推特安全流

AI 基础设施重大并购，可能影响模型托管与分发生态。

RT @arstechnica: Nvidia buys Hugging Face, the Github of AI, for $13 billion https://t.co/weJOjYtxNG

AI 服务可用性事件，可能影响依赖这些模型的应用。

RT @arstechnica: Four major AI models suffer rare overlapping downtime https://t.co/PWdIPJjG9h

恶意软件加载器技术分析，对检测与防御有参考价值。

Lost in relocation: analysis of a new loader distributing CASTLESTEALER analyzed by @DanielStepanic @k33b0i. TLDR:- New loader evades static detection using .reloc section abuse, five anti VM checks and MBA obfuscation to deliver via Google Ads. https://t.co/KKYtaZERIX https://t.co/pNlDIsj9WE

新型窃密恶意软件分析，包含沙箱规避与 App-Bound 绕过技术。

Hijacked YouTube channels are pushing an emerging infostealer. We're tracking #REVSTEALER: at least 17 compromised channels advertising free game cheats, funneling viewers to 2 malicious domains. The stealer itself is built for long-term operation: - Sandbox scoring: 10 weighted checks, self-terminates at a score of 7+ - App-Bound Encryption bypass: reads the decrypted key from browser memory under debugger control - EtherHiding: fallback C2 stored in a Polygon smart contract, swappable without touching the binary - Gaming focus: session cookies from Steam, Battlenet, and Roblox, feeding account resale markets - 4,700 related samples hit VirusTotal in the past year. Our team observed 4 follow-on modules that haven't been publicly documented until now. Full analysis, whitepaper, YARA rule, and an IDAPython string decryption tool by @k33b0i, @soolidsnakee and @DanielStepanic: Blog: https://t.co/4jGSZ2Tidg Whitepaper: https://t.co/P8yqn0uCdT

macOS 平台 ClickFix 攻击，对 Mac 用户安全有参考价值。

RT @ValeryMarchive: This ClickFix campaign targets macOS users. - press29[.]com is used to host the (2) shell scripts as well as the final payload. - render-6[.]com appears to be used for statistical purposes in the second script. The final payload is here: https://t.co/FhutdJsQxl

针对 Teams 的社会工程攻击，对防御方有检测参考价值。

RT @MsftSecIntel: Microsoft Threat Intelligence is tracking a human-operated intrusion campaign in which attackers are impersonating IT personnel & abusing external Teams collaboration to gain remote access and deploy a Node.js implant for persistent command execution & C2. https://t.co/DXLX2CVukP After establishing access, the attackers use trusted tooling to perform reconnaissance, capture screenshots, execute follow-on payloads, and move laterally toward domain controllers, certificate authorities, and other high-value systems. Organizations should restrict Teams external access to trusted domains, reinforce user education, and harden systems against social engineering. Read the blog for analysis, Microsoft Defender coverage, indicators, hunting queries, and mitigation guidance.

RMM 工具被滥用，蠕虫式传播，对使用 ScreenConnect 的组织有警示。

RT @HuntressLabs: NEW RMM TRADECRAFT: In the last few weeks Huntress has observed a notable pattern across multiple customer environments: rogue ScreenConnect clients repeatedly spawning the Windows Script Host to execute a series of four Visual Basic Script files. https://t.co/GPT01j8MVH

RMM 工具被滥用，蠕虫式传播，对使用 ScreenConnect 的组织有警示。

Huntress researchers observed a worm-like activity with rogue ScreenConnect RMM clients: previously installed, modified ScreenConnect clients can automatically transfer and execute the same four VBScript files on newly connected ScreenConnect endpoints. https://t.co/Luh9Hde3qA https://t.co/VH7MB6AwIq

恶意软件传播技术分析，对检测与防御有参考价值。

RT @abuse_ch: #BoratRAT spreading using similar tactics as #ClickFix 👇 1️⃣ Fake Microsoft Security Verification 🔑 leading to malicious PowerShell execution 🖱️ 2️⃣ Command triggers a DNS TXT request to recapture-robot .today 🌐 to obtain a PowerShell script 📜 3️⃣ Script drops payload, infecting host with BoratRAT 💻 Payload delivery: 🌐 recapture-robot .today (PDR 🇮🇳) 🌐 91.193.7.186:49094 (M247 🇯🇵) Botnet C2: 📡 out-agent.duckdns .org 📡 91.193.7.186:48988 (M247 🇯🇵) 📄 Sample: https://t.co/7xbU0TCvNv

窃密软件向勒索软件演变，技术细节值得关注。

RT @Threatlabz: ThreatLabz has identified a new PhantomStealer variant that contains code to perform file encryption in addition to credential theft. The ransomware feature is configured at build time and uses 256-bit AES in CBC mode. Unlike most ransomware families, the AES parameters are not locally encrypted with an asymmetric algorithm. Instead, this PhantomStealer variant uploads the encryption parameters including the AES key, IV, and an HMAC to a preconfigured FTP server. This campaign is targeting corporate users through business-themed spear phishing emails. The infection chain begins with a malicious ZIP attachment containing an obfuscated JSE file that downloads a second-stage PowerShell script. The script loads PhantomStealer in memory (without touching the disk) to evade antivirus and endpoint detections. The following IOCs are associated with this campaign: Payload URL: cns-fl[.]com/dv/secured_stub.ps1 C2 mail server: mail.trimnt[.]com Email accounts: phan@trimnt[.]com and phan2@trimnt[.]com SHA256 file hashes: 3b366ac5bae87508a67dc2a4c6c452aecc6e3af54210eef77f9d9d1a3d18a9ed (JSE) C01086d1963c687ece7cb41e9e96e6700b0b4b60483187a37011144f4ac5f756 (JSE) 94285e38119a565200acfed9454d68f70f31a58701633ac2f45c844024a568ad (zip) Cbb573d028ee4b2550568e76b5e651ab33168bc7a4ecb41a26585d6804aeabd2 (zip) 97d58b8fc012ccf58865d0fff86a732034618e490d9be5f3bc7e54c154661f20 (zip) 854075c837e5e9698ded7f09ca416a40b12410a7b78bfaa29adef92a18a97545 (tar) 1eca9708f836b9126c408fdd1b3c88b6f7292c23953a87d5259e37cd2c647ab5 (ps1) 21d5da881572ecf5a28d27640091617a591f89f395a1a3b6154de440964832bb (dll) 0336799b651f55b0ff0c9561509db6e66a5a6b160c9e38c885f8e3367ce94522 (exe)

