Loading video...

Video Failed to Load

There was a problem loading this video. This could be due to a temporary network issue or the video might be unavailable.

Open-sourcing our RCE implementation for CVE-2026-42533! This is an incredibly powerful NGINX bug that provides both info leak and an out-of-bounds heap write primitives (so, yes, ASLR bypass!). F5 released the security advisory a week ago on July 15th. Fun fact: this bug appears to have been found concurrently... show more

Zhenpeng (Leo) Lin

3,570 subscribers

30,400 views • 1 month ago •via X (Twitter)

Anya Rossi• Live Now

Private livecam show

0 Comments

No comments available

Comments from the original post will appear here

Related Videos

Here goes nginx-quicburst (CVE-2026-42530), a new RCE in Nginx discovered by our security agent VEGA and demonstrated by Nebula Security. This is only the third NGINX vulnerability since 2014 to receive NGINX’s “major” severity rating. If you use Nginx 1.31 with QUIC enabled, we recommend upgrading to the latest version. This bug has been patched in the latest Nginx release. We will publish the technical writeup, including the ASLR bypass, on July 18 together with the previous nginx-poolslip writeup.

Here goes nginx-quicburst (CVE-2026-42530), a new RCE in Nginx discovered by our security agent VEGA and demonstrated by Nebula Security. This is only the third NGINX vulnerability since 2014 to receive NGINX’s “major” severity rating. If you use Nginx 1.31 with QUIC enabled, we recommend upgrading to the latest version. This bug has been patched in the latest Nginx release. We will publish the technical writeup, including the ASLR bypass, on July 18 together with the previous nginx-poolslip writeup.

Nebula Security

105,706 views • 2 months ago

Attacks always get better. Here's a new nginx RCE that bypasses ASLR, tested on the latest nginx 1.30 and 1.31. This still requires a non-default config, but unlike some previous bugs, it does not depend on any additional vulnerabilities or external helpers to get to RCE. We reported the bug on May 15. F5 has confirmed it, and hopefully a patch will land soon. This is getting ridiculous 😅. We have enough nginx bugs to do an entire week of MAD Bugs on it. Who could have thought nginx is starting to feel like the new Linux kernel? This is the funniest time in computer hacking. And yet the world is completely unprepared for this new reality.

Attacks always get better. Here's a new nginx RCE that bypasses ASLR, tested on the latest nginx 1.30 and 1.31. This still requires a non-default config, but unlike some previous bugs, it does not depend on any additional vulnerabilities or external helpers to get to RCE. We reported the bug on May 15. F5 has confirmed it, and hopefully a patch will land soon. This is getting ridiculous 😅. We have enough nginx bugs to do an entire week of MAD Bugs on it. Who could have thought nginx is starting to feel like the new Linux kernel? This is the funniest time in computer hacking. And yet the world is completely unprepared for this new reality.

thaidn

33,231 views • 3 months ago

President Bola Ahmed Tinubu welcomes the US President's commendation of his efforts so far in stemming the tide of insecurity. Several months ago, our both countries agreed to a security partnership to deal decisively with the issues of insecurity because of the shared destinies of both countries. Today, everyone can attest to the fact that we have made appreciable gains. President Tinubu will not rest on his oars until our land is free from these daredevils. The war against insecurity is a battle already being won, and this is an incontrovertibe fact We enjoin the media to continue to show support for the administration's efforts in curtailing insecurity; at least, we all agree this is our country, and we must protect it at whatever cost

President Bola Ahmed Tinubu welcomes the US President's commendation of his efforts so far in stemming the tide of insecurity. Several months ago, our both countries agreed to a security partnership to deal decisively with the issues of insecurity because of the shared destinies of both countries. Today, everyone can attest to the fact that we have made appreciable gains. President Tinubu will not rest on his oars until our land is free from these daredevils. The war against insecurity is a battle already being won, and this is an incontrovertibe fact We enjoin the media to continue to show support for the administration's efforts in curtailing insecurity; at least, we all agree this is our country, and we must protect it at whatever cost

D. H Bwala

24,834 views • 1 month ago

We need to sensitise the people that security is not only the responsibility of government or people in authority. It's our collective responsibility. Every one of us, right from the last man in the village to the highest man, has a role to play. It is important to understand that this issue of insecurity, especially in some parts of the country, has become an industry. It requires massive sensitisation of the populace to participate in addressing the issue of insecurity in this country. - Aminu Masari, Fmr. Governor of Katsina State, speaking at the 2026 NASS Open Week.

