iiinova — where your digital self keeps evolving

Reposted by Alexandre Dulaunoy

Alexandre Dulaunoy @adulau.infosec.exchange.ap.brid.gy · 7h

Threat-Actor explorer v1.1.0 released with many improvements and upgrade to the latest Pivotick library Latest A standalone, browser-only HTML/JavaScript application for exploring the MISP threat-actor galaxy, UUID-based relationships across every cluster […] [Original post on infosec.exchange]

035

Reposted by Alexandre Dulaunoy

Alexandre Dulaunoy @adulau.infosec.exchange.ap.brid.gy · 01/10/2026

GCVE BCP-05-X-03: Bringing Vulnerability Handling Timelines into Vulnerability Records. Vulnerability records usually provide a good description of what a vulnerability is, which products are affected, how severe it may be, and where additional information […] [Original post on infosec.exchange]

GCVE BCP-05-X-03 - Vulnerability Handling and Disclosure Timeline. Overview.

011

Reposted by Alexandre Dulaunoy

Alexandre Dulaunoy @adulau.infosec.exchange.ap.brid.gy · 29/09/2026

The new AI conglomerates are publishing documents warning about the dangers of semi-open models that defenders can actually use, while those same conglomerates are restricting defenders’ access to their own models. #ai #cybersecurity 🔗🤦 […]

infosec.exchange

Original post on infosec.exchange

114

Alexandre Dulaunoy @a.paperbay.org.ap.brid.gy · 23/09/2026

Nous nageons dans le paradoxe de la suspicion. L’IA ne serait pas assez fiable pour écrire un livre, mais suffisamment fiable pour accuser quelqu’un de l’avoir fait. #ia #livre #lecture

000

Reposted by Alexandre Dulaunoy

Alexandre Dulaunoy @adulau.infosec.exchange.ap.brid.gy · 20/09/2026

VULNARCHIVE and GNA 1988: Automated Vulnerability Identifier Allocation in a Federated GCVE Ecosystem. One of the core ideas behind GCVE is that vulnerability identification does not need to depend on a single central authority. Independent GCVE Numbering Authorities (GNAs) can operate their […]

infosec.exchange

Original post on infosec.exchange

002

Reposted by Alexandre Dulaunoy

Alexandre Dulaunoy @adulau.infosec.exchange.ap.brid.gy · 18/09/2026

Tired of drafting vulnerability advisories from Git patches? We developed patch2vuln to facilitate the creation of security advisories directly from Git patches. With a single command, patch2vuln can assist an analyst throughout the advisory creation process: analyzing the patch, drafting the […]

infosec.exchange

Original post on infosec.exchange

021

Reposted by Alexandre Dulaunoy

Alexandre Dulaunoy @adulau.infosec.exchange.ap.brid.gy · 11/09/2026

I love to see clever use of the @gcve ecosystem and @SaschaRommelfangen did a cool GNA which is automatically creating GCVE records and structured security advisories from full-disclosure mailing-list or alike: 🔗 Project details vuln.freearchive.org 🔗 As it's a GNA, it's part of the […]

infosec.exchange

Original post on infosec.exchange

011

Reposted by Alexandre Dulaunoy

Alexandre Dulaunoy @adulau.infosec.exchange.ap.brid.gy · 11/09/2026

We had difficulties automatically classifying chats, messaging channels, and forums. So we tested several open-weight large language models for our use case. The benchmark is published below, along with a tool supporting the classification process. This helps us avoid manually classifying […]

infosec.exchange

Original post on infosec.exchange

023

Reposted by Alexandre Dulaunoy

Alexandre Dulaunoy @adulau.infosec.exchange.ap.brid.gy · 09/09/2026

The @gcve BCP-07 KEV format has been updated to allow the `Withdrawn` and `Reasserted` KEV Assertions. This allows to support case like CVE-2026-69836 . 🔗 gcve.eu/bcp/gcve-bcp-07/#withdrawn-… #cve #gcve #kev […] [Original post on infosec.exchange]

GCVE BCP-07 - Withdrawn and Reasserted KEV Assertions

001

Reposted by Alexandre Dulaunoy

Alexandre Dulaunoy @adulau.infosec.exchange.ap.brid.gy · 06/09/2026

Doing some statistics on the persistence of information published on security and threat intelligence blogs. A surprising number of the domains in the list below are NXDOMAIN nowadays. Don't assume that security information and threat intelligence will remain accessible over time, especially […]

infosec.exchange

Original post on infosec.exchange

101

Reposted by Alexandre Dulaunoy

Tim (Wadhwa-)Brown :donor: @timb.me.uk · 05/09/2026

Interesting Git repos of the week: Bugs: * github.com/MSNightmare/FalconFlank - everyone's favourite new source of 0day pops CrowdStrike Falcon * github.com/MSNightmare/HardBreacher - everyone's favourite new source of 0day pops Kaspersky AV Hard hacks: * […]

infosec.exchange

Original post on infosec.exchange

004

Alexandre Dulaunoy @a.paperbay.org.ap.brid.gy · 04/09/2026

The new map for Wolfenstein 3D should be The White House. #gaming #politics

012

Reposted by Alexandre Dulaunoy

Alexandre Dulaunoy @adulau.infosec.exchange.ap.brid.gy · 02/09/2026

GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference We are pleased to announce a GCVE workshop on 22 September 2026, from 14:00 to 18:00, hosted at the CIRCL/LHC offices in Luxembourg, just before the VulnOpticon conference. The workshop is free and […]

