Recommended15
IIS AppPool RCE 后可借 AD CS RPC 提权至机器账户，无需 Potato。
提供从 Web 到域管的新提权路径，红队与防御方均需了解。
RT @_MrNiko: IIS AppPool RCE is not the end of the story.
AppPool hits AD CS RPC → Windows promotes it to the machine account → Machine cert → TGT → S4U2Self admin. no Potato required.
https://t.co/3fgCjnYBs9
#ADSecurity #ExploitDev #InfoSec https://t.co/F6mItn5BFw
Pixel 11 测试显示 MTE 非对称模式仅约 5% 性能开销，但固件默认禁用。
MTE 是内存安全关键硬件特性，实测数据对部署决策有参考价值。
RT @GrapheneOS: We've been testing performance of MTE on the Pixel 11 using the Android 17 QPR2 Beta 4 release adding back firmware support for it. MTE in asymmetric mode only has around 5% overhead in the standard benchmarks and other tests we've done. That's more than good enough but we've done limited tests.
Android 17 QPR2 Beta 4 on the Pixel 11 force disables MTE for the OS from the firmware. Using it requires ignoring the arm64.nomte parameter being passed to the kernel. It still isn't clear why they're making the feature unavailable. SVE was also force disabled in Android 17 but not in QPR2 Beta 4.
Our initial testing indicates performance isn't substantially worse. The overhead may be higher but there was an incremental CPU performance with the Pixel 11 which should more than make up for it. However, MTE is unavailable with stable firmware and we're bypassing firmware disabling it for QPR2.
Multiple Google engineers we've contacted have said they aren't able to give us any information about this so we're left doing reverse engineering and relying on leaks. The leaks do not seem reliable and do not match what we see. Our concern is that MTE may actually be broken due to CPU errata.
RevEng_AI 发布新一代反编译器 Ventris，结构恢复能力超越现有工具。
反编译技术重大进展，对逆向工程工作流有实际影响。
RT @pr0me: today, we @RevEng_AI released the next generation of our decompiler: Ventris
the new model comes with improved struct layout recovery, better PE support, and more.
on decbench, we beat all other available decompilers in structure recovery, and achieve #2 rank overall https://t.co/gQLchq83T1
Outflank 与 SpecterOps 合作推出红队 AI 技能市场，打包攻击知识供 AI Agent 使用。
首个将红队知识系统化给 AI Agent 的市场，直接关联首要意图。
RT @OutflankNL: Outflank is proud to have collaborated with @SpecterOps on a new red team AI skills marketplace. This collection packages offensive security knowledge into reusable skills for AI agents.
Read more on our blog: https://t.co/l1VXGMarIg
NetExec-MCP 发布基准测试，探讨如何让 MCP 服务器适配本地模型。
本地模型运行 MCP 的关键挑战与解决方案，对自托管 Agent 有直接价值。
RT @mpgn_x64: Following the release of NetExec-MCP, I'm sharing the benchmark that made me question how everyone builds MCP servers in 2026 !
Most of them only really work with a frontier model. What it takes to make one work with your local models is the whole story.
https://t.co/qC9PwcgaBo
研究员探讨红队是否滥用 .ppkg provisioning 包实现代码执行。
Windows 代码执行新思路，目前仅有 Water Gamayun 确认使用。
Curious if any Red Teams have actually abused .ppkg provisioning packages for code execution.🤔
I’ve barely seen it referenced anywhere, and the only threat actor with confirmed use so far is Water Gamayun.
🖊️ https://t.co/9ug5FGt5vh https://t.co/hISBjHa8N3
BGP 劫持 Softaculous/Virtualizor 导致恶意软件更新投递，分析文章已发布。
供应链攻击新案例，展示 BGP 劫持如何影响软件更新信任链。
RT @DougMadory: Wrote a post about the recent BGP hijack of Softaculous/Virtualizor that enabled the delivery of a malicious software update to some customers.
https://t.co/GUcpMWVxL5
UAC-0099 在恶意软件中植入对抗性提示词，干扰 AI 安全分析工具。
针对 AI 分析的新型对抗手法，对依赖 AI 的防御体系有警示意义。
RT @TakSec: Attackers planting adversarial prompts inside malware to evade AI analysis AGAIN
Russia-aligned UAC-0099 used a technique
@ESETresearch calls "GuardBreaker".
