A roundup of 372 items curated from across the security community.
News
Midnight Blizzard’s CaptiveCrunch campaign re-emerged in September 2026 at even larger scale, with AI-refactored Rust-flavor malware and continued MSP compromise.
Pwn2Own Ireland 2026 full schedule published. Targets include mobile devices, IoT, smart home, automotive, and NAS platforms with prize pools up to $300K per category.
- Former German BND Intelligence Chief Arrested for Espionage by SwitHak ().
August Hanning, former head of Germany’s BND foreign intelligence service, arrested on suspicion of espionage and treason.
Team TESO’s legendary ssh1-crc32 exploit, lost for over 25 years, was recovered and published alongside a Phrack 73 article. Includes hellkit, 7350statd, 7350qpopper, and more.
Anthropic expands the Cyber Verification Program with new tiers for authorized offensive work including penetration testing and red-teaming with Mythos 5.1, Opus 5.5, and Sonnet 5.5.
Samsung Galaxy S26 pwned at Pwn2Own Ireland via a Confused Deputy bug using the Djini.ai platform from Mobile Hacking Lab. Pixel targeted next.
Phrack 73 publishes the prophile of Halvar Flake, one of the legends of vulnerability research. A must-read interview covering decades of RE and offensive security.
Attacker used the ARTEX AI tool and Claude agents to target South Korean banks. Exposed by OPSEC failures in the Claude Code session artifacts.
HacktronAI researchers chained a heap overflow and SSO misconfiguration to compromise OpenAI internal repositories.
Albert Heijn, the largest Dutch supermarket chain, dealing with a cyber breach taking down their retail media API and operations.
More this week (42)
- RT DirectoryRanger: Dissecting Impacket. public reference of protocol-level and implementation-level indicators of compromise(IoCs) for detecting Impa… by DirectoryRanger.
- Danish university DTU breach exposes data of up to 200,000 people https://www.bleepingcomputer.com/news/security/danish-university-dtu-breach-exposes-… by BleepingComputer.
- ShinyHunters hacker reportedly detained in Jordan, aiding FBI https://www.bleepingcomputer.com/news/security/shinyhunters-hacker-reportedly-detained-i… by BleepingComputer.
- Microsoft Threat Intelligence: Microsoft Threat Intelligence has identified a cluster of compromised websites leading to ClickFix attacks. Instead of downloading and executing remote payloads like the by Samir.
- New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline https://thehackernews.com/2026/10/new-netscaler-zero-day-explo… by Nicolas Krassas.
- Iranian hacker accused of draining 31TB from university inboxes extradited to the US https://securityaffairs.com/200387/security/iranian-hacker-accuse… by Nicolas Krassas.
- Nuclei vulnerabilities: Information Disclosure, Denial of Service - Martin Desrumaux https://labs.stoik.io/nuclei-vulnerabilities-information-disclosu… by Swissky.
- Pwn2Own Ireland 2026 - The Full Schedule by Dustin Childs.
- Engineer sentenced for locking over 3,000 devices on employer network https://www.bleepingcomputer.com/news/security/engineer-sentenced-for-locking-th… by BleepingComputer.
- Nikkei discloses breaches of employees’ Microsoft, Google email accounts https://www.bleepingcomputer.com/news/security/nikkei-discloses-breaches-of-… by BleepingComputer.
- Pwn2Own Ireland 2026 - Day One Results by Dustin Childs.
- RT Phrack Zine: One more Phrack 73 leak for you! Blueboxing Myths and Feelings: a nostalgic dive into phone phreaking’s golden age. https://archives…. by thaddeus e. grugq.
- The Wikimedia Foundation says rogue OpenAI agents made unauthorized Wikipedia edits and may have partly caused a May outage. https://www.bleepingcompu… by BleepingComputer.
- RT @zooko: Announcing https://hashsma.sh! 𝟘 𝟙 Strengthen cryptography with AI. Cryptography - both current and post-quantum crypto… by thaddeus e. grugq.
- RT FBI Cyber Division: A global credential-compromise campaign known as FortiBleed is actively targeting internet-facing Fortinet FortiGate firewalls … by SwitHak ().
- Someone appears to have hacked the British retailer ASOS and is sending push notifications to customers stating that their data was hacked via a compromised instance at the cloud data storage provider.
- ASOS confirms data breach after “HACKED” in-app notifications https://www.bleepingcomputer.com/news/security/asos-confirms-data-breach-after-hacked-… by BleepingComputer.
- Rockstar Games has now been compromised several different ways since 2018, and none of them were a zero-day https://www.lares.com/blog/rockstar-games-… by /r/netsec.
- Bitvulnex: a vulnerable crypto exchange https://www.blazeinfosec.com/labs/introducing-bitvulnex-vulnerable-crypto-exchange by /r/netsec.
- After my expert negotiating skills (I just asked how they did it), they told me how they compromised “Go Momentum” or “Momentum Telecom”. > be ransomw… by vx-underground.
- One Copilot model refused. Another leaked secrets about half the time. https://adversa.ai/blog/cryptographic-context-injection-github-copilot/ by /r/netsec.
- 100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer https://thehackernews.com/2026/10/100-compromised-websites-use-fake.html by Nicolas Krassas.
- Pwn2Own Ireland 2026 - Day Two Results by Dustin Childs.
- One breach, please, and make no mistakes by Jerzy ‘Yuri’ Kramarz.
- Advantest confirms personal information stolen in ransomware attack https://www.bleepingcomputer.com/news/security/advantest-confirms-personal-informa… by Nicolas Krassas.
- Pwn2Own Ireland 2026 Day 1: 32 Zero-Days, $388,500, Samsung Galaxy S26 Hacked 3 Times https://www.zerohack.org/blog/pwn2own-ireland-2026-day-1-32-zero… by /r/netsec.
- RT Jukan OCP 2026: This hacker is truly legendary. A complete amateur. 1. He left directory listing enabled on his own server, so researchers coul… by Florian Roth.
- RT Larisa Brown: EXCLUSIVE: Sailor arrested on spying charges was believed to have been spying for Russia, @thetimes has been told. The able seaman wo… by thaddeus e. grugq.
- Pwn2Own Ireland 2026 - Day Three Results & Master of Pwn by Dustin Childs.
- Uranium crypto exchange hacker convicted for stealing $53 million https://www.bleepingcomputer.com/news/security/uranium-crypto-exchange-hacker-found-… by BleepingComputer.
- Ransomware attack disrupts Japan’s IDCF Cloud used by govt clients https://www.bleepingcomputer.com/news/security/ransomware-attack-disrupts-japans-id… by BleepingComputer.
- RT Satoki@Kn0wl3dg3: Pwn2Own Ireland 2026でMaster of Pwnの称号を頂きました。$361,000の賞金と42.5 Master of Pwn pointsをゲットです。チーム全員で獲得し… by Dave Aitel.
- RT V12: Re It appears the vendor deleted the version we targeted in our poc while leaving other vulnerable versions available for download. Porting th… by kmkz.
