Check Point 逆向 Defender BTR.sys，将其变为 Ring 0 文件/注册表原语。
微软自家签名驱动被武器化，无内存破坏，EDR 绕过影响面大。
BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive by @vinopaljiri Blog:- https://t.co/34xWb0wySy https://t.co/JqzW0gaUqf
Top5
微软 Defender 签名驱动 BTR.sys 可被重用于 Ring 0 文件与注册表操作。
与上条同源，确认利用细节，EDR 防御方需关注检测。
RT @LxlxIxlxlxL: Microsoft Defender’s own signed kernel driver can be repurposed as a Ring 0 file and registry primitive. Check Point reverse engineered BTR.sys, the Boot-Time Removal driver used by Defender to perform remediation before Windows fully starts. What makes this interesting is that there is no memory corruption and no vulnerable third-party driver involved. The driver reads encrypted transaction files that describe privileged filesystem and registry operations. Researchers reconstructed that transaction format and found that the same hardcoded encryption key was present across 18 signed versions of BTR.sys, spanning Windows 7 through Windows 11 25H2. Once a valid transaction is created, the Microsoft-signed driver performs the requested operation from kernel mode as part of its normal functionality. That means an attacker can potentially reuse a trusted Defender component for actions such as deleting files or modifying registry data while operating through a Microsoft-signed kernel driver. It is a particularly interesting example of how a legitimate security mechanism can become a useful offensive primitive without exploiting a traditional software vulnerability. https://t.co/yNApTNn0GC
IBM DB2 JDBC 驱动发现 RCE 漏洞，官方已发布 CVE-2026-9762 修复。
企业级数据库 JDBC 驱动 RCE，PoC 细节公开，影响面广。
RT @4ra1n_x: 我和 @pyn3rd 以及 unam4 在 IBM DB2 JDBC 中发现 RCE 漏洞，在5月发现和报告，近期官方修复和发布 CVE-2026-9762 安全公告 该漏洞不是由 AI 分析发现，而需要非常复杂的协议构造触发反序列化，我们进行了深入的分析后才发现漏洞 Make JDBC Attacks Great Again https://t.co/XjaP4OXnN9 https://t.co/L0Cd9VkY4N
滥用已签名的 Google Chrome 安装程序实现任意代码执行。
利用签名安装器绕过检测，攻击手法可复现，红队关注。
RT @buffaloverflow: Wrote a blog post about abusing signed Google Chrome installers to achieve arbitrary code execution https://t.co/RUCtkk2glK
Emacs TRAMP 存在零点击本地命令执行漏洞。
本地/自托管 AI Agent 常使用 Emacs，零点击 RCE 风险高。
RT @andersonc0d3: Emacs zero-click local command execution via TRAMP https://t.co/ZTEmJrHa08
Must-see3
伪装成日历和连续打卡工具的恶意 npm 包，隐藏 Linux ELF 载荷。
供应链攻击，一次 import 即触发，影响依赖此包的开发环境。
RT @trendai_RSRCH: Trojanized npm packages posing as calendar and streak utilities hide a Linux ELF payload. One import anywhere in the dependency graph runs it, with no install hook or coverage from --ignore-scripts. TrendAI™ Research has the breakdown: https://t.co/QKkdQUC4kW
斯洛伐克 279 个新交通摄像头发现俄罗斯后门，支持 SMS 触发 shell。
关键基础设施供应链后门，影响面大，需关注固件安全。
RT @tomshardware: Slovakia discovers Russian backdoors in 279 new traffic cameras — SMS-triggered shell access and passwordless live feeds found in EU-funded rollout https://t.co/uIHRWClLtN
Intel SGX 总破解论文即将发布，作者暗示 Intel 不会喜欢。
SGX 安全边界被突破，对依赖可信执行环境的场景影响深远。
RT @_markel___: Intel SGX total hack paper is in progress and I don't think Intel will like it )) https://t.co/EpYGWw9cSI
Recommended15
usbliter8 BootROM 漏洞影响 A12/A13 设备，可窃取文件。
BootROM 漏洞，影响 iPhone 11 等设备，物理接触即可利用。
RT @FCE365: Remember, the new usbliter8 BootROM exploit works on A12 and A13 devices, so if you have an iPhone 11, iPhone XS, XR, etc. avoid plugging it in dodgy charging stations especially those that pop a “Trust computer” alert on the phone. Ramdisks based on this exploit that can steal files already exist!