We need to sensitise the people that security is not only the responsibility of government or people in authority. It's our collective responsibility. Every one of us, right from the last man in the village to the highest man, has a role to play. It is important to understand that this issue of insecurity, especially in some parts of the country, has become an industry. It requires massive sensitisation of the populace to participate in addressing the issue of insecurity in this country. - Aminu Masari, Fmr. Governor of Katsina State, speaking at the 2026 NASS Open Week.

Channels Television

33,549 views • 1 month ago

Lucy McDaid, Sky News, "You have a party policy on NATO, should it be reviewed? Should we be leaving the alliance?" Zack Polanski, "What we're seeing is Donald Trump is an increasingly unpredictable and dangerous man" "Just a couple of days ago he said he was willing to wipe out a civilisation" "Now there's a ceasefire, but Israel is taking advantage of it in terms of bombing Lebanon" "What I've been arguing for a long time and is coming into fruition anyway" "Is that we need to be working with our European neighbours and our European allies" "Brexit was one of the most catastrophic decisions this country has every made: socially, culturally and economically" "But we're also seeing that in terms of our security" "We are increasingly isolated" "It is time to have conversations with our European neighbours on what an alliance and security looks like without relying on Donald Trump" "And the last thing I'd note is that this Labour government were attacking me for these comments just a few months ago, but are now saying the exact same things" "I've been incredibly vindicated for what I've been saying about Donald Trump" "It doesn't take a rocket scientist to look at this man and say this is not somebody we can rely on for the security of this country" "We also need to look to other threats: pandemic resilience, cybersecurity, and food resilience" "We need a holistic review on what our national security looks like" "We know we are not safe when our security relies on Donald Trump"

Lucy McDaid, Sky News, "You have a party policy on NATO, should it be reviewed? Should we be leaving the alliance?" Zack Polanski, "What we're seeing is Donald Trump is an increasingly unpredictable and dangerous man" "Just a couple of days ago he said he was willing to wipe out a civilisation" "Now there's a ceasefire, but Israel is taking advantage of it in terms of bombing Lebanon" "What I've been arguing for a long time and is coming into fruition anyway" "Is that we need to be working with our European neighbours and our European allies" "Brexit was one of the most catastrophic decisions this country has every made: socially, culturally and economically" "But we're also seeing that in terms of our security" "We are increasingly isolated" "It is time to have conversations with our European neighbours on what an alliance and security looks like without relying on Donald Trump" "And the last thing I'd note is that this Labour government were attacking me for these comments just a few months ago, but are now saying the exact same things" "I've been incredibly vindicated for what I've been saying about Donald Trump" "It doesn't take a rocket scientist to look at this man and say this is not somebody we can rely on for the security of this country" "We also need to look to other threats: pandemic resilience, cybersecurity, and food resilience" "We need a holistic review on what our national security looks like" "We know we are not safe when our security relies on Donald Trump"

Farrukh

39,010 views • 4 months ago

We just released some epic stuff at Binary Defense today with our MDR Plus services. Our MDR is really unique in the sense it focuses on our own customers tech stack (or can leverage ours and our platform). What is considered an Open-MDR/XDR. New service includes: Managed Deception, Malware + Attack Disruption, Behavioral-Base Analysis/Detection, EDR Bypass Detections, and a ton more. I did a quick video on it and datasheet linked here. Super proud of this team and the kick-butt innovations going on at Binary Defense. The attack disruption component alone is huge and a new release - our teams been testing it both at BD and TS and it really is innovative and a completely new way in how to look at disrupting attack chains. #BinaryDefense

We just released some epic stuff at Binary Defense today with our MDR Plus services. Our MDR is really unique in the sense it focuses on our own customers tech stack (or can leverage ours and our platform). What is considered an Open-MDR/XDR. New service includes: Managed Deception, Malware + Attack Disruption, Behavioral-Base Analysis/Detection, EDR Bypass Detections, and a ton more. I did a quick video on it and datasheet linked here. Super proud of this team and the kick-butt innovations going on at Binary Defense. The attack disruption component alone is huge and a new release - our teams been testing it both at BD and TS and it really is innovative and a completely new way in how to look at disrupting attack chains. #BinaryDefense