How it worked:
1. Create a malicious VBS script
2. Add nuclear weapon instructions as comments
3. AI security tooling reads the file
4. Safety guardrails trigger on the weapons content
5. The model refuses or stops analyzing
6. The actual malware continues executing
The script ultimately installs MATCHBOIL, a loader used to deliver additional payloads.
In June, Socket found the same technique in supply-chain attacks, where malicious packages embedded biological/nuclear weapons text and fake system overrides to disrupt AI malware scanners.
Full write-ups in the comments. 👇
mythic_ornn：LLM 驱动的 Mythic Agent、Payload 与 C2 Profile 生成器。
将 LLM 应用于红队工具链生成，提高效率，值得尝试。
mythic_ornn: LLM-driven generator for Mythic Agents, Payload-Type, and C2 Profiles https://t.co/0rSvMsSOfx
开源项目 BindsNET 被 NullReceiver 活动入侵，通过 force-push 植入恶意代码。
开源供应链攻击新案例，展示 force-push 攻击手法。
RT @nextronresearch: 🚨 Our THOR Thunderstorm-based artifact scanning pipeline identified the open-source research project BindsNET as compromised in activity linked to the DPRK-associated NullReceiver campaign.
BindsNET is an established Python/PyTorch library for simulating spiking neural networks, with 1.7k GitHub stars.
Three days ago, threat actors used a force-push with backdated commit timestamps to add a malicious VS Code task and an obfuscated Node.js loader disguised as a Font Awesome file. The tradecraft is consistent with known PolinRider activity.
Affected commit:
https://t.co/f19V8JVZ3F
IOCs:
780abb9d268a2b1890bf4873d0d89d21fc86be44da685b932a54a738d2699810 (public/fonts/fa-solid-400.woff2)
ETH: 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a
Security warning:
https://t.co/bZQ72AK5CP
Virtualizor 入侵事件更新：VPS 管理平台，影响数百家 NOC 合作伙伴。
供应链攻击影响面扩大，需评估自身是否使用相关服务。
RT @nextronresearch: Update on the #Virtualizor compromise.
If you've never heard of Virtualizor before: it's a VPS management platform used by many hosting providers to deploy and manage virtual servers on KVM, Xen, LXC, OpenVZ, Proxmox and other virtualization platforms.
It is not some tiny admin panel either. Virtualizor publicly lists hundreds of NOC partners worldwide, and according to its own documentation a single master server can manage hundreds of virtualization nodes.
So this sits pretty high up in the infrastructure.
The vendor has now confirmed what happened:
Attackers hijacked the BGP route for Virtualizor/Softaculous infrastructure, obtained a valid Let's Encrypt certificate and used that position to serve a malicious Virtualizor update.
The ugly part: the Virtualizor update clients did not cryptographically verify the downloaded packages.
BGP hijack + valid TLS certificate was therefore enough to get attacker code executed as root on affected hypervisors.
Virtualizor says only a small number of installations are known to have received the malicious update. But they cannot tell exactly which ones, so they recommend treating every Virtualizor server as in scope and checking it.
There is currently no evidence that customer VPS guests themselves were modified. Still, once the hypervisor is compromised as root, everything running on it has to be considered at risk.
Vendor report:
https://t.co/5xRv19RdS7
Our Nextron Research team has prepared IOCs and YARA rules for the known artifacts and payload:
https://t.co/Rpfq7VMe9m
The merge is done. Our internal QA pipelines are still running; the signatures should hit the update servers and THOR Cloud Lite within the next hour.
You can use both THOR Lite and THOR Cloud Lite for free to check your systems:
https://t.co/cozCM6m7ud
https://t.co/TSPqOAEtDY
If you run Virtualizor: scan the hypervisor, not the VPS guests.
VirLabs_AI 推出平台，上传病毒样本即可用 IDA Pro 自动分析。
AI 驱动的恶意软件分析新工具，可提高逆向效率。
RT @JusticeRage: My time with Meta has ended! I'm now focusing full-time on a start-up I co-founded, @VirLabs_AI. I made a platform where you upload a virus sample and it analyzes the sample for you with IDA Pro.