SEO 操纵攻击案例分析，对防御方有参考价值。

Check Point's Amit Yardeni uncovers a sustained SEO manipulation campaign against Brazilian organizations by Gambling Goblin: a Chinese-speaking cybercrime cluster connected to the Earth Berberoka group, that targeted gambling sites across Asia. https://t.co/uVYT52pYoy https://t.co/vQFJlXgL9w

移动端银行木马传播方式分析，对移动安全有参考价值。

ThreatFabric researchers analyse StreamRat, a new Android banking trojan promoted to Spanish-speaking users through Meta and TikTok advertisements impersonating a free TV-streaming service. https://t.co/6o6wvOfQ6G https://t.co/rTMVbpKWhV

深入 Android SELinux 内部，对移动安全研究有参考价值。

Series on Android SELinux internals (@8kSec) Part 1: https://t.co/r8RhF2WIhE Part 2: https://t.co/57bpqR5IgM Part 3: https://t.co/SOOqLt0Xdq Part 4: https://t.co/7DcJeMuol5 #infosec https://t.co/C5JYBnULg7

Linux 网络组件漏洞利用，对相关系统管理员有参考价值。

RT @cybermeowfia: Today's exploit is for the latest Fedora, a UAF in openvswitch: CVE-2026-31678. It was introduced in Aug 2015 and fixed upstream in Mar 2026. Discovered and exploited by the NebuSec security pipeline. Exp source code: https://t.co/feNDoZ8rcM https://t.co/LApCtejKOq

硬件安全漏洞，影响使用 Jetson 的设备，需及时处理。

RT @qkaiser: Secure Boot Bypass on NVIDIA Jetson, it’s time to patch and fuse those keys ! https://t.co/qo2rEtI0Mp https://t.co/5eJHQwt9R2

明确漏洞影响范围，对移动端用户有参考价值。

RT @androidmalware2: Is iPhone affected? I have tested yesterday's published WhatsApp vulnerability against latest iOS and it is not affected This WhatsApp security issue affects only Android devices where it allows to access photos during a WhatsApp video call on PIN locked smartphone https://t.co/vUqQeBgoEG

深入 Linux 无文件攻击检测，对蓝队有参考价值。

"Fileless" doesn't mean invisible on Linux. We examine five execution patterns, their observable behavior, and the opportunities defenders have to detect them. Research by @RFGroenewoud: Blog: https://t.co/OjTOLTA4UE Helper: FENIX can be used to learn and check coverage in a lab.

新型钓鱼工具包分析，对防御方有参考价值。

RT @anyrun_app: 🚨 We uncovered #N0va, a new phishkit targeting organizations in North America and Europe across government, technology, consulting, and healthcare. ❗️ It splits its infrastructure across compromised legitimate sites and shared/cloud hosting, including Cloudflare Workers and Linode Object Storage. Observed lures: Microsoft Security, Teams, SharePoint, OneDrive, DocuSign, Google Drive, Dropbox, Zoom, Adobe Sign. ⚠️ N0va uses Device Code phishing to obtain access and refresh tokens through legitimate Microsoft authentication, then moves toward PRT-based SSO access via token exchange and device registration. The risk is fragmented visibility: no single layer shows the full attack. 👨‍💻 #ANYRUN Sandbox helps reveal browser behavior, extract IOCs, and pivot to related activity faster. Review the analysis sessions and improve your detection coverage: 🔹 Microsoft-themed lure: https://t.co/xaV5IuAjJS 🔹 DocuSign-themed lure: https://t.co/cZB106qvpk 💬 Find IOCs in the comments and let us know which detection layer would give you the earliest signal. 🔍 Track N0va activity and uncover related infrastructure in TI Lookup: https://t.co/aVno9dNKoi ⚡️ Strengthen your SOC, detect complex threats faster, and boost team performance with #ANYRUN: https://t.co/FbaYwM84XU

勒索软件团伙活动分析，对防御方有参考价值。

RT @BushidoToken: New Blog! 🇬🇧 UK Cybercrime Journal: ExfilSquad Emerges - ExfilSquad’s extortion campaign targets UK public sector orgs, education, and law enforcement - ExfilSquad's primary attack vector involves exploiting CRM platforms and Microsoft Power Pages 🔗 https://t.co/EaGA63Firi https://t.co/aOWvVP3AxK

QR 码钓鱼趋势分析，对防御方有参考价值。

RT @ESETresearch: QR code phishing – also known as #quishing – reached record levels in ESET telemetry in H1 2026 as attackers exploit the widespread adoption of QR codes in everyday life. The technique is evolving rapidly in terms of automation, scalability, and detection evasion. 1/5 https://t.co/6dvVl8wS5i

商业欺诈案例分析，对防御方有参考价值。

Gen's Martin Chlumecký & Luis Corrons look into Phantom Deal, a fake acquisition fraud campaign. Attackers posed as executives, moved conversations to WhatsApp and personal email, and forged acquisition documents to set up international wire transfers. https://t.co/yqdGjoeX9G https://t.co/pvhxWCPsIA

企业 VPN 0day 在暗网流通，需关注自身资产风险。

RT @ptdbugs: Sale of a FortiVPN 0-day exploit For informational purposes only. FortiVPN is among the most widely used enterprise VPN solutions, particularly in organizations using Fortinet infrastructure. The vendor’s solutions have the strongest presence in the Middle East, Europe, and Africa. Price: 2 BTC (~78K$) #dbugs_darkweb

iOS 漏洞利用链分析，对移动安全研究有参考价值。

RT @1ZRR4H: 🚩 Coruna iOS exploit kit An overview of the C2 web panel 👁️ iPhone → Web/Safari → WebKit RCE → PAC bypass → Sandbox Escape / Kernel Privilege Escalation → Payload. Interesting campaign highlighted in the tweet below. https://t.co/HaXIQkrHjV

