Michal Špaček

@spazef0rze

In your web, securing your app. Hacker, webdev, speaker. Security @Shoptet, ex-@reporturi. HTTPS = How To Transfer Private Sh*. Also bsky.app, infosec.exchange.

Prague, Czech Republic

michalspacek.com

Replies Reposts Media

Pinned
Michal Špaček
@spazef0rze
Nov 21, 2023
Origin, site, eTLD, eTLD+1 and PSL are the terms I use in almost every post or talk and I needed a place to explain and compare them. This post started as a talk about something completely different, so... now I have to write the original one, too 😅
Origin, site, eTLD, eTLD+1, public suffix, PSL. What are they?
From michalspacek.com
1
Michal Špaček
@spazef0rze
Aug 14
I just learned there's a .CYOU top-level domain. I fully expected it to be a typo of a .CZ domain (because Czech and English keyboards have swapped Y and Z, and even I personally sometimes type .CY instead of .CZ), but no, not a typo, a real domain.
2
Michal Špaček
@spazef0rze
Jul 19
Update your WordPress: v6.9+ has a bug (GHSA-ff9f-jf42-662q), which combined with an earlier SQL injection (GHSA-fpp7-x2x2-2mjf) leads to Remote Code Execution. It's recommended to update immediately. Remember that time from vuln to exploit is now ~zero.
REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
From github.com
Michal Špaček
@spazef0rze
May 26
After many JS-related supply chain attacks, there's a new PHP one! "The attacker replaced many or all release tags in four laravel-lang/ repositories with malicious lookalikes that point to their own commits which contained malware."
Laravel Lang Supply Chain Advisory | Snyk
From snyk.io
Michal Špaček
@spazef0rze
May 24
Whenever I see an email like this (in my spambox), with a Google Form asking for your email and a repo URL, all I can see is yet another supply chain attack in the making. I wouldn't want to run a legit competition nowadays 😅 (Disclaimer: I have no idea what KaiCode is)
1