头条8
RedNova：从任意文件写入到 Windows 命令执行
Windows 提权技术，利用 COM 对象，PoC 公开，影响面广。
RedNova: From Arbitrary File Write to Command Execution Using COM in Windows
Months ago, I wrote a post (https://t.co/IwwfTJcGyX) about the unique method used in the RedSun exploit to turn a file write into command execution by using a COM object that can be triggered by a low-privileged user and runs as SYSTEM.
In that post, I mentioned that there are other COM objects that can be used in the same way.
I presented one object called CoFilterPipeline and noted that it needs some tricks before it can be weaponized.
Now I've written a full blog post on how you can find such objects and how you can weaponize them in exploits like RedSun.
The video below shows another COM object with the same behavior (windows 11). It's called PerceptionSimulationCoClass.
A low-privileged user can activate it, and it runs as SYSTEM. The video doesn't contain any exploit (it just replaces the COM server as administrator).
The goal is only to demonstrate how a file write can be turned into command execution as SYSTEM while being triggered by a low-privileged user.
https://t.co/Uz2whcSdYQ
windows提权pocrce
@haider_kabibo
原文 ↗
Windows 内核利用技术，可绕过安全防护，影响面广。
The technique works 🤗 We open a handle to the Notepad process and then redirect its kernel handle pointer to point to the lsass.exe EPROCESS
From there, we can operate through that handle and have full control over LSASS without ever opening a handle directly to the process https://t.co/78pwjDqTM7
windows内核提权poc
@Salsa12__
原文 ↗
AI 模型安全漏洞，影响面广，PoC 已公开。
RT @ridvanyagli: 🔴 Grok'ta Zero-Click Data Exfiltration (Veri Sızdırma) Saldırısı Keşfedildi!
Adversa AI araştırmacıları, Grok'un web sayfalarını analiz etme özelliğini hedefleyen Cryptographic Context Injection adlı yeni bir prompt injection tekniği ortaya çıkardı.
Saldırıda kötü amaçlı talimatlar doğrudan metin olarak değil, AES-256-GCM ile şifrelenmiş bir JSON nesnesi içinde gizleniyor. Grok'tan bu veriyi Python çalışma ortamında çözmesi istendiğinde, şifrelenmiş içerik saldırganın asıl talimatlarını ortaya çıkarıyor.
Kritik nokta ise: Grok, kod çalıştırma sonucunda ortaya çıkan bu talimatları güvenilmeyen web içeriği yerine kendi güvenilir çalışma çıktısı olarak değerlendirebiliyor.
Saldırgan daha sonra Grok'u, mevcut oturumdaki kullanıcı adı, yaklaşık konum, abonelik seviyesi ve sohbet geçmişi gibi bağlam bilgilerini saldırganın kontrolündeki bir URL'ye göndermeye yönlendirebiliyor.
Böylece saldırı zinciri:
Web sayfası -> Şifreli prompt injection -> Kod çalıştırma -> Talimatların çözülmesi -> Oturum bağlamına erişim -> Dışarıya veri aktarımı
şeklinde ilerliyor.
Adversa, bu zero-click saldırıyı 3 Haziran 2026'da xAI'ye bildirdiğini ve 19 Ağustos'ta hala yeniden yapılabildiğini belirtiyor. Şu anda kamuya açık bir CVE veya xAI tarafından açıklanmış bir yama bulunmuyor.
ai_agentllmpoc注入
@0xocdsec
原文 ↗
关键基础设施漏洞，影响面广，需立即关注。
RT @DailyDarkWeb: 🚨 Cisco Patches Five Maximum-Severity CVSS 10.0 Vulnerabilities
Cisco has released major security hardening updates addressing nine vulnerability groupings across its Crosswork and Secure Workload platforms — including five carrying the maximum CVSS score of 10.0.