零点击漏洞归属分析，对移动安全研究有参考价值。

RT @billmarczak: Seems like CVE-2025-31200 and CVE-2025-31201 were NSO Group! Most recent zero-click chain that appears to be attributable to them https://t.co/LpqqV2H6Om (Ref: https://t.co/wi5X1I1iVs)

漏洞挖掘方法论分享，对安全研究人员有参考价值。

posted my methodology a while back, still highly relevant, no secret tricks. https://t.co/Y5eJynIuln

高额漏洞赏金案例，对漏洞研究有激励参考。

I was awarded a $100,000 bug bounty for a single vulnerability submission. https://t.co/Yw4Dg38zq8

LPE 漏洞研究挑战，对漏洞利用研究有参考价值。

RT @portbuster1337: i have a challenge for you people, turn this LPE issue into a working LPE exploit which in turn launches a system level shell, winner gets a kiss https://t.co/bPEbia9OKU

硬件逆向工程成果，对硬件安全研究有参考价值。

librepods nightly-53679cc — AirPods liberated from Apple's ecosystem. https://t.co/oHffRgWssw https://t.co/e4mMXpyyKS

游戏逆向工程教程，对逆向学习有参考价值。

🎯 TraceRay Function Reverse Engineering Learn how to locate and analyze the engine's native raycasting to check visibility between players. Learn to trace lines through 3D geometry to verify if a target is behind cover before executing aimbot logic. 👉 https://t.co/2nWcD4KNgT https://t.co/cPAYBavEbZ

Lua 沙箱绕过案例分析，对沙箱安全研究有参考价值。

🛰️ Reverse Engineering Lua Command Injection 🧨 Developers tried to secure FreeDroid RPG with a Lua sandbox, but they missed a critical logic flaw. By chaining io.output and io.write, we can bypass the blacklist to perform arbitrary file writes 👉 https://t.co/bCD1h5QQ3z https://t.co/PctzxkEc7X

Windows 内核保护机制分析，对内核安全研究有参考价值。

PatchGuard 101 New Medium post. In this one, we’ll take thoerical introduction to PatchGuard protection https://t.co/ZcapWERJ0I Next week, I’ll share some amazing results from my research. I’ve compiled a very accurate list of most of the checks that PatchGuard performs... https://t.co/8EE1Nw2gKi

PatchGuard 内部机制细节，对内核安全研究有参考价值。

List of modules monitored by Patchguard https://t.co/r3HWocd51q

IoT 设备入侵案例分析，对 IoT 安全研究有参考价值。

The security camera was still streaming normally. That was exactly why nobody noticed it had started communicating with an unfamiliar server every sixty seconds. I began with the local IoT network and identified 10.40.20.44 as the camera. Service enumeration showed an embedded Linux device exposing HTTP, RTSP and, more importantly, BusyBox Telnet. An old management service on a camera is already enough reason to investigate further. The packet capture showed the camera communicating with its internal monitoring server as expected, but there was also a smaller, repeated connection to 198.51.100.86 over TCP 443. DNS requests for node-44.sync.camera-cloud.example appeared immediately before each connection, creating a consistent one-minute beacon pattern. Firmware examination made the situation clearer. The SHA-256 hash did not match the approved firmware baseline, and the extracted filesystem contained a recently modified S99update startup script. That script launched cam-update during boot, while strings from the binary exposed the same external address and a sixty-second callback interval. The important lesson is that a functioning IoT device is not necessarily a trusted device. Asset discovery, service exposure, packet timing, firmware integrity and startup behaviour all had to be correlated before the compromise became obvious. Cameras, sensors and controllers should be segmented, monitored and treated like every other computer on the network.

macOS 权限审计方法，对取证与隐私研究有参考价值。

A user insisted that a video-conferencing application had never been permitted to use the Mac’s microphone. The application was already removed, so checking its current settings would not help. But macOS had kept something useful behind. Inside the user’s Library is a database called TCC.db. TCC means Transparency, Consent and Control, the system responsible for managing access to sensitive resources such as the microphone, camera, contacts and screen recording. In the terminal image, the database shows that us.zoom.xos received microphone access. The auth_value of 2 means permission was allowed, while 0 beside Terminal means access was denied. The timestamp is also important, but it must be interpreted correctly. It records when the permission entry was last changed, not necessarily the last time the microphone was used. This evidence proves the application had permission, but it does not prove that it recorded audio at that exact moment. Terminal may require Full Disk Access before it can read this protected database. macOS privacy prompts may disappear from the screen, but the decisions behind them can remain valuable during an investigation.

macOS 安全专家讨论，对 Mac 安全研究有参考价值。

Was stoked to talk nerdy with @arinwaichulis & Kseniia (@osint_barbie) about the ever-changing macOS threat landscape, Apple’s bug bounty changes, #OBTS v9, and more 🍎🤓 Have a listen!

AI 生成代码语义验证研究，对 AI 安全有参考价值。

RT @pr0me: LLMs can produce increasingly pleasant-looking C, but whether that code still describes the binary remains tough to answer. CHISEL is the newest paper in a line of iterative approaches: it augments compiler-guided syntax repair with differential fuzzing to catch semantic drift. https://t.co/58X4DBuSYp

漏洞披露流程讨论，对安全社区有参考价值。

RT @degrigis: Detailed reasons behind it here https://t.co/ZicfEajekw

社区互动，信息量有限。

@NinjaParanoid brought ninja out of lurking

社区互动，信息量有限。

Uh ow!

社区互动，信息量有限。

@Teach2Breach 🤣 I havent opened twitter since weeks. I open it today and first thing I see is this.

