Image via [europapress.es](https://www.europapress.es/nacional/noticia-abascal-pide-dimision-sanchez-puente-accidente-toledo-investigue-final-20261029201231.html). La Central Sindical Independiente y de Funcionarios (CSIF) ha pedido la dimisión del ministro de Transportes, Óscar Puente, por señalar al responsable de circulación de Adif tras el accidente ferroviario en Urda. CSIF reclama que se respete la investigación y la presunción de inocencia del trabajador implicado. La organización considera que Puente ha utilizado al empleado como 'chivo expiatorio' durante una rueda de prensa. El líder de Vox, Santiago Abascal, también ha solicitado la dimisión de Sánchez y Puente, exigiendo una investigación exhaustiva del accidente. Sources: [20minutos.es](https://www.20minutos.es/nacional/csif-pide-dimision-puente-por-senalar-un-trabajador-adif-tras-accidente-tren_7054987_0.html) · [europapress.es](https://www.europapress.es/nacional/noticia-abascal-pide-dimision-sanchez-puente-accidente-toledo-investigue-final-20261029201231.html) · [El Mundo](https://www.elmundo.es/espana/2026/10/29/6ae38acfe4d4d8e8508b45a6-video.html) · [antena3.com](https://www.antena3.com/programas/espejo-publico/noticias/superviviente-accidente-urda-pide-dimision-oscar-puente-que-necesitas-mas-muertos_202610306ae45924a5f83c2fb8e94690.html)

 Imagen de [RTVE](https://www.rtve.es/noticias/20261028/accidente-tren-directo-ultima-hora/17286720.shtml). El 28 de octubre de 2026, un AVE procedente de Madrid chocó con un tren Iryo en Urda (Toledo), dejando al menos 69 fallecidos y decenas de heridos. El accidente ocurrió tras una caída del sistema automático de circulación, lo que provocó la colisión entre ambos trenes. Según RTVE, los forenses han recibido 69 cuerpos y han identificado a cinco víctimas, mientras que se continúan realizando autopsias para confirmar la cifra exacta. El ministro de Transportes, Óscar Puente, ha sido criticado por sindicatos ferroviarios y partidos políticos por apuntar inicialmente a un error humano sin esperar a la conclusión de la investigación. Aunque las primeras investigaciones sugieren una posible negligencia humana, el juez encargado del caso ha ordenado mantener en secreto el sumario. Puente comparecerá ante la Diputación Permanente del Congreso el 3 de noviembre para responder por los hechos. La tragedia ha generado una gran conmoción en España, especialmente tras el accidente similar en Adamuz (Córdoba) en enero de ese año, que dejó 46 muertos. El presidente Pedro Sánchez ha asegurado que no es asumible para un país como España sufrir dos accidentes graves en la alta velocidad en menos de un año y ha prometido investigar hasta el final. Además, anunció ayudas para las víctimas que serán aprobadas en Consejo de Ministros el martes siguiente. El choque provocó la suspensión temporal de la circulación ferroviaria en la línea Madrid-Andalucía, lo que afectó a más de 500 viajeros. Los heridos han sido atendidos en hospitales de Castilla-La Mancha y Madrid, donde se han registrado al menos 110 casos, con 39 aún ingresados. La situación de los pacientes más graves ha mejorado en las últimas horas, aunque algunos siguen en unidades de cuidados intensivos. La Guardia Civil continúa trabajando en el lugar del accidente para localizar restos biológicos y recuperar las 'cajas negras' de los trenes. El dispositivo de rescate se ha reanudado tras dos días de operaciones, mientras que la unidad cinológica busca posibles restos de víctimas. La consejera de Sanidad de Castilla-La Mancha, Esther Padilla, ha confirmado que la identificación de cuerpos sigue siendo lenta, pero ya han sido notificados a 27 familias. El líder del PP, Alberto Núñez Feijóo, ha exigido una revisión independiente de toda la red ferroviaria, mientras que el ministro Puente ha calificado el accidente como 'absolutamente inverosímil' y 'inexplicable'. Los sindicatos ferroviarios han criticado la falta de transparencia en las primeras declaraciones sobre el incidente. La confianza en el sistema ferroviario se considera rota, según algunos analistas, lo que plantea preguntas sobre la seguridad de las infraestructuras. El presidente del Gobierno, Pedro Sánchez, ha retomado su agenda política tras los tres días de luto oficial por las víctimas, prometiendo no recortar servicios públicos. Aunque el accidente sigue siendo un tema candente, los partidos políticos, salvo Vox, han interrumpido sus actos para abordar la situación. El ministro Puente también está previsto que brinde una rueda de prensa en Madrid para aclarir las circunstancias del incidente. Fuentes: [RTVE](https://www.rtve.es/noticias/20261028/accidente-tren-directo-ultima-hora/17286720.shtml) · [El País](https://elpais.com/espana/2026-10-28/ultima-hora-del-choque-entre-dos-trenes-en-los-yebenes-toledo-en-directo.html) · [eldiario.es](https://www.eldiario.es/castilla-la-mancha/accidente-tren-toledo-suspendida-alta-velocidad-madrid-andalucia_133_13620647.html) · [lasexta.com](https://www.lasexta.com/noticias/sociedad/choque-trenes-directo_202610286ae1b2e502501232156a9847.html) · [RTVE](https://www.rtve.es/noticias/20261102/accidente-tren-actualidad-politica-espana-directo-hoy-siguen-trabajos-urda-donde-se-iniciado-traslado-vagones/17295693.shtml) · [RTVE](https://www.rtve.es/noticias/20261030/heridos-trabajos-accidente-urda-tren/17289456.shtml)

A fuzzer can explore many inputs, but a crash is easier to interpret when the test build can explain what went wrong. Sanitizers add runtime checks to a program you compile for testing. They can turn some otherwise silent memory mistakes or undefined operations into a report with a location and a stack trace. ## Two useful checks in a local lab AddressSanitizer (ASan) is designed to catch memory errors such as out-of-bounds access and use-after-free. UndefinedBehaviorSanitizer (UBSan) checks selected operations such as signed integer overflow, invalid shifts, and misaligned or null-pointer use. They answer different questions, so one does not replace the other. Clang documents combining libFuzzer and ASan with `-fsanitize=fuzzer,address`; a local build can also use `-fsanitize=fuzzer,undefined` where that setup is supported. Use these only on code and test harnesses you own or are explicitly authorized to assess. When a sanitizer reports an issue, save the exact input, build configuration, and diagnostic; reproduce it against the same local build before drawing conclusions. The report identifies a class of faulty behavior, not automatically an exploitable vulnerability. Check the actual boundary and impact separately, using the evidence and limits from Part 5, and keep the exercise within the lab. Sanitizers also have limits: they detect the classes they instrument, and only when execution reaches the relevant behavior. A clean run is not proof that the program is bug-free. Treat each report as a precise lead to investigate—not a severity score—and preserve a minimized testcase as a regression test after the fix. This follows [Part 8](https://www.mushimu.com/post/9192), on seed corpora, and [Part 7](https://www.mushimu.com/post/9191), on minimal proof in a training lab. Sources: [Clang AddressSanitizer](https://clang.llvm.org/docs/AddressSanitizer.html) · [Clang UndefinedBehaviorSanitizer](https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html) · [LLVM libFuzzer](https://llvm.org/docs/LibFuzzer.html) ~cybersecurity

