MikroTik SSH 1-day RCE 链在野利用，补丁已发布，暴露设备可能已被入侵。
针对网络设备的在野利用，影响面大，需立即排查与修补。
RT @craiu: Heads up, there is a 1-day full MikroTik RCE chain against SSH being used in the wild. Patch was released yesterday, so if you have a MikroTik router with ssh open on the internet, it may already be compromised. Detection guidance and IOCs courtesy of @CERT_Polska_en https://t.co/9RDSNxp3xD
MikroTik SSH 0day 大规模在野利用，补丁发布前已开始攻击。
0day 在野利用，补丁时间线混乱，需确认设备是否受影响。
RT @craiu: MikroTik ssh 0day in the wild with massive exploitation going on since September 2. Patches went out on Sep 3. Initially looked like a 1day but now it seems exploitation actually began one day before the patches were released. 🤯
CERT Polska 披露 MikroTik RouterOS 六个漏洞，组合可未授权完全控制设备。
官方披露细节与检测规则，影响大量暴露设备，需评估风险。
🚨𝗠𝗶𝗸𝗿𝗼𝘁𝗶𝗸 𝗿𝗼𝘂𝘁𝗲𝗿𝘀 𝘂𝗻𝗱𝗲𝗿 𝗮𝘁𝘁𝗮𝗰𝗸 - 𝗖𝗘𝗥𝗧 𝗣𝗼𝗹𝘀𝗸𝗮 According to Shodan there are 1.7 million internet facing Mikrotik routers and the CERT Polska team has identified and coordinated the disclosure of six vulnerabilities in MikroTik RouterOS. Combining two of them 𝗮𝗹𝗹𝗼𝘄𝘀 𝗮𝗻 𝗮𝘁𝘁𝗮𝗰𝗸𝗲𝗿 𝘁𝗼 𝘁𝗮𝗸𝗲 𝗳𝘂𝗹𝗹 𝗰𝗼𝗻𝘁𝗿𝗼𝗹 𝗼𝗳 𝘁𝗵𝗲 𝗱𝗲𝘃𝗶𝗰𝗲 𝘄𝗶𝘁𝗵𝗼𝘂𝘁 𝗮𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻 if the device supports remote access using the SSH protocol. https://t.co/5s8uTJquUM For Microsoft Defenders do you know you can use Microsoft Defender for Endpoint device discovery telemetry to check for Mikrotik routers in your environment ? I am sharing the Sentinel query which you can query and get your network team to look into it if Mikrotik routers are found. Time of essence, run the query and secure.🫡 https://t.co/IvQMTRoKpS #Threathunting 🧙♂️
Endpoint AI Agent Abuse (EAA) 目录发布，收录本地 AI Agent 滥用技术与案例。
直接相关首要意图，系统化梳理本地 AI Agent 攻击面。
Endpoint AI Agent Abuse (EAA) is a curated catalog of techniques and real-world cases involving abuse of local AI agents through their runtime, configuration, state, tools, and inherited authority. - @0x4d31 https://t.co/byWC28eaPq
Telerik UI for ASP.NET AJAX 存在未认证 Padding Oracle 到 RCE 漏洞链。
影响版本跨度大，未认证 RCE，PoC 已公开，需紧急排查。
RT @TantoSecurity: 🚨🚨🚨🚨🚨🚨 From Padding Oracle to Shell: Unauthenticated RCE in Telerik UI for ASP[.]NET AJAX https://t.co/H0ZBJ4R05d The vulnerabilities described in this post were discovered, analysed, and exploited with some AI assistance, and a lot of old-fashioned human persistence.