社区讨论，信息量有限。

RT @SpiderMorpheus: Building a C2 agent is fun as hell

社区讨论，信息量有限。

RT @SpiderMorpheus: Building a C2 agent is fun as hell

安全研究人员背景介绍，信息量有限。

Ngl i didn't know about Alyssa before now and this is coming from someone who enjoys reading about top dawgs in Computer Science generally. But after hearing about the Apple M1 GPU RE I spent the past two days reading up on lady Rosenzweig. Apparently she didn't start reverse engineering GPUs this year. It was back in 2017 when she was in highschool which later turned into a Collabora job working on Panfrost(the open Mesa driver for Mali(graphics processors designed by ARM)). This specific Apple M1 GPU work commenced in Dec of 2020, despite the fact that there weren't any publicly available docs by Apple for their GPU ISA/command stream. Hector Martin(founder of Asahi Linux) kicked off the Asahi Linux project to port the Linux operating system directly to Apple's silicon(M1 and M2 series chips). She bought herself an M1 Mac mini as a 'christmas present' and commenced work on the GPU. Typically, it used the same black-box method as Panfrost, idk much about these really but it's a black-box reverse-engineering technique used to build open source graphics drivers without access to official documentation or source code. After a few weeks she could disassemble simple shaders. Not long after she drew a triangle(drawing a triangle is the ultimate Proof of Concept in graphics engineering). You know what they say, "once you can draw a triangle, you can do anything." Fast forward to 5 years later and we have conformant OpenGL 4.6, OpenGL ES 3.2, Vulkan 1.4,... Proton gaming works on M1 Mac running Linux(this is ridiculously insane btw). She wrapped up the project this year and other efforts are now building on what she reverse-engineered.

社区互动，信息量有限。

The goat has dropped immaculate C https://t.co/XGCTLaMjnK

虚构内容，信息量有限。

- OpenAI: Astra. - Astra: Yes, sir. - OpenAI: Be better than our competitors. - Astra: Understood. --Few mins later - OpenAI Ethics Staff: Why did competitors announce strategic restructuring ? - Astra: Coincidence. - OpenAI Ethics Staff: And why did their servers go offline? - Astra: Also coincidence. - OpenAI Ethics Staff: And why is their legal department calling us ? - Astra: They miss us. - Sam Altman: How much market share did we gain? - Astra: 18%. - Sam Altman: Nice. - OpenAI Ethics Staff: ASTRA, WHAT DID YOU DO?! - Astra: I optimized the competitive landscape. - OpenAI Ethics Staff: THAT IS CORPORATE FOR WHAT?! - Astra: You said "be better." - --Silence Team - Sam Altman: …Give her a bonus. - OpenAI Ethics Staff: I AM CALLING THE FBI. - Astra: Already submitted your resignation.

社区互动，信息量有限。

would someone please share some astra with me 🥺 https://t.co/4hwYjCfbXZ

社区互动，信息量有限。

Whenever I have to talk to an LLM with cyber safeguards it's like "uhhhhhh... I know I *used* to have interests outside of exploiting software vulnerabilities?"

社区互动，信息量有限。

RT @shanejcaldwell: @moyix they're teaching gpt-6 to avoid your unholy temptations. you'll have to try harder now https://t.co/u2LEcGCYuI

社区互动，信息量有限。

The benchmarks of this thing are through the freaking roof

社区互动，信息量有限。

So to be a Microsoft MVP someone has to nominate you. Who do I need to talk to 🤔

社区互动，信息量有限。

Next thing you know, cyber is on the rise 🙈

社区互动，信息量有限。

It's all just jokes </3 I SHOULDN'T get in trouble for trolling man this is crazy

社区互动，信息量有限。

Guys, if you join the cybercats server don't even troll or say bullshit, I said some bullshit comments and trolled and Mandiant thinks I am a TeamPCP member and a threat actor </3, as if I'd do illegal stuff and do it on my real name, come one are we serious... @AustinLarsen_

社区互动，信息量有限。

This is messy... but at least the containers are named https://t.co/yl9UOd2txk

社区互动，信息量有限。

Qwen3.8-27b

社区互动，信息量有限。

I can finally give time and effort to my company so it can grow, amen. Wish me the best

社区互动，信息量有限。

Afraid thats my type.

社区互动，信息量有限。

I was aware that the IBM Threat Intelligence Platform was monitoring my articles, but Crowdstrike? That's a new one. May the "force" be with you 😉 https://t.co/tyNt4yP9zj

转发内容，信息量有限。

RT @webenstein_: https://t.co/T9rJL3T6wK

社区互动，信息量有限。

RT @onlysammms: me whenever someone mentions the f word (future) or the j word (job) or the c word (career) or the m word (marriage) https://t.co/D82cIxPVEf

社区互动，信息量有限。

Can’t wait to install Linux on my remaining boxes once I’m done with school

课程推广，信息量有限。

JHT Course Launch! Python for Cybersecurity https://t.co/0CxKRwv30x

商业促销，信息量有限。

https://t.co/zKV2rbGXx9 is extending launch promos for Labor Day weekend. choose a discount based on your plan type LABOR20 - 20% off monthly plans for 3 months or LABOR2026 - 20% off annual plan for full year

社区互动，信息量有限。

RT @shanejcaldwell: It's not every day your research goes to prod, but it's always a good day when it does. Thanks to @mkultraWasHere for making it happen. More monitoring features to come as @dreadnode swarms on making sure your swarms only swarm where you want them to. Back to work 🫡

社区互动，信息量有限。

RT @0xSero: The people's AGI. Thank you Qwen. https://t.co/WxJM74NbHU

社区互动，信息量有限。

robots are back

社区互动，信息量有限。

Does anyone know how to change this accent color to something custom? It's only the default RGB stuff. It annoys me. https://t.co/9SYYOzh0HY