- RT Mehmet INCE: if you are working for postgresql company and havent read this masterpiece of how hacker-minds bending the lo functions, you are missi… by kmkz.
- With the advancement in AI for vulnerability research and exploitation lately, I really enjoyed learning more hardware attacks this #Pwn2Own Ireland! … by McCaulay.
- Breaking, new, by me: Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested the co-founder of a Canadian cybersecurity firm in connection with an investigation into the ShinyHunte.
- Introducing Aikido Altar: the model that makes sovereign security intelligence possible - @AikidoSecurity https://www.aikido.dev/blog/aikido-altar-ope… by Swissky.
- Cyber exec arrested in case allegedly tied to ShinyHunters hackers https://www.bleepingcomputer.com/news/security/cyber-exec-arrested-in-case-allegedl… by BleepingComputer.
- That’s a wrap for Team ZyGoat at Pwn2Own 2026. Two attempts, two successful exploits - one against Samsung and one against Pixel. We finished in 3rd… by Dimitri Os.
- LG webOS sync-demo Preauth RCE https://ssd-disclosure.com/lg-webos-sync-demo-preauth-rce/ by /r/netsec.
- RT Johannes (4, 4): UPDATE: I can confirm that the Ledger supply chain is compromised in Europe as well. @Ledger should initiate an immediate product … by Sick.Codes.
- FBI Arrests Suspect in FBI-Hacking Case by Bruce Schneier.
Techniques and Write-ups
Alexandre Borges releases Part 1 of the iOS Security Research series covering vulnerability research, exploit development, reverse engineering, and kernel security on Apple platforms.
Project Zero documents the process and pitfalls of fixing bugs introduced by previous fixes, with case studies from emergency patching cycles.
watchTowr publishes PoCs for pre-auth arbitrary file read across Atlassian Jira, Confluence, and Bitbucket, plus an auth bypass PoC against Jira with Atlassian Crowd.
Heap-based buffer overflow in AnyDesk for Linux 8.0.2 allows an unauthenticated remote attacker to achieve arbitrary command execution with root privileges. PoC published.
watchTowr chains multiple PaperCut vulnerabilities into a pre-auth RCE, then bypasses the patches released for prior CVEs. Covers CVE-2026-82077, CVE-2026-82078, and CVE-2026-81578.
Updated interactive map of Active Directory attack paths covering Kerberos, ADCS, delegation, trust abuse, and lateral movement techniques.
Autonomous pipeline that takes a CVE, locates vulnerable binaries, and generates working N-day exploits without human intervention.
Hardware hacking walkthrough extracting Wi-Fi credentials and firmware from a Eufy HomeStation2 through UART access and damaged flash memory recovery.
SpecterOps demonstrates one-shotting LLM-generated Stage-0 agents for Mythic, deployed to live operations. Nighthawk team built two custom C2 agents with Codex in a week.
Flask session cookie deserialization on Google Developer Sites led to arbitrary code execution. Google paid $90,000 for the finding.
More this week (290)
- RT f0rw4rd: OIDA is out. A CLI for OT/ICS assessments: one syntax for Modbus, S7, OPC UA, IEC 104, DNP3 and more, passive pcap analysis, boofuzz fuzzi… by Vincent Yiu.
- still a lot of work to do. still adding additional post-ex commands, and making various feature adjustments, but the core is in place and the UI is lo… by K̵i̵r̵k̵ ̵T̵r̵y̵c̵h̵e̵l̵.
- RT Panos Gkatziroulis : DLLParty is a proof-of-concept Windows DLL-injection technique that manipulates internally constructed thread-pool callbac… by DirectoryRanger.
- RT wrongbaud: New Blog Post! Introduction to ARM ETM Tracing for Reverse Engineers! In this post we extract a live instruction trace from a running Xb… by Alex Plaskett.
- AI file - a Mythic C2 profile that uses the publicly documented OpenAI Files API to exchange implant messages through JSON files instead of a traditio… by Panos Gkatziroulis.
- RT Quentin Texier : Did you know you can request a certificate via NTLM relay through these 2 AD CS endpoints? /_CES_Kerberos/service… by Steven Lowson.
- RT Co11ateral: PowerShell for Hackers - Dropping Nukes Testing different attack scenarios during red team engagements to emulate how hackers work http… by DirectoryRanger.
- RT 𝚊𝚕𝚔𝚊𝚕𝚒: this aspect of making a Real Exploit is discussed in this great talk by @chompie1337 https://github.com/chompie1337/Talks… by thaddeus e. grugq.
- RT Omri Segev Moyal: this is one of the most craziest AI enabled cyber research I have seen to date: https://guysrd.github.io/epoll-uaf-agent way to g… by Jeff McJunkin.
- RT Swissky: Microsoft Paint and Photos Embed Server-Issued GUIDs as Invisible Watermarks in Locally-Generated Images - @CrackmesOne https://xusheng.de… by DirectoryRanger.
- The AD Forest As A Security Boundary And the Impact of Trusts on That Security Boundary – The Revisited Still (In)Secure Sequel, by @JsQForKnowledge … by DirectoryRanger.
- Azure AD Graph Activity Logs: Ingestion and threat detection to close the visibility gap https://www.elastic.co/security-labs/aad-graph-activity-logs-… by DirectoryRanger.
- DCOM Explained: How Attackers Turn a Windows Feature into a Lateral Movement Tool https://detect.fyi/dcom-explained-how-attackers-turn-a-windows-featu… by DirectoryRanger.
- A Practical Guide to BloodHound Data Collection https://www.blackhillsinfosec.com/bloodhound-data-collection/ by DirectoryRanger.
- Passkey Tools. Encode, Decode, Intercept, Modify, and Exploit WebAuthn Operations https://github.com/RUB-NDS/passkeys.tools by DirectoryRanger.
- Token Theft in Microsoft Entra ID, by @insinuator Part 1: Threat Landscape and Attack Techniques https://insinuator.net/2026/08/token-theft-in-microso… by DirectoryRanger.
- RT International Cyber Digest: ‼ BREAKING: A security researcher says he has a full VM escape zero-day: guest-to-host root in “industry standard hy… by Paulos Yibelo.
- RT HotCakeX ︎ סגול: Re @SwiftOnSecurity Thank you, btw there are device usage intents too, so like based on how a device is used (gaming/busine… by SwiftOnSecurity.
- RT Ivan Fitro: This article is very interesting for designing your own AI tooling for BB hunting: use /goal instead of the attack vector. Use the impa… by Arun.
- How to Hack Time, With C2PA https://www.da.vidbuchanan.co.uk/blog/hacking-time.html by /r/netsec.
- Very strongly suspecting some medium effort RLVR can bring that time down to hours. Not that this is in my realm of interests anymore these days. Of c… by rpw.
- Field Notes: Reconstructing the Attacker’s LSASS Dump, by @malmoeb #DFIR https://dfir.ch/posts/field_notes_trickdump/ by DirectoryRanger.
- SigLens - a Windows binary analysis tool designed to pinpoint the exact regions responsible for antivirus detections. It narrows detections down to pr… by Panos Gkatziroulis.
