:32:30

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Adobe #Browser #Canada #Canadian #ConnectWise #CyberSecurity #InfoSec #Malware #OTX #OpenThreatExchange #Password #Phishing #RAT #RCE #Rust #ScreenConnect #TLS #Telegram #UnitedStates #Word #bot #AlienVault

24 Malicious npm Packages Abuse Trusted Mirrors to Host ClickFix Phishing Pages

Indicators extracted from public reporting. Source: https://www.ox.security/blog/research-clickfix-phishing-npm-packages/

Pulse ID: 6a8ed451fd81c5c3493cc0ed
Pulse Link: https://otx.alienvault.com/pulse/6a8ed451fd81c5c3493cc0ed
Pulse Author: CyberHunter_NL
Created: 2026-08-26 11:56:01

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #HTTP #HTTPS #InfoSec #NPM #OTX #OpenThreatExchange #Phishing #RCE #Rust #bot #CyberHunter_NL

How Ubuntu Is Using Rust to Rebuild Core System Tools
#RustLang #Livestream #Rustrover #Rust #Rustinubuntu

https://blog.jetbrains.com/rust/2026/08/26/ubuntu-rust/

Lively Merge | Collaborative programming kernels https://lobste.rs/s/kp1khy #compsci #javascript #rust
https://www.inkandswitch.com/livelymerge/notebook/

I know a lot of people are looking for jobs right now (myself included). NLnet is looking for a Rust developer, who'll work in Amsterdam:

https://nlnet.nl/foundation/jobs/developer-rust.html

#rust #nlnet #getfedihired

Scaling Memory Safety: AI-Assisted Rewrites of C/C++ Dependencies to Rust via @dayanruben https://lobste.rs/s/4ggbhi #c #c++ #rust #vibecoding
https://bughunters.google.com/blog/scaling-memory-safety

MongoDB is hiring Senior Software Engineer, Server Security

🔧 #cplusplus #golang #java #rust #aws #azure #gcp #mongodb #securityengineer #seniorengineer
🌎 New York City, New York
⏰ Full-time
🏢 MongoDB

Job details https://jobsfordevelopers.com/jobs/senior-software-engineer-server-security-at-mongodb-com-apr-17-2026-5cd15a?utm_source=mastodon.world&utm_medium=social&utm_campaign=posting
#jobalert #jobsearch #hiring

Replacing a Rust Enum with a 64-bit Word Made My Interpreter 17% Faster via @abnv https://lobste.rs/s/gyi8v8 #performance #rust
https://pointersgonewild.com/2026-08-25-replacing-a-rust-enum-with-a-64-bit-word/

I stabilized never type https://lobste.rs/s/gizvfn #rust
https://blog.ihatereality.space/0C-never-type/

Fun fact: Rust uses `Result<T, Infallable>` to indicate a function that might fail, but won't. Infallible is an empty type that is equivalent to the "never" type which means a bit of code is unreachable. Its a bit like in zig if you sometimes wrote `noreturn!T`

Anyway here is a good talk about stabilizing the never-type in rust and the challenges that came with it:
https://www.youtube.com/watch?v=3jM4cnEVrLc

Really shows how the language and type system are deeply integrated.

#rust

kudu - easily manage VMs on Linux https://lobste.rs/s/uodrjx #rust #virtualization
https://github.com/pythops/kudu

🦀🥷 We've released a @binaryninja plugin, Rust Metadata Carver, that extracts panic metadata from Rust binaries: https://github.com/decoderloop/rust_metadata_carver

Panic metadata in Rust binaries reveals the libraries used, the version of Rust used, and code locations from the original Rust source, down to the line numbers! This is very useful for finding the key functionality in a binary.

The plugin extracts that metadata, labels the original source file locations, and groups them into Tags (labelled with the 😱 emoji).

#ReverseEngineering #MalwareAnalysis #infosec #malware #reversing #rust #rustlang #BinaryNinja

Alt...

A screenshot of Binary Ninja's Tags window, showing locations from the source file `src/platform/linux.rs`, including line numbers (for example, line 142, col 10)

Canonical has funded a PhD at the University of Bristol, backed by UK Research and Innovation, to build a system that translates large C repositories into behaviourally-correct Rust. https://www.developer-tech.com/news/canonical-bristol-phd-to-automate-c-to-rust-translation/ #canonical #rust #ubuntu #linux #developers #ai #opensource #tech

Like that one forgotten shelf in a government warehouse from Raiders of the Lost Ark, something terrible was sitting in your dependency tree the whole time and nobody checked.

Audit your crates.io packages for suspicious dependencies and watch build logs for unexpected outbound network calls.

Reward: Your inventory has been updated. Net value: negative.

