推特安全流

AI 逆向对抗新思路，对软件保护有参考价值。

RT @quarkslab: "Software protection is futile, AI will break it", they said. But, does it? how? To shine some light read about Rémy Salim's experiments in "Defeating AI-Assisted Reverse Engineering" Where is the fair play, Claude? https://t.co/WiqzDEjCA8 https://t.co/UGuruFnX7j

AI 辅助开发安全工具的新实践，有参考价值。

Building an in-tree LLVM obfuscator solo, with an AI pair - @und3ath1 https://t.co/8yEDYtgthT

内核漏洞管理政策讨论，影响漏洞披露流程。

RT @spendergrsec: https://t.co/MHVO0KjRg1 https://t.co/8zaXgrHx7b CAP_NET_ADMIN vulns aren't vulns anymore? What happened to the cow milking machines? What happened to "we don't know your usage"? Do they have any idea how many currently active CVEs fall under this same case? https://t.co/xqWnYiK65T

AI 自动化漏洞利用研究前沿，值得关注。

RT @BSidesCbr: We're excited to welcome @chompie1337 back to BSidesCbr After keynoting two years ago, she's back with: "Building an Autonomous N-day Exploit Generation Pipeline" Pwn2Own winner. Leader of IBM X-Force Offensive Research. https://t.co/WpX27UEFkz https://t.co/MQX8rvMiCX

移动端安全对比，对设备选择有参考价值。

RT @GrapheneOS: @rhensing Cellebrite's documentation they've been consistently able to exploit iPhones for the past several years. Meanwhile, they still hadn't progressed past exploiting a locked GrapheneOS device updated in 2022 and even lost unlocked device extraction in 2024. https://t.co/DPJSQITAgi

恶意软件分析样本，可供研究。

Here a public scan result with the updates, a classic process injection https://t.co/AWCBgKcg3g

C2 框架新特性，对红队有参考价值。

Virtual Machine integration for BRc4 is now complete. I have to agree that building the VM was the easy part. The hard part was the integration while keeping the size of badger low. Low-key happy that the final size of the VM interpreter embedded inside the badger is a total of around 35kb. Might bring it down a bit further if I could improve the inhouse compiler. 2.7 release is gonna be nuts!

支付安全新攻击手法，影响面广。

RT @TheHackersNews: ‼️ Warning - Expired Visa payment cards can be revived for real purchases. New “Zombie Card” attack rewrites the expiry date a contactless terminal reads over NFC, while the card’s cryptography still validates. See how it works - https://t.co/PCqmL8OKma

EDR 绕过新思路，对红蓝双方有参考价值。

⤵️ MS-Nightmare Un-defend v2 — What Happens When Signatures Can’t Land https://t.co/03kljHlxqn

国内安全公司数据泄露关联分析，有情报价值。

RT @tdatwja: 四川无声信息技术(Sichuan Silence)は、无糖信息(NoSugarTech)やi-SOONのリークデータを調べている際につながりを見つけました。 「双螺旋攻防实验室」や「PKAV」がキーワードですかね... ↓ 无糖信息について調べた時のメモです。 https://t.co/WgWCmFcaxa

真实入侵案例分析，对防御有参考价值。

RT @Officialwhyte22: We changed the Linux account password. The login still happened again. That was when I knew the password was no longer the real problem. This happened on one of our Ubuntu web servers. A deployment account called deploy was meant to be used only by our internal build system. Nobody was supposed to be logging into that account manually, especially not after midnight. But while checking the authentication logs, I noticed something strange. The deploy account had logged in several times from the same external IP address: 9:08 PM. 11:11 PM. 1:14 AM. At first, the assumption was simple. Somebody had the password. So the password was changed. Later that night, another login appeared. That did not make sense. I went back to the SSH logs and checked the authentication method properly. The log did not say: Accepted password It said: Accepted publickey Now we had something. Whoever was accessing the server did not need the password anymore. I checked the account’s SSH configuration and opened: /home/deploy/.ssh/authorized_keys There were two keys inside. The first belonged to our legitimate build server. Nobody recognised the second one. Even more interesting, the authorized_keys file had been modified at 8:54 PM. The first suspicious login happened about fourteen minutes later. I generated the fingerprint of the unknown key and compared it with the fingerprint recorded in the SSH logs. Exact match. That second key was what had been used for all three suspicious logins. So changing the password was never going to stop the access. The attacker already had their own SSH key sitting inside the account. We disabled the deployment account, preserved the authentication logs and SSH files, removed the unauthorized key, rotated the affected credentials and started reviewing what had happened on the server during those sessions. What made this incident interesting was how easy it would have been to misunderstand it. If we had only seen repeated logins after a password reset, we might have assumed the new password had somehow been compromised again. But Linux had already told us exactly what was happening. Accepted publickey Sometimes one word in a log changes the whole investigation.