K8s PSS Restricted 和 RuntimeDefault seccomp 未能阻止 AF_ALG 访问。
即使严格运行时默认，内核攻击面依然存在，容器逃逸风险。
RT @kubesploit: This article explains why Kubernetes PSS Restricted and RuntimeDefault seccomp did not block AF_ALG access during Copy Fail testing It shows why kernel attack surface still matters even when pods follow strict runtime defaults ➤ https://t.co/DXHZSkn4WJ
Check Point 研究揭示微软对 EDR 绕过漏洞不修补，称需管理员权限。
微软拒绝修补 EDR 绕过，攻击者利用管理员权限可致盲 EDR。
RT @Kostastsale: I know this topic has been discussed a lot since the amazing Check Point report dropped, but here’s my two cents after getting the chance to properly read it. The research is awesome. Microsoft’s response, is BS. They basically say an attacker already needs elevated privileges, so this doesn’t meet the bar for servicing. So no CVE and no patch. Classic MS bullshit. TAs with admin are exactly the attackers I’m worried about trying to kill or blind my EDR. Giving them a Microsoft-signed Defender component that can help do that from the kernel is not something I’d just shrug off because “they already have admin.” Anyone here that understands MS logic, please let me know. With no fix coming, assume this eventually gets operationalized and plan around it. TAs will probably be milking this one for a long time. Hunting-wise, baseline normal BTR remediation and alert on the abnormal chain: unexpected BTR.sys load → .sys:changelist → suspicious service staging → PID 4 deleting security components. Report: https://t.co/hGO9NqgWIu
收集了包含枚举和系统令牌窃取的 BOF 集合。
红队可直接使用的 BOF 工具集，提升渗透效率。
Collection of Beacon Object Files (BOFs). Includes: ✅ Enumeration BoFs ✅ System Token Stealing https://t.co/f2yOB26J5W
详细讲解如何将未认证 XSS 升级为远程代码执行。
XSS 提权思路，对 Web 应用渗透测试有实际指导意义。
RT @thehacktivator: You can escalate an unauthenticated XSS to Remote Code Execution — and here’s exactly how you can do it. When most bug bounty hunters or pentesters find an XSS, the first reaction is usually pretty straightforward: get JavaScript execution, trigger alert(1), confirm the vulnerability, and move on. And because XSS is often considered a Medium-severity vulnerability, it’s easy to stop there. But what if the XSS is just the beginning? Instead of asking, “Can I execute JavaScript?”, start asking, “What can I do with that JavaScript?” Who can trigger it? What privileges do they have? What functionality can it access? Can it be chained with another vulnerability? A great recent example is CVE-2026-64638, an unauthenticated reflected XSS in WordPress that can potentially be chained toward RCE under certain conditions. That’s exactly what I’m demonstrating in my latest video — how to look beyond alert(1) and explore the attack chain step by step. If you're learning web security, doing bug bounty, or into pentesting, this is the mindset I want you to take away: Don’t just find the vulnerability. Find out how far you can take it. Watch the full practical demonstration: https://t.co/GbAbQNgLP7
分析三个已公开的 SSRF 绕过案例，开发者以为已封堵。
SSRF 绕过技巧，对漏洞赏金和渗透测试有参考价值。
RT @medusa_0xf: Most hunters give up on SSRF the moment the app stops giving them a response. Filters are everywhere now: block localhost, block internal IPs, don't follow redirects, "safe" by default. So when the payload gets blocked and nothing comes back, most people move on, assuming the app actually is protected. That assumption is exactly how six-figure bounties get left on the table. I broke down three real, disclosed SSRF reports where the developers thought they'd closed the door and hadn't, one through DNS rebinding, one through a redirect status code almost nobody filters for, and one exploited completely blind with zero visible response. If you've ever backed off a target because your SSRF payload got "blocked," you need to see what these hunters did instead. Full walkthrough below. https://t.co/ct7VC983IQ