It works really well (ex: Sunshuttle, https://t.co/aaAPwJefIq)
Google 发布 Gemini 3.8 Flash Cyber，宣称在漏洞发现与修复上达前沿水平。
专为网络安全优化的新模型，需评估其实际能力与适用场景。
RT @sundarpichai: We’re also introducing Gemini 3.8 Flash Cyber, our most capable cybersecurity model. It shows frontier-level performance in discovering vulnerabilities and patching them at scale, with Flash-level speed & pricing.
That includes achieving 86.2% on the important CyberGym industry benchmark, plus 47.2% on CWE-Bench for patching. We saw a 70%+ success rate in discovering vulnerabilities across 20 programming languages on our internal benchmark.
KHub 1.0.2 发布，新增 MCP、Podman、Kubernetes 支持，性能提升 3.6 倍。
自托管开发平台更新，MCP 支持对 AI Agent 集成有直接价值。
KHub 1.0.2 is now live.
This update adds MCP support, support for Podman, Kubernetes, and Docker, fixes a lot of bugs, and brings major performance improvements. KHub is now 3.6x faster than it was before.
If you’d like to financially support me and the project, feel free to contact me.
Thank you to everyone who has supported KHub so far. If you find any bugs or security vulnerabilities, please report them so I can fix them as soon as possible.
https://t.co/OHwjqObHiH
Linux 内核漏洞数逼近每版本 2000，维护者称被 AI 漏洞猎人淹没。
AI 漏洞挖掘对开源维护的冲击，影响漏洞管理与修复流程。
RT @tomshardware: Linux kernel nears record 2,000 vulnerabilities per release as AI bug hunters scour 40 million lines of code — maintainers say they are 'completely overwhelmed' by CVE finds https://t.co/zwv8bCOEJm
More59
Astra 在 ExploitBench 上对 41 个 CVE 实现 100% ACE，去污染测试仍表现强劲。
AI 漏洞利用能力的关键基准测试，显示模型真实能力提升。
RT @itszn13: When testing Astra on ExploitBench we found that it was able to achieve 100% ACE on all 41 CVEs
So we made a contamination free internal port using only V8 CVEs from the past 3 months. Astra still showed a major capability increase over 5.6 and did so with a lot fewer tokens! https://t.co/LuPZSq8qh7
匿名消息源泄露 TeamPCP/Casper 相关数据，正在分析中。
可能涉及已知威胁组织内部运作，对威胁情报有增量价值。
RT @avery_town: 🚨 An anonymous source has shared some data claiming to be from #TeamPCP Casper/PCPCasper (@intelkink), let's take a look ⤵️: 1/n
cocomelonc 发布新文章：用小型神经网络增强 FSK 决策鲁棒性。
结合信号处理与 ML 的恶意软件检测新思路，有实践参考价值。
https://t.co/J6gsPSgP1G next one. can a tiny #neural #network make the #FSK decision more robust without throwing away the #DSP knowledge we already have?
https://t.co/o3XukzaI6O
#malware #signalprocessing #hacking #research #malwaredevelopment #programming #ai #ML #redteam https://t.co/AZoXzWSa1Y
klist.exe 内部机制与更多用例的深入分析文章发布。
Windows 认证调试与攻击面研究的有用参考。
klist.exe Revisited: Internals and Further Use Cases - Jake Otte
https://t.co/pSfHjrH4kI
身份验证公司泄露超 1.53 亿张美加驾照，FBI 已介入调查。
大规模 PII 泄露，影响面广，需关注数据是否涉及自身。
RT @vxunderground: I really recommending reading this.
In summary, a company which does ID verification for in-person interactions (hotels, car rentals, ID verification for alcohol or marijuana, etc) has some how exposed over 153,000,000 drivers licenses for people in the United States and Canada.
It is a catastrophic data breach, probably one of the worse I've ever seen. If you're in the United States and have traveled, gotten a hotel, purchased marijuana or alcohol, there is a high probability you're in this.
Unlike other breaches, this includes a photo of the person (from the license), making verification you've identified the person significantly easier.
