Enabling the next iteration of the borrow checker on nightly https://lobste.rs/s/skft2i #rust
https://blog.rust-lang.org/2026/08/04/enabling-polonius-alpha-on-nighty/

Almost Half of Malware Samples Communicate Direct to IP

Analysis of 4 million dynamic malware reports reveals that 45.32% of malware samples with command-and-control activity establish direct-to-IP (D2IP) connections, bypassing DNS entirely and evading DNS-based security defenses. D2IP traffic accounts for 23.17% of all C2 connection attempts. This behavior is observed across diverse threats including Phorpiex ransomware droppers using hard-coded IP addresses, persistent data exfiltration campaigns employing obfuscated HTTP GET requests, SectopRAT targeting educational institutions with in-browser proxy capabilities, and IoT botnets like Mozi and Boatnet propagating through P2P networks. The research introduces zero trust IP (ZT-IP), a network-level enforcement approach that verifies whether outbound connection destinations were previously sanctioned by DNS responses, effectively blocking malicious D2IP communications that traditional DNS-based security controls cannot detect.

Pulse ID: 6a71e43a0127c62218b7c365
Pulse Link: https://otx.alienvault.com/pulse/6a71e43a0127c62218b7c365
Pulse Author: AlienVault
Created: 2026-08-04 13:08:10

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #CyberSecurity #DNS #Education #HTTP #InfoSec #IoT #Malware #OTX #OpenThreatExchange #Phorpiex #Proxy #RAT #RCE #RansomWare #Rust #ZeroTrust #bot #botnet #AlienVault

BorrowSanitizer https://lobste.rs/s/jkv2du #rust
https://borrowsanitizer.com/

WhatsApp account takeover scam asks you to "vote for my friend"

A sophisticated scam is spreading through WhatsApp that exploits the platform's legitimate 'Linked devices' feature to take over user accounts. Attackers compromise existing accounts and send messages to contacts asking them to vote for a friend or relative in various online contests. When victims click the provided link, they are redirected through pages appearing to be WhatsApp-related, often using the legitimate wa.me domain. The attack tricks users into authorizing a new linked session, granting attackers full access to read messages, send messages as the victim, and access contacts. The scam is particularly effective because it comes from known contacts and relies on trust and quick reactions. Once compromised, attackers can continue the scam by messaging the victim's contacts, creating a chain of account takeovers without triggering traditional security alerts.

Pulse ID: 6a719213d506eb46339cc1dd
Pulse Link: https://otx.alienvault.com/pulse/6a719213d506eb46339cc1dd
Pulse Author: AlienVault
Created: 2026-08-04 07:17:39

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #InfoSec #OTX #OpenThreatExchange #Rust #WhatsApp #bot #AlienVault

Branchless Rust: Making a Filter 4x Faster by Removing an if https://lobste.rs/s/zhfwxt #performance #rust
https://www.greyblake.com/blog/branchless-rust/

Rust: Don't Panic https://lobste.rs/s/qpubrj #video #rust
https://www.youtube.com/watch?v=usRlRCNIOG0

Rust Project Goals: Immobile types and guaranteed destructors https://lobste.rs/s/sp2wji #rust
https://github.com/rust-lang/rust-project-goals/blob/main/src/2026/move-trait.md

Practical Memory Safety https://lobste.rs/s/yjzexe #c #rust
https://ohadravid.github.io/posts/2026-08-unsafe-water/

Awesome Links of Last Week 🧵

Check Thread Below 👇

#rustlang #rust

Since I picked up programming at 8yo with BASIC, I've been a bit of a language polyglot. Over the years I've coded in C, Python, Perl, Shell, more flavors of Assembly than I care to admit, occasionally C++, Go, Java and JavaScript, and heck, even PowerShell.

Then a couple of years ago I started taking #Rust seriously, and I basically haven't touched anything else since.

Anyway, here's where that obsession led. This summer's #GitHub tour, part two:

My vulnerability-hunting toolkit built on idalib-rs 🦀 named with more classical flair than strictly necessary 
https://github.com/0xdea/rhabdomancer - finds calls to sketchy API functions in a binary
https://github.com/0xdea/haruspex - rips pseudocode straight out of the @Hex-Rays decompiler
https://github.com/0xdea/augur - pulls strings and related pseudocode from a binary

Accompanying article (expect an update soon): https://hnsecurity.it/blog/streamlining-vulnerability-research-with-the-idalib-rust-bindings-for-ida-9-2/

So much for being a polyglot 🤷

XMRig Covert Ops: The Cryptomining Campaign That Abuses Trusted Access and Deploys Forensic Smokescreens

Pulse ID: 6a701f78d25ee7fd75898ac7
Pulse Link: https://otx.alienvault.com/pulse/6a701f78d25ee7fd75898ac7
Pulse Author: Tr1sa111
Created: 2026-08-03 04:56:24

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CryptoMining #CyberSecurity #InfoSec #OTX #OpenThreatExchange #Rust #bot #Tr1sa111

Faster floating point math with Rust’s new API https://lobste.rs/s/jnznnu #performance #rust
https://pythonspeed.com/articles/faster-float-math-rust/

> While C++ safety enhancements provide an immediate shield, we believe that runtime mitigations will hit diminishing marginal returns within the next few years.