APT 行动分析，新恶意软件情报。

Bitdefender Labs researchers analyse SilkParasite, a cyberespionage operation, assessed with medium confidence as China-nexus, that targeted government bodies across Central Asia. They found 7 RAT families in use, 5 of which were previously undocumented. https://t.co/415zUnSPs4 https://t.co/YVUKPGhdA5

银行木马活动分析，有情报价值。

Acronis researcher Santiago Pontiroli looks into recent Grandoreiro campaigns. Grandoreiro activity remains concentrated in Latin America, with Mexico accounting for the largest share of observed samples. https://t.co/Q3fS5DCTbE https://t.co/KDBhi5f8UV

移动端恶意软件新变种，影响面扩大。

Zimperium's Vishnu Pratapagiri writes about a new variant of the ToxicPanda Android banking trojan. This version introduces significant enhancements, including a comprehensive set of 167 remote commands, and substantially expands its targets globally. https://t.co/6o0tVupWjR https://t.co/5vWeuyi12N

AI 时代漏洞利用新概念，值得关注。

RT @Margin_Research: New terminology alert! Welcome to the multiverse of the half-day: https://t.co/LkAm7ncJ9I

硬件安全研究，影响 AMD 平台安全模型。

Unlocking everything on the AMD CPU with DRAM scrambling: PSP, C6, microcode, SMM, etc (@xoreaxeaxeax) https://t.co/6dJhLeBHcU #infosec

APT 行动实例，展示供应链攻击风险。

RT @Joel_P_Atkinson: T-Mobile found unusual (Chinese government-backed hacking Salt Typhoon) behavior coming from a router belonging to a different telecom company. Staff drove there and snipped the cable connecting the box https://t.co/JmJc5umior

大型平台故障根因分析，有参考价值。

RT @acolombiadev: I work at GitHub. yesterday was rough and i'm not pretending otherwise. full root cause report is up if you want the timeline and numbers, and what we are doing to prevent this from happening again. https://t.co/05do2WFoMa

PIC 开发教学资源，对红队有参考价值。

RT @MalwareBibleJP: 読み込まれる場所が変わっても動くコード、いわゆるPIC（Position-Independent-Code）の書き方を、どのツールを使う場合にも通じる基礎として体系立てた、Tradecraft-Gardenの教材動画「PIC-Development-Crash-Course」。回避技法をC2から切り離して部品化する研究プロジェクト自身が公開したもの。 ただし収録後に操作コマンドが一本化されたため、動画に映るコマンドの書き方が現行版と食い違うという注記あり。手元で同じ手順を試すなら収録当時の古いアーカイブを使うように、という案内も添付。 プロジェクト側はこれらの成果物を、検知エンジニアリングやEDRの試験、攻撃を模した演習に使える素材として位置づけています。実際に出回るPICローダーがどう組み立てられるかを、攻撃者の実装を待たずに防御側が追える教材でもあります。 【要点の整理】 ・想定する環境として名前が挙がるのは、PIC向けのリンカであるCrystal-PalaceとStardustの2つ。それ以外で書く人に向けては、公開資料集へのリンクを1本置くという扱い ・2026年6月29日のリリースでlink、piclinkなど5つのコマンドが廃止され、cpl [command] という単一の入り口へ統合。視聴案内では、linkがcpl link、piclinkがcpl buildに当たるとの明記 ・同じ手順を試す際に使うよう示されているのは2025年9月10日リリースのアーカイブ（tcg20250910-bsd[.]tgz）で、動画が参照するファイル群はこの版に含まれるとの記載 詳細は以下を参照： 動画本体： https://t.co/gTB1oWsSvx 視聴案内と注記： https://t.co/UOOZdvhFM0 公開時の告知： https://t.co/sXTjLGI3Zv コマンド統合の記載： https://t.co/g7OnTuaieN (※可能な範囲でファクトチェックは実施済なものの、元記事の精度依存や速報・要約の性質上漏れもありうるため、正確な情報は一次情報を直接参照のこと)