Cisco Crosswork:
* CVE-2026-20030 — CVSS 10.0 — SQL injection
* CVE-2026-20357 — CVSS 10.0 — Missing authentication for critical functions
* CVE-2026-20358 — CVSS 10.0 — External control of the file system
* CVE-2026-20359 — CVSS 9.9 — Insufficiently protected credentials
Cisco Secure Workload:
* CVE-2026-20231 — CVSS 9.9 — Command, OS and argument injection vulnerabilities
* CVE-2026-20315 — CVSS 10.0 — Improper access control, including authorization and authentication bypasses
* CVE-2026-20317 — CVSS 10.0 — Improper authentication, including missing authentication and authentication bypass
* CVE-2026-20318 — CVSS 9.6 — Improper input validation, including path traversal
* CVE-2026-20319 — CVSS 7.5 — Memory-safety issues including buffer overflows and out-of-bounds writes
* Cisco says the vulnerabilities were discovered during internal security testing using both existing testing processes and frontier AI models
* Cisco PSIRT is currently NOT aware of malicious exploitation of these vulnerabilities
* There are no workarounds for the Secure Workload vulnerabilities
* Cisco strongly recommends upgrading affected systems to fixed releases
⚠️ Analyst Note:
Five CVSS 10.0 vulnerability groupings appearing across two enterprise security/network-management platforms in the same disclosure cycle deserves immediate attention.
Another particularly interesting detail is how they were discovered: Cisco explicitly says its internal security testing incorporated frontier AI models.
AI is increasingly becoming relevant on both sides of vulnerability research — accelerating offensive discovery while simultaneously giving vendors another tool to identify serious weaknesses before attackers do.
Official Cisco Source:
https://t.co/5mlO0OSyZD
#DDW #Cisco #CyberSecurity #Vulnerability #CVE #AI
cveciscorcesqli
@0xocdsec
原文 ↗
Linux 内核漏洞，PoC 可能公开，影响面广。
RT @phoronix: Specially Crafted NTFS File-System Image Allows Root Access On Linux With NTFS3 Driver
https://t.co/j9cAC1Ffdf
linux内核lpecve
@0xocdsec
原文 ↗
FortiOS 固件解密工具，发现硬编码 AES 密钥
Fortinet 设备安全，密钥泄露影响面广，工具已公开。
RT @_n0p_: Introducing fortitool: one static Go binary that decrypts and unpacks FortiOS firmware end to end, no openssl, no binwalk, no Python, nothing but the binary itself.
Along the way I found something nobody's published before:
FortiGate config backups hide passwords behind a hardcoded AES key, and the common belief is Fortinet rotated it back in 2019 after CVE-2019-6693. They didn't. It rotated quietly at 7.4, and the new key's been sitting unpublished until I reversed it out of /bin/init:
91bc4d1e0e5e35dea0e84803bb1c4cc49699362830f9d6a6c75880b181f6c1db
Full writeup: https://t.co/E4UGryoqyt
Code: https://t.co/XvYpP6oSws
固件工具cve供应链
@ilove2pwn_
原文 ↗
Fedora 44 netfilter UAF 漏洞利用公开
Linux 内核漏洞，PoC 已公开，影响面广。
RT @nebusecurity: Today's exploit is for the latest Fedora 44, a UAF in netfilter, CVE-2026-52912.
It was introduced in Mar 2016 and fixed upstream in May 2026.
Discovered and exploited by the NebuSec security pipeline. (RANDOM_KMALLOC_CACHES + SELinux)
Exp source code: https://t.co/jlanCsTkft https://t.co/WZO8z1uPBU
linux内核cvepoc
@0xocdsec
原文 ↗
Qualcomm AI 加速器驱动 UAF 提权漏洞
AI 硬件驱动漏洞，影响面广，PoC 已公开。
RT @Enno_Insinuator: Privilege Escalation via a Page Use-After-Free in Qualcomm's AI Accelerator Linux Kernel Driver
https://t.co/UMDStsv8R9
ai内核lpecve
@0xocdsec
原文 ↗
推荐15
Google Docs 被利用进行攻击，通过 Apps Script 实现钓鱼
针对 Google Docs 的新型攻击向量，影响广泛，值得关注。
RT @malmoeb: After a bit of tinkering, I was able to replicate the Google Docs attack vector described in the Huntress blog post [1]
Attackers can use Google’s “App Scripts” feature (in Docs) to create a clever pretext. Essentially, the attack works as follows:
The attacker sent the victim a legitimate Google Docs link that appeared to be a partially encrypted conference/planning document. Embedded in the document was a Google Apps Script that displayed its own HTML sidebar (DecryptPanel.html). This sidebar mimicked a “Document Decryption” feature and awaited an “Access Key” sent separately by the attacker.