奖项提名，信息量有限。

VB's Péter Szőr Award, commemorating the life & work of security researcher Péter Szőr, is awarded for the best piece of technical security research published in the past year. What research deserves to win the 2026 award? Nominations close 9 Sept! https://t.co/bzTktFsWTz https://t.co/Ns9UwdFxxL

社区互动，信息量有限。

RT @HackingLZ: The labs have been benchmaxxing the wrong thing they need to focus on this one... https://t.co/VNwSHEm2It

社区互动，信息量有限。

it must have been deleted at the last moment https://t.co/KiTAKxjJWo

社区互动，信息量有限。

RT @terrynini38514: They really speedran my report 💀 https://t.co/L6zCYJz8Ul

与安全无关。

achieving 8 degrees of incline transforms this equipment into an ultimate fat-burning machine🔥🔥🔥 https://t.co/D2RGwg5reG

社区互动，信息量有限。

"Never trust a philosopher holding two forks"

社区讨论，信息量有限。

@0xocdsec There's no fucking way anyone would pay 50k-100k for an EDR LPE. You can hardly get 50k for a Windows LPE, and that if it works from Chrome sandbox.

操作系统设计讨论，信息量有限。

“Linux is obsolete.” Andrew Tanenbaum said this to Linus Torvalds in 1992. And no, this wasn't about Linux vs Windows. Windows wasn't even the point of the argument. They were arguing about how a kernel should be built: microkernel vs monolithic kernel. More than 30 years later, we're still having the same debate. Some arguments in OS dev really never die.

产品设计讨论，与安全无关。

RT @yatingzhao_ux: 从产品设计师的角度，vibe coding 出来的 app 一般都差些什么？从我个人的经验来看，我常常看见这三点。 第一就是不够简洁。 一个服务大量用户的产品，知道怎么把东西收起来，他们会费很大的力气保持界面的精简。而 vibe coding 出来的产品很多很强大，但很多功能都平摊在界面上，不太会取舍。开发者自己用起来很好用，一旦推广给用户，常常会让人觉得过于复杂、不好理解。 另一个常见的特点就是缺乏引导。 如果是自己用的话，即使在一个页面上完成一个流程的所有事，用起来都是非常顺手的。但当这个产品推出去给所有人用，首次使用要有充足的引导，完成一些复杂的任务也最好是一步步来。这一点vibe coding 出来的 app 常常做的不够。 第三点就是缺少品牌的设计，缺少品牌感。 我见到很多其实设计得非常精简、看起来已经很不错的产品，但是视觉上看起来有点像是一个系统页面，让人很难记住这个品牌，记住产品。当它做到极致，它的确是一种风格（比如 ChatGPT 和 Typora），但一般来说一个更好的、有辨识度的品牌设计，会让用户更容易喜欢上这个产品。

社区互动，信息量有限。

Best. Windows Update. Ever.

社区互动，信息量有限。

Please just give that person a reverser job or something this is just insane the level 🤣🤣🤣🤣🤣

社区互动，信息量有限。

@_xpn_ Have fun guys! 🥳

产品发布，信息量有限。

RT @merill: Today is a special day for me. The private preview of my startup https://t.co/F5uN233Yh7 is out and this feedback means the world to me. I spent an insane amount of time architecting and designing the onboarding experience for Maester's self hosted option. It got to a point where I think its as good of an experience as a cloud hosted solution. Thank you for sharing the feedback Flemming!

社区互动，信息量有限。

@mrgretzky @_xpn_ Thanks Kuba! 💚Might just bother Mr Chester for some input ☺️

社区互动，信息量有限。

@Flangvik Good luck, mate! It's not getting easier with kids 😜. From what I heard it takes time to find the meds that work best for you, but once you find them it should make a huge difference. Try hitting up @_xpn_ maybe for suggestions.

个人经历，与安全无关。

All my life, I've had a sneaking suspicion that I've been raw-dogging ADHD. My approach has always been that there's no need to diagnose something unless it's causing you major problems. Becoming a father, however, made me revisit my stance. It turns out that when you've spent most of your adult life self-regulating through intense work sessions and milking dopamine hits from dropping cool shit on the internet to strangers, having that taken away overnight does things to you… I'm happy to say that I've now got my papers stamped and approved, and I've just started testing out some meds. It's kind of funny that the Western approach to this is basically: "Hey, do you want some amphetamines?" 😂 Wish me luck

重复内容，已在必看中。

RT @MSNightmare2000: FalconFlank : Crowdstrike Falcon 0day LPE is now public https://t.co/J0oBnyVkH5

社区互动，信息量有限。

Morning RedTreat 2026 🇪🇸 https://t.co/3QiyKFKlDA

内核研究博客，信息量有限。

RT @AlanSguigna: I've dusted off my SourcePoint license to continue researching early PEI features in MSR handling. Feeding AET + LBR trace + beautified codebase assembly into LLMs yields interesting insights. Part 4 of the blog series is here: https://t.co/BnlrCnYbDg and Part 5 is in-work. https://t.co/JBD6frpVrH

社区讨论，信息量有限。

Last time I checked EDRs would pay some 10k for a good LPE crit. Take a black market value of x5-x10 so 50k-100k. (Not much for an APT) Take 3 EDRs. 200k-300k. He does it for free. What a white hat.