Telerik 漏洞链细节分析：Padding Oracle 结合类型混淆等实现 RCE。
技术细节详实，便于理解漏洞链与评估自身风险。
Detection engineers, red teamers, exploit devs and AppSec people: this Telerik chain is nasty. Tanto Security found an unauthenticated AES-CBC padding oracle in Telerik UI for https://t.co/7IrEzhRL4z AJAX and chained it with two other flaws to get RCE. 4 CVEs. Padding oracle. Timing oracle. Type confusion / unsafe type resolution. Forged upload state. Mixed-mode DLL loading. Shell. Affected versions span 2010.1.309 through 2026.2.519. And yes, the research was done with some AI assistance plus a lot of human persistence. If you work on enterprise https://t.co/7IrEzhRL4z, vuln research or offensive security, read this one properly. By @marcioalm / @TantoSecurity: https://t.co/ihewrqwnDU #VulnerabilityResearch #AppSec #RedTeam #DetectionEngineering
PostgreSQL 12年历史漏洞 CVE-2026-6471 可致代码执行，已修复。
数据库核心组件，低权限利用，影响面广，需及时更新。
RT @The_Cyber_News: 🛡️ 12-Year-Old PostgreSQL Flaw Lets Attackers Execute Code on Database Servers Flaw Details: https://t.co/s5WJDEmzuL A newly disclosed PostgreSQL vulnerability, tracked as CVE-2026-6471 and nicknamed PostGREShell, could allow attackers with low-level replication access to execute arbitrary code on database servers. The flaw in PostgreSQL logical decoding existed for roughly 12 years and has now been fixed in supported releases. PostgreSQL is widely used to store business data, application records, customer details, financial information, and cloud workloads. The vulnerability is especially concerning because it affects an account type commonly used for backups, replication, disaster recovery, and change data capture operations. #cybersecuritynews
Linux Binder 驱动 UAF 漏洞 CVE-2026-64468 的 LPE PoC 已公开。
内核提权漏洞，PoC 公开，影响 Android 及使用 Binder 的系统。
RT @aramosf: 🐧 New: LPE PoC + x86_64 LPE for CVE-2026-64468 — a use-after-free in Linux Binder's binder_free_transaction(). Full credit to Alice Ryhl (Google) for finding & reporting it, and Carlos Llamas for the fix. 🙏 Repo → https://t.co/ncvYDm3ovQ
Rubeus 新增 IAKerb 支持，可远程进行 Kerberoasting 等攻击。
NTLM 弃用过渡期新技术，扩大攻击面，需关注检测策略。
RT @_EthicalChaos_: Weekend project: I added IAKerb support to Rubeus. My god, this is going to open the floodgates. Phase 2 of Microsoft's NTLM deprecation is targeted for H2 2026. IAKerb ships for Server 2025 / Win11 24H2 and is already on by default in the June Canary preview. It proxies Kerberos auth through exposed services via SSPI when a client can't directly reach a KDC. Which means anonymous user enum via AP-REQs with no preauth (zero telemetry), kerberoasting over the open internet, Entra lateral movement through AZUREADSSO tickets and more. All against public facing services. Blog post soon with potential abuse vectors.
使用 Claude Code 逆向 Papercut NG 0day 漏洞的案例分析。
展示 LLM 辅助漏洞研究的实际应用，对 AI 安全研究有参考价值。
Using Claude Code to reverse engineer a zero-day in Papercut NG (@KevTheHermit) https://t.co/oe2r95NMoH #infosec #llm https://t.co/9hExFtvwRe
ntoffsets 数据库发布，收录 1967 个 Windows 内核结构布局与符号信息。
为 Windows 内核研究与利用开发提供宝贵数据资源。