EDR 内部机制研究，对红蓝双方有参考价值。

RT @x33fcon: #x33fcon 2026 talks: Levi Cailleret - EDR Introspection > https://t.co/VZfMs6nPvx https://t.co/8nEUHyBtfE

勒索软件大规模攻击，影响面广。

RT @slashdot: CISA: Medusa Ransomware Hit Over 500 Critical Infrastructure Orgs https://t.co/THhZ0uzTqa

沙箱逃逸技术分析，有参考价值。

RT @_r_netsec: The Curious Incidents with DNS in the Sandbox at Escape-Time https://t.co/6esURa29OH

HTTP 请求走私新变体，影响 Web 安全。

RT @_r_netsec: CRLF-Powered Desync Attacks: Beheading HTTP Streams https://t.co/HYy81sByHS

沙箱逃逸新案例，影响 WebAssembly 安全。

RT @_r_netsec: I escaped the WebAssembly's sandbox and got arbitrary shell execution on the host. https://t.co/SkCXMmkFuB

浏览器成为红蓝对抗新战场，检测难度大。

RT @cr3ghost: How much visibility does your EDR really have when persistence and C2 live inside Chromium? New research from @SpecterOps explores Chromium extensions as a C2 + persistence mechanism, turning the browser itself into an interesting red vs blue battleground. Red teamers will love this. Detection engineers should read it twice. https://t.co/kb6hxq7cLg #RedTeam #DetectionEngineering #EDR

物联网设备漏洞，无需认证即可利用。

RT @SecAlertsCo: 📡 Wavlink WN531P3/WN535M1: critical stack overflow via strcpy in export_pingortrace.cgi, CVSS 9.3, no auth required, network-exploitable. CVE-2026-74843 — check your firmware. #cybersecurity #ciso #cto #vulnerabilities #msp https://t.co/Yxj7ezLXab https://t.co/iWm8VJWm4F

零点击攻击链，影响 Windows 域环境。

RT @SynackRedTeam: A Domain Admin didn't click a phishing link. They just opened a meeting invite, and that was enough to hand over their domain account. SRT researcher Metin Yunus Kandemir found how a stored HTML injection on an internal web app, paired with a DNS trick that lands an attacker's server in Windows' "Local Intranet" zone, triggers automatic NTLM authentication with zero user input. Metin Yunus breaks down the full attack path, proof of concept and fixes in his Exploits Explained Blog: https://t.co/oiKXCnfqme #ExploitsExplained #ActiveDirectory #NTLMRelay #OffensiveSecurity #SynackRedTeam

AI 辅助恶意软件开发教学，有参考价值。

my new platform will teach users how to build extremely high quality implants with AI. not slop. I'll show how to setup a workflow to maintain granular control over code and logic, and gain the benefits of AI dev speed, while not sacrificing design and OPSEC

移动端安全 OS 发展动态，有参考价值。

RT @Sans_Google: GrapheneOS clarifies their Motorola partnership. The first devices with GrapheneOS support should arrive in 2027. They will start with flagships (higher-end hardware than current Pixels, so more expensive). Lower-end devices will take more time to meet their requirements because the updates and security features aren’t as good, mostly due to how Qualcomm handles it. Useful extra details for anyone following the project. Official clarification here 👇 https://t.co/9Vz4uTp3sU Are you waiting for these Motorola GrapheneOS devices… or sticking with Pixel for now? #GrapheneOS #Privacy #OpenSource #DeGoogling #Motorola