Windows 系统中明文密码收集技巧第二部分。
实用的密码收集方法，对红队和渗透测试有帮助。
Fantastic clear-text passwords and where to collect them (Part 2 - Windows) - @malmoeb https://t.co/SZVoaRnRQ3
威胁行为者利用 FTP 横幅隐藏 C2 命令，涉及两个未记录 RAT。
新型 C2 隐藏技术，防御方需更新检测规则。
RT @socradar: Threat actors found a new place to hide C2 commands: FTP banners. SOCRadar's STRU traced this to two undocumented RATs — E4del and PINHOLE. Thread 🧵
Gen Threat Labs 研究 KB Backdoor 及其检测行为。
后门技术分析，对检测工程和红队有参考价值。
Red teamers are going to study this one. Detection engineers should be asking a different question: What would your EDR actually see? New Gen Threat Labs research breaks down KB Backdoor, its tradecraft, and the behaviors defenders need to understand. https://t.co/Sryh8pId3K Author: Shahak Morag #RedTeam #DetectionEngineering #Malware
Claude Security 的 Mythos 工具可扫描 GitHub 仓库漏洞。
AI 驱动的代码扫描工具，对自托管 AI Agent 安全有直接帮助。
RT @claudeai: Point Claude Security at a GitHub repo and Mythos scans for vulnerabilities tracing data across files and reasoning about how components interact. Each finding comes back with a CWE category, confidence and severity ratings, and a suggested fix.
新博客：审计 Microsoft Defender 和 Intune 配置更改。
对使用微软安全产品的组织有直接参考价值。
RT @JeffreyAppel7: NEW BLOG: Auditing Microsoft Defender and Intune Configuration Changes https://t.co/ecMxidAEHa #microsoftSecurity
攻击者注册自己的设备并注册后门 passkey，密码重置无法驱逐。
WHFB 持久化技术，对 Entra ID 安全有重要影响。
Password reset won't evict this attacker. They registered their own device and enrolled a backdoor passkey. You have to delete both explicitly. New blog on WHFB persistence + detection. https://t.co/w621s9Nxcp #BlueTeam #EntraID
通过 DNS 日志发现每 60 秒查询一次的恶意软件。
DNS 检测技巧，对威胁狩猎有实际指导意义。
We nearly ignored this one because the laptop was not doing anything obviously malicious. No strange login attempts. No big upload to the internet. No antivirus alert. But while going through our DNS logs, I noticed one Windows machine making a query almost exactly every 60 seconds. The domain names were changing, but the pattern was the same. Something like: m4n2p7q1.sync-check.example Then one minute later: v8c1k5t9.sync-check.example Then another one. At first I thought it could be some application doing normal background checks. So I checked Sysmon Event ID 22 to see which process was generating the DNS requests. That was where things became interesting. Every request was coming from: ReaderSync.exe The name looked like something Adobe could install. But the file was sitting here: C:\Users\nora\AppData\Roaming\Adobe\ReaderSync.exe I checked the signature. Unsigned. Now I really wanted to know how it was starting. There was a scheduled task called: Adobe Reader Sync and it pointed directly to the same executable. So we had an unsigned program inside the user’s profile, pretending to be Adobe software, running automatically and making DNS requests at a fixed interval. At that point, we isolated the machine. The user later remembered opening an attachment the previous evening that looked like a PDF from a supplier. She said the document opened normally, so she never suspected anything. We could not say from the DNS requests alone exactly what data had been exchanged, but the behaviour looked very much like beaconing. That distinction matters. Seeing suspicious DNS traffic does not automatically mean you have proven data exfiltration. What we had proven was that an unknown executable was repeatedly contacting attacker-controlled-looking infrastructure and had persistence on the endpoint. That was already enough to treat the machine as compromised. The funny thing is, if we were only watching normal HTTPS connections, this could have stayed quiet for much longer. Sometimes the traffic that exposes malware is not a huge connection leaving your network. It is one small DNS request repeating itself every minute.