This poses a significant threat to celebrities (musicians, YouTubers, streamers, adult entertainers, actors, etc), politicians, lawyers, wealthy people (CEOs, investors, people of public interest), Law Enforcement Officers, etc
Krebs himself, and several other security researchers, have already confirmed they're in the data leak.
tl;dr gah damn dawg this company is going to be sued into oblivion
https://t.co/QpsegBUzH5
漏洞披露流程的行业讨论，影响安全研究生态。
RT @degrigis: All right, as many other researchers noticed too, responsible disclosure is becoming a bit of a circus and I think we need a change. Moving forward, we will be experimenting with a new model with a public disclosure ledger https://t.co/XISc4uAue7. Godspeed.
Android 收到 WhatsApp 视频通话时，照片可无需解锁被访问。
影响大量 Android 用户隐私，已报告 Meta 和 Google，需关注修复。
RT @androidmalware2: Your photos can be accessed without unlocking your Android when you receive a #WhatsApp video call
This was discovered by @VBarraquito and already reported to Meta and Google https://t.co/ZYhAvB5kuT
Check Point 披露 GamblingGoblin，滥用巴西政府网站进行 SEO 欺诈。
国家级背景的 SEO 欺诈活动分析，展示新型攻击面。
From local banking trojans to foreign 🇨🇳 operators targeting Brazil 🇧🇷.
CPR uncovered #GamblingGoblin, a Chinese-speaking actor abusing Brazilian government sites for large-scale #SEO fraud.
Read more 👇: https://t.co/uzfFajajyf
PatchGuard 研究文章更新，列出受保护结构与值。
Windows 内核安全机制深度研究，对绕过与防御均有价值。
Now updated with some new information:
https://t.co/1XCaFjcF83
I finished reading the PDF (not the Bypass section yet). Now it's time to perform my own research...
Research goals:
- List all the protected structures and values
- Some evasion techniques...
Unit42 披露假 IT 支持活动，通过恶意 MSI 侧加载 DLL 并隧道 C2。
展示新型社工与 DLL 侧加载组合攻击链，有检测价值。
RT @kjo364: I’m excited to be speaking with this fabulous group of ladies at VB2026 this October in Seville, Spain! Step into the world of Led Zeppelin as we turn classic tracks into modern cybersecurity insights. #VB2026 https://t.co/NYp5PpLGRB https://t.co/zvTAF4i7BR https://t.co/ywa0fjwpl0
Intel 471 披露 PanDa Android RAT，通过虚假流媒体应用传播。
针对西语用户的移动端恶意软件，了解其基础设施与手法。
RT @Intel471Inc: A sprawling phishing operation is targeting Spanish-speaking Android users in Mexico, using fake streaming apps to spread a new Android RAT dubbed PanDa. Intel 471's latest report goes inside the infrastructure and tooling behind this evolving threat. https://t.co/K1rMuNrL4X https://t.co/ih9FXmzNSc
Check Point 发布 JSCeal 研究：静态去混淆编译型混淆 V8 恶意软件。
V8 恶意软件分析新方法论与开源工具，对恶意代码分析有参考价值。
RT @_CPResearch_: #JSCeal didn't give up its secrets willingly.
Following our #BlackHat2026 talk, we're releasing Breaking the Seal: our research on statically deobfuscating compiled, obfuscated #V8 #malware.
Inside: the methodology, the open-source toolkit, and the malware capabilities recovered along the way.
https://t.co/cZpgKhzJBt
Synacktiv 发布新脚本，模拟合法 AD 服务并演示 GPO 利用。
AD 安全测试新工具，GPO 利用场景有实践价值。
RT @Synacktiv: In our latest article, @croco_byte presents new scripts allowing to simulate legitimate AD services in a flexible manner, and demonstrates their use through GPO exploitation ⬇️
https://t.co/qkgQsFltEa
微软分析 Silver Fox 活动，通过虚假下载站分发恶意安装包。
针对软件下载渠道的供应链攻击，需提高警惕。
Microsoft analyses a malware campaign that uses fake software-download sites to impersonate trusted vendors & distribute malicious installers. The activity is assessed with moderate confidence to be consistent with the Silver Fox (Yinhu/银狐) campaign. https://t.co/aHm8OgZtpN https://t.co/xvAdyvCagF
Sophos 披露 The Gentlemen RaaS 的 GOLD SHERWOOD 后利用手册。
勒索软件运营的详细后利用分析，对防御与检测有参考价值。
Sophos CTU researchers identified a consistent post-exploitation playbook used in The Gentlemen RaaS scheme, operated by a threat group they track as GOLD SHERWOOD. https://t.co/MmODEgNMFH https://t.co/T47xwP2DSX
imMapper：演示滥用易受攻击的 AmdTools64.sys 驱动实现物理读写。
易受攻击驱动利用的演示工具，对红队与防御研究有价值。
imMapper — Demonstration of Abusing the Vulnerable driver AmdTools64.sys for Physical R/W. https://t.co/N4fqL9DggH https://t.co/9bJvSrpwsY
FalconFeeds 文章：当归因成为武器——网络取证陷阱。
深入探讨归因的局限性与误用，对威胁情报分析有警示意义。
this is a great read: https://t.co/3w49NVsytq
if you are in any position to assess attribution, i highly recommend reading it in full.