infosec.exchange

Original post on infosec.exchange

004

Alexandre Dulaunoy @a.paperbay.org.ap.brid.gy · 30/08/2026

Les librairies du Sillon Plonger dans une librairie, c’est bien plus qu’un simple acte d’achat ou de curiosité. Les librairies du Sillon, la liste ne fait que grandir. #librairie #paris #librairies #booklover @sillon_fictionnel 🔗 La liste des librairies […]

paperbay.org

Original post on paperbay.org

001

Reposted by Alexandre Dulaunoy

Alexandre Dulaunoy @adulau.infosec.exchange.ap.brid.gy · 24/08/2026

I spent many hours in vulnogram today and to be honest. I'm glad that a colleague started to work on a replacement called `vulniverse`. Still early beta but it's promising. #opensource #vulniverse #cybersecurity #cve #gcve :github: work in progress […]

infosec.exchange

Original post on infosec.exchange

011

Alexandre Dulaunoy @a.paperbay.org.ap.brid.gy · 23/08/2026

The AI police are truly doing essential work: accusing a photograph of being AI-generated when it was shot with a real camera, printed by hand as a cyanotype, and manually processed. It seems “AI-generated!” is just the new “my kids could do it.” #art #work #artwork #aipolice #sarcasm

000

Reposted by Alexandre Dulaunoy

Alexandre Dulaunoy @adulau.infosec.exchange.ap.brid.gy · 23/08/2026

I just released `ptrclassify` is a small, dependency-free Python library and CLI that infers likely IP usage from reverse-DNS PTR hostnames. It is intentionally heuristic and multi-label. PTR naming is operator-controlled and is not authoritative evidence of how an address is actually used. The […]

infosec.exchange

Original post on infosec.exchange

025

Reposted by Alexandre Dulaunoy

Alexandre Dulaunoy @a.paperbay.org.ap.brid.gy · 15/08/2026

How mature is this repository? My long quest for open-source software metrics When I discover an open-source software project for the first time, how can I estimate whether it is mature, healthy and usable? I just released OSSTRL - Open Source Software Technology Readiness Level to help me […]

paperbay.org

Original post on paperbay.org

135

Alexandre Dulaunoy @a.paperbay.org.ap.brid.gy · 15/08/2026

paperbay.org

Original post on paperbay.org

135

Reposted by Alexandre Dulaunoy

Alexandre Dulaunoy @adulau.infosec.exchange.ap.brid.gy · 13/08/2026

If you are curious about (nearly) everything we did the past months at the GCVE.eu initiative: gcve.eu/2026/08/13/gcve-recent-acti… We published a recap blog post. #gcve #cve #vulnerability […] [Original post on infosec.exchange]

GCVE recent activities: standards, software and a growing GNA community

021

Reposted by Alexandre Dulaunoy

Alexandre Dulaunoy @adulau.infosec.exchange.ap.brid.gy · 11/08/2026

From a research paper to running open-source code in just a few days. We (with @cedric) have been experimenting in Vulnerability-Lookup with the concept of Local Exploit Hazard, based on the recent research paper “Modeling Local Exploit Hazard — A Bayesian […] [Original post on infosec.exchange]

Implementation of the paper in vulnerability-lookup

135

Reposted by Alexandre Dulaunoy

Alexandre Dulaunoy @adulau.infosec.exchange.ap.brid.gy · 09/08/2026

Pretty cool idea from @nyanbinary - a bot to analyse fucked up references from the CVE records. @fuckeduprefs_bot Maybe we could imagine an archive bot at the same time to ensure that the references don't get lost. Just like archive.org or similar. Maybe something for @gcve to look into. #cve […]

infosec.exchange

Original post on infosec.exchange

001

Alexandre Dulaunoy @a.paperbay.org.ap.brid.gy · 08/08/2026

Maybe the AI bots trying to find endlessly new content on my blog post? Drive me these questions « Is human generated content what AI bot are only interesting in? Does this mean that human contribution is the only way to keep the system running before it collapse or read its peak? Is the AI […]

paperbay.org

Original post on paperbay.org

002

Reposted by Alexandre Dulaunoy

Alexandre Dulaunoy @adulau.infosec.exchange.ap.brid.gy · 01/08/2026

Sightings have long been a major topic of discussion in the CTI community, particularly in the field of vulnerability management. We have now published a GCVE BCP to standardise the format that has been implemented, tested and used operationally in […] [Original post on infosec.exchange]

Sighting overview on a vulnerability-lookup instance. db.gcve.eu

101

Alexandre Dulaunoy @a.paperbay.org.ap.brid.gy · 29/07/2026

"General Resolution: LLM usage in Debian" When people don’t understand a system, they try to regulate it. #ai #debian #opensource www.debian.org/vote/2026/vote_002

debian.org

General Resolution: LLM usage in Debian

020

Alexandre Dulaunoy @a.paperbay.org.ap.brid.gy · 28/07/2026

bora bora ou bora vocal Tu crées ton île, et tu l'évaste au maximum, quoi. Il faut que les gens soient extrêmement loin de toi, mais loin, parce que ton univers sera vaste, quoi, sera immense, sera énorme, sera énorme univers, quoi. Énorme puissance d'univers […] [Original post on paperbay.org]

072

Reposted by Alexandre Dulaunoy

Alexandre Dulaunoy @adulau.infosec.exchange.ap.brid.gy · 28/07/2026

The Radio Image Framing Protocol (RIFP) 1.0 is an experimental, extensible standard for sending images over low-rate radio links. The default rifp-cpfsk-4800 profile uses binary continuous-phase FSK and can be deployed around 433.92 MHz where local […] [Original post on infosec.exchange]

Radio Image Framing Protocol (RIFP) - test image (RLE)

038