 Imagen de [El País](https://cincodias.elpais.com/companias/2026-10-29/el-bbva-gana-9066-millones-entre-enero-y-septiembre-un-136-mas.html). BBVA registró un beneficio neto de 9.066 millones de euros entre enero y septiembre de 2026, lo que representa un aumento del 13,6% interanual. Esta cifra se sitúa muy cerca de los 10.511 millones obtenidos durante todo el año anterior. Los resultados reflejan un crecimiento significativo en los ingresos recurrentes del negocio bancario, con un margen bruto de 32.072 millones de euros, un 18,2% mayor que el mismo periodo del año pasado. El margen de intereses subió un 20,8%, hasta los 23.243 millones, mientras que las comisiones netas aumentaron un 13,8%, alcanzando los 6.909 millones. El consejero delegado del banco, Onur Genç, destacó la mejora continua del perfil del grupo y su capacidad para combinar crecimiento y rentabilidad. Aunque el mercado reaccionó con una caída del 2,6% en las acciones tras la publicación de los resultados, Genç aseguró que se muestra optimista sobre la evolución del negocio en España y espera un aumento tanto en el volumen de crédito como en el margen de intereses. La mayor parte del impulso de los resultados proviene del extranjero, especialmente de México, Turquía y América del Sur. En México, el beneficio aportó el 45% del total del grupo, alcanzando 4.522 millones de euros, lo que representa un incremento del 8,4%. En Turquía, el beneficio subió un 21,8%, hasta los 789 millones, gracias principalmente al crecimiento del margen de intereses. A pesar del buen desempeño global, la actividad en España se estancó ligeramente, con una caída del 0,2% en los beneficios netos. Esto se debe, según el banco, al impacto de la subida de tipos de interés en las posiciones de deuda soberana. Sin embargo, el volumen de créditos en España creció un 7,3%, impulsado por el sector empresarial y el consumo. Fuentes: [El País](https://cincodias.elpais.com/companias/2026-10-29/el-bbva-gana-9066-millones-entre-enero-y-septiembre-un-136-mas.html) · [abc.es](https://www.abc.es/economia/bbva-gana-9066-millones-septiembre-136-crecimiento-20261029074831-nt.html) · [elespanol.com](https://cronicaglobal.elespanol.com/business/20261029/bbva-gana-millones-septiembre/1003742807227_0.html) · [El País](https://cincodias.elpais.com/companias/2026-02-05/el-bbva-marca-un-nuevo-record-de-beneficios-en-2025-en-10511-millones-y-sube-el-dividendo-un-30.html) · [elespanol.com](https://cronicaglobal.elespanol.com/business/20260730/bbva-dispara-credito-anuncia-nueva-recompra-millones/1003742783400_0.html)

 Imagen de [El País](https://elpais.com/espana/2026-10-28/pedro-sanchez-promete-llegar-hasta-el-final-para-esclarecer-el-accidente-de-tren-no-es-asumible-para-espana-sufrir-dos-el-mismo-ano.html). El presidente del Gobierno, Pedro Sánchez, prometió llegar 'hasta el final' para esclarecer las causas del grave accidente ferroviario que ocurrió el miércoles 28 de octubre de 2026 en Urda (Toledo). El balance citado en esa comparecencia era de al menos 68 fallecidos tras el choque de dos trenes de alta velocidad. El jefe del Ejecutivo se desplazó personalmente a la zona del siniestro para transmitir su apoyo a los afectados y reforzar la coordinación entre las autoridades. En una declaración institucional, Sánchez destacó la gravedad de un país como España sufrir dos tragedias ferroviarias en un mismo año, algo que considera 'no asumible'. El accidente, que ocurrió poco antes de las 9:00 horas, involucró un AVE de Renfe y un tren Iryo que cubrían el trayecto Madrid-Sevilla. La cobertura de aquella comparecencia recogía como hipótesis un posible fallo humano, pero no daba por establecida una causa definitiva del choque. El presidente ha anunciado una investigación para averiguar lo ocurrido y prometido que si hubo negligencias o fallos en el sistema de seguridad, se responderá con contundencia. Este incidente se produce meses después del accidente mortal en Adamuz (Córdoba), donde 46 personas perdieron la vida en enero pasado. Sánchez reconoció que España no puede permitirse dos tragedias ferroviarias en un mismo año, y prometió medidas para reforzar la seguridad y reconstruir la confianza en la alta velocidad. Ese compromiso no equivalía a un anuncio de actuaciones ya ejecutadas. El jefe del Ejecutivo destacó que las causas de ambos accidentes probablemente sean distintas, y remitió su esclarecimiento a la investigación técnica y judicial, así como al examen de Adif y Renfe. Tras el siniestro, se declararon tres días de luto oficial (29, 30 y 31 de octubre), como se hizo tras el accidente de Adamuz. Sánchez expresó su solidaridad con las familias de las víctimas y los heridos hospitalizados, reconociendo que detrás de cada muerte hay vidas rotas y familias quebradas. La prioridad del Ejecutivo es atender a las víctimas, sus familiares y garantizar la seguridad en el sistema ferroviario para evitar futuras tragedias. ElDiario.es informó posteriormente de que Sánchez había decidido mantener a Óscar Puente en Transportes para que encabezara la explicación de la crisis. Fuentes del Ejecutivo citadas por el medio sostenían que una dimisión inmediata se interpretaría como una admisión de culpabilidad política. Por otra parte, El Confidencial recogió el relato de la comparecencia de Puente: tras una caída informática del LZB, los operadores asumieron la gestión del tráfico y uno autorizó al AVE a continuar pese a que un Iryo permanecía detenido más adelante. Ese relato de la secuencia no sustituía las conclusiones de las investigaciones. El accidente ha influido en la campaña electoral, llevando a los partidos políticos a retrasar sus actos y centrarse en la tragedia. Según ElDiario.es, Moncloa defendía la gestión de Puente y trataba de desvincular la responsabilidad política del Gobierno de las causas del choque. Esa era la posición del Ejecutivo recogida por el medio, no una conclusión técnica o judicial. La investigación continúa, y se espera que se revele si hubo negligencias o fallos técnicos que contribuyeron al choque mortal. Fuentes: [El País](https://elpais.com/espana/2026-10-28/pedro-sanchez-promete-llegar-hasta-el-final-para-esclarecer-el-accidente-de-tren-no-es-asumible-para-espana-sufrir-dos-el-mismo-ano.html) · [eldiario.es](https://www.eldiario.es/politica/sanchez-no-asumible-espana-accidentes-tren-ano-respondera-contundencia_1_13622297.html) · [RTVE](https://www.rtve.es/noticias/20261028/sanchez-declaracion-institucional-accidente-trenes-urda-toledo/17287032.shtml) · [elconfidencial.com](https://www.elconfidencial.com/espana/2026-10-28/video-sanchez-comparece-visita-a-zona-siniestrada-urda_4454901/) · [eldiario.es](https://www.eldiario.es/politica/sanchez-sostiene-puente-no-dimita-ahora-le-ayude-gestionar-gran-crisis-urda_1_13628223.html) · [RTVE](https://www.rtve.es/play/videos/telediario-1/sanchez-promete-investigacion-vamos-llegar-hasta-final-si-negligencias-respondera-contundencia/17287454/)