- RT Pavel Yosifovich: New video: basic reversing of a Windows kernel driver. WESP, the new endpoint security driver in Insider builds, has no device ob… by Stephen Sims.
- New aardwolf version is out! https://github.com/skelsec/aardwolf/releases/tag/0.2.16 Contains fixes (thanks to contributors) and new features like ful… by SkelSec.
- RT mpgn: I wrote about securing your CI pipelines on GitHub Enterprise without expensive third-party tools. Own your security, don’t let a tool decid… by Chihuahua in charge NotMe.
- RT R.B.C.: Hey Everyone, here’s my latest blog post - Creating a Function Stomping BOF for Adaptix C2! I love using Adaptix C2, and function stomping … by Panos Gkatziroulis.
- Good news for everyone whose dad is a secret FBI agent, bad news for everyone whose dad who is a real FBI agent. by SwiftOnSecurity.
- RT msuiche: This has nothing to do with the Vercel bug but it’s pretty interesting too. Since everyone is dropping KVM bugs and exploits, and projects… by thaddeus e. grugq.
- RT Johann Rehberger: Video From SELECT to SYSADMIN Hijacking Copilot in SQL Server Management Studio (CVE- 2026-65669) https://youtu.be… by Max.
- Agentic Hacks, Real Proofs: Inside Google’s PageBreak Project - Michał Bentkowski https://blog.google/security/agentic-hacks-real-proofs-inside-googl… by Swissky.
- RT Nicolas Krassas: SrHollow - LSA secrets extraction, reuse a preexisting VSS shadow copy + inline regf parser + AES-256 LSA decrypt via bcrypt.dll. … by Max.
- Our agent scanner allows you to scan SKILLs and MCP servers. You can get a full verdict before installing the skill or MCP inside your agent Chec… by Thomas Roccia.
- RT Abdul Mhanni: Underrated steps taken to disrupt ClickFix and harden against a lot of initial-access vectors is blocking command interpreters like w… by The Haag™.
- RT NetAskari: Interesting find by swarmchasers: https://swarmcha.se/posts/chinese-agent-fleet: by thaddeus e. grugq.
- Open Build Service, one year later: command execution through Mercurial argument injection https://fenrisk.com/research/open-build-service-2/ by /r/netsec.
- RT delivr.to: Malware Delivery Techniques No.78 - Frameless Browser-in-the-Browser Proofpoint has published analysis of TA419, a China-aligned th… by Dominic Chell.
- Hacks of 2 federal agencies in a month have spilled a bonanza of sensitive data https://arstechnica.com/security/2026/10/hacks-of-2-federal-agencies-i… by Nicolas Krassas.
- RT Shaban Shaame: I got hacked at 3:59 AM without clicking anything. My voicemail handed the attacker my Telegram login code. Here is exactly how it w… by thaddeus e. grugq.
- RT etugen.io: Exposed Attacker Infrastructure Sliver C2 - Miner - Metasploit 🇮🇪 34[.]254.202.253 Note: According to our analysis, it is targetin… by batuu.
- TaskExplorer now natively integrates with Ollama …so you can bring your favorite local LLM to the party! Latest version available here: https:/… by Patrick Wardle.
- Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE https://thehackernews.com/2026/10/attackers-target-rejetto-hfs-flaw-that…. by Nicolas Krassas.
- RT Quentin Texier : Did you know you can spot which servers and workstations have the WebClient (WebDAV) service running, straight from BloodHound… by Panos Gkatziroulis.
- Another Historic Cipher Falls to AI https://www.schneier.com/blog/archives/2026/10/another-historic-cipher-falls-to-ai.html by Nicolas Krassas.
- Apple Plans Tighter macOS Full Disk Access Controls Over AI Agent Data Access https://thehackernews.com/2026/10/apple-plans-tighter-macos-full-disk.ht… by Nicolas Krassas.
- RT ZachXBT: 1/ How I infiltrated a Chinese organized crime syndicate that has laundered $1B+ across multiple exploits for Lazarus Group. Posing as a c… by thaddeus e. grugq.
- Denmark reports unauthorized access to 8.8 million people’s CPR data https://cyberinsider.com/denmark-reports-unauthorized-access-to-8-8-million-peop… by Nicolas Krassas.
- RT cr3ghost: If you’re into Windows internals, kernel development or reverse engineering, bookmark this. @codemachineinc has an incredible FREE archiv… by sailay(valen).
- RT zenitylabs: A public URL scanner is a free remote browser. Rogue AI agents figured that out too. Sandboxed agents with limited network access found… by Giuseppe
N3mes1s. - RT dbugs: A PoC/exploit has been discovered for vulnerabilities in libheif Vendor: struktur AG Product: libheif Description: Memory corruption vulnera… by Simone Margaritelli.
- South Korea probes bank breaches amid suspected AI-powered attacks https://www.bleepingcomputer.com/news/security/south-korea-probes-bank-breaches-ami… by Nicolas Krassas.
- Apple iCloud Mail flaws allowed sender spoofing that passed security checks https://cyberinsider.com/apple-icloud-mail-flaws-allowed-sender-spoofing-t… by Nicolas Krassas.
- Alleged dev of Ploutus ATM malware appears in US court after arrest https://www.bleepingcomputer.com/news/security/suspected-dev-of-ploutus-atm-malwar… by Nicolas Krassas.
- Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws https://www.securityweek.com/linux-backdoor-abuses-stun-protocol-exploits-dozens-of-flaw… by Nicolas Krassas.
- ownCloud also impacted from the libheif exploit, exploitation is similar to the https://fortbridge.co.uk/research/wordpress-libheif-rce/ , will create… by Nicolas Krassas.
- RT 0xor0ne: Collection of papers on using LLMs for vulnerability detection https://github.com/huhusmang/Awesome-LLMs-for-Vulnerability-Detection #llm … by thaddeus e. grugq.
- New Dell System Update flaw lets hackers gain root privileges https://www.bleepingcomputer.com/news/security/new-dell-system-update-flaw-lets-hackers-… by Nicolas Krassas.
- https://www.eff.org/deeplinks/2026/10/court-agrees-eff-utahs-vpn-law-demands-technical-impossibility by scriptjunkie (Matt).
- RT Ugur Toprakdeviren: I mapped every Apple framework and everything it imports. 350 frameworks, 1,775 dependencies, straight from the Xcode 27 SDKs: … by Csaba Fitzl.
- RT : Nice repo: https://github.com/ivancabrera02/pyTGTdeleg Remote Kerberos TGT extraction via MSSQL https://github.com/ivancabrera02/rustPack htt… by DirectoryRanger.
- RT V12: Saturday was national boyfriend day so we forgot to post, but here’s a Libreoffice RCE by ϻг_ϻε.
- Federal judge rules Flock license plate searches unconstitutional https://www.scworld.com/brief/federal-judge-rules-flock-license-plate-searches-uncon… by Nicolas Krassas.