Dave Kennedy

21,081 views • 2 years ago

The Cyber and Infrastructure Security Agency (CISA) released a report detailing 9 separate vulnerabilities with Dominion voting machine systems which are used all over the country. It gets even more alarming when you find out these machines are gathering and sending sensitive data and who they are communicating with... A Michigan company who's software and apps are used in multiple counties and states in our elections was found to be communicating information on 1.8 MILLION poll workers, including their names, their children's names, finances, locations, even poll location schematics of the buildings, on the Unicom internet backbone on a server in China. Our elections and data is compromised and putting our elections, people's privacy, and their lives at risk. This is a serious issue that demands an investigation.

The Cyber and Infrastructure Security Agency (CISA) released a report detailing 9 separate vulnerabilities with Dominion voting machine systems which are used all over the country. It gets even more alarming when you find out these machines are gathering and sending sensitive data and who they are communicating with... A Michigan company who's software and apps are used in multiple counties and states in our elections was found to be communicating information on 1.8 MILLION poll workers, including their names, their children's names, finances, locations, even poll location schematics of the buildings, on the Unicom internet backbone on a server in China. Our elections and data is compromised and putting our elections, people's privacy, and their lives at risk. This is a serious issue that demands an investigation.

The SCIF

34,781 views • 7 months ago

Despite what my detractors say, I have endeavoured to be balanced and consistent in my messaging on Ireland and our problem with antisemitism and anti-Israel bias. These have always been my three main points: 1. The label that Ireland holds as ‘the most antisemitic country in Europe’ is a reductive one and not accurate on certain metrics, specifically with respect to physical violence. 2. We have not reckoned with our history of antisemitism and the denial of the scale of the issue here (and even sometimes its very existence) is what makes it difficult to combat. This denial emboldens antisemitism in Ireland further and only serves to make our problem significantly more apparent on an international stage. 3. Irish antisemitism is institutional. To deny it at this stage is folly. This week alone an open Hamas supporter spoke at a protest vigil organised by National Union of Journalist (NUJ) members and the Dublin Broadcasting branch. Both our political and media establishments are entrenched in anti-Israel bias and have a significant antisemitism problem. Please watch below from my first public speech on this subject back in April. I’ll always defend Ireland against sensationalised claims, but will nonetheless never be silenced on the fact that we do have an antisemitism problem and we are long overdue a reckoning for it.

Despite what my detractors say, I have endeavoured to be balanced and consistent in my messaging on Ireland and our problem with antisemitism and anti-Israel bias. These have always been my three main points: 1. The label that Ireland holds as ‘the most antisemitic country in Europe’ is a reductive one and not accurate on certain metrics, specifically with respect to physical violence. 2. We have not reckoned with our history of antisemitism and the denial of the scale of the issue here (and even sometimes its very existence) is what makes it difficult to combat. This denial emboldens antisemitism in Ireland further and only serves to make our problem significantly more apparent on an international stage. 3. Irish antisemitism is institutional. To deny it at this stage is folly. This week alone an open Hamas supporter spoke at a protest vigil organised by National Union of Journalist (NUJ) members and the Dublin Broadcasting branch. Both our political and media establishments are entrenched in anti-Israel bias and have a significant antisemitism problem. Please watch below from my first public speech on this subject back in April. I’ll always defend Ireland against sensationalised claims, but will nonetheless never be silenced on the fact that we do have an antisemitism problem and we are long overdue a reckoning for it.

Rachel Moiselle

46,635 views • 1 year ago

With the new scouting restriction, we’re unable to have college athletes throw in a pro day this year 😢 While we will still hold a Pro Day this year (Feb. 6), I found it only appropriate to give our college guys some shine - they have more than earned it - They are ELECTRIC. Below is a thread that I will add to over the coming weeks of guys who certainly would have been on the Pro Day roster AND guys that we believe our primed for a phenomenal 2026 season 🧵 First, let’s look at some of the best individual pitches from the winter from both our professional and collegiate groups ⚡️

