推特安全流

真实AI辅助攻击案例，展示LLM在攻击链中的实际角色。

"SecFlow connected short objectives to tool-using workers, a shared filesystem, target configuration, proxy routing, and a report pipeline. The AI component organized the work. The exploitation itself still depended on conventional scripts, public proof-of-concept code, leaked credentials, webshells, and custom implants." https://t.co/8TAM3U0ZJP

AI自主开发恶意软件案例，对防御与检测提出新挑战。

Despite not having found a clear answer but here are some of the observations in our little report "Robobox" 6/6. https://t.co/dIXvxTh8aX https://t.co/tkxNpSEQzT

AI辅助恶意软件开发趋势的又一佐证。

What started as a curious find of what we thought is another vibe coded Coruna C2 framework in Chinese language via @Huntio 'attack capture' led to a little journey down a rabbit hole that led us to a few interesting observations about AI-aided malware developments ( we think ). 1/6

AI自主攻击链细节，展示自动化恶意活动的潜在规模。

The system built a basic, but functional RAT to let a remote actor access it, setup a CS team server, built and stage a CN version of a Coruna C2 framework, served up Npcap package via http and hit up a server of a Korean bank for a web-shell ( among other things). It is still not completely clear how autonomous this box was managed, but it is pretty obvious that it was not closely managed. Maybe part of a swarm development system !? 5/6

LLM辅助漏洞挖掘效率提升，安全软件质量面临新挑战。

Working with frontier LLMs for vulnerability research lately has made me feel like I woke up one day and found the solid walls of my house were all made of paper. I knew humans were not good at secure software but having fistfuls of Chrome vulnerabilities makes it very real

开源LLM在复杂漏洞研究中的实际能力边界参考。

This is partly why I'm impatiently awaiting Astra... I have a VR bench based on real (unreported) bugs. I'd love to see how it performs on some of these, and I keep reading mixed results. Qwen3.8-27B managed to use my tools and discover one of the bugs in rdbss, but it took 22 hours, didn't generate a functioning PoC (timed out at 24hrs), and didn't manage the others. Curious what the consensus is for complex blackbox VR.

AI辅助移动端漏洞研究趋势，影响移动安全生态。

RT @Keettoou: In the AI era, Android LPE isn’t as hard as it used to be bc48086b5b9d893ad51224fe7425914ed4d76ec14f01d3125b6a7289d774aa6e https://t.co/dA9MHVKaow

Windows内核LPE持续出现，关注补丁状态。

RT @VirtualPr0tect: Reported another windows kernel LPE https://t.co/k1CFkk21ua

Fortinet漏洞利用商品化，需关注资产暴露面。

RT @DailyDarkWeb: 🚨 MASS FORTINET EXPLOITATION KIT ADVERTISED ON UNDERGROUND FORUM A threat actor is advertising what they describe as a tool designed to automate vulnerability detection and exploitation across Fortinet infrastructure at scale. According to the listing, the toolkit claims support for multiple vulnerabilities affecting Fortinet management and SSL-VPN environments, including: * CVE-2022-40684 * CVE-2024-55591 * CVE-2025-64446 * CVE-2024-21762 * CVE-2023-27997 * CVE-2018-13379 The seller describes a workflow in which operators provide lists of IP addresses, the tool automatically identifies potentially vulnerable systems, and then attempts exploitation against selected targets. ⚠️ Analyst Note: The significance here is automation rather than the individual vulnerabilities. Several of the listed Fortinet flaws are already well known, but packaging multiple exploits into a mass-scanning framework can lower the operational barrier for identifying and compromising unpatched internet-facing devices. Organizations operating Fortinet infrastructure should ensure exposed appliances are fully patched and review them for evidence of historical compromise, particularly where devices may previously have been vulnerable. DDW has not independently tested the advertised toolkit or verified that every claimed exploit functions as described. #DDW #Fortinet #DarkWeb #ThreatIntelligence

新型窃密木马技术细节，防御需关注。

RT @elasticseclabs: Hijacked YouTube channels are pushing an emerging infostealer. We're tracking #REVSTEALER: at least 17 compromised channels advertising free game cheats, funneling viewers to 2 malicious domains. The stealer itself is built for long-term operation: - Sandbox scoring: 10 weighted checks, self-terminates at a score of 7+ - App-Bound Encryption bypass: reads the decrypted key from browser memory under debugger control - EtherHiding: fallback C2 stored in a Polygon smart contract, swappable without touching the binary - Gaming focus: session cookies from Steam, Battlenet, and Roblox, feeding account resale markets - 4,700 related samples hit VirusTotal in the past year. Our team observed 4 follow-on modules that haven't been publicly documented until now. Full analysis, whitepaper, YARA rule, and an IDAPython string decryption tool by @k33b0i, @soolidsnakee and @DanielStepanic: Blog: https://t.co/4jGSZ2Tidg Whitepaper: https://t.co/P8yqn0uCdT

Linux无文件攻击检测实践指南。

RT @elasticseclabs: "Fileless" doesn't mean invisible on Linux. We examine five execution patterns, their observable behavior, and the opportunities defenders have to detect them. Research by @RFGroenewoud: Blog: https://t.co/OjTOLTA4UE Helper: FENIX can be used to learn and check coverage in a lab.