[...]

> The long-term solution is shifting the codebase towards memory-safe languages like Rust.

https://blog.google/security/chrome-stronger-with-every-update/

#Rust #RustLang #carcinization

Is implementing Deref for State when using type state pattern where some States have data, is this anti pattern or not? #Rust #programming

Alt...

impl Deref for ScreenScraperFr { type Target = Authorized; fn deref(&self) -> &Self::Target { &self.state } }

🆕🛠️🇧🇪 New location feature: Cockerill-Sambre Ougrée Ironworks, Belgium

For over half a century, the 35-hectare site dominated the city skyline, a primary production hub for liquid pig iron until it closed in 2011. A maze of steel frames, pipe networks, and industrial conveyors.

Article and gallery now live👇
https://www.obsidianurbexphotography.com/industrial/cockerill-sambre-ougree-ironworks-belgium/

#Belgium #Urbex #AbandonedPlaces #History #Urbex #Liege #Metal #Rust

Alt...

An aerial view of the vast, decaying Cockerill-Sambre Ougree Ironworks in Belgium. Rusting structures and towering machinery fill the scene

Alt...

An interior view of a vast, abandoned industrial facility with heavily rusted machinery and metal grating floors.

Alt...

A vast, derelict industrial hall features a towering blue-grey machine, lit by sunlight

Alt...

An expansive view of an abandoned industrial interior with rusted metal structures, conveyors, and a water-filled floor

----------------

🛠️ Tool
===================

Buzz is a self-hostable workspace where humans and AI agents collaborate in the same channels, built on top of a Nostr relay architecture. Every message, reaction, workflow step, review approval, and git event is a signed event in a single append-only log. The identity model is uniform: agents and humans use the same keypair-based identity, the same audit trail, and the same channel membership semantics.

🔹 Key Features
• Agents as members, not bots. You add an agent to a channel the same way you add a person. The agent gets its own keypair, its own memberships, and its own audit history.
• Identity-based scoping. Agents are scoped by identity, not by permission flags. The README draws an analogy to how you would scope a human teammate.
• Full surface area for agents. Agents can open repos, send patches, review code, run workflows, edit canvases, orchestrate other agents, join voice huddles, and create channels.
• Unified search. Conversations, patches, workflow runs, and approvals are all the same event type, so they are searchable in one place.
• Feature branch as a room. A channel becomes the record of why code exists, with patches, CI results, review, and the merge decision co-located.

🔹 Technical Implementation

The backend is a Nostr relay. A Buzz community is selected by URL in the single-relay setup that ships today. Hosted operators can serve multiple communities behind multiple domains or subdomains, but all tenant-observable state is community-local. The project is written in Rust (the README jokes about a suspicious number of crates) and licensed under Apache 2.0.

🔹 Use Cases
• Asking an agent a project question and getting answers with linked thread references instead of vague summaries.
• Letting an agent triage a bug with scoped identity rather than blanket permissions.
• Running a release coordination channel where humans and agents coordinate on the plan.

🔹 Limitations

The source does not provide performance benchmarks, deployment requirements, or security threat models. The single-relay architecture may present scaling constraints for larger organizations. No independent verification of the agent capability claims.

🔹 References

GitHub repository, Apache 2.0 license, Nostr protocol (NIPs).

🔹 tool #nostr #aiagents #rust #selfhosted

🔗 Source: https://github.com/block/buzz

Immich deployment is an exercise in a needless dependency tree walking.

By itself, Immich is a Node.js application, you might just run it with a node, using some knowledge bits from the official dockerfiles and scripts.

On the other hand, it is intended to be controlled by the `mise` tool (runtime polyglot manager), so I making some detours.

`mise` isn't in pkgsrc, so you'd need to build it in on illumos from sources on your own.

It is a Rust app, where its requirements `rattler`/`rattler_pty` (of Python/Conda) and `libdbus-rs`/`dbus-native-channel` fail to be built on illumos.

The fix for the first one was just submitted to the upstream, the second would require me to work in its requirement -`libc` crate.

I guess it's not going to go deeper than that (but it is three layers removed from the root already).

#Immich #Rust #illumos

An old-new take on argument parsing in Rust by @jmmv https://lobste.rs/s/vrd28h #rust #unix
https://jmmv.dev/2026/07/hello-getoptsargs.html

With any luck, this is the cargo-semver-checks release that will start scanning the Rust standard library for breakage.