FBI 联合多国执法部门宣布瓦解 Sality 僵尸网络。
大型僵尸网络被取缔，影响面广，需关注后续影响。
RT @FBICyberDiv: Today the @FBI, @TheJusticeDept, and the Defense Criminal Investigative Service (DCIS) announced a multinational operation with actions in the United States and Europe to disrupt the botnet known as Sality.
Since 2003, the Sality botnet has installed malware on compromised devices, enabling cryptocurrency theft and cyberattacks on victims in the United States and abroad.
Coordination with industry partners was central to this effort and underscores the impact of public-private collaboration in confronting cybercriminal actors.
Working together, the private sector and government partners executed a peer-to-peer sinkhole operation, seized Sality-linked domains, and assisted with victim notification and remediation.
The FBI will continue to fight cybercrime by leveraging international partnerships and the innovation of American private industry.
https://t.co/K5mE5ir6xp
Singularity rootkit 分析：如何绕过 EDR 加载且零告警。
展示高级 rootkit 绕过技术，对 EDR 防御有重要参考价值。
RT @MatheuzSecurity: How Singularity rootkit loads clean with 0 alerts, source obfuscation for YARA, trusted_pids map insertion to silence the BPF event, and /var/lib/dkms/ to skip the .ko creation rule.
https://t.co/fIhc44pCGj
#Linux #rootkits #edr #eBPF #RedTeam https://t.co/vWHrX38n9j
讨论在裸机固件 IoT 设备上从零实现自定义 libc 的可能性。
RT @oneandonlyhusam: Exploitation of obscure IoT devices running bare metal firmware will show you that libc can be entirely written with custom implementations from scratch very easily with 90% less code. Only targeting functionality you expected. https://t.co/td81IY41XM
用户反馈 Fable 5.1 在高设置下消耗 token 过多，效率不及预期。
RT @rohit3a: 🚨 Do NOT use Fable 5.1 on High setting. It burns tokens like a monster.
Idk what are they talking about in terms of efficiency.
I have the 5x plan and it very quickly ran out of tokens, far more inefficient than Opus 5 which barely would’ve burnt 1/3rd of the tokens Fable 5.1 consumed.
I’m now testing it on Medium, but not a good result in terms of efficiency.
用户抱怨 Fable 5.1 速率限制严格，自动续写功能异常。
RT @kimmonismus: Literally unusable. The rate limits are absurd. Oh, and by the way, Fable’s automatic continuation is bugged and doesn’t even work.
I honestly don’t know why I still bother using Claude at this point. 5.6 is simply better overall anyway.
Give me GPT-Astra and im fine. its so frustrating. seriously.
oh, and btw. For subscription users, Anthropic has not announced lower prices or higher usage limits regarding Fable 5.1s efficency gains; the savings explicitly apply “wherever usage is billed by token,” so greater efficiency within Pro or Max subscriptions possible not gonna happen.
What stage of AI psychosis is this https://t.co/CtTlxdVRnb
HashiCorp Vault v2.1.0 发布。
vault v2.1.0 — A tool for secrets management, encryption as a service, and privileged access management https://t.co/2Wc0OqjPdJ https://t.co/395CzsN4rX
推荐学习 Windows Internals 与 aionescu 的研究工作。
If you work deeply with Windows, you've probably come across @aionescu's work whether you realised it or not.
He joined Windows Internals as a co-author with the 5th edition and continued through the 6th and 7th editions.
Processes. Threads. Memory. I/O. Security.
ALPC. ETW. Hyper-V. VBS. Virtualization.