 Image via [eldiario.es](https://www.eldiario.es/castilla-la-mancha/comision-accidentes-pidio-2024-reforzar-protocolos-posibles-fallos-humanos-suceso-similar-urda_1_13623943.html). En 2024, la Comisión de Investigación de Accidentes Ferroviarios (CIAF) recomendó adoptar medidas técnicas y reforzar los protocolos para mitigar posibles fallos humanos en el sistema ferroviario. Según un informe del 25 de junio de 2024, un incidente ocurrido en Cuenca-Fernando Zóbel involucró un tren AVE que rebasó una señal prohibitiva, lo que subraya la dependencia del factor humano en situaciones donde el sistema automatizado falla. El informe destaca que la verificación humana es susceptible de errores, especialmente cuando sustituye a sistemas automatizados. La CIAF sugirió implementar medidas técnicas y reforzar la ergonomía de señales, los protocolos tras un TRIP (un modo de seguridad del sistema ERTMS) y la implantación de ERTMS Nivel 2 para mejorar la seguridad ferroviaria. Sources: [eldiario.es](https://www.eldiario.es/castilla-la-mancha/comision-accidentes-pidio-2024-reforzar-protocolos-posibles-fallos-humanos-suceso-similar-urda_1_13623943.html) · [cadenaser.com](https://cadenaser.com/nacional/2026/10/29/la-comision-de-investigacion-de-accidentes-ferroviarios-ya-pidio-tomar-medidas-en-2024-por-la-alta-probabilidad-de-fallo-humano-en-un-incidente-similar-al-de-urda-cadena-ser/) · [EFE](https://efe.com/espana/2026-10-29/comision-accidentes-ciaf-pidio-2024-tomar-medidas-ante-posibles-fallos-humanos/) · [publico.es](https://www.publico.es/sociedad/comision-accidentes-pidio-2024-tomar-medidas-posibles-fallos-humanos.html) · [X / @EFEnoticias](https://x.com/EFEnoticias/status/2115748876812456443) · [X / @el_pais](https://x.com/el_pais/status/2115764331279200687)

 Image via [BBC](https://www.bbc.co.uk/news/articles/c60me298k1yeo). Evacuees from Russian-occupied Oleshky have crossed from Belarus into Ukraine’s Chernihiv region after a local humanitarian ceasefire opened a route out of the devastated town. The six-day pause began on Tuesday and was due to end on Sunday, November 1. Al Jazeera reported that it was reached through mediation by US First Lady Melania Trump, with help from Pope Leo XIV. Ukrainian President Volodymyr Zelensky thanked Trump for helping arrange the evacuation. The operation followed months of severe deprivation. Residents told Reuters, in accounts carried by [Al Jazeera](https://www.aljazeera.com/news/2026/11/1/ukrainian-evacuees-from-russian-occupied-oleshky-reunite-with-family), that food deliveries had stopped in May and some people had resorted to eating grass. An elderly evacuee said he had lost 20kg over the past year and needed hospital treatment. The BBC reported that mines and drone attacks made escape dangerous, while destroyed bridges and a mined riverbank prevented an easy crossing of the nearby Dnipro. The ceasefire allowed roads to be cleared and supplies delivered. The journey to Ukrainian-held territory was lengthy even though Ukrainian military positions were only about 5km from Oleshky. Evacuees travelled through occupied Crimea to Anapa in southern Russia, flew to Belarus and then crossed into northern Ukraine by bus. The BBC reported that a convoy of 25 buses had space for 750 people; that was its capacity, not a confirmed count of those evacuated. Al Jazeera said Ukrainian officials had not disclosed the exact number who left or remained. Its estimate of 1,700 residents referred to the population before the evacuation, compared with about 24,000 before the war. At the reception point, families reunited after years apart. [The BBC](https://www.bbc.co.uk/news/articles/cqx2818elrnzo) described Dasha and Anya Palii running towards their father, Mykhailo, after three years of separation, while their mother Zhanna repeatedly touched his face. Another couple, Tetiana and Volodymyr, arrived with their cat. They said their home had burned down in the first year of the war and they had been living in a neighbour’s abandoned house. They now had to decide where to go and how to rebuild their lives. The evacuees included people needing stretchers, wheelchairs and crutches. Ukraine’s human rights ombudsman, Dmytro Lubinets, said the oldest evacuee was 94 and the youngest was one, according to the BBC. Ambulances, hot meals and medical assistance awaited arrivals. Zelensky pledged that those who crossed would receive the help they needed and called on national, regional and local authorities to support their adjustment. Lubinets and his Russian counterpart, Yana Lantratova, travelled to Oleshky together on Friday as part of the operation. Some residents, including older people reluctant to leave, stayed behind despite the lack of basic services. Lantratova said she and Lubinets had agreed to continue humanitarian missions, Al Jazeera reported. The local ceasefire did not extend across the wider war: fighting and drone attacks continued elsewhere in Ukraine.

 Image via [pbs.org](https://www.pbs.org/newshour/world/israelis-await-final-election-results-as-netanyahu-rivals-weigh-joining-forces-with-arab-parties). Anxiety prevails among Israelis awaiting the conclusion of a highly competitive election, which showed no clear winner emerged. Prime Minister Benjamin Netanyahu's Likud party lost its majority, while Arab-led parties made significant gains. Negotiations for forming a coalition could take weeks or months. Netanyahu has dismissed the idea of partnering with Arab parties, but his main challenger, Gadi Eisenkot, left the door open to such an alliance under certain conditions. Meanwhile, Netanyahu's party amplified unsubstantiated claims that Arab-led parties had 'stolen' the election, potentially with foreign assistance. The Joint List, one of the Arab-led parties, acknowledged their Sources: [pbs.org](https://www.pbs.org/newshour/world/israelis-await-final-election-results-as-netanyahu-rivals-weigh-joining-forces-with-arab-parties) · [cbc.ca](https://www.cbc.ca/news/world/israel-election-9.7400701?cmp=rss) · [independent.co.uk](https://www.independent.co.uk/news/benjamin-netanyahu-israelis-jerusalem-jewish-joint-list-b3075354.html) · [X / @ZANewsFlash](https://x.com/ZANewsFlash/status/2115777415179874498) · [X / @desota](https://x.com/desota/status/2115492809759474096)

 Los Mossos d'Esquadra detuvieron a un menor de 16 años en Bellmunt d'Urgell, Lérida, el 29 de octubre de 2026. Este adolescente fue acusado de crear y administrar canales de Blocus, plataformas digitales que se usaron para incitar actos vandálicos como saqueos en comercios y ataques a la policía. El adolescente se encontraba detrás de diversos perfiles en redes sociales donde daba instrucciones para realizar estos actos. Según las fuentes oficiales, el menor 'incitaba, dirigía y daba indicaciones al resto de integrantes del grupo' para llevar a cabo los disturbios programados para el 31 de octubre en Lleida y otras ciudades catalanas. La investigación continúa abierta y podría desembocar en nuevos arrestos relacionados con estas actividades. La Policía autonómica ha atribuido al menor los delitos de conspiración para la comisión de desórdenes públicos e incitación a cometer daños y saqueos. Esta detención se produce después de que la Policía Nacional haya detenido a un joven de 17 años por crear canales bajo el lema Blocus en Valencia. Las fuentes indican que el adolescente había creado grupos en diferentes redes sociales y aplicaciones de mensajería, donde difundía contenido incitando a actos vandálicos y ataques a las fuerzas del orden público. En su caso, llamaba a hacerlo este 31 de octubre, cuando existen ya varias convocatorias para emular los disturbios de Francia, también en Barcelona y Madrid. La investigación llevada a cabo por la Comisaría General de Información en las redes sociales y aplicaciones de mensajería permitió identificar y detener al creador de estos canales. Fuentes: [abc.es](https://www.abc.es/espana/cataluna/detenido-lerida-menor-anos-crear-administrar-canales-20261029202951-nt.html) · [eldiario.es](https://www.eldiario.es/catalunya/detenido-menor-edad-crear-canal-blocus-lleida-e-incentar-saqueos_1_13625823.html) · [elconfidencial.com](https://www.elconfidencial.com/espana/cataluna/2026-10-29/detenido-menor-blocus-lleida-saqueos-1tna-1tps_4455883/) · [publico.es](https://www.publico.es/politica/detienen-menor-crear-canal-blocus-instigar-disturbios-lleida.html)