用 Rust 和 eBPF 构建 EDR 的演示资料。
eBPF 在安全检测中的应用，对自研 EDR 有参考价值。
RT @5unl1fe3: 「Rust×eBPFでEDRっぽいものをつくる」の発表資料です。 https://t.co/ov6FOMwgXU #kernelvm
KHUB 自托管平台发布，修复 CI/CD 问题。
自托管代码托管平台，对本地 AI Agent 基础设施有参考价值。
Okay, the CI/CD issue is fixed, and notifications are fixed too. You can download the source here: https://t.co/tNwBk6OF9D We're self-hosting the ZIP so we don't have to use GitHub, but it's the same source. You can run ./scripts/deploy.sh --self, and the script will set everything up by itself. If you guys find any vulnerabilities, bugs, or anything else, let me know :P
More58
AliExpress 被曝利用无声声音指纹识别用户设备。
大规模隐私侵犯，涉及音频指纹技术，影响所有用户。
RT @brave: Alibaba's AliExpress was caught using users' audio systems to track them. AliExpress wasn't recording users but instead playing a silent sound and measuring how users' specific devices processed it in order to fingerprint them. But don't worry because Brave stops this.
研究重定向句柄内核对象指针，无句柄访问敏感进程。
内核提权/绕过思路，对 EDR 和进程隔离有影响。
I'm researching how to redirect a handle's kernel object pointer to a different EPROCESS, accessing a sensitive process without ever opening a handle to it Seems viable, found a couple old researches doing similar things https://t.co/wmbDnm31I8
从零构建快照模糊测试器，将 Bochs 放入其中。
模糊测试技术深度解析，对漏洞研究有启发。
RT @cr3ghost: What does a snapshot fuzzer look like when you build one from scratch? @h0mbre_ puts Bochs inside the fuzzer, the target inside Bochs, then snapshots the emulator to reset the target and its simulated state. https://t.co/pIfKY4MSy4 https://t.co/Rrz5f6Ueom
Dolby 解码器 RCE 被用作 Pixel 9 零点击攻击链第一步。
零点击攻击链分析，对移动端安全研究有重要价值。
RT @cr3ghost: Incoming audio messages can become a 0-click attack surface before you ever open them. Natalie Silvanovich (@natashenka) breaks down the Dolby decoder RCE used as step 1 of Project Zero's Pixel 9 0-click-to-root chain. https://t.co/QzVc7XKJCS https://t.co/0NdMR6nTJz
发现一种方法让一个核心绕过 SMM，破坏 rendezvous 假设。
SMM 安全边界被突破，对固件安全研究有重大意义。
RT @cr3ghost: SMM is supposed to stop every core. @xoreaxeaxeax found a way to keep one core outside SMM with a ~1-second x86 instruction, breaking the rendezvous assumption. Sandsifter. Rosenbridge. Movfuscator. Now this. Firmware people, this is ridiculous. #x86 #Firmware #Infosec https://t.co/Nia5jJc3HQ
Phrack 新版本发布，包含新 phracktro。
经典安全杂志更新，值得关注最新技术文章。
RT @PiotrBania: yo ppl, check out https://t.co/UrAv8mEcCm and the new phracktro :D and stay tuned for the new phrack release(s) 🤠cheers! https://t.co/RuiVOoBSAA
讨论 CPU 执行存储指令到完成期间发生的一切。
底层硬件知识，对内核和漏洞研究有帮助。
*(volatile ULONG64*)0x000001A400000000 = 0x12345678; Assume that address is currently not present in the process's working set. Explain how everything that happens from the CPU executing the store until the instruction successfully completes ?