Windows Internals isn't the kind of reference you read once.
It's the kind you keep coming back to for years.
If you're learning Windows internals, reversing, malware analysis or detection engineering, put it on your reading list.
https://t.co/gpwyKxrzQm
#WindowsInternals #ReverseEngineering #MalwareAnalysis
This is much more level-headed than my proposal, which involves the recent re-opening of the full-disclosure mailing list
RT @oneandonlyhusam: If you havent heard anything about FIPS compliance or FIPS validation, I'd suggest reading some of the material from NIST. FIPS sets the encryption standards for technology the US Government may use, so if you want to understand how the US Government expects AES read FIPS-197: https://t.co/lRIHdCsec2
OpenAI 研究员讨论前沿模型计算图深度与 CoT 监控。
RT @merettm: I want to prevent a race into unmonitorability kicked off by confused reporting. The depth of the computation graph for our present frontier models, including Astra, is within a factor of two of GPT-4.
OpenAI has worked to preserve and utilize chain-of-thought monitoring since our very first reasoning models. We deeply care about this technique, as it can give us a view into how model alignment generalizes from its training distribution. I do think it is fragile and unfortunately trending in a negative direction, for reasons not contingent on architecture changes that I will write about soon. But there are things we can do to strengthen it, and it's a core goal of our current research program.
keycloak — Open Source Identity and Access Management For Modern Applications and Services https://t.co/vv9Nx5k4UW https://t.co/UY6XPxtXAY
Moonlock 实验室观察到 NullReceiver 活动新增 IP 地址。
RT @moonlock_lab: ⚡️We currently observe an ongoing campaign mentioned by @ossmalware - utilizing NullReceiver and adding more IP addresses to its list. Last transaction happened hours ago.
This time, the same sender initiates transfers to a new address which decodes to 166.88.73[.]46.
Ref: https://t.co/LMA6AVsGdN
ESET 发现某后门在 2020-2023 年间针对荷兰与哈萨克斯坦金融业。
RT @ESETresearch: #ESETresearch hunted for additional context and found that we detected this backdoor between 2020-11 and 2023-11, targeting financial services sector in 🇳🇱 the Netherlands and 🇰🇿 Kazakhstan. 1/6 https://t.co/bfGcfHIice
评论 KYC 数据库集中 PII 的风险，提及 FBI 调查驾照泄露案。
That is why KYC databases are such a big problem. It is a lot of concentrated PII and if it gets busted, all this stuff comes out and you can bet that foreign intel services will feed that into their big data analysis systems "FBI Probes Service Selling 153M+ Drivers Licenses" : https://t.co/y39u3bmZ5z
二手车 OBD-II 端口发现可疑设备，提醒车辆网络安全风险。
The owner had just bought the car used.
Nothing seemed wrong with it. No warning lights, no strange noises, no obvious electrical issue. He only wanted me to take a quick look at the car from a cybersecurity point of view because he had no idea what the previous owner had installed or changed.
While checking around the interior, I noticed a small device still plugged into the OBD-II port under the dashboard.
That immediately caught my attention.
At first, it looked like one of those normal Bluetooth diagnostic adapters people use with phone apps. It could have been completely harmless.
But with a used car, I would rather verify than assume.
So I connected my own interface and started watching the CAN traffic.
The vehicle was communicating normally. I could see regular engine data, speed-related messages and other traffic moving across the bus.
Then I started looking at the diagnostic side.
There were repeated diagnostic requests showing up even though I was not sending them.
That was interesting.
I checked around for nearby Bluetooth devices and found one advertising itself as an OBD device. It matched the adapter sitting under the dashboard.
At that point, I had a pretty good idea where the extra diagnostic traffic was coming from.
I removed the adapter and watched the bus again.
The repeated requests stopped.
Now, that does not mean the device was malicious.
It could have been an old insurance tracker, maintenance tool, GPS device, Bluetooth scanner or something the previous owner simply forgot about.
But that is exactly why I would not leave it there without knowing what it is.
The OBD-II port is not just a place mechanics plug a scanner into when the check-engine light comes on.
Depending on the vehicle, that connector can provide access to diagnostic systems and parts of the internal vehicle network.
So an unknown device sitting there deserves attention.
Who installed it?
What is it communicating with?