With the new scouting restriction, we’re unable to have college athletes throw in a pro day this year 😢 While we will still hold a Pro Day this year (Feb. 6), I found it only appropriate to give our college guys some shine - they have more than earned it - They are ELECTRIC. Below is a thread that I will add to over the coming weeks of guys who certainly would have been on the Pro Day roster AND guys that we believe our primed for a phenomenal 2026 season 🧵 First, let’s look at some of the best individual pitches from the winter from both our professional and collegiate groups ⚡️

Max Bain

19,982 views • 7 months ago

Here's the first preview of a brand new product we're working on called Fizzy. It's our take on an idea/issue/bug tracker. Aiming to ship later this year. I plan on doing videos every week or two showing progress, changes, stuff we're stuck on, new ideas we're trying out, etc. A true look at a product in active development with plenty of unknowns ahead of it. This first video highlights the Collection view — the heart of the product. Cards + two simple columns. Straightforward to the core, approachable for any kind of work, not just software development. Remember, this is all work in progress! In fact, I ran into an issue during the filming, logged it, and then it resolved itself. It's all in here. Happy to take any questions below. Thanks for watching.

Jason Fried

174,832 views • 1 year ago

Christopher Kinch KC, a retired judge, has said that his many years at the bar and on the bench have convinced him that trial by jury is “the gold standard — the best system yet devised to decide whether guilt has been proven.” David Lammy has, in many respects, acknowledged this indirectly by planning to retain jury trials for the most serious cases. An incredibly powerful justification would be needed to scrap this ancient liberty — and none has been provided. Watch Christopher Kinch KC at our In Defence of Jury Trials event last week 👇

Christopher Kinch KC, a retired judge, has said that his many years at the bar and on the bench have convinced him that trial by jury is “the gold standard — the best system yet devised to decide whether guilt has been proven.” David Lammy has, in many respects, acknowledged this indirectly by planning to retain jury trials for the most serious cases. An incredibly powerful justification would be needed to scrap this ancient liberty — and none has been provided. Watch Christopher Kinch KC at our In Defence of Jury Trials event last week 👇

The Free Speech Union

22,043 views • 6 months ago

Tomorrow marks one week since the U.S. proposal for a ceasefire in the sky, at sea, and on the front lines has been on the table. The implementation of this proposal could have begun long ago. Every day in wartime is a matter of human lives. Now, almost a week later, it’s clear to everyone in the world—even to those who refused to acknowledge the truth for the past three years—that it is Putin who continues to drag out this war. For a week now, Putin has been unable to squeeze out ‘yes’ to the ceasefire proposal. He’s saying whatever he wants, but not what the whole world wants to hear. The unconditional ceasefire proposal is essentially about saving lives, allowing diplomats to work on ensuring security and a lasting peace—the proposal that Russia is ignoring. Pressure is needed to finally make Moscow accept that their war must be brought to an end.

Tomorrow marks one week since the U.S. proposal for a ceasefire in the sky, at sea, and on the front lines has been on the table. The implementation of this proposal could have begun long ago. Every day in wartime is a matter of human lives. Now, almost a week later, it’s clear to everyone in the world—even to those who refused to acknowledge the truth for the past three years—that it is Putin who continues to drag out this war. For a week now, Putin has been unable to squeeze out ‘yes’ to the ceasefire proposal. He’s saying whatever he wants, but not what the whole world wants to hear. The unconditional ceasefire proposal is essentially about saving lives, allowing diplomats to work on ensuring security and a lasting peace—the proposal that Russia is ignoring. Pressure is needed to finally make Moscow accept that their war must be brought to an end.

Volodymyr Zelenskyy / Володимир Зеленський

2,157,160 views • 1 year ago

$One of the most tedious (but critical tasks) for software development teams is updating foundational software. It’s not new feature work, and it doesn’t feel like you’re moving the experience forward. As a result, this work is either dreaded or put off for more exciting work—or both. Amazon Q, our GenAI assistant for software development, is trying to bring some light to this heaviness. We have a new code transformation capability, and here’s what we found when we integrated it into our internal systems and applied it to our needed Java upgrades: - The average time to upgrade an application to Java 17 plummeted from what’s typically 50 developer-days to just a few hours. We estimate this has saved us the equivalent of 4,500 developer-years of work (yes, that number is crazy but, real). - In under six months, we've been able to upgrade more than 50% of our production Java systems to modernized Java versions at a fraction of the usual time and effort. And, our developers shipped 79% of the auto-generated code reviews without any additional changes. - The benefits go beyond how much effort we’ve saved developers. The upgrades have enhanced security and reduced infrastructure costs, providing an estimated $260M in annualized efficiency gains. This is a great example of how large-scale enterprises can gain significant efficiencies in foundational software hygiene work by leveraging Amazon Q. It’s been a game changer for us, and not only do our Amazon teams plan to use this transformation capability more, but our Q team plans to add more transformations for developers to leverage.$

