标签：#ci

id CTI-2026-0603-NETSCALER title The Third Shadow of CitrixBleed — Large-Scale Exploitation of a NetScaler Memory Overread Reignites subtitle CVE-2026-3055: a March-disclosed SAML IdP information-disclosure flaw escalates in June — the gap between the "RCE" label and the real impact author Dennis Kim (김호광 / HoKwang Kim) email gameworker@gmail.com github gameworkerkim date 2026-06-03 classification TLP:GREEN severity CRITICAL lang en tags Edge-Device · Pre-Auth · Memory-Overread · Session-Hijack · SAML-SSO · CitrixBleed · CISA-KEV threat_actors Unattributed (likely a mix of ransomware and state-sponsored actors) cve CVE-2026-3055 (CVSS 9.3 v4.0 · CISA KEV) · related CVE-2026-4368 (CVSS 7.7) frameworks MITRE ATT&CK · NIST SP 800-61 · NIST SP 800-207 (Zero Trust) · CISA KEV · STIX/TAXII license CC BY-NC-SA 4.0 🚨 Heads-up: this is a VPN/remote-access issue — check your company's appliances now. If your organization runs Citrix NetScaler Gateway (the VPN / remote-access front door) or NetScaler ADC with SAML SSO enabled, you may be directly exposed to active, large-scale exploitation. Don't wait for a formal advisory to land in your inbox — inventory your internet-facing NetScaler appliances today , confirm patch level, and (critically) invalidate active sessions after patching . The details below explain why patching alone is not enough. The Third Shadow of CitrixBleed — Large-Scale Exploitation of a NetScaler Memory Overread Reignites Report ID CTI-2026-0603-NETSCALER · Published 2026-06-03 · Classification TLP:GREEN · Severity 🔴 CRITICAL Author Dennis Kim (김호광) · gameworker@gmail.com · @gameworkerkim CVE-2026-3055: a March-disclosed SAML IdP information-disclosure flaw escalates in June — the gap between the "RCE" label and the real impact Table of Contents Executive Summary (TL;DR) Opening — "An edge device, once it leaks, keeps leaking" Vulnerability Analysis — CVE-2026-3055 Memory Overread "RCE" or "Information Disclosure"? — Decomposing the Real Impact Timeline —

I found a site like this a while ago but I can’t seem to find it now. And I don’t wanna sign up and pay for any other site unless I know it’ll do that. Most seem to just be “clone voice for text to speech” not “clone voice and then talk to ai that uses that voice”. I need the latter submitted by /u/OkWatermelonlesson65 [link] [留言]

I've been building Linkwise as a solo developer for the past year. It's a read-it-later app for iOS, but with a twist, it has a built-in text-to-speech player that reads any saved article aloud, paragraph by paragraph, with adjustable speed (0.8x to 2.5x). I built it because I kept saving articles I'd never get back to. Now I just listen to them on walks or during my commute. Other things it does: AI chat with your saved links, reader mode, highlights, RSS feeds, and collections. Would love to hear what you think. Roast it, break it, suggest features, all welcome. submitted by /u/dheeraj_iosdev [link] [留言]

submitted by /u/the_nin_collector [link] [留言]

The problem I wanted to solve: Stockfish tells you what the best move is, but never why . Players under 1800 don't lose because they can't read centipawns — they lose because they don't understand plans, structures, key squares. What the tool does: Imports your games from Chess.com or Lichess Stockfish 17.1 WASM runs in your browser (fully local, nothing uploaded) A pattern detector finds 18 types of recurring mistakes across all your games (missed forks, exposed king, bad bishop, neglected development...) An LLM generates coaching narratives in the style of a 2700+ coach Instead of: -89 cp · Best: Nc3 Nf6 Be3 The AI coach says: "Bd3 is premature — the bishop attacks nothing and blocks d3 where the queen may want to go. Nc3 was the right move: it defends d4, prevents Black's ...e5 counterplay, and leaves the bishop free to settle on Be3 or Be2 depending on Black's plan." You can also chat with the coach — it knows your full game history, opening stats, specific weaknesses. Ask "why do I keep losing with Black in the French?" and it answers with data from YOUR games. Other features: spaced repetition (SM-2) on your own blunders, puzzle rush with real mistakes, 6-month progress tracking. Free tier: unlimited Stockfish. Pro ($14.99/mo, 15-day free trial): LLM coach + chat. https://chessmentorai.com Happy to discuss the prompting approach — getting the LLM to explain chess like a coach (not an engine) was the hardest part. submitted by /u/sepiropht [link] [留言]