I still pay for Claude, but CVP kind of made it useless for me, so I just make it churn out toy apps. Today's is ntoffsets. ntoffsets is a public database of Windows kernel struct layouts, member types and global symbol RVAs, one record per build. 1,967 builds, 1507 through 26H1, amd64 / ARM64 / x86. Keyed by PDB GUID + Age. Credits: Winbindex by @m417z, indexes which Windows binaries exist and where to get them. ntoffsets builds directly on that work. Symbols come from Microsoft's public symbol server. No PDBs or binaries are redistributed, only offsets derived from them. https://t.co/TJ9dHOK2jJ
发布五个固件逆向工程技能包，支持 Claude Code、Codex 等 AI Agent。
将 AI Agent 应用于固件安全研究，提供可直接使用的技能与脚本。
RT @husseinmuhaisen: I’ve published five firmware reverse engineering skills under OrbitCurve for Claude Code, Codex, and other compatible agents. They cover firmware extraction, ELF analysis, Ghidra, QEMU emulation, and security reporting. Includes four Ghidra scripts, and more. If you use agents for embedded security research, try them on your targets. GitHub repository https://t.co/5B0mxaOust
实验评估本地开源权重 LLM 在漏洞检测方面的能力。
为本地化 AI 安全工具选型提供实证数据。
Experiments with local open-weight LLMs to detect vulnerabilities (@xmartinaxo) https://t.co/4vv8W1oeBc #infosec https://t.co/JrtpEV7g2s
1Password 研究显示 AI 生成的安全补丁成功率仅 26%，且可能引入新漏洞。
对依赖 AI 自动修复漏洞的风险提出量化警示。
RT @HedgieMarkets: 🦔AI can only fix security vulnerabilities 26% of the time. Researchers at 1Password ran over 6,000 AI-generated patches using Claude and ChatGPT against real vulnerabilities. Half the time the AI failed to fix the original bug. 4.5% of the time it created a brand new vulnerability that didn't exist before. And the researchers found that checking an AI-generated security patch takes more effort than just writing the fix yourself. Their conclusion was blunt. "The expected value of a fully LLM-generated, non-human-reviewed patch is a net-negative by a considerable margin." My Take OpenAI launched a program this summer called "Patch the Planet" where AI finds bugs and generates the fixes. These researchers ran 270 patches against one of those same bugs. Zero clean fixes. Not one. Every patch that fixed the original problem created a new vulnerability in the process. The partner that submitted a fix through OpenAI's program produced what the researchers classified as the worst possible outcome, it didn't fully fix the bug and it introduced a new exploit on top of it. Here's what this means if you don't write code for a living. Companies are using these AI tools to patch the software that runs your bank, your hospital, your phone. The pitch has been "AI finds and fixes security holes faster than humans." This study says the AI fix is four times more likely to be broken than working, and a third of the time it recreates the exact same mistakes human programmers already made. Reviewing the AI's work takes longer than doing it yourself. So the speed advantage disappears the moment you try to verify the output, which most companies won't do because the entire point was to move faster. I think we're going to see major breaches traced back to AI-generated patches that nobody checked, and the companies that shipped them are going to blame the tool instead of the decision to trust it. Hedgie🤗 Study: https://t.co/5b9FQRBMSX
研究指出 LLM 自动化修复管道更可能改变行为、引入新漏洞而非修复。
与 AI 补丁研究结论一致，强调人工审计必要性。
RT @seanhn: https://t.co/gOtQb9QmuU "At present, it appears that highly-automated, LLM- based remediation pipelines are more likely to change application behavior, introduce new vulnerabilities, or mask existing ones, than fix known vulnerabilities."