社区互动，信息量有限。

RT @kerne1_p4n1c: @MSNightmare2000 Wtff bruh u was asking for a licence 2days ago ! Did u just fucked'em so fast lol crazy

链接分享，信息量有限。

https://t.co/rFTePQQlP8

基础知识讨论，信息量有限。

RT @OmegaNekoSimp: Understanding the Fundamentals of Cyber Security: There are 2 main points of contention in security. The first point of contention is obvious, you have offense (red team) who is trying to do the hacking, and you have defense (blue team). The less obvious dynamic though is blue team vs the users. All defensive decisions must balance the effectiveness against attackers with how annoying you make normal processes for your good users. Let's consider the extremes. If you have a book and you light it on fire and reduce it to a pile of ashes, no attacker can read it no matter how hard they try, but nobody else can read it either. On the other side of the spectrum, let's say you donate the book to a library. Anybody can access it, but anybody can steal it, damage it, or even light it on fire themselves. Now before we get into some fundamental strategies, I need to explain one more core truth about security: Nothing is genuinely unhackable. Although the odds are low, properly hashed passwords can be cracked, SSL keys can be broken, the lock on your front door can be picked, your window can be smashed. There is no foolproof "perfect security". The next best alternative is the thing that resolves all conflict: attrition. Keep them busy, exhaust their resources, make them burn exponentially more money to attack you than it costs to defend yourself. This is at the very heart of all defensive security. When done correctly, the cost for a normal user is noticeable, but doesn't create extra steps or make them think. There is one last core idea that I consider fundamental, which is monitoring. If you're unlucky enough to draw the attention of a dedicated attacker who has the resources to overcome your attrition layer, the strategy changes. Since nothing is ever truly secure, the best you can hope to do is slow them down and make escalation as slow as possible for the attacker. This buys you time to be able to deal with them manually, and ideally you involve law enforcement at this point because, ultimately, the only way to make a dedicated attacker stop is to ban them in real life.

链接分享，信息量有限。

https://t.co/cb9TEYKPE6

与安全无关。

RT @ErikVoorhees: KYC is a bullshit scam that endangers millions of innocent people so that regulators can feel as if they're providing value to the world

社区互动，信息量有限。

RT @ghidraninja: It's been 0 days since the last TX/RX swap incident. 🥲 https://t.co/bQGrYY7TLs

工具源码分享，信息量有限。

源码地址https://t.co/KeB0OHscnU

AI Agent 应用案例，信息量有限。

RT @IntCyberDigest: A developer debloated his four-year-old Android TV by enabling developer options, pointing Claude Code at it, and letting the agent disable apps, install FLauncher, and shorten animation timings—all without root. He says it now runs smoother than ever. He published the prompt and a four-step guide; he says nothing is uninstalled and every step is reversible. https://t.co/pL0Zvz6OY4

会议信息，信息量有限。

RT @mdowd: https://t.co/JZh3jIZShI is sold out. In response to multiple requests, we have made virtual tickets available! So if you're unable to make it out to oz or missed your chance to get a ticket, you can still watch the talks live and get in on the action!

社区互动，信息量有限。

bro i literally just asked to check the model. https://t.co/jXZTFiUUZz

社区讨论，信息量有限。

$250,000 for a Chrome exploit chain is still a very low bounty btw

社区互动，信息量有限。

Some quite Russian accounts on this one. Propaganda is really something else in 2026 isn't it.

社区互动，信息量有限。

RT @ntrippar: Huge congrats to the Native team incredible result. really speaks to the value of strong harnesses and solid methodology. even as more cyber-capable models ship, you're still dealing with sampling variance and reward optimization. raw capability helps, but reliable end-to-end outcomes take a lot more.

与安全无关。

RT @Cartidise: Xiaomi didn’t just copy Huawei’s design, they also shamelessly copied the promotional graphics 💀 https://t.co/UL574bAgE9

与安全无关。

RT @JonErlichman: Steve Ballmer’s reaction to the iPhone. https://t.co/G81R0t7Pss

技术演示，信息量有限。

RT @SnazzyLabs: It’s real. Real macOS. On a real iPad. Natively. https://t.co/2fE8be2NXK

社区讨论，信息量有限。

RT @pforemski: BGP is so simple yet difficult. We need more BGP opsec people, against the "AI will fix that" trends.

社区互动，信息量有限。

RT @rekdt: rekdt says he has never used EDR: “I just let the malware walk around until it does its job”

法律事件，与安全技术无关。

RT @tomshardware: Russian hacker faces up to 20 years in prison, following extradition and indictment over US phishing campaign that allegedly infected 80,000 PCs — hacker stole victims' data via remote access https://t.co/Hy4TWbKqEw

与安全无关。

Okay, who at Apple designed the UI here that elides the *units*, apparently at random? https://t.co/TgHLp3vAmN

与安全无关。

RT @depressionlesss: street animals are not asking you to take them home or spend your entire life saving them. sometimes they just need one human to be kind to them today.

社区互动，信息量有限。

Now you know what got sol so excited :D https://t.co/MBxCsCRXic

社区互动，信息量有限。

RT @HackingLZ: This Model is amazing they really fixed the CVP guardrails. https://t.co/0lMAtuVCEe

书籍推荐，信息量有限。

RT @cr3ghost: If you work deeply with Windows, you've probably come across @aionescu's work whether you realised it or not. He joined Windows Internals as a co-author with the 5th edition and continued through the 6th and 7th editions. Processes. Threads. Memory. I/O. Security. ALPC. ETW. Hyper-V. VBS. Virtualization. Windows Internals isn't the kind of reference you read once. It's the kind you keep coming back to for years. If you're learning Windows internals, reversing, malware analysis or detection engineering, put it on your reading list. https://t.co/gpwyKxrzQm #WindowsInternals #ReverseEngineering #MalwareAnalysis

硬件新闻，与安全无关。

RT @GameGPU_com: https://t.co/hWE6q50ELa Insider Kepler_L2 revealed AMD targets clock speeds between 3.1 and 3.4 GHz for RDNA 5. The flagship Radeon RX 10800 XT uses a 3nm node, gaining 3 times more compute units and 4 times wider memory bandwidth. Hardware ray tracing increases by 100% per unit for 4K gaming at 240 Hz. The card beats the RTX 5090 by 30–60% using only 350W–450W compared to 600W for the rival graphics card costing up to $5000. Nvidia delays the RTX 60 series to prioritize AI orders and DLSS 5. High target frequencies of the upcoming AMD architecture will fundamentally transform the balance in the discrete graphics market. #AMD #Radeon #RX10800XT #RDNA5 #Nvidia #RTX5090 #Hardware

链接分享，信息量有限。

RT @uwu_underground: https://t.co/kReAGqWNq7

社区互动，信息量有限。

I was aware that the IBM Threat Intelligence Platform was monitoring my articles, but Crowdstrike? That's a new one. May the "force" be with you 😉 https://t.co/tyNt4yP9zj