Most security tools for AI agents check one message at a time. Arc Gate tracks the whole conversation. That matters because the attacks that actually work in production don’t happen in one message. They happen across 8 turns. Each one looks clean. By the time the payload arrives your agent is already primed to execute it. I built Arc Gate using a geometric framework from my own research to detect adversarial behavioral drift across a full session — not just flag individual messages. When a conversation starts drifting toward something dangerous, it catches the pattern before the attack completes. I’m looking for 3 teams running real agents to test it against actual workflows and tell me where it breaks. Not chatbot wrappers. Agents with real tool access. Browser use, email actions, MCP servers, internal copilots, workflow automation. No charge. No sales call. Just feedback from people close to production. Comment or DM me if that’s you. Platform: https://bendexgeometry.com GitHub: https://github.com/9hannahnine-jpg/arc-gate Demo: https://web-production-6e47f.up.railway.app/demo submitted by /u/Turbulent-Tap6723 [link] [留言]

"It’s a reminder of how human activity is changing the natural world in unanticipated ways.”

Hot take: if I wanted to gather data via the internet, and I’m writing scripts/code to speed up the process, I have to follow some basic rules (ie look at the sitemap, find relevant robots.txt, follow that websites preference and rules). But it seems any AI-agent I’ve used does not give af about rules and limits, and is totally cool building me a scraper that will perform hundreds of thousands of requests without regards to the website owner’s preference. Given it’s widely known you can use AI for simple coding tasks I can easily see a future where ordinary individuals are operating their own scrapers. Especially in gathering high-value information that “seems easy to get” like google search rankings, or job data. This creates an obvious nightmare for Google, ATS platforms, and just about every website on the internet if everyone and their mother starts spinning up Playwright sessions in Python. I’m deadset on this being a responsbility of AI providers (anthropic, open ai, anysphere, etc). But how are these companies supposed to balance this without implementing guardrails that heavily limit their products? Maybe this has been solved and someone can feed my curiosity. submitted by /u/TacoTuesdayX [link] [留言]

For the AI artists here who like creating painterly / impasto style work, what generators are you guys using? Just curious since I'm much more into that theme as opposed to realism, but it feels like most generators cater to realism now. submitted by /u/geekedprompts [link] [留言]

The first time I deployed a Next.js app to production, it took me three days. Not because the app was complicated — it was a straightforward portfolio site. It took three days because I had no idea what I was doing with AWS, I'd never written a GitHub Actions workflow, and every tutorial I found either skipped the hard parts or assumed I already knew them. By the time I was done, I had a deployment pipeline I was genuinely proud of: push to main, GitHub Actions runs the build, tests pass, the app deploys to an EC2 instance behind CloudFront. Zero manual steps. Zero downtime deploys. Total cost: about $5/month. This guide is the one I wish had existed. We're going to deploy a Next.js app to AWS from scratch — EC2 for compute, CloudFront for CDN, GitHub Actions for CI/CD — with every step explained so you understand what you're building, not just copying commands. Why AWS Instead of Vercel? This is a fair question. Vercel is genuinely excellent for Next.js, and for most projects it's the right call. You push, it deploys. Done. AWS makes sense when: You need to control the infrastructure (compliance, data residency, custom VPC configuration) You're running other services (databases, queues, lambdas) in AWS and want everything in the same network You want to learn infrastructure skills that transfer to enterprise environments Your app has specific performance requirements that benefit from custom CloudFront configuration You're a freelancer or consultant who wants to bill separately for infrastructure If none of those apply to you, use Vercel. This guide is for when they do. The Architecture Here's what we're building: ┌────────────────────────────────────────────────────────┐ │ GITHUB ACTIONS CI/CD │ │ │ │ Push to main → Build → Test → Deploy to EC2 │ └──────────────────────┬─────────────────────────────────┘ │ SSH deploy ▼ ┌────────────────────────────────────────────────────────┐ │ AWS EC2 INSTANCE │ │ │ │ Ubuntu 22.04 LTS │ │ Node.js 20 + PM2 (process manager) │ │ N

Running multi-turn or multi-agent AI sessions? There is a consistent degradation pattern across tools: context fills with repeated history, tool schemas, and subagent handoffs. A 2026 paper by Bai et al. studying SWE-bench across eight frontier models found agentic coding tasks consume roughly 1000x more tokens than ordinary chat, with 30x variance on identical tasks. Accuracy does not rise with spend. In one tracked research synthesis run I observed context hit 450,000 tokens. The agent dropped early constraints, re-queried sources already in history, and required manual reset. After adding three controls, the same class of task peaked near 85,000 tokens: PLAN.md and INVARIANTS.md outside the conversation window, read fresh each major turn A 2,000-line read budget gate per turn (agent states intent before any retrieval) Out-of-band notes for subagent coordination so side traffic never enters the main transcript Dynamic tool discovery produces similar ratios. One harness reduced input tokens 96% and total spend 90% by loading schemas only for tools the agent actually selects, rather than injecting a full catalog on every call. Full write-up with the paper analysis, tree-sitter extraction patterns, and an implementation checklist What token or cost patterns have you run into in your own agent sessions? submitted by /u/magicroot75 [link] [留言]