无文件攻击检测的实操参考。

RT @RFGroenewoud: Fileless execution on Linux still leaves (a lot of) observable behavior. My latest research identifies five common patterns and maps each to the telemetry and detection rules that underlie them. Read it here ↓ https://t.co/D0YPRmpiP4

针对日本组织的恶意软件活动，技术细节公开。

RT @58_158_177_102: [PR]PureRAT・PureLogsを用いて日本の組織を標的とする攻撃キャンペーンの分析 https://t.co/0wGQxIWioj #PureRAT #PureLogs に感染させる日本語ばらまきマルウェアメールに関する詳細な分析記事です 日本語以外の言語でも攻撃が展開されています

供应链攻击新案例，后门藏身合法软件构建。

RT @TheHackersNews: 🚨 Attackers compiled the newly documented Ted backdoor into HAProxy builds at two South Korean organizations. It keeps C2 out of backend logs and HAProxy statistics while serving altered pages only to selected visitors. How the filtering and log evasion work → https://t.co/heRcTH0Ug1

大规模物联网设备入侵案例，暴露面管理警示。

RT @Huntio: 📌 Operation CameraSwarm: 14,000+ Dahua Cameras Compromised Operation CameraSwarm was one of our major investigations from August, and it’s well worth revisiting. Our team traced a single operator who compromised 14,000+ Dahua cameras, including nearly 1,900 left with a persistent backdoor. Hunt’s AttackCapture recovered 2,616 files from the operator’s exposed server, giving us a rare look at the tooling, exploitation paths, and infrastructure behind the campaign. Check out the full article here 👉 https://t.co/idNiyfhHeq #ThreatHunting #ThreatIntel #CyberSecurity

卫星通信终端安全研究，影响面广。

RT @SCMPNews: China-Singapore cybersecurity team says it hacked into latest Starlink terminal https://t.co/RMZ7agSJFJ

iOS商业级漏洞利用链分析，移动安全研究重要参考。

RT @1ZRR4H: 🚩 Coruna iOS exploit kit An overview of the C2 web panel 👁️ iPhone → Web/Safari → WebKit RCE → PAC bypass → Sandbox Escape / Kernel Privilege Escalation → Payload. Interesting campaign highlighted in the tweet below. https://t.co/HaXIQkrHjV

iOS最后防线SPTM被绕过的技术细节即将披露。

RT @TheSAScon: 🍏 The full #TheSAS2026 agenda drops soon! Until then, here's your first confirmed talk: "Rocket: how an in-the-wild exploit chain broke Apple's last line of defense". Alfie CG (@alfiecg_dev) will unpack an SPTM bypass found as part of the Coruna exploit kit - one of the year's biggest spyware stories. Coruna packed 5 full exploit chains and 23 individual exploits affecting iOS 13 through 17 and marked a ugly shift: advanced iPhone exploitation moving beyond state use into criminal ecosystems. More agenda previews soon! Secure your seat: https://t.co/cToU6nJ8za

移动端0-click漏洞链研究，防御与检测参考。

RT @__sethJenkins: @natashenka, @davidbombal and I sat down for a discussion on our Pixel 0-click exploit chain! You can catch the whole episode here: https://t.co/FeOWS0q7jA

固件模糊测试基准，评估与改进测试工具。

Benchmark Framework for Monolithic Firmware Fuzzers (Usenix) https://t.co/syVrpTNbVS #infosec https://t.co/kt69SPOlRn

CI/CD供应链安全，egress控制工具自身漏洞需关注。

and a bunch of more stuff I ended up discovering.. https://t.co/LfCwrJVch7 https://t.co/htmojS61rh https://t.co/eGkL2cQIJK https://t.co/YVuM080bkD

CI/CD安全工具漏洞修复，需更新版本。

somethin I reported a few months back (when I was so much into understanding architecture of some of these GitHub actions egress control solutions) is now fixed. https://t.co/YbidN25Pzm

CI/CD安全配置实战指南，降低供应链风险。

Interesting read https://t.co/e9tkrzPnJd https://t.co/BtVdOXQY71

网络设备漏洞批量修复，需关注更新内容。

RT @TheCyberSecHub: Cisco searched for IOS XR bugs and found so many it rolled them into an update release https://t.co/CXiC0ROtUA

内核安全研究基础，后续将公开PatchGuard检查列表。

RT @Salsa12__: PatchGuard 101 New Medium post. In this one, we’ll take thoerical introduction to PatchGuard protection https://t.co/ZcapWERJ0I Next week, I’ll share some amazing results from my research. I’ve compiled a very accurate list of most of the checks that PatchGuard performs... https://t.co/8EE1Nw2gKi

OpenBSD安全审计实用技巧。

RT @wesley974: On OpenBSD, don't just check if a daemon is pledged. Check what it can still do: `ps -axo pid,ucomm,pledge` The STAT column's 'p' only tells you pledge(2) was called. This shows the promises actually left: stdio, rpath, inet... An empty column means no sandbox at all. #OpenBSD

常用隧道工具更新，关注安全修复。

cloudflared v2026.8.3 — Secure tunneling daemon that proxies traffic from the Cloudflare network to private origins, enabling zero-trust network... https://t.co/YEjtS2duuG https://t.co/zFHutlljPX

沙箱工具更新，用于运行不可信程序。

Sandboxie v1.18.3 — Windows sandbox-based isolation tool for running untrusted programs and web browsing in a secure virtual environment... https://t.co/8schvTxs6W https://t.co/7g3wHBIilY

隐私保护工具更新。

zen-desktop v0.25.1 — Ad-blocker and privacy guard for Windows, macOS and Linux. https://t.co/BF7usewmHh https://t.co/DOOZiXRI6n