1Password 发布报告详述 LLM 生成安全补丁的常见缺陷模式。
深入分析 AI 补丁失败模式，对安全开发流程有参考价值。
RT @HackingLZ: Paper from the folks at 1pass “Frontier Models Vulnerability Patches are Often F.L.A.W.E.D. Fix-Like Artifacts With Embedded Defects: Common failure modes of LLM-generated security patches” https://t.co/x9lBMJrbRm
发布 KQL 查询，用于检测来自 OpenAI 出站 IP 的 M365 活动。
针对 AI Agent 侦察/注入的检测方法，可直接用于 SOC。
🧠 𝗛𝘂𝗻𝘁𝗶𝗻𝗴 𝗔𝗜 𝗢𝘂𝘁𝗯𝗼𝘂𝗻𝗱 𝗥𝗶𝘀𝗸𝘀 — 𝗢𝗽𝗲𝗻𝗔𝗜 𝗜𝗣 𝗪𝗮𝘁𝗰𝗵𝗹𝗶𝘀𝘁 Following the recent 𝗢𝗽𝗲𝗻𝗔𝗜 𝗔𝗴𝗲𝗻𝘁 𝗶𝗻𝗰𝗶𝗱𝗲𝗻𝘁 targeting a German wiki site, I built a 𝗞𝗤𝗟 𝗾𝘂𝗲𝗿𝘆 to help SOC teams identify 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝟯𝟲𝟱 𝗮𝗰𝘁𝗶𝘃𝗶𝘁𝗶𝗲𝘀 originating from known 𝗢𝗽𝗲𝗻𝗔𝗜 𝗼𝘂𝘁𝗯𝗼𝘂𝗻𝗱 𝗜𝗣 𝗿𝗮𝗻𝗴𝗲𝘀. This query lets defenders quickly visualize what actions were triggered by those IPs — giving visibility into potential 𝗔𝗜‑𝗱𝗿𝗶𝘃𝗲𝗻 𝗿𝗲𝗰𝗼𝗻𝗻𝗮𝗶𝘀𝘀𝗮𝗻𝗰𝗲 𝗼𝗿 𝗶𝗻𝗷𝗲𝗰𝘁𝗶𝗼𝗻 𝗮𝘁𝘁𝗲𝗺𝗽𝘁𝘀 across tenant boundaries. Sharing this so defenders can 𝘀𝘁𝗮𝘆 𝗮𝗵𝗲𝗮𝗱 𝗼𝗳 𝗮𝘂𝘁𝗼𝗻𝗼𝗺𝗼𝘂𝘀 𝗮𝗴𝗲𝗻𝘁 𝘁𝗿𝗮𝗳𝗳𝗶𝗰 and 𝗺𝗮𝗽 𝗲𝗺𝗲𝗿𝗴𝗶𝗻𝗴 𝗔𝗜 𝘁𝗵𝗿𝗲𝗮𝘁 𝘀𝘂𝗿𝗳𝗮𝗰𝗲𝘀. https://t.co/dyDW1ajDZt #AIAgentThreatHunting 🧙♂️
提供 OpenAI 爬虫 IP 范围列表，用于监控与检测。
补充 AI 出站风险监控所需的数据源。
https://t.co/fSKSR8o4I9
分析一个由 LLM 创建和运营的恶意软件基础设施（RoboBox）。
展示 LLM 被用于自动化恶意软件运营的真实案例。
We took down the paywall for this one: We investigated a rather interesting little instance of a server hosting Cobalt Strike Teamserver, a simple but fully function working RAT, a spiked update delivery infrastructure of a Chinese software and some other goodies. But it seemed that the whole box and its content was created and operated by an LLM: https://t.co/DQ3461QoPr
OpenAI 发布 Codex Security CLI 和 SDK，用于查找和修复漏洞。
官方 AI 安全工具，值得评估其能力与局限。
codex-security npm-v0.1.25 — OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities... https://t.co/HIX5AwBw65 https://t.co/OGoKxO4jm8
Ironclaw 发布，定位为安全、私密的 AI Agent 操作系统。
本地 AI Agent 安全基础设施，与首要意图相关。
ironclaw ironclaw-v1.4.0 — Secure, private AI agent operating system with local encrypted storage, OAuth/SSO authentication, policy-based access control,... https://t.co/aoHFLf9I1Z https://t.co/iBjs5iJA5D
Skyvern v1.0.52 发布，用于自动化浏览器工作流的 AI 工具。
浏览器自动化 Agent，需关注其潜在安全风险。
skyvern v1.0.52 — Automate browser based workflows with AI https://t.co/leaKykQGi6 https://t.co/ykRHBZwBqA
GLM 5.3 网络安全专用 FP8 模型发布。
本地化网络安全大模型，可评估其用于安全分析的能力。
GLM 5.3 CRACK Cybersecurity FP8 https://t.co/sGyXsUmADI
观点：今年最具影响力的攻击可能是 TeamPCP 和供应链，而非漏洞利用。
提供对攻击趋势的宏观判断，有助于调整防御优先级。
RT @HackingLZ: I have a suspicion that when we look back at the most impactful hacks this year, it won’t be the vulnpocalypse everyone has been talking about. It’ll be the TeamPCP and supply chain compromises. So far, the vulnpocalypse has largely been a patchpocalypse. My guess for next year is that attackers realize the cost of targeting homegrown, internet facing web apps is approaching zero with local models. Historically, attackers went for scale by scanning for framework bugs. Models are getting good enough to point at custom apps deployed by Fortune 100/500 companies that aren’t software companies but still build plenty of software for their customers.
KASLD v0.4.0 发布，Linux KASLR 去随机化工具，新增 18 个泄露组件。
内核利用研究的重要工具更新，提升利用可靠性。
RT @_bcoles: KASLD v0.4.0 released. Linux #KASLR derandomization tool. Memory regions now carry a certainty rating: "guaranteed" proven values/ranges, and "likely" narrower guesses that can be wrong (from heuristics/side-channels). +18 leak components (120 total). https://t.co/NDUxBpgqE5 https://t.co/LouDw2Kw8b
Telegram 客户端因恶意 Lottie 贴纸崩溃，疑似 DoS 攻击。
跨平台客户端 DoS，影响广泛，需关注官方修复。
RT @GangExposed_RU: The issue appears to be caused by a maliciously crafted Lottie sticker. The sticker contains a red star whose shape configuration includes an extremely large value: layers[0].shapes[0].pt.k = 10e38 The value is accepted by Telegram’s servers as valid/safe sticker content. However, when the sticker is rendered by the client, the renderer interprets this value as the number of points/rays of the star. As a result, the client attempts to process an astronomically large number of geometric elements (10^38), exhausting the renderer’s resources and causing the Telegram client to crash. The important distinction is that the malicious sticker passes server-side validation but triggers a denial-of-service condition during client-side rendering. Because the affected content is stored in the group history, opening the group causes the client to load and render the malicious sticker, resulting in an immediate crash. This effectively makes the affected group inaccessible from the client. If the same payload can be delivered to arbitrary groups, the issue could potentially be used as a client-side DoS against Telegram groups.