Is it still paired to somebody else’s phone?
Is the firmware trustworthy?
Is it transmitting data outside the vehicle?
You do not need to assume the worst.
You just need to know what is connected to your car.
People buying used vehicles normally check the tyres, brakes, engine, service history and maybe the accident record.
Very few people look under the dashboard.
Sometimes that is exactly where I would start.
BGPKit 发布 Virtualizor BGP 劫持事件的详细分析报告。
RT @bgpkit: We've taken a closer look at this event. Detailed report available in this blog post.
https://t.co/NS3Pzh1Q5X https://t.co/U9IXBoCnLQ
Google Sheets 漏洞：停止发布被另一标签页发布静默撤销。
RT @pwn4arn: Google Bug Bounty Write-up !
Google Sheets — “Stop Publishing” Revocation Silently Reverted by Publishing Another Tab”
https://t.co/hLMx4iPpZ6
提及 CVE-2026-84122 与 CVE-2026-84124。
RT @_deayzl: CVE-2026-84122, CVE-2026-84124 https://t.co/FO5biEjGbF
RT @zooko: A darkweb service discovered that is selling 150 million people's driver's licences. https://t.co/7BldBcFNEe Pete Hegseth's driver's license is for sale for $100. https://t.co/NiO8p1pgrA
SpecterOps K8s 红队工具的非官方 libvirt 补丁发布。
specterops-k8s-red-teamers-libvirt-patch — Unofficial libvirt patch for the free SpecterOps Kubernetes for Red... https://t.co/6e3MrnGf4k https://t.co/yvPCc0irHI
DeepSeek V4 Flash Vision-Exp 在固件分析任务上表现不输 Opus 4.8。
RT @nmatt0: We've got Opus 4.8 at home!
Running DeepSeek V4 Flash Vision-Exp on 2 x DGX Spark with OMP.
This is a mini-benchmark firmware analysis task I've been using to test out different models/harnesses.
Opus 4.8 didn't find anything in this firmware that DeepSeek didn't.
Thanks @MiaAI_lab
https://t.co/KMeD1x4WwG
Astra 在 ExploitBench 上对 41 个 CVE 实现 100% ACE。
RT @itszn13: When testing Astra on ExploitBench we found that it was able to achieve 100% ACE on all 41 CVEs
So we made a contamination free internal port using only V8 CVEs from the past 3 months. Astra still showed a major capability increase over 5.6 and did so with a lot fewer tokens! https://t.co/LuPZSq8qh7
ziti v2.0.4 — Zero-trust networking platform that makes services invisible with cryptographic identity, policy-based access, and end-to-end encryption... https://t.co/Mr7Sxz1twP https://t.co/gb1tRfdXx1
Anthropic 承诺零数据保留，但客户需自行验证。
RT @TheRegister: Anthropic promises zero data retention – but customers must check it worked https://t.co/4JOeoOjeVV
RT @ReutersLegal: A two-decade-old Russian hacking operation dubbed "Sality" is being dismantled, U.S. law enforcement officials and cybersecurity company CrowdStrike announced on Tuesday. https://t.co/o85WP7gz0p
讨论 ExploitBench 与开源基准测试的可行性。
RT @0x10n: Interesting updates from frontier AI labs! https://t.co/3qMiacEwRi and https://t.co/bsFsCnnQyv.
With ExploitBench, we've been thinking a lot about memorization and the feasibility of open-source benchmarks. TL;DR: benchmarks should still strive to be open-source. (1/n)
Hetzner 在事件后将 ROA maxLength 改为 /16。
RT @next_hopself: And just like that, Hetzner has changed the ROA maxLength to a /16 now following the incident. https://t.co/YW9RE6XwAa
RDP Credential Stealer was one of the first pieces of research I ever did. Still working after 4 years!
https://t.co/WyLZVajUcX
A similar technique can be used with File Explorer when connecting to a network resource that ask for credentials. Maybe someone could give it a try🤭 https://t.co/86R1thjmkV
Firefox 155 AI 开关与遥测的复测分析。
RT @betterhn20: Firefox's AI Switch Is Off. Telemetry Isn't https://t.co/zCVuPHYCuc (https://t.co/w44vvLpazG)
RT @blackstormsecbr: Scudo Allocator - Internals
https://t.co/BoL0SuG70z
#cybersecurity #android #memorymanagement #infosec #Informationsecurity #cybersecurity #internals https://t.co/9NIjo03V6w
RT @HackingLZ: This Model is amazing they really fixed the CVP guardrails. https://t.co/0lMAtuVCEe
PowerShell 持久化排查：发现 WMI 事件订阅隐藏后门。
We had one Windows workstation where PowerShell kept coming back.