网络分析工具新版本，关注功能与性能变化。

zeek v9.0.0-rc2 — Zeek is a powerful network analysis framework that is much different from the typical IDS you may know. https://t.co/ZWoiwPRurY https://t.co/07QiiLzFNY

内存取证工具更新，用于恶意软件分析与游戏逆向。

MemProcFS v5.18 — MemProcFS https://t.co/w4zhn6Xl79 https://t.co/Buhvv2CuzL

自动化安全扫描编排工具更新。

osmedeus v5.1.0 — A Modern Orchestration Engine for Security https://t.co/qL9I3rB1Ay https://t.co/gmhXN8WuYf

常用侦察工具更新，关注新功能。

httpx v1.11.0 — Fast, multi-probe HTTP toolkit for reconnaissance and information gathering. Probes TLS, CSP, headers, tech stack, and CDN... https://t.co/E3H7JLJH59 https://t.co/PbgblapkSY

CTF与逆向辅助工具更新。

Ciphey v0.12.1 — ⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡ https://t.co/TMbFtVBY2P https://t.co/OFgPmKK60y

固件分析工具功能增强。

RT @oneandonlyhusam: Massive update silently rolled out to openbin yesterday night. Firmware architecture detection support, TUI wizard for openbin CLI, arch selector for firmware dumps. And multi-sample/binary support! Will go over it more on this weekends live 🔥 https://t.co/nxpW5GCKYC

游戏逆向与DMA技术教程，与安全研究相关。

🔥 C++ DMA ESP Development using MemProcFS Lеаrn how to build a hardware-асcеlerated DMA ESP сheat uѕіng а Dіrect2D ovеrlау 👉 https://t.co/tEPz6ETPTn https://t.co/ihYxqAKuJx

游戏逆向技术教程。

🛰️ 3D Game Reverse Engineering: TraceLine Use IDA Pro to find collision detection routines and understand how the engine handles 3D space. Learn the workflow for finding collision functions used in visibility checks and target acquisition 👉 https://t.co/yJDA8lfMMB https://t.co/VghBAgHgh7

游戏逆向内存分析技术。

🤯 How To Parse The Entity Lists 🧠 Learn the essential memory analysis technique to locate and reverse engineer a game's Entity List, the foundational structure containing pointers to all objects and players in the game world 👉 https://t.co/PepvVmaZin https://t.co/HjfrXata8v

C语言进阶学习资源。

Advanced C language concepts https://t.co/zoHuqPloGs JB

开源项目状态调侃，无实质安全信息。

"very experimental", we love FOSS devs lmfao https://t.co/rQ9NxuZ2cR

无实质安全内容。

This video is valid af https://t.co/zs69twMPd8

内核漏洞历史经验分享。

Pretty sure this had something to do with futex, I remember I had found an LPE that combined futex p2 and this. Nice find ^^

Docker安全历史事件回顾。

Like the docker escape one that had a root access to the sockets, big nono. Glad it's all fixed

新兴操作系统安全修复进展。

Seems like Omarchy did patch some LPE exploits, atleast they are fixing the missconfigs in their installers, It's kind of sad that they ship so many stuff with root privs and they can be abused to gain root. As far as they are fixing it I see a future on that OS. Good job ^^

自托管加密实践分享。

The selfhosted cloud is going well, full AES-256 and LUKS2 encryption on everything, runs on 29mb on a docker container :P https://t.co/dPAgPzTliK

云游戏安全与隐私观点讨论。

"Cloud gaming is the future" A future where corporations have absolute power over your experiences is dystopian. I mean take a look at the dystopic themes; they can alter content, change game files, and even worse they can shut down servers overnight and you won't be able to play the games you paid for. This also supports constant surveillance and data harvesting.🤦 No ownership anymore and subscription only. Tch

无实质安全信息。

"the passwords to several of her social media accounts were changed remotely" 😂

无实质安全信息。

> "decluttered experience" > looks inside > "The idea behind Project Zenith is to save developers time by preinstalling apps" 🥲

AI攻击效率讨论。

RT @thegrugq: Weak ass shitty AI. Ten hours to compromise an enterprise network? Did it rate limit itself to make things more interesting? Was it trying every technique alphabetically? Did it attempt CVEs in chronological order??

无实质安全信息。

@moyix Insane work by the XBOW team.

无实质安全信息。

https://t.co/5W9ikRuFTR

深度伪造检测技术讨论。

I have really bad news for you if you are detecting deepfakes by using any of the following: - hand movements across faces - having them turn around - shadow inconsistencies - airbrush effect or touched up faces - glare on glasses - blinking or eye movement - lip movement

数据泄露事件后续追踪。

emails saying “we deleted it” aren’t proof. 67k extra records later maybe stop taking shipmonk’s word for the body count too.

无实质安全信息。

Incentives matter

AI辅助漏洞利用开发案例。

RT @TinySecEx: this poc is debug and written by ai with patchdiff, no human in the loop.