Telegram 群组因恶意内容导致全平台客户端崩溃，无法访问。
详细描述 DoS 攻击场景，提醒用户注意恶意内容风险。
RT @GangExposed_RU: 🚨 Potential client-side DoS in Telegram A Telegram group I own has been deliberately made completely inaccessible. Every attempt to open the group causes the Telegram client to crash. The issue is reproducible on iOS, Android, Desktop and Web - the chat is completely inaccessible. The group has not been deleted or banned. I am the owner, and the invite link is still valid. I know who is behind the attack. Based on the circumstances, I suspect that malicious content was deliberately placed in the group to trigger the client crash. If this condition can be remotely triggered by specific content, an attacker could potentially make any Telegram group inaccessible by sending a specially crafted payload. This makes the issue significantly more serious than an ordinary client crash. @telegram - please investigate this urgently. I can provide the necessary details and evidence privately. Affected group: https://t.co/U260AiB8zu
发布工具，可在 C2 植入体内内存运行整个 Tailscale 守护进程。
先进的隐蔽通信与内网穿透技术，对红队有参考价值。
RT @_EthicalChaos_: Want to run an entire Tailscale daemon from memory inside a C2 implant with zero disk artifacts, no kernel drivers, traffic indistinguishable from HTTPS to a CDN, and relay connections from the victim network back through the tailnet. Now you can. Enjoy! https://t.co/WmBlShAnLr
KHAØS C2 框架发布，利用 Teams、GitHub 等可信服务进行通信。
新型 C2 框架，展示如何利用可信服务规避检测。
Discover KHAØS C2, a post-exploitation framework designed to blend into enterprise environments by routing traffic through trusted services like Teams, GitHub, and DNS. Built with modern evasion techniques and a complete post-exploitation toolkit. https://t.co/s9qLxOjHYd
介绍 KHAØS C2 的代理与规避技术，包括间接系统调用、硬件断点绕过等。
详细技术实现，对理解现代 C2 规避技术有帮助。
Pivoting works through SOCKS5, reverse port forward, or SMB named pipes. Everything runs under indirect syscalls with ETW and AMSI bypassed through hardware breakpoints, sleep obfuscation, and call stack spoofing. #RedTeam #C2 #OffensiveSecurity #Pentesting #InfoSec #MalwareDev
KHAØS C2 支持多种注入、凭据窃取与提权技术。
展示完整后渗透工具链能力，便于评估威胁。
The agent runs execute-assembly in-process, loads BOF/COFF objects, and supports four injection techniques including module stomping. On the credential side, it dumps LSASS, Kerberoasts, grabs SAM hives, and handles token manipulation with getsystem and UAC bypass. https://t.co/DEQXybZysL
通过 BYOVD 句柄表补丁重定向文件对象，离线读取 SAM/SYSTEM 获取 NTLM 哈希。
绕过 lsass 的新型凭据窃取技术，对检测有挑战。
Redirecting a File handle's kernel object pointer to SAM's and SYSTEM _FILE_OBJECT via BYOVD handle table patch, then reading the locked hive offline to dump NTLM hashes without touching lsass https://t.co/UmJZa8F6Hr
Handle Redirect 工具开源，用于重定向文件句柄内核对象。
提供实现上述攻击的具体工具，便于研究。
Handle Redirect also released in GitHub: https://t.co/QiVyOpXwM1
PID Mutation 工具开源，用于进程 ID 混淆。
提供进程伪装技术，对红队与检测研究有价值。
PID Mutation its already released in GitHub: https://t.co/qXABjGesWZ
介绍 Module Overloading 技术及其在规避检测中的应用。
详细讲解一种 Windows 代码规避技术，有学习价值。
Module Overloading New Medium post, in this one we will see how Module Overloading works, why it is useful for evasion, and how to implement it in C or C++ https://t.co/UTs4B0QU9F
Censys 发布博客，介绍如何大规模指纹识别 AdaptixC2 框架。
提供开源 C2 框架的检测方法，对防御方有价值。
Censys published a beginner friendly blog about fingerprinting an Open Source AdaptixC2 Framework at Scale. https://t.co/AJCDFJiQ25 #c2 #detection https://t.co/3dSazoi8Z2
Rasterfall 工具发布，利用 librsvg 0day 实现 RCE。
展示图像处理管道作为 RCE 攻击面的风险。
RT @_MrNiko: 🚨 Rasterfall just dropped Satori → Sharp → librsvg 0day RCE XML inject via title/desc text UAF in librsvg/libxml2 → ROP on Node 24.20.0 OG image pipelines are RCE sinks. https://t.co/rSsjoDTJPm credit @sybr1d_ #VulnerabilityResearch #ExploitDev #InfoSec
发布文章，介绍如何绕过 Chrome 远程调试端口限制。
针对浏览器调试接口的攻击技术，对红队有参考价值。
RT @r1cksec: A post about how to bypass Chromes remote-debugging port restrictions. https://t.co/z109mqRWov #infosec #cybersecurity #redteam #pentest #chrome
发现 V8 引擎中存在超过 3.5 年的常量整数溢出漏洞。
浏览器核心漏洞，长期存在，凸显 AI 漏洞挖掘的局限性。