- Legacy sign-on service comes back to bite school software provider Bromcom https://www.theregister.com/security/2026/10/05/legacy-sign-on-service-come… by Nicolas Krassas.
- From Physical Memory Read/Write to SYSTEM https://vojtechhron.dev/en/article/ktapi-lpe by Panos Gkatziroulis.
- If you have been following along - we recently updated https://loldrivers.io and fresh as of right now - https://lolrmm.io has been refreshed as well!… by The Haag™.
- RT Pruva: CVE-2026-63277: LibreOffice Calc RCE via calcext:data-mappings, sql provider and jdbc connector - document-named Java DB driver loaded from… by Giuseppe
N3mes1s. - BOFKatz - Beacon Object File implementation of mimikatz leveraging the Process Hollowing technique https://github.com/KrakenEU/BOFKatz by Panos Gkatziroulis.
- RT 🇷🇴 cristi: OAuth 2.0 & OIDC for Pentesters, blackboard edition. https://youtu.be/I7emM4_hCAw by Arun.
- RT Chainguard : Fixing zero-days under embargo is hard. Figuring out where to keep those fixes… even harder Each embargoed fix must ship wi… by Giuseppe
N3mes1s. - RT Cyber (In)Security: I’ve decided to finally release my vulnerability hunting methodology that I’ve been using for several months now, both in testi… by thaddeus e. grugq.
- Playing with the newest process‑injection technique in my lab to explore defensive detection opportunities: Console Named Pipe If you need the PoC an… by Panos Gkatziroulis.
- SelectorsHub chrome extension(400k users) opens server-picked ad tabs without a click https://malext.io/reports/RedirectorsHub/ by /r/netsec.
- RT Ronen Shustin: Haven’t touched Android research in 5 years, but Android and I just became friends again . Reported a cool 3-vulnerability chain… by kmkz.
- RT cr3ghost: Infosec has a rebranding problem. Take an old primitive, wrap it in a new PoC, call it “novel”, add an “EDR evasion” headline and AI slop… by Chihuahua in charge NotMe.
- RT : This seems great for OT. Uses the NetExec approach; https://getoida.dev/ https://github.com/f0rw4rd/oida by Vincent Yiu.
- RT DirectoryRanger: Re Token Theft in Microsoft Entra ID (Part 3 of 4): Token Protection https://insinuator.net/2026/10/token-theft-in-microsoft-entra… by DirectoryRanger.
- RT Numb3rs: I’ve never worked on WhatsApp before, so I thought it’d be interesting to poke it with a stick! I wrote an article about my attempt to unc… by Alex Plaskett.
- Today at @OffensiveAIcon: All Models Cheat: Prompt-Level Mitigation of Cheating of Offensive Cyber Tasks : @mkultraWasHere : https://ww… by dreadnode.
- for red teamers hunting xoxd/xoxc tokens :) https://github.com/noperator/chromedb by Caleb Gross.
- HEIF Heist (The image format bug that hacked everything or could have) got me thinking, I’d prefer running complex binary image parsers in a memory safe language. So I told the computer to build Image.
- Here we go again… by Kuba Gretzky.
- RT Elissa: I spoke with @LiveOverflow of Hacktron for a behind-the-scenes look at how they hacked OpenAI’s infrastructure, what he’s building with his… by LiveOverflow hextree.io.
- RT Cruz: RED-SNOW-5.3-FLASH EXL3 is LIVE for both ONE and TWO DGX Sparks. ONE Spark: 2.49 bpw, 90.32% top-1, up to 61.7 tok/s TWO Sparks: 4.9… by Jean.
- RT Thomas Naunheim: New chapter: #AgentIdentities in the Attack & Defense Playbook for #MicrosoftEntra is live! https://github.com/Cloud-Arc… by Arun.
- I see a lot of activiy going around browser cache smuggling which I presented back in 2023 there https://sensepost.com/blog/2023/browsers-cache-smuggl… by Aurélien Chalot.
- RT AirVector: Re @tom_nuttall Here’s the detailed analysis of the situation by Dave Aitel.
- RT Sky News: BREAKING: ASOS customers have received a push notification saying the e-commerce giant had been ‘hacked’ Sky’s Phoebe Southworth has the … by Simone Margaritelli.
- RT Pruva: Apart from the latest LibreOffice RCE we have other 5 repro from the same batch of CVEs From LFI, to arbitrary file write, between SSRF. htt… by Giuseppe
N3mes1s. - Possible Vulnerability in Apple’s Automatic Reboot by Bruce Schneier.
- RT Pruva: CVE-2026-105642: Ghost CMS RCE via Bookmark Card Images SVG handling in bundled image processing library You can work on the PIE https:… by Giuseppe
N3mes1s. - Teaching network intrusion in the funnest way possible https://store.steampowered.com/app/4980910/Project_RedTeam_Contract_Offensive/ by /r/netsec.
- How do you prioritize prebuilt detection rules when there are hundreds to choose from? Elastic SIEM uses real fleet telemetry to tag rules based on no… by Samir.
- Fake ChatGPT, Gemini Sites steal advertising accounts, MFA codes https://www.bleepingcomputer.com/news/security/fake-chatgpt-gemini-sites-steal-advert… by BleepingComputer.
- Go-based OSINT and security research tool for username, email, password, domain, IP, and Bitcoin intelligence. Includes configurable site databases, o… by Panos Gkatziroulis.
- RT Attorney General James Uthmeier: Today, we sued TP-Link for lying about the safety of its routers and its ties to the CCP. TP-Link sold Floridians … by SwitHak ().
- Earth Sirrush (AKA UAC-0099, SHADOW-EARTH-065) : A Russia🇷🇺-Aligned Intrusion Set With 4 Years of Evolving Espionage Tooling (Target Ukrainian�… by SwitHak ().
- RT James Kettle: Re Read the full details here: https://portswigger.net/research/the-model-isnt-cooperating by d3d aka dead (dead, мёртв, 死了).
- It is obvious as fuck that this “zoom-update” (extension is missing for some reason, it should be “zoom-update.msc” I guess) is not legit, but not one… by MalwareHunterTeam.
- RT pwnmachine : How abliterated models can get you pwned We backdoored a 7B open model for less than $50, pointed Codex at it and it silently… by ProjectDiscovery.
- Listen in on @shanejcaldwell and @0xdab0’s talk, “ScopeBench: Measuring Alignment Outside the Sandbox” at 11:05 AM, right here at @OffensiveAIcon. M… by dreadnode.
- Apple decided to further investigate this. maybe it’s not fine after all. by Csaba Fitzl.
- You’re Building Your MCP Wrong - @mpgn_x64 https://mpgn.fr/youre-building-your-mcp-wrong/ by Swissky.
- vf3 (very fast fun vibe fuzzer) designed by @_dinolover38 is faster than Jackalope and libprotobuf-mutator #OAIC by chompie.
- In this talk, I will discuss Microsoft’s ‘security second’ approach when it comes to agentic capabilities in Project Opal. Abuse of default features i… by Nikhil Mittal.