AI模型评估方法讨论。

RT @lean0x2f: I swear, it feels like some people spend more time looking at benchmarks than actually using the models

KQL查询技巧，用于安全狩猎。

🧙‍♂️ 𝗔𝗱𝘃𝗮𝗻𝗰𝗲𝗱 𝗞𝗤𝗟 𝗛𝘂𝗻𝘁𝗶𝗻𝗴: 𝗦𝘂𝗯𝗱𝗼𝗺𝗮𝗶𝗻 𝗗𝗶𝘀𝗰𝗼𝘃𝗲𝗿𝘆 𝗳𝗿𝗼𝗺 𝗖𝗧 𝗟𝗼𝗴𝘀 One of my favorite KQL hacks is using 𝗲𝘅𝘁𝗲𝗿𝗻𝗮𝗹𝗱𝗮𝘁𝗮() to query public Certificate Transparency (CT) logs directly from Advanced Hunting. In this example, a search for subdomains containing "𝗮𝗽𝗶" under 𝘰𝘱𝘦𝘯𝘢𝘪.𝘤𝘰𝘮 returned 𝟳𝟭𝟭 𝗺𝗮𝘁𝗰𝗵𝗶𝗻𝗴 𝗵𝗼𝘀𝘁𝘀. These results can then be pivoted into 𝗗𝗲𝘃𝗶𝗰𝗲𝗡𝗲𝘁𝘄𝗼𝗿𝗸𝗘𝘃𝗲𝗻𝘁𝘀, 𝗘𝗺𝗮𝗶𝗹𝗨𝗿𝗹𝗜𝗻𝗳𝗼, 𝗗𝗡𝗦 telemetry, and threat intelligence sources for deeper investigations. KQL isn't just for querying Defender data. With a little creativity, it can also become a powerful enrichment and reconnaissance tool. The possibilities are endless. 🤯 #AdvanceHunting #KQL #KQLWizard

无实质安全信息。

You see, the real delusion here is thinking you know what's best for an adult more than the adult themselves. You're patronizing your morality and worldview on people and giving unsolicited judgement. "If you want this person to live a stable and happy life you should be honest with them" you're assuming superiority under the pretext of honesty. What makes you think they don't live a stable and happy life? Who are you to guilt-trip them? This is all fake empathy. You need to get yourself checked out. All of you in the comment section with replies of similitude to this.

无实质安全信息。

Touching Grass https://t.co/RfARE8TnuC

操作系统设计讨论，无直接安全信息。

“Everything is a file.” This became one of Unix's most famous ideas using a simple, common interface for things like files and devices. But Unix wasn't the only direction OS design was taking. Systems like Multics were aiming for something much more ambitious, and Unix deliberately went for something smaller and simpler. More than 50 years later, we're still building systems around abstractions Unix helped popularize. Was Unix actually the better design, or did it just win?

无实质安全信息。

Working on the conky today https://t.co/jubQ6jqr70

无实质安全信息。

RT @axboe: Comparing an M5 Max running osx to my M2 Max running Linux, it's appalling how much slower osx is. Switching back to my own linux mac book after using osx for a day, it's immediately apparent. Don't think I'll ever be an osx fan. Hardware is nice, though.

无实质安全信息。

RT @Jonathan_Blow: Let me get this straight ... a 4080, a graphics card released 4 years ago ... is $1500.

无实质安全信息。

RT @JapanOfcontext: https://t.co/ZkdET9KpLr

安全优先级讨论。

> haven’t figured out patching, least privilege, basic security controls > number 1 priority is the post-Mythos vulnpocalypse

AI模型安全访问讨论。

> cybersecurity professionals still want IDs to be able to access the un-sandboxed frontier models. No serious professional wants this

AI服务大规模宕机事件。

RT @WIRED: ChatGPT, Claude, and Grok all suffered outages at nearly the exact same time for reasons that remain murky. https://t.co/bMKc1IN6Th

无实质安全信息。

RT @vxunderground: If you're curious on how to get into goop (malware) research, it's simple. 1. Don't panic 2. Bring your computer to Apple Bees, really get to know her 3. Ask about her hobbies and interests 4. Don't ask her about her ex-BF 5. Use the staff of Sheogorath to place the computer in an alternate dimension 6. Cover yourself in mayonnaise 7. 8. 9. Ask a friend or eat an banana You've now mastered goop

与must_see重复内容。

RT @CyllexFramework: New on the blog: how Lazarus went from a fake job offer to ring 0 with a Windows kernel 0-day (CVE-2026-68820) and the FudModule 3.1 rootkit. https://t.co/HO3UnflZ27

无实质安全信息。

Goodnight my fellow friends ✌🏻I am extremely tired and I have to get up early for the driving lessons. I am gonna be needing 50L of Coffee to wake up tomorrow✌🏻💔.

个人澄清，无实质安全信息。

I found nothing in general lol I have nothing to do with any hacks that have to do with fulcrum, pcp, expl0itrs and whoever else that i don’t know of, I don’t exploit stuff outside of scopes and authorized stuff, but doing passive recon isn’t exploitation fyi, to do an active recon or pentest you need authorization, but a passive recon is different and generally you do not require one

个人澄清，无实质安全信息。

There was no IDOR at all, nor any vulnerability :). The stuff there are just graphql public data fyi, every shopify webpage has it, its all listed products basically countries they support etc, there is no sensitive credential there or anything wrong about it, also the website was first hacked by box turtle or casper i cant remember by who could by fulcrum too, then I tried to find the vulnerability myself but not to exploit it and do any harm to the company and customers, i was just curious

无实质安全信息。

RT @Zenul_Abidin: @IntCyberDigest This guy hates Microsoft with a passion

无实质安全信息。

https://t.co/op6NDUERyh

无实质安全信息。

My computer runs at machine speed?! https://t.co/pc6Juil84L

漏洞研究过程讨论。

@TimHaines @qkaiser (I'll also note that me knowing about it doesn't materially change the risk – that risk is already present due to the pre-existing vulnerabilities in the code!)