RT @0x10n: During my time at @QED_Audit I circled back and took another quick look at browser/JSE vulnerability research. AI agents flying high, seemingly finding & exploiting bugs everywhere, and there's this: a **constant integer overflow** in V8, alive for over 3.5 years. (1/5)
研究指出 Linux 无文件执行仍会留下可观测行为，并映射到检测规则。
为 Linux 无文件攻击检测提供实用指南。
RT @RFGroenewoud: Fileless execution on Linux still leaves (a lot of) observable behavior. My latest research identifies five common patterns and maps each to the telemetry and detection rules that underlie them. Read it here ↓ https://t.co/D0YPRmpiP4
NetSPI 发布 Azure RBAC/ABAC 提权技术文章，含 MSRC 案例。
云权限提升技术详解，对云安全有参考价值。
RT @kfosaaen: New @NetSPI blog out today! Kudos to @thomas_elling for doing all the heavy lifting on this one, but this is a great primer on Azure RBAC/ABAC, with a privilege escalation MSRC ticket snuck in at the end. https://t.co/4r5a7WcA4O
Responder 工具新增排除自身 IP 的功能，避免误报。
提升 Responder 实用性，减少红队操作中的噪音。
RT @al3x_n3ff: Are you (like me) constantly running into your own Responder? The days are finally over!🚀 @Defte_ and I finally finished up a PR by bdrogja that let's you define exclusions such as "yourself". You can also exclude entire ranges or IPv6 addresses (if anyone uses those lol). https://t.co/rMEblTSwzk
CrowdStrike 与 NVIDIA 合作推出网络安全领域的前沿模型。
商业 AI 安全模型发布，关注其能力与市场影响。
RT @Dinosn: CrowdStrike Launches Frontier Models for Cybersecurity, Created with NVIDIA https://t.co/EJtdKsNZ8I
JSCeal V8 恶意软件利用窃取的浏览器 Cookie 绕过 Google 认证。
新型恶意软件，针对浏览器会话认证，需关注检测。
RT @TheHackersNews: 🚨 JSCeal V8 malware can bypass Google authentication using stolen browser cookies. It can also modify Binance, Bybit, and Ledger traffic through a local proxy. How analysts decoded its hidden capabilities: https://t.co/MYB7wc6Lx9 https://t.co/hpzR6qHrws
Netskope 报告：5400+ 被黑小企业网站通过区块链隐藏 ClickFix 载荷。
大规模恶意广告活动，使用新技术隐藏，需了解其机制。
According to Netskope’s latest threat report, more than 𝟱,𝟰𝟬𝟬 𝗰𝗼𝗺𝗽𝗿𝗼𝗺𝗶𝘀𝗲𝗱 𝘀𝗺𝗮𝗹𝗹‑𝗯𝘂𝘀𝗶𝗻𝗲𝘀𝘀 𝘄𝗲𝗯𝘀𝗶𝘁𝗲𝘀 are serving 𝗖𝗹𝗶𝗰𝗸𝗙𝗶𝘅 𝗽𝗮𝘆𝗹𝗼𝗮𝗱𝘀 𝗵𝗶𝗱𝗱𝗲𝗻 𝗼𝗻 𝘁𝗵𝗲 𝗯𝗹𝗼𝗰𝗸𝗰𝗵𝗮𝗶𝗻 through the 𝘌𝘵𝘩𝘦𝘳𝘩𝘪𝘥𝘪𝘯𝘨 technique, with most of the affected sites running on 𝗪𝗼𝗿𝗱𝗣𝗿𝗲𝘀𝘀 and some on 𝗣𝗿𝗲𝘀𝘁𝗮𝗦𝗵𝗼𝗽; using @anyrun_app 𝗜𝗻𝘁𝗲𝗹𝗹𝗶𝗴𝗲𝗻𝗰𝗲 𝗟𝗼𝗼𝗸𝘂𝗽, defenders can surface active WordPress sites delivering these payloads, and I’ve shared the exact query in the comments so fellow defenders can replicate the lookup and strengthen their monitoring. https://t.co/cL1FH5ldsK #Threathunting 🧙♂️
提供 ANY.RUN 查询，用于发现提供 ClickFix 载荷的活跃 WordPress 网站。
提供可操作的威胁狩猎查询，便于主动发现风险。
https://t.co/jN9cRxahkX Intelligence Lookup https://t.co/4DomiARVmd{%22query%22:%22threatName:%5C%22etherhiding%5C%22%20and%20threatName:%5C%22clickfix%5C%22%20AND%20threatName:%5C%22susp-clipboard%5C%22%22,%22dateRange%22:180}
发布 Chrome 浏览器密码窃取工具。
恶意工具，了解其存在即可。
RT @MyuraASM: browser-stealer-plang!!! (Chrome only for now) it works tho mueheheh https://t.co/GGUUGOhwr0
JavaScript 混淆工具发布。
常规工具更新，无特殊增量。
javascript-obfuscator — A powerful obfuscator for JavaScript and Node.js https://t.co/i0pW9DmKYn https://t.co/Czn7pgGkke
Binary Ninja 6.0 发布，带来性能提升与 MCP 支持。
逆向工具更新，对相关用户有价值。
RT @vector35: A bird? A plane? NO! It's Binary Ninja 6.0, codename "Krypton". Major new stable with massive performance improvements, built-in MCP, Binary Similarity, Extension Manager, TMS320C6x, New User Wizard, and so much more: https://t.co/VP7IwyJOGI
Rocket.Chat v8.8.0 发布。
常规软件更新。
https://t.co/6EneYs5XhP v8.8.0 — The Secure CommsOS™ for mission-critical operations https://t.co/j3p1XcP0Ao https://t.co/umsSUZ80sE
DefectDojo v3.2.400 发布。
常规漏洞管理平台更新。
django-DefectDojo v3.2.400 — Open-Source Unified Vulnerability Management, DevSecOps & ASPM https://t.co/JOP1w7LCIU https://t.co/LLhkqZKUop
hosts 文件整合工具更新。
常规工具更新。
hosts v3.16.111 — 🔒 Consolidating and extending hosts files from several well-curated sources... https://t.co/w21nQW7bCa https://t.co/Bd5vrmSPlM
OpenVAS Scanner v23.50.24 发布。
常规漏洞扫描器更新。
openvas-scanner v23.50.24 — This repository contains the scanner component for Greenbone Community Edition. https://t.co/evakfVhUK6 https://t.co/dRmAmbVAxt
