With the exploits published as-is, you'll only get root inside the container: there's no explicit namespace break, and calling setuid() in a container just gives you root in the container.
However, it can be used to modify files that are passed into the container (e.g. Docker run -v), or files that are shared with other containers (e.g. other Docker containers sharing the same layers). kube-proxy with Kubernetes happens to share a trusted binary with containers by default, which is how it can be exploited: https://github.com/Percivalll/Copy-Fail-CVE-2026-31431-Kuber...
You don't need any setuid binaries. You could just as easily use the vulnerability to add a job to crontab(5) that causes the cron daemon to run whatever you want as root.
Similar to me, I learnt some html tags through a book which was sold at newsstand, once I was at my cousin's house using her computer without internet access, then I wrote a simple html page with the Win 95 cloud wallpaper as background image. My cousin was terrified how I did that!
imo, the real value of Ada/SPARK today is that it enforces a clear split between specification and implementation, which is exactly what your LLM needs.
You define the interface, types, pre/post conditions you want in .ads file, then let the agent loose writing the .adb body file. The language’s focus on readability means your agent has no problem reading and cross referencing specs. The compiler and proof tools verify the body implements the spec.
This is pretty standard for specification documents, probably more accurate to say AI sounds like them than the other way around.
Ignoring the particular technologies used (OAuth/JWT) it looks like they’re adding more auth to the devices themselves; think two computers connected to the same network switch not being able to impersonate each other.
Because clicking on a navigation button in a web app is a good reason to window.history.pushState a state that will return the user to the place where they were when they clicked the button.
Clicking the dismiss button on the cookie banner is not a reason to push a state that will show the user a screen full of ads when they try to leave. (Mentioning the cookie banner because AFAIK Chrome requires a "user gesture" before pushState works normally, https://groups.google.com/a/chromium.org/g/blink-dev/c/T8d4_...)
No idea how they actually do it, but I wouldn't be surprised if manual reports and actions play a big role. The policy doesn't need to be enforced reliably as long as it is plausible for reasonably big actors to get caught sooner or later and the consequences of getting caught are business-ruining.
But detecting it on a technical level shouldn't be hard either. Visit the page, take a screenshot, have an AI identify the dismiss button on the cookie/newsletter popups, scroll a bit, click something that looks inactive, check if the URL changes, trigger the back action. Once a suspicious site is identified, put it in the queue for manual review.
The URL does not even need to change, you can pushState with just a JavaScript object, catch the pop and do something like display a modal. (I use this pattern to allow closing fullscreen filter overlays the user opened)
Still, requires user interaction, on any element, once.
So the crawler needs to identify and click most likely the consent/reject button. Which may not even trigger for Googlebot.
So they likely will rely on reports or maybe even Chrome field data.
Field data is a great point - it should be really obvious when people click "back", and many then click back again immediately after (or close the tab, or whatever people do to "escape").
I wasn't aware of these glasses, pretty cool. Not sure I'm ready to drop that much money on a pair with prescription lenses though.
Would be useful to have my multimeter display in my field of view when heads down debugging a circuit. There are a few bluetooth meters on the market, so I think this is doable?
Looking at the SDK, the fixed LVGL font is a bummer. Ideally I'd like to have a raw framebuffer to control, though I imagine this is difficult to do over bluetooth without blowing your power budget. Maybe you could have a custom indexed tilemap and push sprites around?
reply