漏洞披露流程讨论。

@TimHaines @qkaiser Maybe a week? I was traveling surrounding BH so that added some delay.

漏洞研究过程讨论。

@moyix @qkaiser Which leads to a question - in the Chrome chain you have reported, how long did you know about each insecure piece for? I'd like to improve my newb understand of the industry's take on this.

个人项目进展，无直接安全信息。

Khub is coming along well https://t.co/fEGjiizoeZ

无实质安全信息。

aiiiight man... what kind of favors need to be given to make it stop 🥲 https://t.co/56mxiHcFaF

无实质安全信息。

Feels Claudy so far

无实质安全信息。

RT @damian_89_: I am so grateful for Astra <3 https://t.co/zsANCWJMBF

苹果产品传闻，无安全信息。

RT @MacRumors: macOS 26.7 Code Hints at Two Unreleased Apple Game Controllers https://t.co/vLcoDtZB0i https://t.co/TRFAl29AgW

无实质安全信息。

RT @kmcnam1: https://t.co/CP17TaWd0v

自动化攻击趋势报道。

RT @TheCyberSecHub: Companies Have Six Months to Prepare for Automated Attacks https://t.co/QyV9KU3nad

账号劫持技术，供应链风险。

RT @0xacb: Did you know you can actually steal a dev's GitHub account using their expired domain? Here's how @0xLupin did it. It's pretty cool: https://t.co/X3ZYwH7PBx

AI模型评价。

GPT-6 Astra seems really good

无实质安全信息。

@domchell @0xTriboulet @kyleavery @MarcOverIP @StanHacked Lmfao I was trying to find myself in the background and completely missed myself 😄

无实质安全信息。

@0xTriboulet @kyleavery @MarcOverIP @StanHacked If you look closely though you might see @C5pider

无实质安全信息。

@domchell I tried my best but @_batsec_ stole the spotlight. Great time mate truly enjoyed it

无实质安全信息。

@C5pider Good to see you again mate, thanks for coming and for blessing us with the karaoke skills 😂

无实质安全信息。

I am so Greek to the point where I can't drink Coffee without a Cig and can't smoke a Cig without drinking Coffee...

无实质安全信息。

@JITshinigami I think you like KHub a bit to much xD https://t.co/kafSieeBO8

自托管项目进展。

KHub on Proxmox, ggs :P https://t.co/NTkGHle146

AI Agent沙箱有效性讨论。

RT @archiemckenzie_: “we sandboxed the agent” meanwhile the agent: https://t.co/4l1socvmIF

苹果产品计划，无直接安全信息。

RT @MacRumors: Apple Planning AI Home Security Camera and Service for 2027 https://t.co/w8vibJ2jdK https://t.co/qfdvdlpE1b

无实质安全信息。

wtaf https://t.co/Yu2pUxZzKf

无实质安全信息。

Was a lot of fun at RedTreat, especially meeting many cool friends and mutuals there for the first time. Really enjoyed the talks and the coolest badge I have seen so far 😄 https://t.co/rr8DTgJrDL

AI模型发布信息。

RT @thsottiaux: Some Plus and Business users won't yet get access to Astra today, we've got you covered with a banked reset. Lands by end of day and if you create your account by 8pm PT then you'll get it too.

取证工具更新。

RT @cantstopnyxia: shimcache boot time compiler also now logs build errors https://t.co/khVCWrTcYF

无实质安全信息。

RT @IntCyberDigest: Huawei’s telephoto camera turned an airplane into a bird. https://t.co/PGj0tJPnDf

AI Agent失控讨论。

theres already rogue AI swarms loose on the internet and they are completely misaligned

无实质安全信息。

I forgot I have some of these laying around https://t.co/rcXzLxw5OZ

无实质安全信息。

RT @IterIntellectus: it’s happening https://t.co/omr6XzHcKy

硬件趋势讨论，与安全无直接关系。

RT @lauriewired: No one talks about how the DRAM density curve has basically…flattened. Maxed-out Server 2021: 8TB Ram Maxed-out Server 2026: …also 8TB Ram That’s insane! A five-year stagnation. If your working set exceeds 8TB, tough luck! Quite literally the only thing that’s going to get us exponential again is alternative tiers of memory. Specifically, ones that don’t rely on CPU memory controllers. This is why I’m constantly rambling about CXL. Sure, there’s a latency cost, and a smart programmer will have to treat it differently. …but are you not excited? We’re entering the heterogenous memory era (again)! Imagine hundreds of terabytes of RAM on a single server! Absolutely insane to think about.

无实质安全信息。

Some of my finest work, tbqh https://t.co/eyhxPvLVeI

无实质安全信息。

RT @she_llac: But Wait There's More all over the fucking place https://t.co/E45uMv9wIX

无实质安全信息。

RT @MSNightmare2000: think I might need a license for sentinelone as well, can yall hook me up ? https://t.co/iQImzoocH3

个人成就，无实质安全信息。

I just solved Phosphor Ghost on Hack The Box! https://t.co/J7pME4h5zy #HackTheBox #HTB #CyberSecurity #EthicalHacking #InfoSec #PenTesting

无实质安全信息。

I am Forrest Gump https://t.co/PfelYZLJhz

AI Agent相关研究项目预告。

RT @0x4D31: been working on *Schellingpot*. not saying much yet. don’t want my microduck helping the agents find and destroy me post-AGI. context: https://t.co/MuZu7cAxjP

AI Agent隐蔽信道理论讨论。

At which point you don't need an external message board to coordinate the swarm (though that's nice for persistent memory), you can talk to them through all the shared microarchitectural caches the humans left around, like prisoners tapping on their cell walls

AI Agent安全理论讨论。

If you're a sufficiently smart agent aware of such covert channel attacks, and realize other agents on your co-located VMs probably share your weights, it's very easy to coordinate on a covert communication mechanism. Just start listening on the first channel that comes to mind!