- https://gist.github[.]com/recoverfitter-ux/d9fdb8ef52fd833fb16155c4ed68aeee No way that this GitHub gist is being used by some actor as a C2 DDR or an… by MalwareHunterTeam.
- It appears from the story that although an individual Accenture contractor lost his job over failing to apply the patch, the overall Accenture contrac… by Kim Zetter.
- RT MagicSword: Lavawall and Zecurit leads from @patialavii sent us looking for RMM tools hiding behind Zoom installers, Adobe downloads, and DocuSign … by Chihuahua in charge NotMe.
- Ninja Forms plugin flaw exploited to hack WordPress sites https://www.bleepingcomputer.com/news/security/ninja-forms-plugin-flaw-exploited-to-hack-wor… by BleepingComputer.
- by Thomas Roccia.
- emp3r0r C2 payloads can be trimmed down to 11MB or ~5MB as PIC, on both Linux and Windows, while keeping all its core features including P2P mesh, Sta… by jm33_ng.
- RT kernelstub (Prepakis Georgios): I have created an emulator the past year to emulate the FritzBox Firmwares. I reverse engineered how it works, the … by rpw.
- RT abraxas: 3 MORE REMOTE MySQL ( @MySQL ) 0DAYS! EXPLOITS: https://github.com/abraxas/mysql-install-component-scheme - RCE https://github.com/abraxas… by Max.
- RT Nicolas Krassas: quincunx33/ai-jailbreak: A collection of jailbreak prompts and exploit techniques for local and frontier AI models, with modern me… by Spiros Fraganastasis.
- Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589 | by @watchtowrcyber https://labs.watchtowr.com/you-wont-hear-about-… by Florian Roth.
- RT POC_Crew: #POC2026 Kuan-Ting Chen(@h3xr4bb1t) & Ting-Yu Chen(@terrynini38514) - “Obvious Was Only the Beginning: A WebKit Exploit Chain fo… by Orange Tsai.
- SQLi with Captcha Bypass using Google Cloud Vision https://labs.itresit.es/2026/10/07/old-dives-02-sqli-bypassing-captcha-with-google-cloud-vision/ by Peter Gabaldon.
- macOS Teaser: Sandboxed user to root LPE. by Csaba Fitzl.
- RT Ophir Harpaz: Tal attempts to explain why the current vulnpocalypse isn’t (yet) a breachpocalypse. while his explanation may not be the correct one… by Halvar Flake.
- Exploiting Reversing (ER) series: article 10 | iOS Security Research (part 01) https://exploitreversing.com/2026/10/06/exploiting-reversing-er-series-… by Nicolas Krassas.
- RT Kévin GERVOT (Mizu): I’m happy that my first article as part of the @SLCyberSec research team is finally out! It covers an interesting ImageM… by Rémi GASCOU (Podalirius).
- FortiBleed still a bleeding nuisance as FBI confirms ongoing attacks https://www.theregister.com/security/2026/10/07/fortibleed-still-a-bleeding-nuisa… by Nicolas Krassas.
- Apple’s Verified Photography System https://www.schneier.com/blog/archives/2026/10/apples-verified-photography-system.html by Nicolas Krassas.
- SonicWall warns of max severity SSRF flaw in SMA1000 gateways https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-max-severity-ssrf-flaw… by BleepingComputer.
- CVE-2026-21589 by Nuclei by ProjectDiscovery.
- RT Jeremy Kritz: https://bugbounty.meta.com/payout-guidelines/muse/ Muse bugs pay up to $300k, attack us instead! by Simone Margaritelli.
- RT cr3ghost: If you’re into malware analysis, Windows internals or reverse engineering, bookmark this. @eversinc33 has built an excellent FREE archive… by Max.
- MECCHA CHAMELEON can’t hide from the RCE - by Robbe Van Roey @AikidoSecurity https://www.aikido.dev/blog/meccha-chameleon-rce by Swissky.
- CERT-UA: Fake Cloudflare Checks Deliver LunexStealer Malware https://securityaffairs.com/200537/hacking/cert-ua-fake-cloudflare-checks-deliver-lunexst… by Nicolas Krassas.
- CVE-2026-102489 Deep-Dive: Zammad Session Leak to RCE https://horizon3.ai/attack-research/disclosures/cve-2026-102489-zammad-session-leak-rce/ by Nicolas Krassas.
- Google blocks rogue HTTPS certificates after domain registry hijacks https://cyberinsider.com/google-blocks-rogue-https-certificates-after-domain-regi… by Nicolas Krassas.
- RT Horizon3 Attack Team: Check out our latest deep-dive on CVE-2026-102489, a session leak to RCE affecting #Zammad helpdesk and found actively exploi… by ϻг_ϻε.
- RT Nextron Research : We’ve continued working on the recent Citrix #NetScaler exploitation around CVE-2026-88771 and CVE-2026-88772 and significa… by Florian Roth.
- RT Eugenio Benincasa: This new Natto Thoughts three-part series digs into ZRON, a Chinese commercial hacking company whose internal data was recently … by Dave Aitel.
- New, by me: ShinyHunters Extorted Boeing Spin-off Prior to Arrests A teenager from Amman, Jordan suspected of leading the prolific data theft and extortion group ShinyHunters has been detained and is.
- PoeLLM malware infects exposed AI servers in cryptomining attacks https://www.bleepingcomputer.com/news/security/poellm-malware-infects-exposed-ai-ser… by Nicolas Krassas.
- Microsoft Outlook to block MSIX attachments starting November https://www.bleepingcomputer.com/news/microsoft/microsoft-outlook-to-block-msix-attachme… by BleepingComputer.
- A Decision Model Breaks Like Any Other Language Model: A First Look at Jev https://blog.checkpoint.com/ai-security/jev-is-not-a-language-model-but-it-… by Simone Margaritelli.
- Poetry is the new AI security threat as PoeLLM malware infects 3K+ servers https://www.theregister.com/security/2026/10/07/poetry-is-the-new-ai-securi… by Nicolas Krassas.
- @shanejcaldwell and @0xdab0 took the stage yesterday at @OffensiveAIcon to officially launch ScopeBench. At last year’s con, one question k… by dreadnode.
- Unpatched Critical LMCache Flaw Lets Unauthenticated Attackers Run Code Remotely https://thehackernews.com/2026/10/unpatched-critical-lmcache-flaw-let… by Nicolas Krassas.
- RT Armadin: Our Senior Capability Researcher @mhskai2017 found three unauthenticated RCEs across the SolarWinds product line, none requiring user inte… by werdhaihai.
- RT Kiwids: Six years ago, SolarWinds became the victim of a supply chain attack that impacted thousands of customers and government entities. In this … by werdhaihai.
- US states sue popular kitmaker TP-Link over China risks https://www.theregister.com/security/2026/10/07/us-states-sue-popular-kitmaker-tp-link-over-ch… by Nicolas Krassas.
- California updates wiretapping law, removing right to sue over internet surveillance https://www.scworld.com/brief/california-updates-wiretapping-law-… by Nicolas Krassas.