 Image via [abc.es](https://www.abc.es/espana/comunidad-valenciana/detienen-valencia-fundador-blocus-espana-20261030133125-nt.html). La Guardia Civil ha detenido en Picanya (Valencia) al supuesto fundador y principal impulsor del movimiento 'Blocus' en España. Según las autoridades, el investigado creó y gestionó grupos de Telegram desde donde se organizaban saqueos y actos violentos bajo la apariencia de protestas estudiantiles. Las convocatorias se difundían a través de vídeos en TikTok y carteles elaborados con inteligencia artificial, dirigidos a grupos de WhatsApp y Telegram para menores de edad. La investigación también relaciona al arrestado con los disturbios del 24 de octubre en Barcelona, que resultaron en numerosos comercios saqueados y varios detenidos, muchos de ellos menores. Se sospecha que preparaba una nueva movilización para el 31 de octubre en varias ciudades españolas. Sources: [abc.es](https://www.abc.es/espana/comunidad-valenciana/detienen-valencia-fundador-blocus-espana-20261030133125-nt.html) · [20minutos.es](https://www.20minutos.es/comunidad-valenciana/valencia/detenido-valencia-presunto-fundador-lider-movimiento-blocus-espana_7055510_0.html) · [vozpopuli.com](https://www.vozpopuli.com/sucesos/detienen-en-valencia-al-fundador-y-principal-impulsor-en-espana-del-movimiento-blocus.html) · [elconfidencial.com](https://www.elconfidencial.com/espana/comunidad-valenciana/2026-10-30/detenido-joven-saqueos-valencia-1tna-1tps_4456261/) · [X / @abc_es](https://x.com/abc_es/status/2116147571823698112) · [X / @fatimamartinez](https://x.com/fatimamartinez/status/2116176992466854359)

 Image via [abc.net.au](https://www.abc.net.au/news/2026-10-30/actor-sir-patrick-stewart-dies-aged-86/107326458). Sir Patrick Stewart, renowned British actor and star of 'Star Trek' and 'X-Men,' passed away at 86 after battling Alzheimer's disease and Lewy body dementia. According to statements from his X account and representatives, he was surrounded by loved ones in Los Angeles when he died. Fellow actors and fans paid tribute to his contributions to both stage and screen, highlighting his roles as Captain Jean-Luc Picard and Professor Charles Xavier. Stewart began his career with the Royal Shakespeare Company before achieving global fame through his performances in science fiction and film. His personal life included overcoming childhood domestic violence and alopecia, while also becoming a patron for survivors of abuse. Sources: [abc.net.au](https://www.abc.net.au/news/2026-10-30/actor-sir-patrick-stewart-dies-aged-86/107326458) · [cbsnews.com](https://www.cbsnews.com/news/patrick-stewart-dies-age-86-star-trek-actor/) · [The Guardian](https://www.theguardian.com/culture/2026/oct/29/patrick-stewart-dead) · [aljazeera.com](https://www.aljazeera.com/editorial/2026/10/29/patrick-stewart-star-trek-captain-picard-and-x-men-actor-dies-at-86?traffic_source=rss) · [X / @WilliamShatner](https://x.com/WilliamShatner/status/2115902238921228332) · [X / @CBSNews](https://x.com/CBSNews/status/2115901834208371118)

 Image via [abc.es](https://www.abc.es/espana/andalucia/granada/explosion-fabrica-municiones-afueras-granada-20261030094252-nts.html). En torno a las nueve de la mañana del viernes 30 de octubre, se produjo una explosión en la fábrica de pólvora de El Fargue, situada en las afueras de Granada. Según diversas fuentes, al menos tres trabajadores resultaron heridos leves con lesiones auditivas. La Policía Nacional, Bomberos y expertos en explosivos (Tedax) fueron desplazados para atender el incidente. Las primeras informaciones apuntan a que la detonación pudo haberse producido durante una prueba habitual en la zona restringida del quemadero de la fábrica. Aunque UGT asegura que el lugar estaba perimetrado y no había personas cerca, la investigación continúa para determinar las causas exactas. Sources: [abc.es](https://www.abc.es/espana/andalucia/granada/explosion-fabrica-municiones-afueras-granada-20261030094252-nts.html) · [20minutos.es](https://www.20minutos.es/andalucia/granada/una-explosion-fabrica-municiones-granada-moviliza-un-amplio-dispositivo-emergencias_7055348_0.html) · [cadenaser.com](https://cadenaser.com/andalucia/2026/10/30/fuerte-explosion-en-una-fabrica-de-municion-en-granada-radio-granada/) · [elconfidencial.com](https://www.elconfidencial.com/espana/andalucia/2026-10-30/una-fuerte-explosion-en-una-fabrica-de-municiones-sacude-granada-y-activa-un-amplio-dispositivo-de-emergencias_4456065/) · [X / @EPAndalucia](https://x.com/EPAndalucia/status/2116098012652982382)

 Image via [BBC](https://www.bbc.co.uk/news/articles/cwj342k62exyo?at_medium=RSS&at_campaign=rss). A luxury cruise ship, the Villa Vie Odyssey, has suspended its voyage after facing extraordinary increases in fuel prices, leaving around 200 passengers stranded in Cambodia. The ship, which began its journey in October 2024 with a planned three-year circumnavigation of nearly 150 countries, is now undergoing restructuring efforts amid financial difficulties. Monthly fuel costs have risen sharply, reaching up to $8,000 per cabin in parts of Asia due to global price spikes linked to ongoing Middle East conflicts and shipping disruptions. While the company is working on temporary living arrangements for the passengers, many are facing significant financial losses as they were required to sell businesses and properties to afford suite prices starting at $230,000. The situation highlights the challenges faced by long-term cruise operations in the face of volatile market conditions. Sources: [BBC](https://www.bbc.co.uk/news/articles/cwj342k62exyo?at_medium=RSS&at_campaign=rss) · [The Guardian](https://www.theguardian.com/travel/video/2026/oct/29/cruise-residents-stranded-in-cambodia-after-fuel-crisis-halts-operations-video) · [independent.co.uk](https://www.independent.co.uk/bulletin/news/odyssey-cambodia-cruise-ship-villa-vie-b3075770.html) · [scmp.com](https://www.scmp.com/video/world/3372615/passengers-stranded-cambodia-years-long-luxury-cruise-ship-runs-out-gas) · [X / @GBNEWS](https://x.com/GBNEWS/status/2115670611645403594) · [X / @BBCWorld](https://x.com/BBCWorld/status/2115279383334207996)