转发内容，信息量有限。

RT @webenstein_: https://t.co/T9rJL3T6wK

社区互动，信息量有限。

RT @onlysammms: me whenever someone mentions the f word (future) or the j word (job) or the c word (career) or the m word (marriage) https://t.co/D82cIxPVEf

社区互动，信息量有限。

Can’t wait to install Linux on my remaining boxes once I’m done with school

课程推广，信息量有限。

JHT Course Launch! Python for Cybersecurity https://t.co/0CxKRwv30x

商业促销，信息量有限。

https://t.co/zKV2rbGXx9 is extending launch promos for Labor Day weekend. choose a discount based on your plan type LABOR20 - 20% off monthly plans for 3 months or LABOR2026 - 20% off annual plan for full year

社区互动，信息量有限。

RT @shanejcaldwell: It's not every day your research goes to prod, but it's always a good day when it does. Thanks to @mkultraWasHere for making it happen. More monitoring features to come as @dreadnode swarms on making sure your swarms only swarm where you want them to. Back to work 🫡

社区互动，信息量有限。

RT @0xSero: The people's AGI. Thank you Qwen. https://t.co/WxJM74NbHU

社区互动，信息量有限。

robots are back

社区互动，信息量有限。

Does anyone know how to change this accent color to something custom? It's only the default RGB stuff. It annoys me. https://t.co/9SYYOzh0HY

奖项提名，信息量有限。

VB's Péter Szőr Award, commemorating the life & work of security researcher Péter Szőr, is awarded for the best piece of technical security research published in the past year. What research deserves to win the 2026 award? Nominations close 9 Sept! https://t.co/bzTktFsWTz https://t.co/Ns9UwdFxxL

社区互动，信息量有限。

RT @HackingLZ: The labs have been benchmaxxing the wrong thing they need to focus on this one... https://t.co/VNwSHEm2It

社区互动，信息量有限。

it must have been deleted at the last moment https://t.co/KiTAKxjJWo

社区互动，信息量有限。

RT @terrynini38514: They really speedran my report 💀 https://t.co/L6zCYJz8Ul

与安全无关。

achieving 8 degrees of incline transforms this equipment into an ultimate fat-burning machine🔥🔥🔥 https://t.co/D2RGwg5reG

社区互动，信息量有限。

"Never trust a philosopher holding two forks"

社区讨论，信息量有限。

@0xocdsec There's no fucking way anyone would pay 50k-100k for an EDR LPE. You can hardly get 50k for a Windows LPE, and that if it works from Chrome sandbox.

操作系统设计讨论，信息量有限。

“Linux is obsolete.” Andrew Tanenbaum said this to Linus Torvalds in 1992. And no, this wasn't about Linux vs Windows. Windows wasn't even the point of the argument. They were arguing about how a kernel should be built: microkernel vs monolithic kernel. More than 30 years later, we're still having the same debate. Some arguments in OS dev really never die.

产品设计讨论，与安全无关。

RT @yatingzhao_ux: 从产品设计师的角度，vibe coding 出来的 app 一般都差些什么？从我个人的经验来看，我常常看见这三点。 第一就是不够简洁。 一个服务大量用户的产品，知道怎么把东西收起来，他们会费很大的力气保持界面的精简。而 vibe coding 出来的产品很多很强大，但很多功能都平摊在界面上，不太会取舍。开发者自己用起来很好用，一旦推广给用户，常常会让人觉得过于复杂、不好理解。 另一个常见的特点就是缺乏引导。 如果是自己用的话，即使在一个页面上完成一个流程的所有事，用起来都是非常顺手的。但当这个产品推出去给所有人用，首次使用要有充足的引导，完成一些复杂的任务也最好是一步步来。这一点vibe coding 出来的 app 常常做的不够。 第三点就是缺少品牌的设计，缺少品牌感。 我见到很多其实设计得非常精简、看起来已经很不错的产品，但是视觉上看起来有点像是一个系统页面，让人很难记住这个品牌，记住产品。当它做到极致，它的确是一种风格（比如 ChatGPT 和 Typora），但一般来说一个更好的、有辨识度的品牌设计，会让用户更容易喜欢上这个产品。

社区互动，信息量有限。

Best. Windows Update. Ever.

社区互动，信息量有限。

Please just give that person a reverser job or something this is just insane the level 🤣🤣🤣🤣🤣

社区互动，信息量有限。

@_xpn_ Have fun guys! 🥳

产品发布，信息量有限。

RT @merill: Today is a special day for me. The private preview of my startup https://t.co/F5uN233Yh7 is out and this feedback means the world to me. I spent an insane amount of time architecting and designing the onboarding experience for Maester's self hosted option. It got to a point where I think its as good of an experience as a cloud hosted solution. Thank you for sharing the feedback Flemming!

社区互动，信息量有限。

@mrgretzky @_xpn_ Thanks Kuba! 💚Might just bother Mr Chester for some input ☺️

社区互动，信息量有限。

@Flangvik Good luck, mate! It's not getting easier with kids 😜. From what I heard it takes time to find the meds that work best for you, but once you find them it should make a huge difference. Try hitting up @_xpn_ maybe for suggestions.