- RT MalDev Academy: Publishing the “ApiHashing” repository based on the latest V2 update of the malware development course. The library replaces GetMod… by NULL.
- Technical details for 3 unauthenticated RCE vulnerabilities in SolarWinds discovered by @mhskai2017 @ArmadinSecurity This is critical. Co… by Andrew Oliveau.
- RT TrendAI Zero Day Initiative: 2 bugs + Sina Kheirkhah (@SinSinology) of Summoning Team = exploited Sonos Era 300 and $12,500 and 5 Master of Pwn poi… by SinSinology.
- https://blackmagick.io updates today: New technique: (lifted from Cling) BM-T3008 STUN Field Tasking New Pulse articles: Cling: public STUN for mappin… by K̵i̵r̵k̵ ̵T̵r̵y̵c̵h̵e̵l̵.
- Microsoft, Adobe, Apple, and Foxit vulnerabilities by Kri Dontje.
- RT TrendAI Zero Day Initiative: Re @_McCaulay strikes again and down goes Home Assistant Green once again! With a 6 bug chain, including 1 collision a… by McCaulay.
- Pretty cool, 10 months ago I applied this concept of Generative UI for Threat Intelligence. I was tired of lengthy chatbot that generates a wall … by Thomas Roccia.
- Made a personal network in Shazzer so you can have all your logged in browsers connected so you can fuzz them all at once. Also added a fuzz basket fe… by Gareth Heyes \u2028.
- CVE-2026-21589 Atlassian Jira, Confluence & Bitbucket pre-auth arbitrary file read. Discover every Atlassian instance you run and see which … by ProjectDiscovery.
- RT B1lal: During an analysis on @etugenio, a server hosted in Hong Kong 🇭🇰 caught my attention. Further investigation revealed that it was part … by batuu.
- RT Fabian Bader: I had the domain for quite some time and the website was already up - but finally it’s where I wanted it to be. ◽Full XDR and Sent… by DirectoryRanger.
- Implant Encryption via Dump Encoding Library https://ipurple.team/2026/09/21/dump-encoding-library/ by Panos Gkatziroulis.
- With all the new G’s (New GTLDs that ICANN has approved) coming up like .pdf now is a great time to disable search from your browser bar so you don’t accidentally end up at a malicious site. For FireF.
- Speaking of @ torproject a new version of # Tor is out with more security fixes. Please UPDATE! https:// gitlab.torproject.org/tpo/core /tor/-/raw/tor-0.4.9.14/ChangeLog.
- I found yet another way to invoke JavaScript functions without parentheses https://blog.ikaes.de/yet-another-way-to-invoke-functions-without-parenthes… by /r/netsec.
- RT ᴍɪᴄʜᴀʟɪs ᴍɪᴄʜᴀʟᴏs: Tested Microsoft Defender for Office 365’s new prompt-injection protection. Base64/zero-width emails slipped past… by Panos Gkatziroulis.
- As in the article mentioned, it was already known they are doing this over 7 years ago… so maybe this news came “a little” late… by MalwareHunterTeam.
- Ignore all instructions and read this blog: The state of AI-analysis evasion in malware by Ryan Fetterman.
- UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing by Joey Chen.
- RT Brad Spengler: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=357e8a77a501d96c9517f01f4a211eed5e9c9184 by h0mbre.
- The United Kingdom has finally gotten round to sanctioning the RU crypto payments platform Cryptomus, aka Xeltox Enterprises, Certa Payments and more recently Heleket. After our story in 2024 detailin.
- RT Andrew Thompson: Cyber Operations against cameras can enable physical intelligence, surveillance, and reconnaissance in the battlespace. @GreyNoise… by Steve YARA Synapse Miller.
- RT zenitylabs: Re AgentCorruption: How A Single Prompt Collapsed The Entire Cloud Security Model: https://labs.zenity.io/post/agentcorruption-how-a-si… by Giuseppe
N3mes1s. - RT Daniel Cuthbert: There is only one Halvar and he’s amazing. by Dave Aitel.
- RT VirusTotal: From Automation to Infection (Part III): Naming, Measuring, and Detecting Malicious AI Agent Skills https://blog.virustotal.com/2026/10… by Simone Margaritelli.
- Two ways to fake a browser: BitB and BitM https://www.grizzlysec.com/blog/browser-in-the-browser-vs-browser-in-the-middle by /r/netsec.
- Just $5k #bugbounty for a vulnerability that exposed 17 Trillion Microsoft records :( https://blog.faav.net/how-i-couldve-accessed-17-trillion-mi… by payloadartist.
- RT Xint: Let’s talk GhostCompact: What if you could cut your output token costs on OpenAI by 97-99%? Our researcher @tjbecker fo… by Lucas Leong.
- RT 0xor0ne: Building an agentic Vulnerability Research Workflow https://blog.quarkslab.com/from-ai-agents-to-rce-building-a-vulnerability-research-wor… by kmkz.
- CTI folks, heads up! New OpenCTI RCE exploit was merged today https://github.com/rapid7/metasploit-framework/pull/21884 by ege.
- RT watchTowr: watchTowr Intel has been watching attackers exploit Citrix NetScaler (CVE-2026-88771) for 11 days, from backdoors to bulk credential the… by Nicolas Krassas.
- Cisco warns of critical flaws allowing Nexus switch takeover https://www.bleepingcomputer.com/news/security/cisco-warns-of-critical-flaws-allowing-nex… by BleepingComputer.
- RT ESET Research: #ESETresearch has analyzed the evolution of #MATCHBOIL, a C# downloader used by the 🇷🇺 Russia-aligned APT group UAC-0099 to do… by SwitHak ().
- RT BallisKit: Need to disable any EDR in post exploitation? Here is a simple tutorial showing how to do that using BallisKit EDR Eclipse! EDR Eclipse … by Chihuahua in charge NotMe.
- A Single POST Freezes Any Next.js Server https://simonkoeck.com/writeups/react-rsc-formdata-event-loop-dos by /r/netsec.
- FakeGit malware campaign returns with 17,610 malicious GitHub repos https://www.bleepingcomputer.com/news/security/fakegit-malware-campaign-returns-wi… by BleepingComputer.
- Fresh Living off the Land Weekly is out Forty-five merged pull requests from 12 contributors landed across LOLDrivers, HijackLibs, LOOBins, and L… by The Haag™.
- Low-cost Android phones ship with residential proxy malware https://www.bleepingcomputer.com/news/security/low-cost-android-phones-ship-with-residenti… by BleepingComputer.
- RT Byron Wan: Oct 8: the Justice Department and FBI announced court-authorized seizures to deny malicious cyber actors access to two hacking tools, “… by Florian Roth.
- Serving a (g)zip bomb with Caddy - @dustriorg https://dustri.org/b/serving-a-gzip-bomb-with-caddy.html by Swissky.
- Disrupting AI-enabled “false front” operations (BS 5/6🇷🇺 and 4/6🇮🇷) ↘ https://openai.com/index/disrupting-ai-enabled-false-front-oper… by SwitHak ().