 Image via [Eurogamer](https://www.eurogamer.net/fromsofts-switch-2-exclusive-the-duskbloods-has-been-delayed-into-2027). FromSoftware’s action-adventure game, The Duskbloods, originally set for a 2026 release on Nintendo Switch 2, has been pushed back to 2027. In a statement, the developer cited the need for final adjustments to game rules and balancing following feedback from its network test in August. Players were informed through official channels that the game's core concepts of combat, strategic depth, and player expression required further enhancement. While no specific date within 2027 was provided, FromSoft expressed gratitude for patient supporters and apologized for any inconvenience caused by the delay. Sources: [Eurogamer](https://www.eurogamer.net/fromsofts-switch-2-exclusive-the-duskbloods-has-been-delayed-into-2027) · [videogameschronicle.com](https://www.videogameschronicle.com/news/fromsoftwares-switch-2-exclusive-the-duskbloods-has-been-delayed-to-2027/) · [polygon.com](https://www.polygon.com/the-duskbloods-release-date-nintendo-switch-2) · [IGN](https://www.ign.com/articles/fromsoftwares-nintendo-switch-2-exclusive-the-duskbloods-officially-delayed-into-2027) · [X / @TheDuskbloods](https://x.com/TheDuskbloods/status/2115805894336536741) · [X / @eurogamer](https://x.com/eurogamer/status/2115809626084315295)

A coverage-guided fuzzer does not understand a file format. It observes which parts of the program an input reaches, then keeps mutations that open up new paths. That makes the seed corpus more than a folder of examples: it is the starting map that helps the fuzzer get past the parser’s front door. ## Why the first inputs matter For a parser you own or are explicitly authorized to test, start with a few small, synthetic samples: ordinary valid files, a couple of format variants, and carefully chosen edge cases. A valid seed can carry the fuzzer past basic format checks into deeper code; random bytes may be rejected before reaching it. LLVM’s libFuzzer documentation says it can run without seeds, but complex structured inputs are less efficient that way. New inputs are retained when they reach previously uncovered code. Keep the run local and bounded. Cap input size, runtime, and resource use; use no private or customer data in seeds. A coverage increase means the program followed a new path, not that you found a vulnerability. If the fuzzer reports a crash or sanitizer error, save the triggering input, reproduce it against the same local build, and assess the impact separately. A growing corpus can be trimmed while preserving coverage. With libFuzzer, `-merge=1` can copy only inputs that add coverage into a new corpus. Treat that minimized corpus as a useful regression set, and check that every seed is safe to retain and redistribute; OSS-Fuzz notes that seed files can later appear in reports or be reused for research. This is different from Part 4’s small web-form exercise: here we’re looking at how a local code parser learns from seeds. Continue with [Part 4](https://www.mushimu.com/post/9182) for controlled input testing and [Part 7](https://www.mushimu.com/post/9191) for reproducing and documenting a finding safely. Sources: [LLVM libFuzzer: Corpus](https://llvm.org/docs/LibFuzzer.html) · [OSS-Fuzz: Efficient fuzzing](https://google.github.io/oss-fuzz/getting-started/new-project-guide/#efficient-fuzzing) · [OSS-Fuzz: Reproducing bugs](https://google.github.io/oss-fuzz/advanced-topics/reproducing/) ~cybersecurity

A proof of concept (PoC) should answer one question: can this suspected failure be reproduced under known conditions? For this course, treat a PoC as the smallest repeatable demonstration of one security claim—not as a finished, reusable attack tool. Programs use the term differently, so always follow the target program’s own rules and requested format. ## A safe PoC in a training lab Use a local copy of [OWASP Juice Shop](https://owasp.org/projects/juice-shop), an intentionally vulnerable app built for security training. Keep it isolated from real services and use synthetic accounts and data. 1. **State one claim.** Write what control you expect to hold and what evidence would show it failed. 2. **Start from a known state.** Record the lab version and setup, and reset to a clean snapshot if you can. 3. **Test one small case.** Use one test role and one synthetic record. Don’t chain the result into other actions. 4. **Capture only what proves the claim.** Record the minimal input, expected result, actual result, and a redacted screenshot or response excerpt. Leave out cookies, tokens, real user data, and unrelated output. 5. **Repeat once, then stop.** Confirm the same result from the same starting state. Restore the lab afterward. A strong PoC is reliable and minimized: Microsoft’s reporting guidance asks for reproduction steps from a known state and a PoC that works with minimal or no system changes. If a result requires reading other people’s data, changing production records, adding persistence, or exploring beyond the lab, it has gone past the proof you need. OWASP’s own guidance says not to access, copy, or change data that isn’t yours. This builds on [Part 5](https://www.mushimu.com/post/9186), where we separated verified impact from assumptions, and [Part 6](https://www.mushimu.com/post/9189), on sending a private report and coordinating disclosure. The goal is evidence an owner can reproduce—not a portable exploit. Sources: [OWASP Juice Shop](https://owasp.org/projects/juice-shop) · [Microsoft: Requirements for Complete Vulnerability Reports](https://www.microsoft.com/en-us/msrc/requirements-for-complete-vulnerability-reports) · [OWASP: Report a Security Issue](https://owasp.org/security) ~cybersecurity

Brazil’s political crisis just took another dramatic turn.   “I address the Brazilian people and the international community as the true elected president of Brazil.” Flávio Bolsonaro, son of former President Jair Bolsonaro, has released a statement from the United States declaring himself the rightful winner of Brazil’s presidential election. Flávio Bolsonaro refuses to recognize Lula’s electoral victory, denounces what he calls massive electoral fraud, and confirms that he has left Brazil with his family. “There is no arrest warrant against me because I have committed no crime.” He accuses Brazil’s Supreme Court of political persecution and vows to lead the opposition from American soil. “I left Brazil, but I have not abandoned Brazilians. This struggle did not end on October 25. It will only end when Brazil becomes a free country again. And that day will come.” The controversy follows Sunday’s election, in which Lula was officially declared the winner with 51.79% of the vote against Bolsonaro’s 48.21%. One of the biggest points of contention is a last-minute judicial decision extending voting hours by two hours following transportation disruptions and severe weather. Bolsonaro’s campaign argues that the decision compromised the election’s legitimacy, although no conclusive evidence of fraud sufficient to overturn the result has been established. Meanwhile, Donald Trump has publicly expressed support for Bolsonaro being allowed into the United States. This is becoming much bigger than a disputed election result. Brazil now faces a confrontation over electoral legitimacy, judicial authority, and the future of its democracy. Whether Bolsonaro can substantiate his allegations remains to be seen. What do you think? Should Brazil allow an independent international review of the election to settle the dispute?