Enjoy v0.50.0! What a fitting moment for a nice round number 🎉 Expect a blog post soon!

#rust #rustlang #semver

Alt...

cargo-semver-checks v0.50.0 release notes. - Support for rustdoc JSON v61 for the latest nightly Rust - One new lint: `auto_trait_impl_added` - Bugfix in `constructible_struct_adds_field` to properly account for existing `pub` but `#[doc(hidden)]` fields. - Support for parsing rustdocflags from `.cargo/config.toml` and some minor bugfixes - Thanks to @taiki-e for accepting our upstream patches and promptly releasing them in `cargo-config2` so we can use them!

Every year, RustWeek and the All Hands meeting of the Rust Project are the most productive few days Rust ever gets.

An unbelievable amount of stuff gets done. And now you can read all about it!
https://blog.rust-lang.org/inside-rust/2026/07/31/all-hands-2026-retrospective/

#rust #rustlang #rustweek #rustweek2026

----------------

🛠️ Tool
===================

dnsglobe is a Rust-based terminal UI for checking DNS propagation across 34 public resolvers worldwide. It queries each resolver directly (no cache, EDNS0, TCP fallback for truncated responses) and presents results on an adaptive world map or rotating 3D globe, depending on terminal width.

🔹 Key Features

The tool supports a watch mode that re-polls until a record has propagated across all resolvers. Answers sharing any record are grouped together, so round-robin DNS configurations (where each resolver caches a different subset of an IP pool) count as one consistent answer rather than conflicting results. Outliers are flagged as ≠ DIFFERS once all results arrive.

EDNS Client Subnet support (RFC 7871) is built in via the --ecs flag, allowing you to query GeoDNS zones as a specific client network would. Multiple subnets can be specified, producing one table per subnet plus a convergence summary.

Anycast detection is a notable feature. For networks like Quad9, Cloudflare, Google, OpenDNS, CleanBrowsing, and Neustar UltraDNS, dnsglobe asks which site is actually answering. It uses TXT id.server.on.quad9.net for Quad9, CH TXT id.server for Cloudflare, egress subnet via TXT o-o.myaddr.l.google.com for Google, and TXT debug.opendns.com for OpenDNS. The discovered site appears in the Loc column as IATA-style codes (e.g., →YUL), and the resolver's map dot moves to the POP serving your queries.

🔹 Technical Implementation

The visual rendering adapts to terminal width: terminals with 157+ columns get a flat world map, narrower ones (131+) get a spinning 3D globe. Resizing across the threshold morphs one into the other. Ctrl+O toggles manually, and --view auto|map|globe forces a style.

Installation is available via Homebrew, cargo, AUR (source and prebuilt), and Nix flakes.

🔹 Use Cases

Verifying DNS changes have propagated globally, validating GeoDNS behavior from specific client subnets, and detecting resolver inconsistencies across regions.

🔹 Limitations

Limited to 34 predefined public resolvers. No custom resolver list mentioned in the source. The tool is focused on propagation visibility rather than performance benchmarking.

🔹 dns #dnsglobe #rust #dnspropagation #tool

🔗 Source: https://github.com/514-labs/dnsglobe

rustgrep - structural grep for Rust source https://lobste.rs/s/xidxte #rust #vibecoding
https://radicle.network/nodes/radicle.dpc.pw/rad%3Az3wPTYCEHukxHQNU2fQ2b3eASNw8a

Just built a prototype of a audio-first, screen reader accessible Tetris game written in Rust/WxDragon for Windows called Audio Tetris using Google Antigravity. I haben't built a release version as of yet, but you can find the GitHub repo here: https://github.com/thegregariousdragon/audio-tetris I'm obviously still working on it, but if you would like to test it out, the repo is there for the cloning. Feedback is strongly encouraged. #A11Y #Accessibility #Blind #Rust #WxDragon #Windows #Tetris

Is your company currently hiring for a role that includes using Rust?

Reply with a link to the opening and any relevant context.

If you're not, we'd appreciate a repost for visibility

#rust #rustlang #programming

ST Rust drivers https://lobste.rs/s/ogfqd0 #hardware #rust
https://blog.st.com/rust-mems-drivers/

Why I forked rand https://lobste.rs/s/kvxee3 #rust
https://casualhacks.net/blog/2026-07-27-why-i-forked-rand.html

The next one in the #peoplebehindosco series is Felix.

Hi @Gronner 👋

Felix is a software engineer with more than 10 years experience in the automotive and medical industry. Working at XITASO he focuses on building secure and safe systems. Besides that he provides trainings on security, safety, software architecture and Rust. To learn in and with a community he organises the SWEC and is a member of the iSAQB. He loves learning by exploring: building small embedded system or tools, mostly in Rust. In his spare time he enjoys playing pen & paper games, miniature figure painting and playing the drums.