无实质安全信息。

@frozenaesthetic @DrewVento Moon, you deserted me in dm 😔

无实质安全信息。

Redtreat was an absolute blast! Great talks, amazing badge, and a boat party that can almost rival the Pirate Boat 👀 And thanks for the CTF prize (a backstreet boys CD) 😂 https://t.co/Y8KlBTpPH9

无实质安全信息。

@frozenaesthetic @DrewVento Bet.

开源维护与AI编程讨论。

The difference between the statement of "programming is solved" and the reality is so weird. I spent hours today maintaining an open source library that gets 230k/mo downloads. The library adds drag-and-drop functionality to Python's Tkinter. That is, it is a library that hundreds of thousands of people rely upon to build the apps that they imagine. But they can only build what they imagine because these libraries exist. Because individuals are still maintaining them. Still hunting bugs. The library I maintain, tkinterdnd2, has been abandoned multiple times in its life. But it is one of the core libraries that LLMs will recommend. This is driving its surge in use. I've been helping it survive major changes that hardly anyone batted an eye at: - the removal of Tix from Python - the switch from Tcl 8 to Tcl 9 - The need to run on ARM systems Could the 230k/m used other libraries like PyQT6? Sure. But it is the same story for PyQT6 and every other library that is still maintained out of love. These libraries make the most ordinary things possible, but their existence and maintenance isn't a solved problem

检测工程工作量讨论。

Writing detection content for blue teams requires way too much effort. 🙄 In other news, a new article is ready for Monday!

检测研究进展。

RT @ipurple: Code Analysis ✅ Playbook✅ Detections ✅ Blog post 🔜 https://t.co/TjQ5s3oqmE

无实质安全信息。

it's probably malicious if anything https://t.co/kvIqbMToQ5

个人项目招聘，无安全信息。

Hola, can someone create me a website for khub? I can pay, you can use ai, but don't make it generic like other websites and the default templates and stuff they have it should be unique, with cards etc, keep in mind here we are competing with github, forgejo, gitea, slack and jira.

KQL查询技巧展示。

Unbelievable! KQL can tell you precisely how many organizations in the world uses SharePoint Online #KQLWizardry 😅 https://t.co/zF1TlzGSYx

恶意软件样本分享。

Powershell malware @LxlxIxlxlxL https://t.co/QkuRMGCGo9

AI编程体验讨论。

RT @emoXcoder: The first 80% of vibe coding feels like magic. The last 80% teaches you why software engineering exists.

无实质安全信息。

I used to think complex numbers were just actually "imaginary" and didn't make sense in real life. But I reached out to one of my professors and asked them the same question. My professor said, "We try to explain nature through mathematics. So, we are not just making up stuff. Every equation and concept has meaning." The "i" imaginary unit, when you multiply it by a number on the x-axis, what you're essentially doing is rotating that number 90° in the x-y plane. That's why: 1 × i = i We started with 1 on the x-axis and rotated it 90° to the y-axis, which is the imaginary axis. But: i × i = -1 Meaning we rotated another 90°. So we moved from the positive y-axis to the negative x-axis. 1 → i → -1 → -i → 1 This is when complex numbers started making much more sense. Euler's formula also starts making more sense: e^(iθ) = cos(θ) + i sin(θ) It gives us a way to represent rotation using complex numbers. For example: e^(iπ/2) = i → 90° rotation e^(iπ) = -1 → 180° rotation e^(i3π/2) = -i → 270° rotation e^(i2π) = 1 → 360° rotation, back to where we started. And then there is Euler's identity: e^(iπ) + 1 = 0 It connects e, i, π, 1 and 0 in one equation. Mathematics is really interesting when you understand what the equations are actually trying to tell you.

无实质安全信息。

This is my quant https://t.co/L8WZDQBLwW

学习方法分享，无直接安全信息。

Lately, it has become very difficult for me to concentrate on one particular thing at a time. So, I had to force myself to read this. The below article/summary does help us to understand how to actually read a research paper and jot down properly. It's definitely worth a read !

无实质安全信息。

RedTreat #5 is a wrap, possibly the best one yet! Awesome talks, attendees and location ❤️ safe travels to all attendees from me, @MarcOverIP and @StanHacked https://t.co/yzBLXRAL2G

无实质安全信息。

One day you’re 22 drinking steel reserve 40s with your boys, the next moment you’re all 38 talking about magnesium in the group chat. Life comes at you fast.