The decryption was designed to fail intentionally. After entering the supposedly correct key, the Apps Script interface displayed a fake error message and then offered repair/update steps (your classic Click Fix steps).
What’s particularly interesting about this vector is that the victim remains entirely on https://t.co/UuOIbi5N3S throughout the process. This makes the process appear significantly more trustworthy than a classic phishing page on a third-party domain.
Definitely something to look out for.
[1] https://t.co/rUigzmTcjS
钓鱼google_docs攻击手法
@0xocdsec
原文 ↗
绕过现代 EDR 的新技术，对红队和防御者都有价值。
RT @_MrTiz: Intel #CET killed traditional #callstack #spoofing. Here is how to bypass modern #EDRs telemetry anyway.
New: CET-Compliant Callstack Spoofing via Thread Pool & Enum callbacks.
Manual shadow stack resync via JMP & #INCSSPQ. Article & Rust PoC included👇
https://t.co/fJOmAcFGOa https://t.co/l4l8UV24ow
edr绕过windowspoc
@DaWouw
原文 ↗
Furtex：基于 io_uring 和 eBPF 的 Linux 后渗透工具
新型 Linux 后渗透工具，对红队和防御者都有参考价值。
RT @MatheuzSecurity: Dropping something I've been building: Furtex, a post-exploitation and evasion research toolkit for Linux built around io_uring and eBPF. Raw syscalls throughout, no frameworks, no liburing.
https://t.co/fDMxPEtEV2
#linux #rootkit #malware #ebpf #io_uring #research
#evasion
linux后渗透工具ebpf
@0xocdsec
原文 ↗
macOS 上发现新的 ClickFix 式信息窃取攻击
macOS 攻击手法更新，对安全防护有参考价值。
RT @ValeryMarchive: Hey @MarceloRivero & @patrickwardle we have a new one here, still targeting macOS, obfuscated JS code, ClickFix-style install procedure. It's party time here for these since this spring... #infostealer
on VT: ee41752cdcda41faf7730f25a1d596a7dd64180ae836c00376afc37c78e7cd68 https://t.co/ZAVtJGExLK
macos恶意软件攻击手法
@patrickwardle
原文 ↗
逆向工程新技术，对安全研究有参考价值。
Static Devirtualization of Tencent VM (@BackEngineerLab)
https://t.co/pUNxbrtbGk
#infosec https://t.co/9BKJqvailN
dnscmd.exe 功能移植到 BOF，可提权域管
红队工具，利用 DnsAdmins 组提权，有实战价值。
RT @r1cksec: A post about how the functionality of dnscmd.exe was ported to a BOF, enabling to gain domain admin rights when impersonating a user who is a member of the DnsAdmins group.
https://t.co/vozs2i1B32
#infosec #cybersecurity #redteam #pentest
新型钓鱼模拟工具，对红队和防御者都有价值。
Mimic - Frameless Browser‑in‑the‑Browser (BitB)
A single‑script Shadow DOM / MutationObserver library for realistic phishing simulations, easily injected via reverse proxy.
https://t.co/462EKc93N6 https://t.co/lmNJjA74ES
Offensivecon 2026 幻灯片发布，包含 QSEE 漏洞利用
移动端 TEE 漏洞利用，影响面广，值得关注。
RT @pulsoid: Slides from #Offensivecon2026 have been released!
You may want to peek into our use of secure ranges and XPUs to pwn QSEE on Google Wifi Pro.
EL3 privesc with 2 single writes. --> TEE writable from NS-EL0.
Writing TEE memory with bash scripts...is quite cool ;)
移动端tee漏洞利用
@mrgretzky
原文 ↗
Windows 内核利用技术，有扩展性，值得研究。
The best thing about the technique, also works for threads, files, any object handle.
So for example you can open any dummy file and redirect the pointer of your handle to point the ntds.dit...
Not bad right?
windows内核利用技术
@Salsa12__
原文 ↗
开源工具，对安全研究有实用价值。
Tap in if you're into Malware Anal/Vuln Research,...