红队工具新特性，有实操价值。

Made a lot of improvements in implants session & QUIC Protocols. Making some cool BoFs and some of the cool features like plugin system will be coming up. correction: yesterday i was disclosing smb pivoting. today it's tcp pivoting. https://t.co/uuaZlKLxkc

APT 攻击手法分析，有情报价值。

Earlier this month, I wrote about .ppkg packages and how to use them for code execution, including a detailed detection strategy. It looks like the only threat actor that used provisioning packages was Water Gamayun 🇷🇺 🖊️ https://t.co/9ug5FGt5vh https://t.co/ES3asGqS5E

恶意软件开发技术，有参考价值。

API Hashing New Medium post, in this one we will see how to resolve Windows API addresses by hash computed entirely at compile time, leaving no function name strings in the binary https://t.co/Vsz61kuKn8 https://t.co/YtDhn4Hpb3

移动端内核漏洞，影响 Pixel 设备。

RT @pkqzy888: Pixel 11 just arrived. Such a great phone. Naturally, we had to see how long it would take to get a kernel LPE working on it. 😄 Here is one. Responsible disclosure already made a few weeks ago. https://t.co/hIziAi1TMP

移动端取证知识，有参考价值。

The idea behind this post is important, but saying “everything on your phone is forever” is technically too broad. Deleting a file does not automatically mean a forensic examiner can recover that exact file forever. What happens after deletion depends heavily on the phone, operating system, file system, encryption, application involved, backups, cloud synchronization and what happens to the storage afterwards. On older storage systems, deleting a file could simply remove the reference pointing to that file while the underlying data remained on the storage until something overwrote it. That made traditional deleted-file recovery much more straightforward. Modern smartphones are different. iPhones and Android devices use flash storage, strong encryption and storage-management mechanisms that can make direct recovery of deleted data significantly more difficult. Once encryption keys are destroyed, storage blocks are reclaimed, or the device performs operations such as garbage collection/TRIM, recovering the original deleted content may become impossible. But this is where digital forensics becomes interesting. Investigators are not always looking for the original file itself. A deleted photograph might still leave behind a thumbnail, timestamp, filename, database entry or cloud copy. A deleted message might still appear in an application database, notification history, synced device, backup or another participant’s phone. A deleted browser search might leave traces in browser databases, cached content, DNS records, account activity or cloud-synchronized history. A deleted application may still leave configuration files, logs, databases or references showing that it previously existed. Even when the content itself is gone, metadata can sometimes prove that something happened, when a file existed, when an application was opened, when a device connected to Wi-Fi, when a USB device was attached, or when an account communicated with another account. Investigators may also obtain evidence from places outside the physical phone entirely: iCloud or Google backups, application providers, synced laptops or tablets, email servers, cellular-provider records and other devices involved in the communication. So the better way to explain this is: Deleting something from a phone does not guarantee that every trace of it disappears. Sometimes the original data is recoverable. Sometimes only fragments or metadata survive. Sometimes another system still has a complete copy. And sometimes the data really is gone. That distinction is exactly why mobile forensics is much deeper than simply pressing “recover deleted files.” A forensic examiner reconstructs activity by correlating artifacts from the device, applications, accounts, backups and surrounding infrastructure until those individual traces begin to tell the full story.