One of the most tedious (but critical tasks) for software development teams is updating foundational software. It’s not new feature work, and it doesn’t feel like you’re moving the experience forward. As a result, this work is either dreaded or put off for more exciting work—or both. Amazon Q, our GenAI assistant for software development, is trying to bring some light to this heaviness. We have a new code transformation capability, and here’s what we found when we integrated it into our internal systems and applied it to our needed Java upgrades: - The average time to upgrade an application to Java 17 plummeted from what’s typically 50 developer-days to just a few hours. We estimate this has saved us the equivalent of 4,500 developer-years of work (yes, that number is crazy but, real). - In under six months, we've been able to upgrade more than 50% of our production Java systems to modernized Java versions at a fraction of the usual time and effort. And, our developers shipped 79% of the auto-generated code reviews without any additional changes. - The benefits go beyond how much effort we’ve saved developers. The upgrades have enhanced security and reduced infrastructure costs, providing an estimated $260M in annualized efficiency gains. This is a great example of how large-scale enterprises can gain significant efficiencies in foundational software hygiene work by leveraging Amazon Q. It’s been a game changer for us, and not only do our Amazon teams plan to use this transformation capability more, but our Q team plans to add more transformations for developers to leverage.

Andy Jassy

999,183 views • 2 years ago

This is like having an army of white hat hackers at your disposal. They break into your app, prove the exploit works, an open a PR that fixes it. It takes about 10 seconds to set up and can be automated to run nightly or weekly for any codebase. In an eval of real and recent vulnerabilities, which the models had never seen, Security Swarm found the bug in 72% of cases, the highest recall of any tool we tested, at ~2/3 the cost of the next most accurate alternative. 🤯 If you have an OSS repo you'd like me to fork and run Security Swarm on, drop a link!

This is like having an army of white hat hackers at your disposal. They break into your app, prove the exploit works, an open a PR that fixes it. It takes about 10 seconds to set up and can be automated to run nightly or weekly for any codebase. In an eval of real and recent vulnerabilities, which the models had never seen, Security Swarm found the bug in 72% of cases, the highest recall of any tool we tested, at ~2/3 the cost of the next most accurate alternative. 🤯 If you have an OSS repo you'd like me to fork and run Security Swarm on, drop a link!

nader dabit

120,233 views • 2 months ago

Russia must clearly see and truly feel that Ukraine will be in Europe – and that this cannot be stopped. That is why we are carrying out internal reforms and working externally to secure a clear date for Ukraine’s EU membership. If there is a clear date, it will mean that Russia will not be able to block our accession in any way. You see how different things get blocked, and how difficult it is for a united Europe to implement even decisions that have already been made. This must not be the case with opening the clusters for Ukraine or with our accession – this is a matter of trust, security, and the future. From an address to the European Council meeting (3/3).

Russia must clearly see and truly feel that Ukraine will be in Europe – and that this cannot be stopped. That is why we are carrying out internal reforms and working externally to secure a clear date for Ukraine’s EU membership. If there is a clear date, it will mean that Russia will not be able to block our accession in any way. You see how different things get blocked, and how difficult it is for a united Europe to implement even decisions that have already been made. This must not be the case with opening the clusters for Ukraine or with our accession – this is a matter of trust, security, and the future. From an address to the European Council meeting (3/3).

Volodymyr Zelenskyy / Володимир Зеленський

191,311 views • 5 months ago

Tomorrow is an important day. We are anticipating a historic conclusion from the European Union—a report on Ukraine's implementation of the European Commission's recommendations. And we are already planning our next steps following this report. Our legislative efforts and the strengthening of state institutions. Ukraine has already come a long way toward stronger ties with the European Union. We are fully aware that EU membership relies on a political decision shared by all EU members that want to see a new state join, but it also relies on the candidate state itself and its work to approximate and adapt EU standards and community norms. Ukraine will join the EU. And we will achieve this, in particular, as a result of our state's internal transformation that is completely consistent with the interests of our people. The EU represents economic security and social stability for Ukraine, and Ukraine represents the strengthening of the entire EU community. And it is critical that the Ukrainian parliament continues to support the legislative efforts required for our European integration.