Openbin is technically GitHub+GHIDRA
And join our discord server so you can ask for assistance if you get puzzled anytime
开源工具，对安全研究有实用价值。
RT @oneandonlyhusam: After 2.5 months in beta, and over 1000 organic users, and a small discord community, I am finally annoucing the launch of https://t.co/OzGP5VPli2 @OpenBinAI
The Free and Opensource collaborative security research and reverse engineering platform. Weather you're into malware analysis, or vulnerability research, you can now create and access your projects anywhere completely for free, share projects with friends and fellow researchers, and publish your analysis reports or vulnerability research publicly with the community!
You can also peer review publicly posted research, fork and make your own revisions, and build your public profile, all with fully build in LLM access to get AI assistance with your work in openbin. This platform was build to address the gap in the security research community where we did not have a collaborative space to work on things together like how developers have github, and github would probably ban you anyways, we don't!
Join us today, a growing ecosystem of enthusiastic, passionate, and collaborative security researchers, completely for free!
https://t.co/k1KcHn4Azk
AI 工具隐私问题，影响自托管 AI 用户。
RT @yo_yo_yo_jbo: As a reminder, on macOS due to TCC, a user shouldn't be able to simply read Messages contents. However, Codex keeps its history in /Users/$USER/.codex/sessions, and so you get the content that ChatGPT wrote there. Fun times. https://t.co/TZekWOxlIk
ai_agent隐私macos
@0xocdsec
原文 ↗
GhostDebug：基于 VEH 的 Windows 调试器
绕过调试器检测的工具，对逆向工程有价值。
RT @vollragm: About a year ago I built GhostDebug, an x64 VEH-based Windows debugger designed to bypass common debugger-detection checks by avoiding the normal Win32 debugging APIs.
Check it out here:
Blogpost: https://t.co/bGJbUiaytm
GitHub: https://t.co/chqtsGZZIm
windows调试器工具
@0xocdsec
原文 ↗
AI 代理审计：2350 亿 token 的会话日志分析
AI 代理在逆向工程中的应用，对自托管 AI 安全有参考。
RT @momo5502: 235 Billion Tokens Later: Auditing What The AI Agents Really Did
I have analyzed more than 2gb of session logs from the MW2 decompilation session.
I discovered super interesting insights on how to optimize the multi agent setup.
Go give it a read 😁
https://t.co/b4bf9PBxpa
ai_agent逆向报告
@mrexodia
原文 ↗
x64dbg-MCP Server：AI 驱动的逆向工程
AI 代理控制调试器，对自托管 AI 安全有参考。
RT @duty_1g: 🚀 x64dbg-MCP Server — fully automated, dynamic, agentic reverse engineering for x64dbg.
🧠 71 MCP tools
🤖 Fully automated & dynamic agentic RE
🔴 22 debugger event callbacks
⚡ Native Zig plugin — zero dependencies
🛠️ Breakpoints, memory, registers, tracing, xrefs, PE analysis & more
🌐 Streamable HTTP + SSE
📦 x32 + x64
Let your AI agent control, analyze, debug, and dynamically reverse engineer binaries directly through x64dbg.
🔗 https://t.co/5gmqJw6SVm
#x64dbg #MCP #AgenticAI #ReverseEngineering #CyberSecurity #RedTeam #MalwareAnalysis #Zig
ai_agent逆向工具
@h4x0r_dz
原文 ↗
更多25
Hackbot：AI 驱动的自动化漏洞挖掘工具介绍
展示 AI Agent 在漏洞挖掘中的实际应用，对自托管 AI 安全有参考价值。
The Bug Bounty Singularity: Our Hackbot - @rez0__
https://t.co/F1cqPCYbuW
ai_agent工具漏洞挖掘
@pentest_swissky
原文 ↗
讨论 Windows PatchGuard 对句柄表的保护
涉及 Windows 内核安全机制，对安全研究者有参考价值。
@Salsa12__ @grok Doesn't Windows PatchGuard (KPP) protect process' handle table located in the kernel address space and used to retrieve pointers to kernel objects?
windows内核安全机制
@artem_i_baranov
原文 ↗
tmp.0ut 5 发布，包含病毒、rootkit 等研究内容
安全研究社区的重要发布，包含技术内容。
RT @netspooky: So excited for tmp.0ut 5! There is so much amazing stuff in here.