物联网设备安全基础知识。

A smart thermostat may look like a simple temperature controller, but inside it is actually a small network-connected computer managing one of the most important systems in your home. At the centre is the main processor. This is the part that handles the thermostat’s logic, processes sensor readings, runs the device firmware, communicates with the network and decides when the heating or cooling system should turn on or off. The temperature and humidity sensors continuously measure the environment around the device. Some models also use occupancy, motion or ambient-light sensors to understand whether someone is home and adjust the temperature automatically. That is how smart thermostats can build schedules and reduce unnecessary energy usage. The Wi-Fi module and antenna connect the thermostat to your home network. Once connected, the device can communicate with a mobile app, cloud services, smart-home platforms and sometimes voice assistants. This allows you to change the temperature remotely, view energy reports, receive alerts and manage schedules even when you are not at home. Inside the device, flash memory stores the firmware and configuration data, while RAM gives the processor temporary working memory while the system is running. Some devices may also include a secure element or cryptographic chip to help protect sensitive keys used for authentication and encrypted communication. The HVAC interface and relays are where the digital side of the thermostat meets the physical heating and cooling system. When the processor decides that the room needs more heat or cooling, it activates the correct control circuit, which then tells the HVAC equipment what to do. This is also where cybersecurity becomes important. A smart thermostat does not operate alone. It can be connected to your router, cloud account, mobile app, smart-home platform, voice assistant and other IoT devices. That means the attack surface is much larger than the thermostat sitting on the wall. Weak passwords, outdated firmware, poor Wi-Fi security, exposed cloud accounts or excessive app permissions can all create problems. A compromised account could potentially allow someone to view device information, change settings or interact with connected smart-home services. Even the data produced by the thermostat can be sensitive. Temperature schedules, occupancy patterns and usage history may reveal when people are normally home or away. That is why protecting the account and network matters just as much as protecting the physical device. Good security starts with strong unique passwords, multi-factor authentication where available, updated firmware, WPA2 or WPA3 Wi-Fi, limited app permissions and regular monitoring of account activity. The diagram is a simplified educational representation, so exact internal components and layouts will vary between manufacturers and models. The main lesson is simple: A smart thermostat is not just a thermostat. It is a sensor platform, computer, network device, cloud-connected service and physical controller all working together. When you secure IoT devices, you are not protecting only the hardware. You are protecting the entire ecosystem around it.

Windows 内核研究资源，有参考价值。

Chad Everdox appreciation post. Nick ‘Everdox’ Peterson (@nickeverdox) is genuinely one of the most underrated reverse engineers and Windows researchers in the industry. A lot of people know Riot Vanguard. Far fewer know the depth of Windows internals, kernel, anti-debugging, hypervisor and reverse engineering work behind one of the engineers who helped build and advance it. His old blog is an absolute gold mine. Some of this research is more than a decade old and still covers concepts people are learning and rediscovering today. Old but gold: Easy anti-trace with SYSCALL: https://t.co/cWpMDBIHzX Debugger detection with GetProcessIoCounters: https://t.co/NlQUlZQyVO BTF + LBR anti-tracing: https://t.co/ugj2T4VdPL Paged virtual memory as an anti-debug / anti-dumping primitive: https://t.co/R8fVpHinQC Kernel/user shared page kernel-debugger detection: https://t.co/SOgN6v0AHt RTL_USER_PROCESS_PARAMETERS anti-debugging: https://t.co/YggdAETOTW Full archive: https://t.co/Qbg8ScFxIt Then there is InfinityHook, another Everdox contribution that became a reference point for Windows kernel instrumentation: https://t.co/iSEJpIvye4 And his own article on https://t.co/SLm7Vlyd93: PatchGuard: Detection of Hypervisor Based Introspection [P1] https://t.co/pJNWLBE2Gu If you are interested in reverse engineering, Windows internals, Windows kernel research, anti-debugging, anti-cheat engineering, hypervisor internals or obscure tricks buried deep inside the OS, his work is invaluable. Also bookmark the wider https://t.co/SLm7Vlyd93 archive: https://t.co/oGY1wYHPFw That site is multi-author and contains excellent work from @daaximus , @aidankhoury across reverse engineering, kernel internals, virtualization and EPT. People spend a lot of time chasing the newest research. Sometimes the real gold has been sitting online for 10+ years. #ReverseEngineering #WindowsInternals #Infosec

EDR 绕过工具，有参考价值。

PussyBlocker-UndefendV2 - Security Update Disruption tool: Targets: ✅ Windows Defender ✅ Windows Update ✅ Kaspersky ✅ ESET https://t.co/0wP8hNhYvS

AI 监控新功能，有参考价值。

RT @TheRegister: Microsoft gives Task Manager another task: Watching AI workloads https://t.co/FZqduunZdn