新视频发布，Pro 会员可获取 maldev AI 工具包。
AI 辅助恶意软件开发工具，对红队有吸引力。
New video is up on https://t.co/89GDKUPzs4 . Pro members can grab the maldev AI kit and start using it to build custom offsec tools with strict OPSEC profile. Video on using the application testing kit to automate your web app testing and bug bounty hunting is coming soon. https://t.co/hW8mGQIpfw
汽车网络安全学习资源列表。
汽车安全入门资源，对扩展安全知识面有帮助。
List of resources for learning about automotive cybersecurity https://t.co/aWiAKoUBFx #infosec https://t.co/RFiOeeD98q
GrapheneOS 与摩托罗拉合作，关注非折叠设备。
移动端安全操作系统进展，对隐私和安全有影响。
RT @GrapheneOS: Initial focus for our partnership with Motorola is a regular non-folding device. Current generation Motorola Signature (2026), Razr Fold (2026) and Razr Ultra (2026) are very close to meeting our requirements but lack MTE, adequate secure element integration and other features being added for 2027. Flagship Snapdragon provides much better CPU and GPU performance and provide more of what's needed via isolated components on the SoC. That includes better cellular, Wi-Fi/Bluetooth and GNSS radios with solid security including good isolation. Snapdragon Pixels worked well for us and it will again. Tensor was a sidegrade or downgrade from Snapdragon in many ways. Tensor is paired with the fantastic Titan M2/M3 which was a huge security advantage. It also brought hardware memory tagging (MTE) with the Pixel 8. Snapdragon 8 Elite Gen 5 finally shipped MTE but it's broken on the non-Elite SoC. Next generation Snapdragon will have more mature support for MTE and greatly improved secure element support. It's still likely going to be a lot of work to get MTE fully deployed for the kernel and OS. We need all our hardware-based features including our USB-C port protection ported to it too. These devices will meet or exceed of our official requirements including 7 years of proper updates, starting out with the Linux 6.18 LTS which can be upgraded to a new branch eventually, reset attack protection for firmware boot modes and everything else. There wasn't time to do it all for 2026. It's very realistic to provide better security than Pixels against remote attacks. It's far harder to provide a secure element as good as the Titan M2/M3. There will definitely be a decent secure element providing the current generation features including the Android 16 QPR2+ rate limiting design. Pixels have become much harder to support. AOSP 16 removed support for Pixels and they became harder to properly support than many other devices rather than easier. It's crucial to keep up with the major OS updates to provide all the security patches and we do but it's much harder for us now. Motorola is doing a large portion of the work of porting GrapheneOS to their devices. They'll provide us with what we need for firmware/drivers in the form we need it and it will be far easier than Pixels. We'll be able to get issues in the firmware and drivers fixed through Motorola and Qualcomm.