#Rust #SupplyChain #Malware #CyberSecurity #Crates #BuildTimeBreach (2/2)

RSoC 2026: EEVDF for Redox https://lobste.rs/s/p92osu #osdev #rust
https://www.redox-os.org/news/rsoc-eevdf/

I'm updating my Rust projects to harden them against supply chain attacks:
- explicit allowlist of hashes for build scripts in the project
- `min-publish-age` of 7 days for deps updates, using the nightly cargo feature
- ensure no jobs that could run a build script have GH tokens

#rust #rustlang

(more Linux and FOSS news in previous posts of thread)

Godot 3.6.3 LTS Released: Android 16 and iOS 15 Updates for Mobile Devs:
https://www.linuxcompatible.org/story/godot-363-lts-released-android-16-and-ios-15-updates-for-mobile-devs/

Godot 4.7.2 Release: Threading Hardening, Mouse Input Fixes, and 57 Stability Patches:
https://www.linuxcompatible.org/story/godot-472-release-threading-hardening-mouse-input-fixes-and-57-stability-patches/

Nginx 1.31.4 Lands with PROXY Protocol v2 Support and gRPC Hardening:
https://www.linuxcompatible.org/story/nginx-1314-release-proxy-protocol-v2-and-grpc-hardening/

Nginx Dark Mode Support For Error Pages Remains Elusive:
https://www.phoronix.com/news/Nginx-Dark-Mode-Mystery

GNU Emacs 31.1 RC1: Completion Overhaul, Window Commands and Unicode 17.0:
https://www.linuxcompatible.org/story/gnu-emacs-311-rc1-completion-overhaul-window-commands-and-unicode-170/

WordPress 7.1 “Mary Lou” brings responsive styling, new media editor, and sticky admin bar:
https://alternativeto.net/news/2026/8/wordpress-7-1-mary-lou-brings-responsive-styling-new-media-editor-and-sticky-admin-bar/

WordPress launches browser extension for Chrome and Safari that can replace the admin bar:
https://alternativeto.net/news/2026/8/wordpress-launches-browser-extension-for-chrome-and-safari-that-can-replace-the-admin-bar/

Matomo 5.13.0 lands with a sparkline overhaul and native AI traffic tracking:
https://www.linuxcompatible.org/story/matomo-5130-released-ai-chatbot-tracking-and-security-fixes/

Go 1.27 released with generic methods, struct improvements, and memory allocation gains:
https://alternativeto.net/news/2026/8/go-1-27-released-with-generic-methods-struct-improvements-and-memory-allocation-gains/

Rust 1.98.0 Lands in Stable: Algebraic Floats, itoa Replacement, and Stability Fixes:
https://www.linuxcompatible.org/story/rust-1980-lands-in-stable-algebraic-floats-itoa-replacement-and-stability-fixes/

Bun 1.4 lands: Rust rewrite and zero external dependencies mark major milestone for devs:
https://alternativeto.net/news/2026/8/bun-1-4-lands-rust-rewrite-and-zero-external-dependencies-mark-major-milestone-for-devs/

Stripe will reportedly acquire AI model router OpenRouter in deal exceeding $7 billion:
https://alternativeto.net/news/2026/8/stripe-will-reportedly-acquire-ai-model-router-openrouter-in-deal-exceeding-7-billion/

Murena Just Made The Fairphone (Gen. 6) Better!:
https://feed.itsfoss.com/link/24361/17422921/murena-fairphone-6-plus

Redox OS Switches To EEVDF-Based Scheduler For 2.6x Throughput:
https://www.phoronix.com/news/Redox-OS-Goes-EEVDF

Open-Source Etnaviv Driver Now Able To Run YOLOX:
https://www.phoronix.com/news/Etnaviv-YOLOX

VirtualBox 7.2.16 Improves Shared Clipboard in Wayland, Adds FRED Support:
https://9to5linux.com/virtualbox-7-2-16-improves-shared-clipboard-in-wayland-adds-fred-support

FFmpeg Lands H.265 Vulkan Encode Performance Optimizations:
https://www.phoronix.com/news/FFmpeg-Faster-HEVC-Encode

#WeeklyNews #FOSSNews #Godot #Nginx #GNUEmacs #Emacs #WordPress #Matomo #Go #Rust #Bun #Stripe #Murena #FairPhone #Redox #RedoxOS #Etnaviv #YOLOX #VirtualBox #FFmpeg #GodotEngine #Dev #Development #Programming #Coding #GameDev #WebDev #WebServer #VM #FosseryTech

Why aren't my two Cortex-A9 cores cache coherent? via @binjip978 https://lobste.rs/s/vikit1 #hardware #rust
https://thejpster.org.uk/blog/blog-2026-08-22/