移动端安全 OS 生态讨论。

RT @GrapheneOS: @IntCyberDigest The devices from sold by these companies mostly use their own fork of AOSP or GrapheneOS. The companies forking GrapheneOS often make insecure changes such as disabling our USB-C port protection and locked device auto-reboot timer. They market these changes as being improvements.

macOS 取证知识，有参考价值。

A Mac user downloaded an application, moved it to another folder and renamed it. The file looked completely normal, but macOS still remembered where it came from. That memory was stored inside an extended attribute called com(.)apple(.)quarantine. When Safari downloads a file, macOS can attach hidden metadata containing the downloading application, a timestamp and a unique identifier. Finder does not normally show this information. In the image below, the @ beside the application’s permissions reveals that extended attributes exist. The xattr command then exposes the quarantine record, while spctl shows that Gatekeeper rejected the unsigned application. This is why macOS may warn you about an application even after it has been renamed or moved. The warning is not based only on the filename, the file is carrying its download history with it. For forensic investigators, that invisible tag can help connect a suspicious file to the browser or application that introduced it. Useful inspection command: xattr -l ~/Downloads/QuickNote.app

社会工程学提醒，有参考价值。

RT @Malwarebytes: Ever receive a random text like "what's for dinner?" from a number you don't recognize? Replying confirms your number is active and responsive, making you a valuable target for scammers. Here’s why a polite response is worth money to cybercriminals. https://t.co/7H5itEEWx8

安全配置讨论，有参考价值。

This should be the default

Linux 硬件支持进展，有参考价值。

RT @twtayaan: Apple's newest MacBooks can now boot Linux. Linus Torvalds just released Linux kernel 7.2, and buried inside the changelog is initial support for Apple's M3 chip. There is no official driver, no documentation, no cooperation from Apple at all. The Asahi Linux team spent months reverse-engineering Apple Silicon from scratch, with zero help from the company that built it. Right now it only boots to a serial console. Full graphics acceleration is still a work in progress. But the hardest part is done. The M3, one of Apple's most locked-down chips, now runs code Apple never signed off on. Back in 2020, Torvalds himself said getting Linux running on Apple Silicon looked like too much work for him personally to take on. A small team of volunteers started the project anyway in early 2021. Five years later, one MacBook at a time, they are quietly proving that a locked platform is not the same thing as an impossible one. Source: https://t.co/0zjIQi0Uor

文件系统性能改进，有参考价值。

RT @phoronix: Btrfs Ready With More Performance Improvements For Linux 7.3: Some ~3x To ~5x Wins https://t.co/vZ82aEzCwW

攻击趋势观察，有参考价值。

RT @HackingLZ: There is an entire follow on novel here about how attackers, once inside network and often even for initial access largely go after abuse of legitimate functionality, identity, configuration, and trust relationships rather than traditional software bugs. A lot of what actually gets people owned has never required a novel memory corruption vulnerability in the first place.

移动端间谍软件威胁，有参考价值。

RT @citizenlab: Senior researcher @jsrailton spoke to @techcrunch about the “unprecedented” number of Apple users who recently received notifications alerting them to suspected spyware attacks against their devices. Read: https://t.co/EvAH1SjqBc

勒索软件生态趣闻，有参考价值。

RT @TheRegister: Ransomware crook poses as recovery firm to steal payments from fellow extortionists https://t.co/SBXJW4cXC2

移动端取证进展，有参考价值。

RT @IntCyberDigest: ‼️ BREAKING: The Netherlands Forensic Institute has found a way to crack Google Pixel phones, though it did not say which OS the phone was running. There is a high chance they were using an OS like GrapheneOS, since all three suspects were using Google Pixel phones. Or perhaps they are just fans of Google products. They have already cracked one of the suspects' phones — that of Swedish national Veronica K., a suspect in a triple murder — prosecutors told the high-security court at Schiphol today. The phone held images of weapons and stacks of cash, plus chats investigators can now read. The Forensic Institute expects to crack the two co-defendants' Pixels too.