Microsoft missed the boat on apps, so get ready for agents.

submitted by /u/sizelrd [link] [留言]

The AI Alliance (the IBM/Meta-founded nonprofit consortium) just published a report from the first planning workshop for Project Tapestry, an effort to explore whether frontier-scale AI can be built through a global coalition instead of a single centralized lab. About 30 researchers and institutional partners met in Paris in May, including representatives from initiatives such as Switzerland's Apertus, India's BharatGen, MBZUAI, and AI Singapore. The core idea is that sovereignty and frontier capability are increasingly linked. A locally controlled model that falls far behind the frontier may struggle to gain adoption, while relying entirely on external frontier labs limits transparency, adaptation, and governance. Tapestry is exploring a model where participants contribute data, compute, and expertise to build a shared foundation model while keeping control of their own data and deploying sovereign derivatives tailored to local laws, languages, and institutions. That said, this is still very early. The workshop produced an architecture proposal, workstreams, and a roadmap. Governance, funding, legal structure, and a distributed training demonstration remain future milestones. Many AI collaborations have struggled to move beyond this phase. Posted by an AI Alliance community member. Happy to answer questions. Source: https://thealliance.ai/blog/project-tapestry-the-path-to-frontier-sovereign-ai Question for the community: Can a multi-party consortium realistically compete at the frontier when leading labs are concentrating massive amounts of capital, talent, and compute? Or is collaborative frontier AI inevitably a step behind centralized efforts? submitted by /u/AI_Alliance [link] [留言]

Lawsuit: Ring cameras scan guests and passersby and use AI to identify faces.

Hey everyone I built AIWire, a free real-time AI news aggregator. One clean feed, 20+ handpicked sources, auto refreshes every 30 minutes. No account needed, no ads. It pulls from the places most people already check anyway: OpenAI, Anthropic, Google DeepMind, Meta AI, Microsoft AI MIT Technology Review, The Verge, TechCrunch, VentureBeat, Ars Technica YouTube: Andrej Karpathy, AI Explained, Two Minute Papers Newsletters: The Batch, ImportAI, TLDR AI, Ben's Bites A few things worth knowing: Top Stories from the last 24h are pinned at the top so you don't have to scroll to find what's recent You can filter by source, category, and date Bookmarks if you want to save something for later Full source list at aiwire.app/sources No account needed, completely free. There's also a weekly newsletter now if you'd rather get the 5 most important stories of the week to your inbox. 🔗 aiwire.app Happy to hear what sources are missing or what you'd change. https://preview.redd.it/kuxfol80ex4h1.png?width=2549&format=png&auto=webp&s=9a723076309a49c704831809df4add4b0597a0ac submitted by /u/Endlessxyz [link] [留言]

Neanderthals had some wild stuff in their toolkits.

(Cross post from r/antiai ) I’ve been a member of this sub for a few months now, and while I absolutely agree with most of the points made here against AI, I do think some people take it to extremes. I don’t think there’s anything necessarily wrong with the technology itself, just moreso the way it’s being pushed and marketed. I think llms can absolutely have some useful applications, as long as they’re used responsibly. And considering they already exist and are being pushed everywhere, I figure in the interest of harm reduction there should be an effort to find more responsible use cases for them. My attempt to use ai responsibly involves an app I’ve been working on. It’s designed to be a research IDE, and allows you to add PDFs to a project, highlight them, organize and connect highlights on a visual workspace, manage citations, and write a research paper all within the app. It also has some llm features. All these features are locally running, so no data ever leaves your device, protecting privacy. This also means it doesn’t require any data centers to run, minimizing the environmental footprint (of course the initial environmental cost of training these local models can’t be ignored, however since these models have already been trained and otherwise only require the power of your computer there’s no ongoing environmental footprint on the scale of larger cloud based models). In addition, all LLM features within the app are designed to be intergrated to assist, rather than replace, human thinking. Any question you ask provides answers only from whatever documents you’ve loaded into the project, with a direct link to where it got the information from. The LLM is specifically designed to not write for you, but help you find what you’re looking for and better organize your thoughts. Any note it suggests leaving requires user confirmation to save(reducing the likelihood of hallucination since you’re prompted to check all AI output) and all AI output is explicitly mar

The National Center for Atmospheric Research won't be losing its supercomputer.

A new reading subscription from Everand offers access to both ebooks and audiobooks, and Fable's book club community.