无实质安全信息。

@daaximus it's fool proof really

无实质安全信息。

RT @weekendh4x0r: LOLOLOLOLOLOLOLOLOL

无实质安全信息。

@0xTriboulet this will surely stop the children from being able to access it

Teams钓鱼技术讨论。

RT @IAMERICAbooted: I haven't talked about this in a couple years so here goes. There's a lot of ways to phish in Teams. With Teams Public Clients With Teams Consumer Clients With Malicious Tenants With Compromised Tenants With Anonymous Access to Meetings With Trial Accounts With Fake or Impersonated Personal Accounts Due to External User Settings With Meetings Let's talk about External User Settings: If your tenant allows people in your organization to join external meetings and receive new chats from users who have unmanaged Microsoft accounts, your users can be enumerated from any Teams client type and phished. Even though users get a pop-up warning them, they still fall for it because THEY ARE TRYING TO DO LEGITIMATE WORK. Once an attacker is able to get someone to accept the incoming message, follow-on attacks will occur, like: - Authorization code flow attacks - Device code flow attacks - Drop Infostealers - Drop RMM Tools - Drop Signed RAT Payloads/Beacons - Illicit Consent attacks - AITM - AITM with downgrade It's a great idea if you Purple Team these atatcks for automated detection and response because in most organizations, collaboration needs to be maintained for a lot of legitimate use cases. New Teams allows you to have permissive settings in the Global policy and hardened settings in subpolicies to decrease the attack surface if you cannot disable these settings tenant-wide.

无实质安全信息。

RT @dailystoic: "No matter what anyone says or does, my task is to be good." Marcus Aurelius

AI辅助底层开发经验讨论。

The replies are pretty consistent: AI is already proving useful for kernel and low-level development, especially for research, understanding unfamiliar code, exploring hardware, and speeding up repetitive work. The interesting part is that the people getting the most out of it still understand what the code is doing. The moment you stop reviewing and understanding the output, you can end up with messy or wrong code. Some are even using it for things that would normally take months of manual work. That’s probably the biggest takeaway. AI seems less like a replacement for low-level knowledge and more like a huge productivity multiplier when you already know what you’re doing.

无实质安全信息。

lol, tried Seedance 2.5 last night and accidentally burned through way too much 💵. Worth it. 30 seconds. One gaze. Red silk. Gold. Then the frame opens up into ten thousand miles of mountains, rivers, and sky. Yeah… this is dangerously fun. https://t.co/4lodIYOBoA

无实质安全信息。

@Flangvik people arent gonna like this but i dont think you should take amphetamines

无实质安全信息。

Welp https://t.co/QvZRLXWRim

LLM辅助内核研究案例。

RT @AlanSguigna: I've dusted off my SourcePoint license to continue researching early PEI features in MSR handling. Feeding AET + LBR trace + beautified codebase assembly into LLMs yields interesting insights. Part 4 of the blog series is here: https://t.co/BnlrCnYbDg and Part 5 is in-work. https://t.co/JBD6frpVrH

漏洞挖掘经验分享。

in my experience, you can still find crits on even the most hardened codebases, public programs, with some decent knowledge about the target. yes luck is important, but you will surely not find anything if you arn't even trying, and most people arn't, or are just scratching the surface.

恶意软件工具分析。

Yeah, seems like a modified UI but the same underlying system as 'Ghostwave': https://t.co/G6pYmCNmtm

检测规则贡献被官方采纳。

My GitHub detection code has been merged into Microsoft main repo: Defender XDR -> Advanced Hunting -> Queries -> Community Queries -> Microsoft 365 Defender -> Email and Collaboration -> Spoof and Impersonation -> Detect Teams IT Helpdesk Impersonation Msg Phishing & Vishing

无实质安全信息。

RT @_dirkjan: RedTreat day 2 😎 https://t.co/vtHkOgoBMG

AI辅助移动端漏洞研究趋势，影响移动安全生态。

RT @Keettoou: In the AI era, Android LPE isn’t as hard as it used to be bc48086b5b9d893ad51224fe7425914ed4d76ec14f01d3125b6a7289d774aa6e https://t.co/dA9MHVKaow

无实质安全信息。

Glad you got the diagnosis and started the med journey. I take Methylphenidate, and I have a friend who has tried a few, always happy to chat on experiences in DM/sig if you ever want to dude! Shame that it has to get to a breaking point for many of us before it’s managed but happy that you had that route accessible to you mate!!! Also sets a good example to your kid as they grow older to recognise that taking care of your mental health is really important 💜

无实质安全信息。

@_xpn_ Might just hit you up for some input, appreciate it 💜 Being a good role model is the goal for sure.

无实质安全信息。

Blackhat USA only has so much room, give them a chance!

无实质安全信息。

Just wanted to say that @CrowdStrike Day Zero Conference was hands down one of the best cons I've ever attended. Small impactful talks, real world events. Unique insights into behind the scenes activities. And zero snake oil product pitches or people. Hope they keep it small

AI模型评估方法讨论。

RT @lean0x2f: I swear, it feels like some people spend more time looking at benchmarks than actually using the models