个人经历，与安全无关。

All my life, I've had a sneaking suspicion that I've been raw-dogging ADHD. My approach has always been that there's no need to diagnose something unless it's causing you major problems. Becoming a father, however, made me revisit my stance. It turns out that when you've spent most of your adult life self-regulating through intense work sessions and milking dopamine hits from dropping cool shit on the internet to strangers, having that taken away overnight does things to you… I'm happy to say that I've now got my papers stamped and approved, and I've just started testing out some meds. It's kind of funny that the Western approach to this is basically: "Hey, do you want some amphetamines?" 😂 Wish me luck

重复内容，已在必看中。

RT @MSNightmare2000: FalconFlank : Crowdstrike Falcon 0day LPE is now public https://t.co/J0oBnyVkH5

社区互动，信息量有限。

Morning RedTreat 2026 🇪🇸 https://t.co/3QiyKFKlDA

内核研究博客，信息量有限。

RT @AlanSguigna: I've dusted off my SourcePoint license to continue researching early PEI features in MSR handling. Feeding AET + LBR trace + beautified codebase assembly into LLMs yields interesting insights. Part 4 of the blog series is here: https://t.co/BnlrCnYbDg and Part 5 is in-work. https://t.co/JBD6frpVrH

社区讨论，信息量有限。

Last time I checked EDRs would pay some 10k for a good LPE crit. Take a black market value of x5-x10 so 50k-100k. (Not much for an APT) Take 3 EDRs. 200k-300k. He does it for free. What a white hat.

社区互动，信息量有限。

RT @kerne1_p4n1c: @MSNightmare2000 Wtff bruh u was asking for a licence 2days ago ! Did u just fucked'em so fast lol crazy

链接分享，信息量有限。

https://t.co/rFTePQQlP8

基础知识讨论，信息量有限。

RT @OmegaNekoSimp: Understanding the Fundamentals of Cyber Security: There are 2 main points of contention in security. The first point of contention is obvious, you have offense (red team) who is trying to do the hacking, and you have defense (blue team). The less obvious dynamic though is blue team vs the users. All defensive decisions must balance the effectiveness against attackers with how annoying you make normal processes for your good users. Let's consider the extremes. If you have a book and you light it on fire and reduce it to a pile of ashes, no attacker can read it no matter how hard they try, but nobody else can read it either. On the other side of the spectrum, let's say you donate the book to a library. Anybody can access it, but anybody can steal it, damage it, or even light it on fire themselves. Now before we get into some fundamental strategies, I need to explain one more core truth about security: Nothing is genuinely unhackable. Although the odds are low, properly hashed passwords can be cracked, SSL keys can be broken, the lock on your front door can be picked, your window can be smashed. There is no foolproof "perfect security". The next best alternative is the thing that resolves all conflict: attrition. Keep them busy, exhaust their resources, make them burn exponentially more money to attack you than it costs to defend yourself. This is at the very heart of all defensive security. When done correctly, the cost for a normal user is noticeable, but doesn't create extra steps or make them think. There is one last core idea that I consider fundamental, which is monitoring. If you're unlucky enough to draw the attention of a dedicated attacker who has the resources to overcome your attrition layer, the strategy changes. Since nothing is ever truly secure, the best you can hope to do is slow them down and make escalation as slow as possible for the attacker. This buys you time to be able to deal with them manually, and ideally you involve law enforcement at this point because, ultimately, the only way to make a dedicated attacker stop is to ban them in real life.

链接分享，信息量有限。

https://t.co/cb9TEYKPE6

与安全无关。

RT @ErikVoorhees: KYC is a bullshit scam that endangers millions of innocent people so that regulators can feel as if they're providing value to the world

社区互动，信息量有限。

RT @ghidraninja: It's been 0 days since the last TX/RX swap incident. 🥲 https://t.co/bQGrYY7TLs

工具源码分享，信息量有限。

源码地址https://t.co/KeB0OHscnU

AI Agent 应用案例，信息量有限。

RT @IntCyberDigest: A developer debloated his four-year-old Android TV by enabling developer options, pointing Claude Code at it, and letting the agent disable apps, install FLauncher, and shorten animation timings—all without root. He says it now runs smoother than ever. He published the prompt and a four-step guide; he says nothing is uninstalled and every step is reversible. https://t.co/pL0Zvz6OY4

会议信息，信息量有限。

RT @mdowd: https://t.co/JZh3jIZShI is sold out. In response to multiple requests, we have made virtual tickets available! So if you're unable to make it out to oz or missed your chance to get a ticket, you can still watch the talks live and get in on the action!

社区互动，信息量有限。

bro i literally just asked to check the model. https://t.co/jXZTFiUUZz

社区讨论，信息量有限。

$250,000 for a Chrome exploit chain is still a very low bounty btw

社区互动，信息量有限。

Some quite Russian accounts on this one. Propaganda is really something else in 2026 isn't it.

社区互动，信息量有限。

RT @ntrippar: Huge congrats to the Native team incredible result. really speaks to the value of strong harnesses and solid methodology. even as more cyber-capable models ship, you're still dealing with sampling variance and reward optimization. raw capability helps, but reliable end-to-end outcomes take a lot more.

与安全无关。

RT @Cartidise: Xiaomi didn’t just copy Huawei’s design, they also shamelessly copied the promotional graphics 💀 https://t.co/UL574bAgE9

与安全无关。

RT @JonErlichman: Steve Ballmer’s reaction to the iPhone. https://t.co/G81R0t7Pss

技术演示，信息量有限。

RT @SnazzyLabs: It’s real. Real macOS. On a real iPad. Natively. https://t.co/2fE8be2NXK

社区讨论，信息量有限。

RT @pforemski: BGP is so simple yet difficult. We need more BGP opsec people, against the "AI will fix that" trends.

社区互动，信息量有限。

RT @rekdt: rekdt says he has never used EDR: “I just let the malware walk around until it does its job”

法律事件，与安全技术无关。

RT @tomshardware: Russian hacker faces up to 20 years in prison, following extradition and indictment over US phishing campaign that allegedly infected 80,000 PCs — hacker stole victims' data via remote access https://t.co/Hy4TWbKqEw

与安全无关。

Okay, who at Apple designed the UI here that elides the *units*, apparently at random? https://t.co/TgHLp3vAmN

与安全无关。

RT @depressionlesss: street animals are not asking you to take them home or spend your entire life saving them. sometimes they just need one human to be kind to them today.

社区互动，信息量有限。

Now you know what got sol so excited :D https://t.co/MBxCsCRXic

社区互动，信息量有限。

RT @HackingLZ: This Model is amazing they really fixed the CVP guardrails. https://t.co/0lMAtuVCEe