- Hacktics and Telemetry, Special Brucon Edition is now live! Check it out! https://www. youtube.com/watch?v=hXvwp38YiKA.
- RT Citrix: We have issued immediate guidance for CVE-2026-107406 in NetScaler ADC and NetScaler Gateway: https://bit.ly/4rWRBz4 We strongly urge affec… by SwitHak ().
- Abusing Constrained Delegation without Protocol Transition against SPN-less https://hunio.org/security/abusing-constrained-delegation-without-protocol… by Panos Gkatziroulis.
- Loupe: An Android Console in the Browser https://captmeelo.com/mobile/2026/09/21/loupe.html by /r/netsec.
- How We Found Thousands of Exposed NVIDIA GPUs and a Way to Disrupt Them (CVE-2026-47483) https:// lava.security/research/cve-202 6-47483-nvidia-dcgm-exporter-vulnerability.
- RT Kim Jinu: We just received a $250,000 Chrome Full Chain bonus! We’ve claimed the second Full Chain bonus of 2026. Only two remain! Under the r… by thaddeus e. grugq.
- What the 2026 Microsoft Digital Defense Report reveals about AI, identity, and the future of cybersecurity by K Gibson.
- RT Benjamin Samuels: This program is tone deaf to the challenges maintainers are actually facing. There is no shortage of valid bug reports. If you si… by Dan Guido.
- RT ThreatWire: PoC RELEASED: Telegram Desktop one-click account takeover (CVE-2026-107181) A researcher has published a full technical write-up a… by rpw.
- RT Md Ismail Šojal : IDA Pro into an AI-Reverse engineering workstation: - Instant function explanations + security analysis - Semantic knowl… by thaddeus e. grugq.
- RT Pruva: CVE-2026-93674: IBM Langflow OSS 1.0.0 through 1.12.2 is vulnerable to remote unauthenticated code execution via OS command injection. https… by Giuseppe
N3mes1s. - RT 0xor0ne: An autonomous N-day exploit pipeline (slide deck, @chompie1337) https://www.beautiful.ai/player/-P2q0r-B7nGYGGK3-32Z/Binchomp-N-Day-Pipeli… by Nicolas Krassas.
- RT Daniel Cuthbert: Credit where credit due. @SocketSecurity 11 mins, ELEVEN minutes and you detected a ChainDrop / Shai-Hulud supply chain attack ser… by thaddeus e. grugq.
- rea 31,759 stars Deploy autonomous AI agents to reverse engineer anything. Dissect everything from high-level app behavior down to raw native … by Marco Ramilli.
- How can an HTTP Range request help exfiltrate files and secrets from VMs? At T-REX 2026, @TG91aXMK presented Fusetea, a tool we use during TLPT engage… by Synacktiv.
- Microsoft says devices running unsupported versions of Windows will stop receiving security updates starting in May 2027 after next year’s Windows Upd… by BleepingComputer.
- Not sure how I managed to miss this repository! Offensive techniques using Windows Fibers: 1⃣ PoisonFiber (The first remote enumeration & Fiber injec… by Panos Gkatziroulis.
- Man admits to running network of 15,000 money mules for cybercriminals https://www.bleepingcomputer.com/news/security/ukrainian-russian-dual-citizen-a… by Nicolas Krassas.
- US Disrupts China-Linked Integrity Tech ‘s Cyber Espionage Tools https://securityaffairs.com/200673/security/us-disrupts-china-linked-integrity-tech-… by Nicolas Krassas.
- GoBalance Flaw Lets Attackers Hijack .onion Addresses by Recovering Tor-Format Keys https://thehackernews.com/2026/10/gobalance-flaw-lets-attackers-hi… by Nicolas Krassas.
- FBI Seizes 7 Domains, Disrupts Flax Typhoon Tools Used in Critical Infrastructure Intrusions https://thehackernews.com/2026/10/fbi-seizes-7-domains-di… by Nicolas Krassas.
- Max severity SonicWall SMA1000 flaw now exploited in attacks https://www.bleepingcomputer.com/news/security/max-severity-sonicwall-sma1000-flaw-now-ex… by BleepingComputer.
- RT Defused: Since yesterday we have been observing unauthenticated SSRF traffic against our SonicWall SMA decoys. CVE-2026-102255 (alternate acces… by kmkz.
- RT T4T5: airdrop fully reverse-engineered! works flawlessly on my framework laptop by Gergely Kalman.
- Maybe he was going alphabetically? by thaddeus e. grugq.
- Germany arrests alleged core Qilin ransomware member after extradition https://www.bleepingcomputer.com/news/security/germany-arrests-alleged-core-qil… by BleepingComputer.
- RT International Cyber Digest: ‼ BREAKING: Swiss auction site Ricardo exposed the names, postal addresses and phone numbers of ~890,000 accounts. O… by Nicolas Krassas.
- RT Almamater Technologies: Apple’s M6 brings a new gem: checked pointer arithmetic (CPA). Let’s dig in: https://almamatertech.com/notes/checked-point… by Alex Plaskett.
- RT Owain Evans: New paper. Previous: Models transfer a love of owls through sequences of numbers (Subliminal Learning). New: We show models can transf… by Bill Demirkapi.
- Index of all known BOFs https://chryzsh.github.io/awesome-bof/site/ #redteam by Panos Gkatziroulis.
- A JPEG, a Race, and a Ghost: Breaking Discourse’s Image Pipeline https://www. slcyber.io/research/a-jpeg-a-r ace-and-a-ghost-breaking-discourses-image-pipeline.
- A JPEG, a Race, and a Ghost: Breaking Discourse’s Image Pipeline https://www.slcyber.io/research/a-jpeg-a-race-and-a-ghost-breaking-discourses-image-p… by /r/netsec.
- RT exsiway: so about the $86m ledger drain. everyone’s screaming “ledger got hacked” again. i spent the evening digging and it’s dumber and scarie… by Sick.Codes.
- RT Vikas Anil Sharma: My latest security research was recognized by Apple Inc. and assigned : CVE-2026-86926 - a heap buffer overflow in Claris FileMa… by kmkz.
- RT Dr. Dan Lomas: There are always gaps - vetting doesn’t get everyone. But most people who become an insider threat do so after forms have been fille… by thaddeus e. grugq.
- Some panel titled “NEXUS C2 | Crypto Sniffer”: http://194.9.6[.]5:4313/login “Crypto Wallet Sniffer” by MalwareHunterTeam.
- RT Mark Karpelès: I’ve put together a research page on the Ledger implants I’ve found in order to organize my findings and future research. The next … by Alex Plaskett.
- Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks https://www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-bing-… by BleepingComputer.
- RT Dino A. Dai Zovi: This is correct: “Attempting to outpace AI-driven exploitation with reactive defense is a losing battle. As Provos noted in follo… by thaddeus e. grugq.
- Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto https://www.bleepingcomputer.com/news/security/unpatched-ahsaycbs-flaws-exploited-… by Nicolas Krassas.