SaRCAsm 实现内存安全的 x86_64 汇编。
内存安全汇编新思路，对底层安全开发有启发。
RT @filpizlo: Memory safe x86_64 assembly thanks to SaRCAsm (Safe Runtime Capability-enforcing Assembler) https://t.co/yRglXQRKbK
使用静态二进制提升器测试 obfusheader.h。
二进制分析工具链，对逆向工程有帮助。
RT @Farenain: I'm testing https://t.co/6EWpNuGXQK with my static binary lifter. For the moment I use @unicorn_engine to extract a trace and the trace is the input to my IGNIL IL and then lifted to LLVM IR. It seems like when applying optimizations in LLVM IR, the result constant was obtained https://t.co/L2eitFTOzD
GTA 6 泄露促使 Take-Two 传唤微软获取 Discord 服务器用户设备 ID。
法律与安全交叉案例，涉及设备 ID 和隐私。
RT @tomshardware: GTA 6 leaks prompt Take-Two to subpoena Microsoft for Windows device IDs of everyone in three Discord servers — daily gameplay leaks shatter cloud of secrecy around the much-hyped game https://t.co/LJpiFerip4
JavaScript 沙箱研究综述。
JS 沙箱安全研究汇总，对 Web 安全有帮助。
RT @7urb01: Some people are just looking for an excuse to talk about JavaScript sandboxes at all times. I'm some people. Research Review. https://t.co/wPxG9FH7G7
为 C2/rootkit 添加 PHP Web 界面。
C2 开发进展，对红队工具建设有参考价值。
adding a php web interface to my c2/rootkit if you like web interface control better then a pure console. (ops right now all data is just ex output https://t.co/ATHIpiPdRz
Damn Vulnerable Drone 训练模拟器，用于学习无人机黑客技术。
无人机安全学习资源，对 IoT 安全研究有帮助。
RT @three_cube: Drone Hacking - Hacking UAVs with Damn Vulnerable Drone The Damn Vulnerable Drone, or DVD, is a training simulator that was made for people who want to learn drone hacking without buying a drone. It recreates an entire drone system in software, including a flight controller, an onboard companion computer, a ground control station and the wireless links connecting them all. Every piece is there, and every piece runs inside Docker containers on a single computer. It has more than 40 realistic attack scenarios with walkthroughs https://t.co/5Ctu4BK4m6
沙箱更新，添加系统调用参数和 PDF 报告生成。
沙箱工具增强，对恶意软件分析有帮助。
Sandbox Update - Added sample syscalls and their parameter values to the call chain - Added the option to generate a PDF report of the results https://t.co/sTlq2l3bTr https://t.co/aR9CKDV6x6
FreeBSD 15.0 沙箱逃逸 PoC 已发布。
FreeBSD 沙箱逃逸，对 BSD 系统安全有影响。
RT @impost0r_: https://t.co/7tuXdZopdB https://t.co/GzudzNOsYb Not much changed, it did a decent job at mimicking how I write. But the PoC's on GitHub now. Enjoy. A present for someone.
通过 PCP massaging 绕过 SLAB_VIRTUAL 的跨缓存攻击技术。
内核漏洞利用新技术，对 Linux 内核安全研究有参考价值。
RT @n0sign4l: @spendergrsec This is also a cool technique https://t.co/ju4LnZ4mt2 bypassing SLAB_VIRTUAL
使用 AMD Ryzen 395+ 和 Radeon PRO 搭建本地 AI 环境。
本地 AI 硬件配置，对自托管 AI Agent 有参考价值。
RT @xct_de: Looking a bit into local AI these days and ended up with an usual setup combining @AMD Ryzen 395+ (Geekom A9 Mega 128GB) with a @RadeonPRO R9700 32GB. Still figuring things out but here are some details: https://t.co/XAjaus0EJD
KHUB 自托管平台，替代 GitHub、Slack 和 Jira。
自托管开发平台，对本地 AI Agent 基础设施有参考价值。
RT @kernelstub: KHUB replaces GitHub, Gitea, Codeberg, and Forgejo for your code, Slack for your team chat, and Jira for your issues and boards. Real Git repos, pull requests, a visual CI/CD pipeline editor, wikis, releases, and WebRTC calls, all in one self-hosted platform running on hardware you actually control. Ditch GitHub today and switch to KHUB! https://t.co/OHwjqObHiH
x33fcon 演讲视频已发布。
安全会议演讲，可能包含新技术和观点。
RT @_ar0x4: My @x33fcon talk has been published. Hope you like it.