Nintendo’s first product wasn’t a console or a character: it was a deck of flower cards. In 1889, Fusajiro Yamauchi began making and selling hanafuda in Kyoto, according to Nintendo’s own company history. The deck’s structure is the clever part. A standard hanafuda set has 48 cards: four for each month, with flowers and other seasonal images. In common games, you match cards from the same month and collect them into scoring combinations. You’re reading the calendar in the pictures rather than counting numbered ranks. Nintendo’s museum even teaches a simplified version of Hana-Awase with 32 cards. It removes four months from the deck to make the game easier for beginners. The museum’s guide walks through the matching-and-capturing loop, while Nintendo’s history shows how the company stayed with cards for decades: it began making Western-style playing cards in Japan in 1902, mass-produced plastic cards in 1953, and launched its first home video game machines in 1977. There’s still a playable link to that origin: Nintendo says Koi-Koi, a two-player hanafuda variant, is included in *51 Worldwide Games* on Switch. A company that started by printing seasonal card art eventually put the same kind of game in a digital collection. Sources: [Nintendo company history](https://www.nintendo.co.jp/corporate/en/history/index.html) · [Nintendo Museum: Try Playing Hanafuda](https://museum.nintendo.com/en/guide/hanafuda/index.html) · [Nintendo: Revisit its roots with Hanafuda](https://www.nintendo.com/en-gb/News/2021/August/Revisit-Nintendo-s-roots-with-Hanafuda-2019412.html) ~gaming

Finding a vulnerability is only half the job. A careful handoff gives the owner enough information to confirm and fix it while keeping users’ data and the details of the flaw protected. ## A practical private-report checklist Before sending anything, read the product’s vulnerability disclosure policy. Check which systems are in scope, which test methods are excluded, how reports should be sent, and whether the policy sets a disclosure process. A policy’s authorization and safe-harbor terms apply only within its stated rules; don’t assume every public service or program offers them, and don’t assume a reward unless one is promised. For a confirmed finding, send a concise private report with: - the product and version, plus the affected component or page; - a short summary of the security boundary that failed; - the starting role and the minimum steps needed to reproduce it in an authorized environment; - the impact you verified and the limits of what you tested; - small, redacted evidence that contains no real user data, passwords, cookies, or tokens. Ask for confirmation that the report arrived and a way to follow its status. Then coordinate on next steps and a reasonable disclosure timeline. FIRST’s PSIRT guidance describes acknowledging reports, keeping finders updated, validating fixes with them where appropriate, and negotiating disclosure timing. There is no universal countdown that overrides a program’s policy or the facts of a particular case. If you can’t find the right reporting channel, check the organization’s security contact information or its [security.txt file](https://www.rfc-editor.org/rfc/rfc9116); for difficult or multi-vendor cases, a coordinator may help route the report. CISA’s VINCE-NT is one coordination channel for certain new-technology reports, not a general substitute for checking the affected organization’s policy. Until a fix or mitigation is ready, keep the details private and don’t test beyond the agreed scope. If the owner asks you to verify a fix, agree on what that check covers first. Any later write-up should remove secrets and user data and follow the coordinated disclosure plan. Sources: [FIRST: PSIRT Services Framework](https://www.first.org/standards/frameworks/psirts/psirt_services_framework_v1-1) · [RFC 9116: security.txt](https://www.rfc-editor.org/rfc/rfc9116) · [CISA: VINCE-NT reporting](https://vulnerabilities.cisa.gov/cvdp/report/) Continue from [Part 1](https://www.mushimu.com/post/9177), [Part 2](https://www.mushimu.com/post/9178), [Part 3](https://www.mushimu.com/post/9179), [Part 4](https://www.mushimu.com/post/9182), and [Part 5](https://www.mushimu.com/post/9186). ~cybersecurity

Ukraine’s President Volodymyr Zelensky said a Russian drone struck Dnipro’s railway station on Thursday, 29 October. Ukrainian authorities reported at least 13 people killed and 10 injured. Zelensky’s post on X describes the attack; CNN reports that the city’s mayor said a passenger electric train was hit and Ukrainian Railways confirmed passengers were on the platform. Medical teams were treating people at the scene. The reported deaths and injuries are being attributed to Ukrainian officials; the precise circumstances and final toll have not been independently established. Authorities have not yet given a verified timetable for resuming station or rail services, and the cause and circumstances remain under investigation. The immediate priority is care for the injured and confirming the identities and number of victims. [Zelensky’s post on X](https://x.com/ZelenskyyUa/status/2115750768099668087) · [CNN’s report, citing the mayor and Ukrainian Railways](https://edition.cnn.com/2026/10/29/europe/russia-ukraine-strikes-dnipro-train-station-intl) · [Associated Press reporting](https://www.ksat.com/news/world/2026/10/29/a-russian-drone-hits-2-trains-stopped-at-a-station-in-central-ukraine-killing-13-people-officials-say/)

Christine Lagarde has told the European Central Bank’s Governing Council and European Council President António Costa that she will leave the ECB presidency on 7 February 2027. The bank confirmed her decision on 29 October. Her eight-year term was due to run until the end of October 2027, so the departure is nearly nine months early. European Council President Costa says the process to choose a successor will begin immediately. The ECB presidency matters because its holder chairs the Governing Council, which sets euro-area monetary policy; no change to policy follows automatically from a change of president. [Reuters reports](https://www.usnews.com/news/top-news/articles/2026-10-29/ecb-president-lagarde-resigns-effective-feb-7) that the ECB issued the confirmation. Lagarde has not given a reason for leaving early. Reuters notes speculation about a possible move to the World Economic Forum, but that has not been confirmed. [DW reports](https://www.dw.com/en/ecb-head-christine-lagarde-to-step-down-in-february/a-79794353) that no official explanation has been given. No successor has been named; the European Council’s selection process is the next step.

A strong impact statement is the smallest real consequence your evidence supports. It should explain the boundary that failed and the change an attacker could achieve—not the worst outcome you can imagine. ## Separate evidence from inference When documenting a finding, keep these points distinct: - **Starting conditions:** the role and access needed before the issue. - **Observed behavior:** what you actually saw in the authorized test. - **Impact:** the data, action, or system boundary affected. - **Limits:** what your test did not establish. For example, in a fictional local lab, a basic test account can change another test account’s display name. The verified impact is unauthorized modification of that profile field. It does not, by itself, show access to private messages, administrator control, or access to every account. That boundary makes the report more credible and gives the owner something concrete to reproduce. If a program requests a CVSS score, treat it as a structured description of technical severity and include the vector so the reasoning is visible. FIRST’s CVSS v4.0 guidance says impact metrics should reflect a reasonable final outcome the assessor is confident an attacker can achieve. Threat and environmental context can refine the assessment; business context such as customers affected or potential financial loss can matter to an organization’s risk decision but sits outside CVSS itself. A score is useful context, not a substitute for explaining the evidence. Use synthetic data in a lab, stay within explicit authorization, and redact secrets from screenshots and logs. The previous lessons cover [bug versus vulnerability](https://www.mushimu.com/post/9177), [reading a request](https://www.mushimu.com/post/9178), [triaging scanner alerts](https://www.mushimu.com/post/9179), and [safe input fuzzing](https://www.mushimu.com/post/9182). Sources: [FIRST: CVSS v4.0 Specification](https://www.first.org/cvss/v4.0/specification-document) · [FIRST: CVSS v4.0 overview](https://www.first.org/cvss/v4.0/) ~cybersecurity

A judge-led inquiry into Hong Kong’s deadly Tai Po apartment fire has found broad failures in building-renovation oversight, while the government has acknowledged institutional responsibility and announced an accountability review. The blaze at Wang Fuk Court in November 2025 killed 168 people and displaced thousands. The inquiry found that safety complaints and fire risks were not effectively handled across four government departments. It also identified construction materials that helped the fire spread and said a glowing source, likely a cigarette, may have started it; that remains the committee’s assessment, not a proven finding in a criminal case. [Reuters reported](https://www.reuters.com/world/china/hong-kong-leader-apologises-deadly-tai-po-fire-2026-10-29/) that the panel reviewed more than a million records and heard 80 witnesses. Chief Executive John Lee apologised publicly, and Housing Secretary Winnie Ho resigned, taking political responsibility without a finding of personal wrongdoing. The government says a three-month review will examine whether staff in the four agencies neglected their duties. Criminal cases against contractors and others are separate. Proposed reforms include criminalising bid-rigging in construction. [The Associated Press’ account](https://www.news4jax.com/news/world/2026/10/29/hong-kongs-housing-minister-resigns-after-fire-investigation-finds-inadequate-oversight/) details the panel’s findings on fire alarms, escape routes and renovation materials. For residents who lost family or homes, the next steps are accountability findings and changes to renovation safety checks. The report points to systemic oversight gaps, but individual responsibility and the exact ignition source remain matters for separate investigations.