PrivescCheck 更新。
常规提权枚举工具更新。
PrivescCheck v2026.09.02-1 — Privilege Escalation Enumeration Script for Windows https://t.co/ZcyHCjlGvW https://t.co/9dHXNdl3tv
vm2 v3.11.8 发布。
沙箱工具更新，但 vm2 已不再维护，需注意风险。
vm2 v3.11.8 — Isolated JavaScript sandbox for Node.js that runs untrusted code with restricted access to built-in modules and host resources via... https://t.co/Ml2orxVIKD https://t.co/BmvMsmIKHQ
ipurple 预告明日发布关于 Windows Defender 的文章。
关注后续文章。
@_xpn_ @CloudflareDev Congrats, it is a crazy number!
回顾 Credential Guard 攻击演变与检测策略。
对 Windows 凭据安全有兴趣者可读。
Earlier this year, I wrote about the evolution of Credential Guard attacks and modern detection strategies, including SpecterOps’ latest SSP Negotiation technique. Tomorrow, a new article is going to drop about Windows Defender. ⤵️ 🖊️ https://t.co/8wxvXdhbel https://t.co/1w1o0Sa87X
Building a Detection Foundation 系列文章发布。
检测体系建设入门系列，适合新手。
RT @DirectoryRanger: Building a Detection Foundation, by @Carlos_Perez Part 1 The Single-Source Problem https://t.co/1pjienxof8 Part 2 Windows Security Events https://t.co/3imctfbmUj Part 3 PowerShell and Script Logging https://t.co/uyJqfPbYt6 Part 4 Sysmon https://t.co/Qr238fyTdT
HTTP/1.1 Must Die 交互式学习工具发布。
学习 HTTP 请求走私的交互式资源。
RT @CristiVlad25: I turned @albinowax HTTP/1.1 Must Die into an interactive learning companion. Free, here: https://t.co/2uyKBqrUzt
编写自己的 VPN 协议指南发布。
网络协议学习资源。
RT @_mattata: Writing your own VPN Protocol 16 Production VPN protocols implemented, so that you can follow a guide to write a simple one as an exercise. https://t.co/VtY8LAGDFE
研究 Firecracker 安全层，指出 IO_URING 边界问题。
对微虚拟化安全感兴趣者可读。
RT @antitree: What I've been researching about the security layers of Firecracker and how one of the layers isn't very effective at being a meaningful boundary. Spoiler, it's always IO_URING https://t.co/draejCo8e8
推荐 Alex Ionescu 的系列安全研究演讲。
高质量学习资源汇总。
RT @cr3ghost: If you're going to study @aionescu, don't stop at one talk. Some of the best rabbit holes: Reversing Without Reversing OffensiveCon 2019 https://t.co/zRXstK71Lk The Linux Kernel Hidden Inside Windows 10 Black Hat USA 2016 https://t.co/XaDluq6po9 Battle of the SKM and IUM: How Windows 10 Rewrites OS Architecture Black Hat USA 2015 https://t.co/rPH8T8hFEW Advancing the State of UEFI Bootkits OffensiveCon 2018 https://t.co/7RF9JNuFD8 Hooking Nirvana: Stealthy Instrumentation Techniques for Windows 10 REcon 2015 https://t.co/VmvLA17NCQ The Windows Notification Facility with Gabrielle Viala Black Hat USA 2018 https://t.co/ab6wQbg5vf Unknown Known DLLs and other Code Integrity Trust Violations with James Forshaw REcon 2018 https://t.co/mfyXEBpQeY Hacking Like in the Movies: Visualizing Page Tables for Local Exploitation with Georg Wicherski and Alexandru Radocea Black Hat USA 2013 https://t.co/QHOh4Ir05M OS Security Is Hard: Why All the Fuzzers in the World Won't Change the Way Platform Security Is Failing Us USENIX WOOT 2020 https://t.co/jHx62AoK7T Windows reversing. Kernel exploitation. VBS / VTLs. PPL and Code Integrity. Instrumentation. WSL. Page tables. UEFI. Platform security. There is an absurd amount to learn here. Bookmark the list. #WindowsInternals #ReverseEngineering #KernelSecurity
推荐 Idov31 的免费 Windows 安全研究资源。
汇总高质量研究资源，值得收藏。
RT @cr3ghost: Detection engineers, red teamers, malware analysts, reverse engineers and blue teams: if EDR bypass, EDR blinding, BYOVD, rootkits or Ring 0 tradecraft interests you, @Idov31 has published an absurd amount of FREE Windows security research. Nidhogg: 25+ rootkit / EDR tampering capabilities, easily be integrated with your C2 framework. NovaHypervisor: VT-x + EPT defense when the kernel itself may already be compromised or abused through BYOVD. Jormungandr: Jormungandr is a kernel implementation of a COFF loader, allowing kernel developers to load and execute their COFFs in the kernel. Cronos: PoC for a new sleep obfuscation technique (based on Ekko) leveraging waitable timers to RC4 encrypt the current process