Tomorrow is an important day. We are anticipating a historic conclusion from the European Union—a report on Ukraine's implementation of the European Commission's recommendations. And we are already planning our next steps following this report. Our legislative efforts and the strengthening of state institutions. Ukraine has already come a long way toward stronger ties with the European Union. We are fully aware that EU membership relies on a political decision shared by all EU members that want to see a new state join, but it also relies on the candidate state itself and its work to approximate and adapt EU standards and community norms. Ukraine will join the EU. And we will achieve this, in particular, as a result of our state's internal transformation that is completely consistent with the interests of our people. The EU represents economic security and social stability for Ukraine, and Ukraine represents the strengthening of the entire EU community. And it is critical that the Ukrainian parliament continues to support the legislative efforts required for our European integration.

Volodymyr Zelenskyy / Володимир Зеленський

740,159 views • 2 years ago

Former NASA Astronaut Edgar Mitchell said this on a radio station discussion on July 23, 2008: "I happen to be privileged enough to be in on the fact that we have been visited on this planet, and the UFO phenomenon is real. It’s been covered up by all our governments for the last 60 years or so." NASA issued an official statement responding to this allegation: "NASA does not track UFOs. NASA is not involved in any sort of cover-up about alien life on this planet or anywhere in the universe. Dr. Mitchell is a great American, but we do not share his opinions on this issue."

Former NASA Astronaut Edgar Mitchell said this on a radio station discussion on July 23, 2008: "I happen to be privileged enough to be in on the fact that we have been visited on this planet, and the UFO phenomenon is real. It’s been covered up by all our governments for the last 60 years or so." NASA issued an official statement responding to this allegation: "NASA does not track UFOs. NASA is not involved in any sort of cover-up about alien life on this planet or anywhere in the universe. Dr. Mitchell is a great American, but we do not share his opinions on this issue."

Disclosure Party

58,108 views • 7 months ago

I have proof that the evolution of security can be fast – and cheaper than old defense systems. This is an iPad with software that lets us control our security in real time. It’s true. We have these iPads – I have one, my Prime Minister has one, our Minister of Defense, and our top military commanders – they have it. It lets us see the front line in Ukraine, and even every enemy killed – with video proof. Right now, 90% of Russian losses on the front are caused by our drones. That’s why it’s so important to know who has the advantage in drones – and to be fast and strong in defending against them. The iPad also shows every strike in our skies, our sea area, and our long-range strikes against Russia. It gives us real-time control over people’s safety, and our infrastructure and energy sector. And I believe the evolution of security will make it possible for every leader, every defense minister – and even ordinary people – to have tools like this, and with them, a high level of protection of life. Leaders and ministers work for people. And if the leaders have power, it is only because people trust them with their security. With tools like this, people will not only trust – they will be able to see for themselves what is being done for their security. In real time. From my address to the Parliament of the United Kingdom (3/7)

I have proof that the evolution of security can be fast – and cheaper than old defense systems. This is an iPad with software that lets us control our security in real time. It’s true. We have these iPads – I have one, my Prime Minister has one, our Minister of Defense, and our top military commanders – they have it. It lets us see the front line in Ukraine, and even every enemy killed – with video proof. Right now, 90% of Russian losses on the front are caused by our drones. That’s why it’s so important to know who has the advantage in drones – and to be fast and strong in defending against them. The iPad also shows every strike in our skies, our sea area, and our long-range strikes against Russia. It gives us real-time control over people’s safety, and our infrastructure and energy sector. And I believe the evolution of security will make it possible for every leader, every defense minister – and even ordinary people – to have tools like this, and with them, a high level of protection of life. Leaders and ministers work for people. And if the leaders have power, it is only because people trust them with their security. With tools like this, people will not only trust – they will be able to see for themselves what is being done for their security. In real time. From my address to the Parliament of the United Kingdom (3/7)

Volodymyr Zelenskyy / Володимир Зеленський

522,722 views • 5 months ago