Hold up — let 4chan speak. They're onto something here

Hi,

We've archived the MITRE CVE database. The CVE DB is free and open source on GitHub. However, we're providing a backup location for the data. We doubt it'll magically disintegrate in ash, but if it does we have a copy.

https://vx-underground.org/Archive/CVE

According to USASpending, MITRE has received approx. $1,500,000,000 since 2008 from the United States government.

We could survive approx. 30,000 years with that much money 😂😂😂

We've been surviving for almost 6 years by begging nerds for spare change, sucking the dicks (and clits) of small business owners, and praying X payouts give us more than $50/month

For $500,000/yr we'd be a fuckin' MALWARE REPO MACHINE (3,000 years to spend $1,500,000,000)

If we got $1,000,000/yr (never will happen), vx-underground would transcend space and time, pull malware from the 4th dimension — we'd be producing malware content like we were in the Dragon Ball Z hyperbolic time chamber

If we had $1,000,000/yr, Bradley and I would travel to Russia to physically meet Lockbit in person and challenge him to a Yu-Gi-Oh duel to end his operations

hello tiny people living inside my computer

X employees shared online they're rewriting the X DM system and naming it 'XChat' — which is strange because I recall using XChat sometime in the late 90's, or early 2000's

For those young ones reading this: XChat is an IRC client

For those young ones reading this: IRC is kind of like Discord, except way slimmed down, way less features but way more flexible and you can host a server yourself

People who are 18 years old, as of 2025, were born the same year as the release of Halo 3 — the same year the original iPhone was released when Steve Jobs was alive.

The people you will be interviewing in the next couple of years do not know a world without smart phones.

Anyway, let that echo in your head tonight when you're trying to sleep. 2007 was 18 years ago.

Hello, how are you?

tl;dr doing stuff

Right now we've got 250GB+ of new malwares we need to push. We're in the process of syncing it, making local backups, etc. We also temporarily stopped migrating virus-dot-exchange, but it's still on the todo list.

As many of you have noticed, updates on things have been volatile and shakey. I greatly miscalculated the difficulty of preparation and deployment of mini-human. I had thought, to some degree, it was an exaggeration that it would require a great deal of effort — it turns out the entire planet (past, and present) was not lying.

Despite the deployment of Smelly Smellington Jr, the general plan will be as follows:

- Continue daily ingests and malware sample distribution from petikvx, JaffaCakes118, and Neiki__. These 3 act as the back bone of our malware ingestion cycle.

- If or when _BradleyVX returns from his family duties: continual archival of The Old New Thing, cat picture collection (semi-joking), and his work on malware collection. Bradley has primarily been responsible for the malware family collection and he will continual doing so.

- Cryakl will continue working on the malware builder collection. Cryakl has done an excellent job ensuring we're up-to-date on malware builders historically and present...ly (?)

- f0wlsec will continue his work on the APT malware samples and papers collection. If you do not see an update in a significant period of time, feel free to poke him with a stick.

My request to anyone who reads this: PLEASE do not hesitate to contact me (or whoever) regarding malware papers (reverse engineering, development, history, whatever). Even if the paper doesn't make it into the collection it is super-duper appreciated when someone notifies us of a potential paper. It makes my life so much easier. If you've written a paper for yourself, or your group, or your company — DON'T hesitate to notify me (or whoever in our group) so it can be archived.

How to send us a paper: literally just send the link on Discord, Twitter, Telegram, e-mail. That's all you have to do. If you send me enough cool stuff maybe you can take my job and be given a pretty staff sticker and I can focus more on other administrative tasks.

Anyway, i'll be AFK. You'll see a spike in silly posts and cat pictures. If this upsets you, I don't know bro, we're busy and this is all for free. You gotta deal with it for awhile.

Love you
- smelly smellington

Use TorGuard VPN.

I didn't have to append this is this post, but they're our hosting provider and the owner uses his company resources and time to collect cat pictures with us.

Bubble-dot-io employees have responded.

Bubble (or individuals representing the company) assert the code we shared yesterday is not a zero day exploit and we (or the researchers mentioned) failed to take appropriate measures to read the documentation provided by Bubble

In summary, they state each user is responsible for the security of their data and users must follow the appropriate Bubble-dot-io security guidelines. The issues we relayed yesterday do not impact Bubble-dot-io in totality, rather these are customers who failed to follow the guidelines

They also called us an embarrassment and said our post is borderline malicious because it is misleading because (or the researchers, whoever), did not read the security guidelines.

Hello,

We've removed the post on the Bubble zero day. The purpose of the post was to draw attention to the issue — which was indeed addressed.

As a recap, 2 researchers published a paper on Bubble-dot-io and how to exploit it. Bubble ignored them. We were requested to relay the issue loudly so it was addressed. It was addressed. Bubble asserts they do not consider this an exploit because this is the result of users failing to RTM and follow the Bubble security guidelines.

I will personally take the L that it was a stretch to classify this as zero day when this is the result of users not following the Bubble best practices guide. It does not impact Bubble in totality.

tl;dr 2 guys 1 bubble

Removed weird balloon thing from car. Now can safely store beer in car

Please drink and drive responsibly