Windows 安全机制基础知识。

HVCI, or Hypervisor-protected Code Integrity, is one of the important security features built on top of VBS. Normally, Code Integrity runs as part of the normal Windows environment. With HVCI, kernel-mode Code Integrity runs in the isolated VBS environment, while the hypervisor helps protect that security boundary from the normal OS. Why does this matter? The Windows kernel has extremely high privilege. If an attacker exploits a kernel vulnerability, they may gain powerful memory read/write capabilities. One possible next step is modifying kernel code or creating executable kernel memory. HVCI makes this much harder. With HVCI enabled, kernel executable memory is subject to stronger Code Integrity rules. Code must pass Code Integrity validation before it can execute, and HVCI prevents memory from being both writable and executable. So an attacker cannot simply do: Get kernel memory write -> modify executable code -> execute it HVCI also affects kernel drivers. Drivers execute in kernel mode, so they need to follow these memory and code-integrity rules. For example, HVCI-compatible drivers should not: Create writable + executable memory Generate executable code dynamically Modify executable system memory Treat arbitrary data as executable code The important part is the trust boundary. HVCI does not prevent kernel vulnerabilities from existing. It makes it harder to turn a successful kernel compromise into arbitrary modified kernel code execution. The simplified model is: Normal Windows kernel -> VTL0 Code Integrity -> isolated VBS environment Hypervisor -> protects the isolation Kernel code -> must satisfy Code Integrity before execution So HVCI is not a replacement for fixing kernel vulnerabilities. It is a mitigation that makes the post-exploitation path much harder, especially attacks that depend on modifying or creating executable kernel code.

行业观点，有参考价值。

CVEs everywhere 0days everywhere RCEs everywhere And yet I still see some posts say AI won't affect cybersecurity 🤡

行业趋势预测，有参考价值。

RT @fr0gger_: My guess is that we will see an increase of vulnerabilities exploitation for 2-3 years until we get an inflection point where most software are running with new security baselines.

关键基础设施安全指南，有参考价值。

RT @NSACyber: NSA and others releases guidance on applying prevention tactics to strengthen defense of U.S-based programmable logic controllers being targeted by cyber actors using AI. Learn more: https://t.co/HO99aak50Y #cybersecurity #AI

内核漏洞修复进展，有参考价值。

RT @FrankOverF1ow: Fixed upstream and backported to 6.12.103 while the latest Debian 13 is 6.12.101 so....

无实质内容。

https://t.co/SEdzxdEVBT

无实质内容。

https://t.co/RH8Ka3FpHG

个人经历，有参考价值。

Sharing my Small Journey about how i got into corporate Red Teaming.... i found these screenshots while moving my files across my old NAS. This was a special moment for me when i was 20. this was the last part of my interview, where i had to bypass a live environment within 24 hours, with an edr installed and set to maximum protection mode. this was my first job lol. At that time i was mentally not alright. i had just gone through a breakup at that time lol. it was the first time i had faced this kind of shitty situation, so i wasn't in a good mood and i got stuck. i still attended the interview because i felt like i wanted to give it a try, cuz red teaming & malware development is my passion & obsession. i was able to get a callback by using adaptixc2 with some minimal modifications and a fresh loader written in rust at the movement, all within 4 hours of constant coding, debugging, and testing. i still had 20 hours left and didn't know what to do, so i just added the initial phase with filefix, chained everything together, and ended up framing a full ttp cycle, which they really didn't ask me to do. this was just an extra part from my side because i thought it would be nice to add. I was happy throughout the whole challenge because i wasn't thinking about anything else, just the goal. just one callback. After preparing the documents for 3 hrs. i was able to submit it within the challenge time. Later after sometime i realized that everything happens for an reason. If you are kind and helpful, the kindness will return to you someday. If you are good, god will always leads an good way even when the situation is bad. After an year passed (Present):- conducting engagements against edrs became my normal routine lol. Things learned from past and mistakes :- - your passion & goals comes first, then everything else. - if you really work hard, you will get results. - if it doesn't work, take an break and try again until you succeed. - love but don't attach :) After the report submission, they reached out to me within 2 days, and after that, the quoted post says it all😀

无实质内容。

@_EthicalChaos_ Nicee !!