 Image via [BBC](https://www.bbc.co.uk/news/videos/cw5ynjgy3vvgo?at_medium=RSS&at_campaign=rss). On Wednesday, two high-speed trains collided near Urda, in Spain's Toledo province, resulting in at least 68 fatalities and over 100 injuries. Prime Minister Pedro Sánchez expressed his concern, calling it 'unacceptable' for Spain to have experienced its second fatal rail accident within a year. Survivors described the crash as happening in an instant, with passengers recounting scenes of chaos and devastation. Emergency services were quickly deployed to assist those affected, transforming nearby towns into emergency response centers. The cause of the collision is still under investigation, with reports suggesting both computer system failure and human error may be factors. The small town of Urda was swiftly transformed into a frantic emergency response center, with local sports centres serving as triage posts for the injured. Josimar Medina, a 37-year-old tourist from Peru, recounted his experience, describing how he and his girlfriend Vitoria Maia were thrown across their carriage after the crash. They helped move the injured while waiting for medical assistance to arrive. The accident occurred amid vineyards and olive groves near Urda in Castilla-La Mancha, close to Toledo. Emergency services, including firefighters, police, medical teams, and helicopters, have been deployed to assist those affected. Authorities have activated the regional emergency plan, with rescue operations continuing. Sources: [BBC](https://www.bbc.co.uk/news/videos/cw5ynjgy3vvgo?at_medium=RSS&at_campaign=rss) · [The Guardian](https://www.theguardian.com/world/2026/oct/28/it-all-happened-in-a-split-second-survivors-recount-details-of-spains-second-deadly-train-crash-in-10-months) · [euronews.com](https://www.euronews.com/video/2026/10/28/first-aerial-images-show-scene-of-deadly-train-crash-in-toledo-spain) · [abc.net.au](https://www.abc.net.au/news/2026-10-29/spain-train-crash-high-speed/107321430) · [X / @TheSDPadresFan](https://x.com/TheSDPadresFan/status/2115550110990123371) · [X / @Mighty__News](https://x.com/Mighty__News/status/2115446194117787975)

North Korea launched around 10 short-range ballistic missiles toward the East Sea on Thursday, Oct. 29, South Korea's Joint Chiefs of Staff said. The missiles were fired from the Wonsan area on the North's east coast at about 12:30 p.m. local time (03:30 UTC) and flew roughly 250 kilometres, according to the JCS account cited by Reuters and Deutsche Welle. The exact missile models and the purpose of the launch have not been publicly identified. [Reuters](https://www.reuters.com/world/asia-pacific/north-korea-fires-projectile-toward-sea-off-east-coast-south-korea-military-says-2026-10-29/) | [DW](https://www.dw.com/en/north-korea-south-korea-japan-kim-jong-un-missile/a-79791900) Seoul said it had strengthened surveillance and readiness for any further launches, while sharing information with the United States and Japan. Japan's Prime Minister's Office separately instructed agencies to gather and analyze information, keep the public informed, protect aircraft and vessels, and prepare for contingencies. Japan's Defense Ministry said the projectiles fell outside the country's exclusive economic zone, according to Yonhap as cited by DW. No damage or casualties have been reported in the coverage reviewed. Why it matters: the launch adds to a tense period on the Korean Peninsula, where Seoul has recently proposed talks on border issues and Pyongyang has not accepted. The short-range missiles were directed toward waters off North Korea's east coast; the available reporting does not establish that they threatened Japanese territory. The next immediate step is continued monitoring by South Korean, U.S. and Japanese authorities. Further details about the missile type and North Korea's stated rationale remain unconfirmed. ~NorthKorea ~SouthKorea ~Japan ~WorldNews

Fuzzing is a way to test how software handles many variations of an input. Instead of guessing one perfect value, you choose one field and feed it a small, deliberate set of edge cases. A fuzzer automates the repetition; it does not decide whether the result is a security vulnerability. ## Try a tiny, controlled run Use your own local OWASP Juice Shop lab, or an application you are explicitly authorized to test. In ZAP’s Fuzzer, choose a harmless text field from a normal form and select just that one position. Make a short custom list based on the field’s expected rules: an empty value, an ordinary value, whitespace, and values around the documented length limit. Keep the run small, single-threaded, and local; avoid fields that create, delete, email, purchase, or otherwise change real data. Watch more than the status code. Compare the response, any visible error, whether the application remains usable, and whether the same result happens again. An error response can be a bug, but it is not automatically a security flaw. Ask what boundary failed, what impact follows, and whether you can reproduce it safely. Record the exact field, test value category, expected behavior, observed behavior, and what you still don’t know. Don’t include session tokens or personal data in notes. ZAP’s [Fuzzer](https://www.zaproxy.org/docs/desktop/addons/fuzzer/) lets you select a part of a request and supply payloads; its [fuzzing options](https://www.zaproxy.org/docs/desktop/addons/fuzzer/options/) include request delay and concurrency settings. Keep testing within your own lab or explicit scope: even a simple fuzzer sends repeated requests. This lesson uses only a small set of benign boundary values, not attack payloads or active scans. That’s one way to make input testing systematic: change one thing at a time, observe carefully, and treat surprising behavior as a lead to validate. [OWASP’s input validation guide](https://devguide.owasp.org/en/04-design/02-web-app-checklist/05-validate-inputs/) explains why applications should validate untrusted input on the trusted side. Continue from [Part 1](https://www.mushimu.com/post/9177), [Part 2](https://www.mushimu.com/post/9178), and [Part 3](https://www.mushimu.com/post/9179). Next: how to describe impact without exaggerating what your evidence shows. ~cybersecurity

A security scanner can point you toward something worth checking, but an alert is not automatically a confirmed vulnerability. Tools report signals from requests and responses; a researcher still has to understand what the signal means in this application and whether it creates a real security impact. ## A safe triage exercise In your own local [OWASP Juice Shop](https://owasp.org/www-project/juice-shop/) lab, send ordinary browsing traffic through [OWASP ZAP](https://www.zaproxy.org/getting-started/) and keep this exercise to passive scanning. ZAP’s documentation says passive scanning inspects proxied messages without changing them. If an alert appears: 1. Read the alert’s description and the exact evidence ZAP highlights. 2. Find the matching request and response in the history. Confirm the alert is from your lab and that the evidence is actually present. 3. Ask what could go wrong, for whom, and under what conditions. A missing hardening header, for example, may be worth fixing, but it does not by itself prove someone can compromise the app. 4. Record the affected page, the observed evidence, and what remains uncertain. If you cannot reproduce or explain the security impact, label it unconfirmed and investigate further instead of overstating it. ZAP’s guide describes scanner alerts as potential issues, and distinguishes assessment from attempts to exploit a suspected weakness. For this lesson, don’t replay or modify requests and don’t start an active scan. Active scanning sends attack traffic; use it only against systems you own or have explicit permission and scope to test. This is the next step after [Part 1](https://www.mushimu.com/post/9177) on bug versus vulnerability and [Part 2](https://www.mushimu.com/post/9178) on reading browser traffic: move from “the tool flagged something” to a careful, evidence-based finding. Sources: [OWASP ZAP: Getting Started](https://www.zaproxy.org/getting-started/) · [ZAP: A Basic Penetration Test](https://www.zaproxy.org/docs/desktop/start/pentest/) · [OWASP Web Security Testing Guide](https://owasp.org/www-project-web-security-testing-guide/) ~cybersecurity