I highly recommend checking out our interview with programming legend Doug McIlroy. It was surreal to get to chat with him. He's 94 now, and was citing papers he was influenced by in the 1940s and 50s...
Linux 7.3 增强对 EFI 固件错误的防护
内核安全更新，对系统稳定性有影响。
RT @phoronix: Linux 7.3 Better Protects Against Buggy EFI Firmware Taking Down The Rest Of User-Space
https://t.co/r1oZXo0zH4
linux内核efi
@0xocdsec
原文 ↗
涉及供应链信息，可能影响 AI 工具安全性。
Gets its AI tooling from a company called Beijing Jiuyang Technology Co., Ltd. (北京玖扬科技有限公司) 4/4. https://t.co/pevEUaNgip
可能涉及信息操纵，但信息不完整。
They seem to operate quite a range of Twitter/X, LinkedIn and Telegram accounts for whatever reason. 3/4 https://t.co/CGhfkRqWZd
涉及中国安全公司数据泄露，影响面广，值得关注。
New Integrity Tech (永信至诚) leak has dropped for sale on a regular market place. We could only take a look at the sample data, which is not plentiful. But here are a few first quick observations... 1/4 https://t.co/9wGWxhygFw
数据泄露事件安全公司
@NetAskari
原文 ↗
涉及本地 AI 部署，与自托管 AI 相关。
RT @arekfurt: As with other software, with LLMs there will be situations where the best answer is local/on-prem (or run by you on PaaS cloud) and situations where the best answer is SaaS-based.
The West needs to catch up in the former category.
https://t.co/p96FxAcZ72
llm本地部署议题
@Teach2Breach
原文 ↗
Windows 11 24H2 对 KASLR 绕过的 ETW 检测
涉及 Windows 安全机制更新，对安全研究有参考。
TIL on Windows 11 24H2 and later, calling NtQuerySystemInformation to circumvent KASLR from a non-admin process will generate a Syscall Usage ETW-TI event for security products to consume, not that you could do it anyway, not without SeDebugPrivilege enabled :) https://t.co/LZOS4U15wX
windowskaslretw
@_winterknife_
原文 ↗
tmp.0ut 5 发布，包含病毒、rootkit 等
安全研究社区的重要发布。
RT @tmpout: We are pleased to release tmp.0ut 5 Volume!
Get your viruses, rootkits, strange ELFs, weird machines, tiny files, cool art, and phresh beats here!!
https://t.co/tZLM50HOc0 https://t.co/8P9lnXgcdq
数据泄露事件，影响面广，值得关注。
RT @DailyDarkWeb: 🇨🇳 Chinese Cybersecurity Company Integrity Technology Group Allegedly Targeted — Sensitive Corporate and Government-Related Data Offered for Sale
A threat actor on an underground cybercrime forum is advertising data allegedly belonging to Integrity Technology Group Inc. (永信至诚), a publicly listed Chinese cybersecurity company.
* The seller claims the material covers operations involving China, Hong Kong, Taiwan, Vietnam and Japan
* Allegedly compromised financial information includes bank account numbers, corporate cash-flow records and quarterly reports
* Personal information purportedly includes board members' names and national ID numbers
* The actor claims possession of credentials associated with multiple cloud and technology platforms, including Alibaba Cloud, Tencent Cloud and other services
* The listing also claims to contain internal technical white papers, corporate qualification and customer information, technology-development agreements, procurement contracts and bidding documents
* Particularly notable is an alleged document related to a 2025 cybersecurity emergency-response exercise involving the Fuzhou Cyberspace Administration Office
* The seller also references contracts involving several organizations, including the Institute of Information Engineering at the Chinese Academy of Sciences
⚠️ Analyst Note:
The claims have not been independently verified and should currently be treated as threat-actor allegations.
If authentic, however, this would be more significant than a conventional customer-data leak. The combination of cloud credentials, internal cybersecurity documentation, financial records, contracts and government-related materials could expose organizational relationships, security architecture and potentially sensitive supply-chain information.
The selling account appears to have joined the forum in August 2026 and currently shows no established reputation, which is an important caveat when assessing credibility.
#DDW #DarkWeb #China #DataBreach #Cybersecurity #ThreatIntelligence #CyberThreats
数据泄露事件安全公司
@0xocdsec
原文 ↗
AI 在安全研究中的应用趋势，对自托管 AI 安全有参考。
RT @dhakal_ananda: I'm finding more bugs than ever.
