wildylion

libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution. References

    https://nvd.nist.gov/vuln/detail/CVE-2026-55200
    libssh2/libssh2#2052
    libssh2/libssh2@97acf3d
    https://www.vulncheck.com/advisories/libssh2-out-of-bounds-write-via-unchecked-packet-length-in-transport-c
    https://github.com/bikini/exploitarium/tree/main/libssh2-cve-2026-55200-poc
    https://web.archive.org/web/20260623211210/https://github.com/bikini/exploitarium/tree/main/libssh2-cve-2026-55200-poc

Who could've thought that injecting SF6 into blood vessels is actually safe enough to be FDA-approved... interesting.

You can say whatever, but I'll be calling this a 'slop-down menu' from now on.

Storm troopers, but not the kind you'd expect.

Only if it's Australia.

Try to get a middle hop somewhere at a russian datacenter. Sometimes these have DPI censorship boxes disabled (?) -- I know one that lets me forward simple Wireguard from mobile routers to a EU server with a few SNAT/DNAT rules, even though ordinarily that would get blocked at first sight.

(Sadly, it's just Mikrotik gear that can't use any fancy censorship evasion protocols).

That'll eventually get detected and put a massive target on the back of anybody dumb enough to use it. Sorry to burst your bubble.

This is the literal job of state security. Besides, most of those $#@$###s get in not by pretending they've been persecuted, but simply because they already have deep cover and hold passports of other countries.

And I sincerely hope that you will never have to know what it's like to flee your own country, first hand. Peace.

Fuck you. I have many people here (many of them queer) who had to leave everything and become forced emigres or asylum seekers.

Have a bit of compassion, would ya?

My childhood crush is in Ukraine (I mean, he's Ukrainian), my dear friend (Ukrainian) had to leave everything and seek refuge in NL. My friends (Russian) are under a constant threat of getting imprisoned for 10+ years because they still help support queer and trans people in Russia.

Compared to them I feel very privileged, because I was able to GTFO on my own. But if you think that all Russian citizens must be deported, you're either a troll or a madman. Besides, this is exactly what, for example, Stalin did to Chechens, or think about what the USA did to the Japanese.

Did it help someone? No. Did it ruin millions of lives? You fucking guess.

upd: made it all clearer, and sorry for all the profanity

I'm considering even creating a dial-up (yes, V.34 modem!) line somewhere near to Russia, to offer a side channel with text browsing, news, IRC and email. For when things get really, really bad (they will ...)

Before you ask: yes, dialup works on modern networks if the codec is G.711 (uncompressed). Most public phone network is this way because fax is a thing, but some bulk carriers or some enterprises use compressed codecs.

Side question, but what happens if there's a technical error with the service provider that leads to double spending?

Example: we bought tickets worth 300 EUR from Deutsche Bahn, they were hit by a DDoS and couldn't complete the transaction.

We got charged *twice* (i.e. 600 EUR and not refunded yet. AND no tickets!!!

Now they claim all they can do is to give us 600 EUR in vouchers (that are not even transferrable).

Would a Chargeback work in this case?

And my friend (who's ordered the tickets) has a very traditional bank that only gives a statement monthly, and probably accepts claims on every 29 of February, between 7 and 8 AM and only by fax (IYKYK those German companies...)