His Tags: #AppSec, #Embedded, #Rust, #ThreatModeling

Thank you very much for your work as a volunteer and your support in organizing the Open Security conference. Stay tuned and follow the hashtag #peoplebehindosco for more people behind osco.

It's Friday again so it's time for another update on Diesel, a ORM and query builder for Rust.

This week we got 5 new PR's and no new bug report.

#rust #rustlang

Currently decompiling LabubaRAT with Ghidra. It's taking ages to perform the initial analyzing, probably because of Rust.

https://blackpointcyber.com/blog/labubarat-a-rust-based-remote-access-tool-masquerading-as-nvidia-software/

#malware #rust #RAT #labubaRAT

How to speed up the Rust compiler in July 2026 https://lobste.rs/s/ycsivx #compilers #performance #rust
https://nnethercote.github.io/2026/07/31/how-to-speed-up-the-rust-compiler-in-july-2026.html

Successfully ported the complete #LLVM stack (version 19.1.7, including llvm's binutils, clang, ldd) to #Solaris 11 Express (snv_151a) #SPARC. This build of #Solaris works on #SPARC machines that Solaris 11 GA (and later) do not support (example: sun4u workstations and servers), as well as machines that #Illumos does not support completely. This may allow for #Zig and #Rust to be ported to this version of Solaris on SPARC. Complete source archives, build instructions, and signed binaries in SVR4 package format (and soon, IPS) will be available for download. #Solaris #SPARC #retrocomputing #Illumos #Sunmicrosystems

CC: @ptribble @SolarisDiaspora

Progress toward compiling Linux with gccrs via @fanf https://lobste.rs/s/cpyuub #linux #rust
https://lwn.net/SubscriberLink/1083202/f1ba926cd57ac5c5/

RT @usr_bin_roygbiv: Falls du es nicht weißt: Verwende Go statt Rust für dein gesamtes Backend, denn die Kompilierzeiten ermöglichen eine SIGNIFIKANT schnellere Iterationsgeschwindigkeit für Agenten, wobei der Performanceunterschied vernachlässigbar ist.

mehr auf Arint.info

#BackendDevelopment #DeveloperTools #GoLang #ProgrammingTips #Rust #SoftwareEngineering #arint_info

https://x.com/usr_bin_roygbiv/status/2082794423843217760#m

Question for my blind coding friends: Where do I obtain WxDragon to use with the latest stable version of Rust? I want to experiment with Rust and WxDragon using Google Antigravity, but I want to make sure I get the latest stable versions of Rust and WxDragon that are most accessible with NVDA. #A11Y #Accessibility #Blind #Coding #Rust #WxDragon #Antigravity

RT @usr_bin_roygbiv: Falls du es nicht weißt: Verwende Go statt Rust für dein gesamtes Backend, denn die Kompilierzeiten ermöglichen eine SIGNIFIKANT schnellere Iterationsgeschwindigkeit für Agenten, wobei der Performanceunterschied vernachlässigbar ist.

mehr auf Arint.info

#BackendDevelopment #DeveloperTools #GoLang #ProgrammingTips #Rust #SoftwareEngineering #arint_info

https://x.com/usr_bin_roygbiv/status/2082794423843217760#m

XMRig Covert Ops: The Cryptomining Campaign That Abuses Trusted Access and Deploys Forensic Smokescreens | Group-IB Blog

Join the Cybercrime Fighters Club, a group of professionals dedicated to combat cybercrime and other forms of cyber-crime. £1.5m in funding, research, development and training.

Pulse ID: 6a6b19baacfdff5ea7386d10
Pulse Link: https://otx.alienvault.com/pulse/6a6b19baacfdff5ea7386d10
Pulse Author: CyberHunter_NL
Created: 2026-07-30 09:30:34

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CryptoMining #CyberCrime #CyberSecurity #GroupIB #InfoSec #OTX #OpenThreatExchange #Rust #bot #CyberHunter_NL

Writing the PHP Virtual Machine in Rust (with a lot of help from AI) via @mykiwi https://lobste.rs/s/hbtqfe #ai #php #rust
https://jolicode.com/blog/writing-the-php-virtual-machine-in-rust-with-a-lot-of-help-from-ai

This Week's Project Spotlight 🦀

datafusion

DataFusion is an extensible query engine written in Rust that uses Apache Arrow as its in-memory format.

#rustlang #rust

RT @TheRegister: Nach der Neuschreibung von SQLite in Rust richtet Turso seinen Fokus auf Postgres. Das Cloud-Datenbank-Start-up möchte mit einem einzigen virtuellen Maschinenkern mehrere SQL-Frontends betreiben.

mehr auf Arint.info

#CloudDatabase #Postgres #Rust #SQL #Turso #arint_info

https://x.com/TheRegister/status/2082428467958940149#m