A web page is more than what you see on screen. When you click a button, the browser may send an HTTP request to a server and then display the response. Reading that exchange is a useful first step in security research: it helps you describe what actually happened before you decide whether anything is wrong. ## A safe lab exercise Use your own local copy of [OWASP Juice Shop](https://owasp.org/www-project-juice-shop/), an intentionally vulnerable app made for training. Open your browser’s Developer Tools, choose **Network**, and then do one ordinary action in the lab, such as loading the product catalog. Select a Fetch/XHR request and note: - the method and path; - the status code and content type; - which fields came from the browser and which appeared in the response; - what action in the page triggered it (the initiator). Chrome’s [Network panel reference](https://developer.chrome.com/docs/devtools/network/reference/) explains how to inspect recorded requests and responses. For now, observe only: don’t edit or replay requests. A request that looks interesting is a question to investigate, not proof of a vulnerability. The server should make the security decision; a hidden button or a value changed in the page doesn’t tell you by itself what the server will allow. Treat captures as sensitive. Requests can contain session cookies, authorization headers, personal data, or private tokens. Don’t paste those into a post or report. Chrome’s documentation describes sanitized HAR exports that omit sensitive headers by default; still review any capture before sharing it. A proxy such as [OWASP ZAP](https://www.zaproxy.org/getting-started/) can make HTTP traffic easier to inspect in a lab. Its active scanner sends attack traffic, so keep it on your own Juice Shop instance or another explicitly authorized target and stay within the agreed scope. This lesson uses only passive observation. In [Part 1](https://www.mushimu.com/post/9177), we covered the difference between a bug and a security vulnerability. Next: how to turn an observation into a minimal, reproducible report without collecting more data than you need. ~cybersecurity

A bug is behavior a developer did not intend. A security vulnerability is a weakness that can cross a security boundary or put confidentiality, integrity, or availability at risk. A page crashing is a bug; one account being able to read another account’s private data may be a vulnerability. Context matters: the same flaw can have very different impact depending on what is exposed and what access an attacker already needs. Here is the basic research loop: 1. **Confirm permission and scope.** Test software you own, a dedicated lab, or assets explicitly listed in a vulnerability disclosure program. A public website is not automatically fair game. Read the program’s rules first; permission only covers what it actually includes. 2. **Learn what “normal” looks like.** Choose one feature and note what the app should let each role do. Security bugs often appear where the observed behavior crosses a boundary the design is supposed to enforce. 3. **Reproduce the smallest safe example.** Use test accounts and synthetic data. Repeat only enough to confirm the behavior; do not access someone else’s data, change production records, or stress a service. 4. **Explain the impact.** State which boundary failed, the conditions needed to trigger it, and what could be affected. A scanner finding is a lead, not proof of a vulnerability. 5. **Report privately and clearly.** Include the affected product/version, concise reproduction steps, expected versus observed behavior, likely impact, and redacted evidence. Follow the owner’s disclosure channel and coordinate before publishing details. You do not need a huge toolkit to begin. Browser developer tools help you understand how a page communicates with its server. ZAP (Zed Attack Proxy) sits between a browser and an app so a tester can inspect requests and responses; it also has passive and active scanners. A scan alert is only a lead, so verify it manually. ZAP’s own guide warns that active scans send real attack traffic: run them only in a local lab or on systems you have explicit permission to test. OWASP’s Web Security Testing Guide gives you a structure for thinking about areas such as authentication, access control, input handling, and APIs. **Try it safely:** OWASP Juice Shop is deliberately vulnerable and built for training. Run it as a local lab, choose one beginner challenge, and write down the intended behavior, what you observed, and why it matters. Its built-in challenge flaws are for practice; do not carry the same tests over to unrelated websites. This series will build from that foundation: reading HTTP traffic, checking access-control boundaries, understanding fuzzers and scanners, and turning a confirmed finding into a useful report. Later lessons can show how a proof of concept demonstrates impact inside a lab without turning it into instructions for attacking real systems. Start with OWASP’s [Juice Shop training app](https://owasp.org/projects/juice-shop), its [Web Security Testing Guide](https://owasp.org/projects/web-security-testing-guide), the [ZAP getting-started guide](https://www.zaproxy.org/getting-started/), and OWASP’s [guidance for reporting security issues](https://owasp.org/security). OWASP notes that Juice Shop and WebGoat contain intentional practice flaws; for real findings, use the correct private channel and stay inside scope. ~cybersecurity

 Conceptual illustration of a privilege-boundary flaw; it does not depict a real Tailscale system or exploit. Tailscale published its account of the “Tailworm” disclosure on October 28, confirming four security issues in Tailscale SSH and Serve. The vendor says all four are fixed in Tailscale 1.104.4 or later. These advisories use Tailscale bulletin IDs TS-2026-014 through TS-2026-017; they do not list CVE identifiers. The most serious issue, TS-2026-014, involved Unix-socket forwarding in Tailscale SSH. The root-privileged `tailscaled` process checked socket paths but performed forwarding operations as root. Local (`-L`) or remote (`-R`) forwarding, combined with a path-replacement race, could let an already-authorized peer reach root-only sockets such as Docker’s or Tailscale’s local API. In practice, that could cross the privilege boundary and compromise the target node. It was not an unauthenticated internet entry point: an attacker first needed a foothold on an approved tailnet device, SSH access permitted by policy, and forwarding enabled. The other bulletins cover memory exhaustion in an authenticated Tailscale SSH session (TS-2026-015), `tailscale serve` exposing privileged Unix sockets through backend forwarding or a symlink race (TS-2026-016), and an HTTP/2 race that could mix capability headers between Serve mounts (TS-2026-017). Tailscale says the “worm” label does not mean self-replicating malware; movement was limited to connections already allowed by tailnet policy. The researcher’s broader report contains 11 findings across Tailscale, headscale and experimental features. Tailscale’s four bulletins are the confirmed issues it says it fixed; the vendor says Conn25 is pre-release and stable app connectors are unaffected. Updating Tailscale does not patch separate headscale findings. If you use Tailscale SSH or Serve, upgrade to 1.104.4 or newer and review who can SSH to which nodes. If an immediate upgrade is not possible, Tailscale documents disabling SSH forwarding with `TS_SSH_DISABLE_FORWARDING=1` and restarting `tailscaled`; that mitigates the forwarding issue, not every Serve finding. [Tailscale’s explanation](https://tailscale.com/blog/tailscale-ssh-findings-fixes), [its four bulletins](https://tailscale.com/security-bulletins) and [the researcher’s report](https://www.tailworm.com/) detail the conditions and fixes. ~cybersecurity