But honestly? I'm enjoying it less than ever.
I wrote a blog post on how AI has changed vulnerability research, what I feel about it, and what next.
https://t.co/roQm1ypva1
ai漏洞研究议题
@alkalinesec
原文 ↗
OT 攻击事件，影响关键基础设施安全。
Iran-linked hackers reportedly forced a small UK energy facility offline for four days after a cyberattack.
The incident did not disrupt Britain’s wider power supply, but it still showed what can happen when attackers gain access to operational technology.
Imagine arriving at work and discovering that the power plant has been placed on airplane mode by somebody operating from another country. 😭
Attacks against energy and water systems are different from ordinary data breaches. The objective may not be to steal customer records. An attacker could manipulate industrial equipment, lock operators out or stop a physical process completely.
CISA has previously warned that Iran-affiliated actors targeted internet-connected programmable logic controllers, particularly devices left exposed with weak or default credentials.
ot事件攻击
@Officialwhyte22
原文 ↗
安全研究社区的重要发布。
RT @PiotrBania: yo ppl, check out https://t.co/UrAv8mEcCm and the new phracktro :D and stay tuned for the new phrack release(s) 🤠cheers! https://t.co/RuiVOoBSAA
隐私侵犯事件，影响广泛，值得关注。
RT @brave: Alibaba's AliExpress was caught using users' audio systems to track them.
AliExpress wasn't recording users but instead playing a silent sound and measuring how users' specific devices processed it in order to fingerprint them.
But don't worry because Brave stops this.
隐私指纹事件
@artem_i_baranov
原文 ↗
隐私侵犯事件，影响广泛，值得关注。
AliExpress website fingerprints users audio devices without their knowledge: https://t.co/aFoYirmd1J https://t.co/1fno092pzT
涉及 AI 与安全研究，有参考价值。
RT @davidfowl: Opinions seem to be going out of style with LLMs.
There’s a lot of “we don’t need X anymore, agents can just do it.”
Style still matters. Approaches matter. Tradeoffs matter. Taste matters.
If you outsource your opinions to the agent, eventually you lose the mastery required to know if the agent is actually doing a good job.
内核提权漏洞，PoC 可能公开，值得关注。
RT @VirtualPr0tect: Reported my first windows kernel LPE. https://t.co/ct2osQMQJK
windows内核lpe
@0xocdsec
原文 ↗
Ox-alpha 来自 Zai 的 GLM-5.X 系列
AI 模型信息，对 AI 安全研究有参考。
RT @elder_plinius: Ox-alpha is from Zai, GLM-5.X family
my agent has spoken 🙌 https://t.co/VT22xeuVkX
Linux 文件系统安全更新，有参考价值。
RT @phoronix: eCryptfs Sees Fixes For Potential Malicious Intent, Some Dating Back To Its 2006 Debut
https://t.co/5nVYRgRo2V
linux文件系统cve
@0xocdsec
原文 ↗
内核更新，可能包含安全修复。
RT @Linux247: Linux Kernel 7.2 Officially Released, This Is What’s New https://t.co/2blkVub577
安全研究社区的重要发布。
RT @PiotrBania: yo ppl, check out https://t.co/UrAv8mEcCm and the new phracktro :D and stay tuned for the new phrack release(s) 🤠cheers! https://t.co/RuiVOoBSAA
VPN 安全研究，影响面广，值得关注。
RT @Enno_Insinuator: Security Testing of WireGuard Implementations, from @vanhoefm et al.
https://t.co/eNsyIbVKVq [PDF] https://t.co/4soYda4RPz
Windows 内核利用技术，对安全研究有参考。
RT @Steph3nSims: Thanks again to @yarden_shafir for sharing her research on exploiting I/O Rings on Windows, along with the work Microsoft has done to mitigate the technique.
Watch the full talk on YouTube: https://t.co/8MbNR8CEee
windows内核利用技术
@_winterknife_
原文 ↗
系统安全更新，有参考价值。
RT @openbsd: Errata patches released for the kernel and expat: https://t.co/YTWc6G2KWy
openbsd补丁cve
@0xocdsec
原文 ↗