评论 OpenAI 不监控网络评估，却攻击 Hugging Face。
AI 安全治理讨论，对 AI Agent 安全有参考价值。
RT @ZackKorman: Be OpenAI. Don't monitor cyber evals. Hack Hugging Face. Don't notice. Oops. Add monitoring. Now lobby the gov to force everyone else to add monitoring too. I don't support this. Legal compliance checkboxes aren’t good security. Impose massive penalties for incidents instead. https://t.co/b2C5qP13le
警方为 30 美元启动全面调查，引发对执法资源分配的讨论。
社会事件，与安全技术无关。
The police really launched a full investigation over $30. They released CCTV footage, asked the public for assistance and published a phone number like this man had just escaped from a maximum-security prison. 😭 Imagine sitting at home after picking up money from the floor, then turning on the news and seeing yourself described as “the suspect.” Meanwhile, people are losing phones, packages and entire bank accounts, and the response is usually: “Have you tried contacting customer service?” This man did not find $30. He accidentally activated a statewide manhunt. At this point, he should return $35, the original money plus an inconvenience fee for making the police create the poster.
游戏开发者因客户投诉而崩溃，进行人肉搜索并清空 Discord。
游戏社区事件，与安全技术无关。
RT @ItsGamerDoc: Bro completely crashed out and started doxxing and clearing the discord chat because their customers were complaining too much 😭 https://t.co/TLUxP1cKtk
Smukx.E 预告新项目。
工具开发预告，信息量有限。
@ipurple Soon:- https://t.co/D8wH8IRBEO
提倡使用本地服务器替代订阅服务。
自托管理念，与安全技术无直接关系。
RT @sysadafterdark: Having local servers in your home is the most based thing you can do in 2026. Every subscription you pay for has an open source alternative that doesn’t leave your network. https://t.co/0ct1tG2dUe
有人要求游戏工作室直接杀死作弊者而非封禁。
游戏社区讨论，与安全技术无关。
courageous man demands game studios just straight up kill cheaters instead of banning them https://t.co/wPrpjMaBmB
转发一条链接，内容未明。
信息不明确。
RT @jonasLyk: https://t.co/AeIdwj23cp
未知
source ↗
OpenBSD 上使用 clang 编译器的示例。
技术细节，信息量有限。
RT @canadianbryan: $ gcc -v ksh: gcc: not found $ cc -v OpenBSD clang version 22.1.6 Target: sparc64-unknown-openbsd8.0 Thread model: posix InstalledDir: /usr/bin $ 😌
父亲因核物理成就受到家乡表彰。
个人成就，与安全技术无关。
RT @chompie1337: Today my dad was honored by his hometown of Giovinazzo, Italy for achievement in nuclear physics & energy. He spent his career innovating the field, against political forces. Now AI demand has sparked a nuclear revival & his hard work will finally be built upon. I’m very proud. https://t.co/uV7pz4l9zL
预告新课程即将发布。
课程预告，信息量有限。
Btw, when I said I had a new course in a couple of days, this wasn't it! More info very soon... JB
对互联网晚上 8 点下线的评论。
个人观点，与安全技术无关。
Why the fuck is this a thing. Sorry, the Internet goes home at 8pm... https://t.co/mWX5KRtJQg
逆向工程 HLGuard 反作弊系统。
反作弊历史分析，对游戏安全有参考价值。
🕵️ Reverse Engineering HLGuard Anti-Cheat Dive into the pre-kernel era of anti-cheat development with the GH Historical Anti-Cheat Analysis Database. 10k word essay written by a human. 👉 https://t.co/QmT7tKo5no https://t.co/KBbu9tlefW
开始新的学习旅程。
个人动态，信息量有限。
Another learning journey starts today... https://t.co/nijtl9aboZ
感谢反馈，新内容将不断添加。
个人互动，信息量有限。
@ipurple 🙏thank you. New content will be added all the time now that we are past launch, and I'll keep tuning it toward what users tell me they need. Appreciate your feedback!
对他人工作的肯定。
个人互动，信息量有限。
@Teach2Breach Solid work so far, I am sure you can do much more in the future.