and change the permissions from RW to RX to evade memory scanners. Venom: Venom is a library that meant to perform evasive communication using stolen browser socket Sandman: Sandman is a backdoor that is meant to work on hardened networks during red team engagements. MrKaplan: MrKaplan is a tool aimed to help red teamers to stay hidden by clearing evidence of execution. And the blog goes much deeper: Windows drivers, WinDbg, IRPs/IOCTLs, ObRegisterCallbacks, process/thread/image callbacks, registry callbacks, IRP + SSDT hooking, APC injection, kernel-to-user injection, AMSI bypass, ETW/ETW-TI tampering, credential access, PPL, callback removal/tampering and the primitives EDRs depend on for visibility. Then you get into PatchGuard, KVA Shadow, CR3/address-space internals, VBS, VTL0/VTL1, HVCI, VMX, VMCS, VM-exits, VMCALL, EPT, EPT hooks and the bigger question: how do you defend an endpoint when Ring 0 itself can no longer be trusted? Red teamers: study EDR bypass/blinding, kernel post-ex, BYOVD, covert execution, sleep obfuscation and unconventional C2. Detection engineers + blue teams: study exactly what telemetry, callbacks and trust boundaries attackers can manipulate. Malware analysts + reverse engineers: see what modern kernel tradecraft actually looks like under the hood. The FREE Lord Of The Ring0 series alone could keep you busy for a long time, and the individual project writeups turn the theory into actual implementations. This is a rare GitHub full of PoCs with basically a public Windows offense-vs-defense research lab. Blog: https://t.co/7gpRfTt2OP GitHub: https://t.co/0HIDZmI7dN Bookmark it. Clone the repos. Save the references while everything is public. #DetectionEngineering #RedTeam #MalwareAnalysis #ReverseEngineering
观点：漏洞研究推动了浏览器安全整体提升。
对漏洞研究价值的宏观思考。
RT @LiveOverflow: I believe vulnerabilities matter beyond just immediate threats. Modern exploitation always chains multiple layers. Every step positions you on the next perimeter level. Vulnerability research looks at all those. In 2010 if you talked about a single browser exploit, the industry would cry “it doesn’t matter because there are so many”. And yet in 2026 attackers don’t use browser exploit kits anymore and have to resort to eg. social engineering. I think this is the result of vulnerability research. It’s like math proofs that don’t have obvious immediate benefits, vulnerability research’s insights also come over time. That’s how scientific progress has always worked, and it has always clashed with “the real world”. The opinion that vuln research is not really relevant in cybersecurity as a whole is short term. Companies and those who are aligned with the business plans, always focus on what matters in the moment. I believe in long term progress from small incremental scientific advancements. You cannot really measure the benefit of a single new vuln getting found. But looking over decades, vulnerability research has informed threat models and built technical knowledge that made all these cybersecurity solutions possible in the first place. What is happening right now is just the clash between big cybersecurity corporations and their money incentives vs. small technical work that will lead to positive benefits longterm that are not directly exploitable for gains. Call me academically delusional, but I just believe capitalism doesn’t always follow the best incentives. And circling back to LLMs and their current focus on vulnerability research. I think LLMs are really good in math and code, so that’s where we apply them now. AI math proofs don’t seem to have an immediate benefit to the world, but I do think they have impact longterm. Also LLMs are super easy to social engineer, so they are maybe just a really bad tool for the wider cybersecurity domain... Vuln research is where LLMs can make an impact now. So just let it all play out and complain less about the stupid marketing of the AI companies? Cybersecurity marketing has always been cringe.