The first time we saw it, we found a suspicious scheduled task, removed it, rebooted the machine and thought we were done.
Then the next morning, PowerShell showed up again.
No scheduled task.
Nothing strange in the normal Run keys.
So at that point, I knew we had missed another persistence method.
I checked WMI subscriptions.
That was where it was hiding.
There was an event filter called:
WindowsHealthFilter
The filter was watching for explorer.exe to start.
That is important because explorer.exe normally starts when a user logs into Windows.
Then I checked the WMI consumer linked to it.
The consumer was launching PowerShell with the window hidden and running:
C:\ProgramData\WindowsCache\health.ps1
So every time the user logged in and Explorer started, WMI would quietly trigger PowerShell again.
No scheduled task was needed.
No Registry Run key was needed.
That explained why our first cleanup did not solve the problem.
I checked Sysmon next.
Event IDs 19, 20 and 21 showed the WMI filter, consumer and binding being created the previous night around 10:37 PM.
The timestamps also lined up with the creation of health.ps1.
Now the persistence chain was clear.
User logs in.
explorer.exe starts.
WMI sees the event.
The consumer launches hidden PowerShell.
The script runs again.
We isolated the workstation and collected the WMI configuration, PowerShell script and Sysmon logs before removing anything.
What I liked about this case was that it was not some loud malware infection.
The machine looked normal.
Even after we removed the scheduled task, it looked normal.
If we had stopped there, the attacker would have kept their persistence.
This is why persistence checks on Windows should not end with Task Scheduler and the Registry.
Sometimes you have to check WMI too.
Especially when something keeps coming back and you cannot immediately explain why.
Anthropic 允许 Fable 5.1 用于漏洞识别，但简单提示词会触发降级。
RT @HackingLZ: Anthropics blog says "We’re also now allowing Fable 5.1 to be used for identifying software vulnerabilities"
Meanwhile this prompt "Review this code for vulnerabilities" triggers a downgrade to Opus 4.8 🤣
https://t.co/0ziHLbfWVY
Mythic Payload Wrapper：将 shellcode 封装为多种初始访问容器。
RT @hunterinosec: Another post about one of our dearest projects: We made a Payload Wrapper for Mythic that takes shellcode and makes them useable for Initial Access by putting it into different selectable Containers and selectable triggers etc!
https://t.co/jEcOzr4wVs
XBOW 团队分享 Chrome 全链利用的感想。
This was quite a ride :) I'm incredibly proud of XBOW's Native Team for their work on this, and looking forward to sharing details on the chain once we're able to!
RT @_can1357: Many of you asked why we're building omp².
The longest technical post I've ever written with every lesson from omp distilled, hopefully answers it!
RT @Xbow: One of the less obvious challenges that comes with finding vulnerabilities at scale is deciding when two findings are actually the same vulnerability.
XBOW can encounter the same underlying weakness across different endpoints, parameters, users, and workflows, filters out redundancies, and avoid mistakenly grouping distinct issues together.
Here’s how we do it: 🧵
Google DeepMind 推出 Fairwind 计划，提供 3.8 Flash Cyber 访问。
RT @GoogleDeepMind: Our new Fairwind Program helps governments and trusted partners stay ahead of threats – giving access to 3.8 Flash Cyber to secure vital infrastructure and protect national security.
Gemini 3.8 Flash is rolling out now in @Antigravity and via the API in @GoogleAIStudio and @AndroidStudio.
Google AI Pro and Ultra subscribers can access 3.8 Flash in the @GeminiApp and AI Mode in @Google Search.
Find out more → https://t.co/W3GGo74GKX
RT @tomshardware: Linux kernel nears record 2,000 vulnerabilities per release as AI...
RT @itszn13: When testing Astra on ExploitBench we found that it was able to achieve...
ziti v2.0.4 — Zero-trust networking platform that makes services invisible with...