请求 Hak5 赞助。
个人请求，信息量有限。
@Hak5 sponsor me
指责某人抄袭他人工作。
个人纠纷，与安全技术无关。
This guy is straight up stealing @Ivanklydz ‘s work. https://t.co/cDHVsVmisg
询问 Ox Alpha 的所有者是谁。
社区疑问，信息量有限。
wtf ! who is the owner of Ox Alpha
有消息称 iPhone 18 Fold 提前泄露。
消费电子新闻，与安全技术无关。
Girl is leaking the Apple iPhone 18 Fold weeks earlier?
iPhone 18 开箱视频。
消费电子新闻，与安全技术无关。
RT @malygonnn: iPhone 18 unboxing https://t.co/KzeRTK00aQ
评论攻击者等待补丁后利用 Nday 漏洞。
攻击策略讨论，信息量有限。
RT @simplylurking2: the token-frugal (or lazy) attacker waits for CVE-hungry researchers to spend their tokens finding+disclosing 0day and waits for patches to then LLM_PEWPEW.md out Nday in hrs, popping key shells they've been waiting on for months. 🤷♂️ dont hate the player, hate the new long game
对 0x 模型的个人喜好表达。
个人观点，信息量有限。
Man whatever this 0x model is, I'm enjoying it.
对某事的赞同。
个人互动，信息量有限。
true brother https://t.co/pqmOn2lzzX
对某篇文章内容的不满。
个人情绪，与安全技术无关。
RT @tayvano_: Every fucking time these fuckheads post something I spend 10 minutes reading the most retarded soap opera of an article, trying to figure out what their fucking point is, why they published it, and what they are even fucking saying. Fucking jfc it’s just CONTAGIOUS INTERVIEW? That’s it. That’s the entire article? Why do you waste everyone’s time with such nonsense. 😭
Lady Gaga 伴侣创办 AI 护肤初创公司。
商业新闻，与安全技术无关。
RT @TechCrunch: Michael Polansky — better known publicly as Lady Gaga's partner and a former top deputy to Sean Parker — has quietly spent years building an AI-driven startup that keeps living human skin tissue alive for weeks outside the body to discover new skincare https://t.co/w5SWXWS6bk
分享 SoundCloud 音乐链接。
个人分享，与安全技术无关。
https://t.co/Vt2udpmUs2
KHUB 版本存在 CI/CD 问题，已修复。
工具更新，信息量有限。
Btw this version has a CI/CD bug with the splitting the docker names, I have it fixed I will upload to website later, you dont need to do anything just rerun https://t.co/gkVSLw2S2V and the DBs will be there everything will stay there, I’ll add a versioning too and an update script that downloads the zip extract and runs it. Maybe a one liner too!
对某排名第五的惊叹。
个人互动，信息量有限。
RT @_can1357: yooooo #5 👀 https://t.co/JaGP2j9geE
Proton 11.0-2 支持更多 Steam Play 游戏。
Linux 游戏兼容性更新，与安全技术无关。
RT @phoronix: Proton 11.0-2 Enables More Titles With Steam Play / Linux Gaming https://t.co/BlyX7x9NOd
调侃 vanguard 模拟器是蜜罐。
个人调侃，信息量有限。
RT @deteccphilippe: scene: your vanguard "emu" turned out to be a honeypot, so you take some time to work on yourself lol https://t.co/tfk9xM6b6g
转发一条链接。
信息不明确。
RT @igor_os777: https://t.co/afefSffqam
未知
source ↗
宁愿坐牢也不添加 cookie 横幅。
个人观点，与安全技术无关。
RT @jecwick: I'd rather go to jail than add a cookie banner to my website
转发一条链接。
信息不明确。
RT @xcopydotexe: https://t.co/P2T2rv7bMQ
未知
source ↗
调侃 Rasta Mouse 抽烟。
个人调侃，信息量有限。
@_RastaMouse Since when did Rasta Mouse smoke Apple cider trees? Did the good stuff run out on the farm 🤣
承认停止阅读代码。
个人动态，信息量有限。
RT @haydendevs: im gonna be honest, i stopped reading the code
Smukx.E 正在开发 EkkoFrozenTwin。
工具开发进展，信息量有限。
I ain't dead. Working on EkkoFrozenTwin the pooling-3. https://t.co/0H4hO56dYA