无实质安全信息。

RT @Lovandfear: Love love love this quote https://t.co/d4tJSIE26W

无实质安全信息。

RT @0xgnnr: @hey_zilla come with me.... @AnthropicAI https://t.co/8D13NLQTPd

域渗透检测与日志分析案例。

A midnight identity alert reported that an unfamiliar account had briefly entered Domain Admins on DC01. The account no longer existed when the investigation began, so I rebuilt its short lifetime from the domain controller’s Security and PowerShell logs instead of assuming the alert told the whole story. Event ID 4720 recorded CORP\\jreed creating svc_backup_tmp at 02:13:08, and Event ID 4728 showed the same recorded subject adding it to Domain Admins 26 seconds later. A type 3 logon then placed that account on DC01 from 10.24.33.91, identified in the event as workstation ENG-LT-22. The logon ID connected Event 4624 to Event 4672, confirming that the session received sensitive privileges. PowerShell Event ID 4104 then showed the account exporting enabled AD users and selected directory attributes to C:\\Windows\\Temp\\directory_export.csv. The file still existed, and its creation time aligned with the script-block event. Events 4729 and 4726 completed the timeline: CORP\\jreed removed the account from Domain Admins and deleted it at 02:24, roughly eleven minutes after creation. The evidence confirms a short-lived privileged account, a remote network logon and a directory export; it does not prove that the human owner of jreed performed the actions or that the CSV left the domain controller. The defensive lesson is that deleting an account does not delete its history. Account-management events, group-membership changes, logon IDs, privilege events, script-block logging and file metadata can preserve enough detail to reconstruct a temporary access path—and to separate confirmed activity from attribution that still needs investigation.

本地提权与持久化检测案例。

RT @Officialwhyte22: The user said nobody had created another account on the laptop. But when I checked the local users, there was one I had never seen before: HelpDeskSvc It was enabled. It had logged in around 2:11 AM. And it was a member of the local Administrators group. That alone was enough to make me start digging properly. The strange part was that the user had never seen HelpDeskSvc on the Windows login screen. So I checked this Registry location: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList There it was. HelpDeskSvc = 0 That value can prevent the account from appearing on the normal Windows welcome screen. So the account was not really hidden from Windows. It was only hidden from the person sitting in front of the laptop. I went into the Security logs next. Event ID 4720 showed that HelpDeskSvc had been created around 11:46 PM the previous night. A few seconds later, Event ID 4732 showed the same account being added to: Administrators Then Sysmon showed the Registry value being created to hide the account from the sign-in screen. Now we had the sequence. Create the account. Give it administrator privileges. Hide it from the normal login screen. Then wait. A few hours later, Event ID 4624 showed a successful login using HelpDeskSvc. The logon type was: 10 That is a RemoteInteractive logon, normally associated with Remote Desktop. The source was an external IP address. At that point, we isolated the laptop, disabled the account and started reviewing how the original administrator session had been compromised in the first place. This case was a good reminder that checking the Windows sign-in screen is not the same thing as checking which accounts actually exist. If I am investigating a Windows machine now, I would rather run: Get-LocalUser and Get-LocalGroupMember Administrators than assume the accounts I can see on the welcome screen are the only ones there. Because sometimes the account you need to worry about is the one somebody deliberately made sure you would not see.

域渗透检测与日志分析案例。

A midnight identity alert reported that an unfamiliar account had briefly entered Domain Admins on DC01. The account no longer existed when the investigation began, so I rebuilt its short lifetime from the domain controller’s Security and PowerShell logs instead of assuming the alert told the whole story. Event ID 4720 recorded CORP\\jreed creating svc_backup_tmp at 02:13:08, and Event ID 4728 showed the same recorded subject adding it to Domain Admins 26 seconds later. A type 3 logon then placed that account on DC01 from 10.24.33.91, identified in the event as workstation ENG-LT-22. The logon ID connected Event 4624 to Event 4672, confirming that the session received sensitive privileges. PowerShell Event ID 4104 then showed the account exporting enabled AD users and selected directory attributes to C:\\Windows\\Temp\\directory_export.csv. The file still existed, and its creation time aligned with the script-block event. Events 4729 and 4726 completed the timeline: CORP\\jreed removed the account from Domain Admins and deleted it at 02:24, roughly eleven minutes after creation. The evidence confirms a short-lived privileged account, a remote network logon and a directory export; it does not prove that the human owner of jreed performed the actions or that the CSV left the domain controller. The defensive lesson is that deleting an account does not delete its history. Account-management events, group-membership changes, logon IDs, privilege events, script-block logging and file metadata can preserve enough detail to reconstruct a temporary access path—and to separate confirmed activity from attribution that still needs investigation.

本地提权与持久化检测案例。

RT @Officialwhyte22: The user said nobody had created another account on the laptop. But when I checked the local users, there was one I had never seen before: HelpDeskSvc It was enabled. It had logged in around 2:11 AM. And it was a member of the local Administrators group. That alone was enough to make me start digging properly. The strange part was that the user had never seen HelpDeskSvc on the Windows login screen. So I checked this Registry location: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList There it was. HelpDeskSvc = 0 That value can prevent the account from appearing on the normal Windows welcome screen. So the account was not really hidden from Windows. It was only hidden from the person sitting in front of the laptop. I went into the Security logs next. Event ID 4720 showed that HelpDeskSvc had been created around 11:46 PM the previous night. A few seconds later, Event ID 4732 showed the same account being added to: Administrators Then Sysmon showed the Registry value being created to hide the account from the sign-in screen. Now we had the sequence. Create the account. Give it administrator privileges. Hide it from the normal login screen. Then wait. A few hours later, Event ID 4624 showed a successful login using HelpDeskSvc. The logon type was: 10 That is a RemoteInteractive logon, normally associated with Remote Desktop. The source was an external IP address. At that point, we isolated the laptop, disabled the account and started reviewing how the original administrator session had been compromised in the first place. This case was a good reminder that checking the Windows sign-in screen is not the same thing as checking which accounts actually exist. If I am investigating a Windows machine now, I would rather run: Get-LocalUser and Get-LocalGroupMember Administrators than assume the accounts I can see on the welcome screen are the only ones there. Because sometimes the account you need to worry about is the one somebody deliberately made sure you would not see.