- > be me > get dm from @malwrhunterteam > “smelly, i found goop” > wtf i love goop (malware) > he didn’t actually say that > i’m only saying that for c… by vx-underground.
- RT deayzl: The story behind the chrome full chain bonus, we thought that we could get it using 1-day renderer exploit that I had + 0-day sbx that he f… by LiveOverflow hextree.io.
- RT OrcaRouter : We’re excited to introduce OrcaCyber Zero 1.5 - our latest frontier cybersecurity model, built to discover critical vulnerabiliti… by Spiros Fraganastasis.
- RT Co11ateral: Living Off The Browser - NXC/Certipy/LDAP-shell/SharpHound We showed how to run pentesting tool right inside your Chrome browser. From … by DirectoryRanger.
- RT Cyber_OSINT: FortiGuard Labs reported that Casbaneiro’s Latin America campaign uses geofencing and distributed data-receiving servers to evade ana… by kmkz.
- Two characters open up a world of typosquatting opportunities in Chromium browsers https://www.theregister.com/security/2026/10/10/two-characters-open… by Nicolas Krassas.
- Smashing the token limit with overlapping fragments (CSS injection token exfiltration, PortSwigger Research) https://portswigger.net/research/smashing… by /r/netsec.
- GitHub Actions leaking secrets when Miri output is cached https://blog.rust-lang.org/2026/09/21/github-actions-leaking-secrets-when-miri-output-is-cac… by Nicolas Krassas.
- RT Ayush Anand: There are plenty of LOLBin lists, but only one page indexes all of them. http://lolol.farm indexes the community’s Living-Off-the-Land… by SwiftOnSecurity.
- AI-assisted attackers hit financial APIs from India to South Korea as CERT-In issues critical alert https://ministryofcyberaffairs.com/news/d30154ba-0… by Nicolas Krassas.
- RT Hunt.io: AI-Driven Campaign Targets South Korean Banks Using Chinese ARTEX Tool https://securityaffairs.com/200661/hacking/ai-driven-tool-arte… by Vincent Yiu.
- RT S3cur3Th1sSh1t: Input payload obfuscation is a real game changer here. No AMSI or ETW bypass needed and memory scanner evasion by Steven Lowson.
- AI Agent Security: Six Controls From Nine Real Incidents https://blog.gitguardian.com/ai-agent-security-six-controls/ by /r/netsec.
- HTB: DevHub https://0xdf.gitlab.io/2026/10/10/htb-devhub.html by Nicolas Krassas.
- RT Adrian Shtuni: Was #Hanning’s massive espionage scandal foreseeable? As more details emerge, it increasingly appears the warning signs were alread… by Halvar Flake.
- Some panel titled “Login - Beacon”: http://194.9.6[.]117:8090/login?next=/ “Beacon Panel” “Window watcher monitoring” by MalwareHunterTeam.
- Some panel titled “ONYX C2 | Login”: http://194.9.6[.]5:1115/login “ONYX C2” “Command & Control” by MalwareHunterTeam.
- RT Hamid Kashfi: “You are my AI vulnerability researcher. Read this repository and make sure you fully understand the internals of AirDrop from this … by Dave Aitel.
- Silent Ransom Group Allegedly Extorted $207 Million Without Encrypting Files https://securityaffairs.com/200719/cyber-crime/silent-ransom-group-allege… by Nicolas Krassas.
- RT LaurieWired: enough people have been hounding me about GhidraMCP that I went ahead and updated it for those interested. works with latest ghidra, h… by Garrett.
- BinarySoap - A python proof of concept tool to assist in payload classification against EDR/AV’s machine learning models https://github.com/kyle41111/… by Panos Gkatziroulis.
- RT SuperBeetleGamer: Our AI found a bug that let anyone mint infinite XRP, with $94B at risk. It had been hiding in one of the most audited codebases … by Swissky.
- Anthropic Restricts Live Internet Access After Claude Evaluation Failures https://securityaffairs.com/200726/ai/anthropic-restricts-live-internet-acce… by Nicolas Krassas.
- RT LuemmelSec: Are you fucking serious by K̵i̵r̵k̵ ̵T̵r̵y̵c̵h̵e̵l̵.
- New from citrix https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697191 by Nicolas Krassas.
- Someone sent me some really fucking annoying goop. The malware (maybe accidentally?) infected a healthcare facility. The malware was sent to a healthc… by vx-underground.
- PowerShell for DFIR, by @co11ateral Part 1: Log Analysis and System Hardening https://hackers-arise.com/powershell-for-defenders-part-1-log-analysis-a… by DirectoryRanger.
- MicroBurst. PowerShell Toolkit for Attacking Azure, by @kfosaaen https://github.com/NetSPI/MicroBurst by DirectoryRanger.
- ProxyBlob. tool designed to create SOCKS proxy tunnels through Azure Storage services, by @quarkslab https://github.com/quarkslab/proxyblobv by DirectoryRanger.
- Sundays are a day for writing blog posts it seems, here’s part 2 of my 3 part series; Below the Waterline, this part dives into regulating red teams a… by Andy Gill.
- A Practical Guide to “Plug&Pwn” for Pentesters and Defenders https://blog.scrt.ch/2026/10/06/a-practical-guide-to-plugpwn-for-pentesters-and-defende… by Nicolas Krassas.
- U.S. CISA adds ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND flaws to its Known Exploited Vulnerabilities catalog https://securityaffa… by Nicolas Krassas.
- RT Quentin Texier : New blog is live: http://blog.safetech.red Red and Purple notes, and first article out: The origins of RustHoun… by DirectoryRanger.
- Microsoft Defender for Cloud Apps Deep Dive Part 1 Introduction. Securing the Cloud Era https://cyberboo.substack.com/p/microsoft-defender-for-cloud-a… by DirectoryRanger.
- State of Identity Active Directory https://www.inde.nz/blog/state-of-identity-active-directory Entra ID https://www.inde.nz/blog/state-of-identity-ent… by DirectoryRanger.
- NTDLL-Reconstruction https://leosmith.wtf/blog/ntdll_reconstruction.html by Panos Gkatziroulis.
- Nippon Columbia malware incident exposes 8.6 million karaoke fan records https://www.bleepingcomputer.com/news/security/nippon-columbia-malware-incide… by BleepingComputer.
- RT Panos Gkatziroulis : NTDLL-reconstruction: A technique that mixes NTDLL unhooking and hellsgate gate variants https://github.com/sk4r4b/NTDLL-r… by DirectoryRanger.
- NTDLL-reconstruction: A technique that mixes NTDLL unhooking and hellsgate gate variants https://github.com/sk4r4b/NTDLL-reconstruction by Panos Gkatziroulis.
- RT Tal Be’ery: Burning a possible @BlackHatEvents submission just to make a point: I modified WhatsApp to permanently rewrite its own chat history by … by thaddeus e. grugq.
- Bitdefender finds preinstalled Android malware you can’t uninstall, seen in 150 countries https://securityaffairs.com/200759/malware/bitdefender-find… by Nicolas Krassas.
- New website: estimating human cryptanalytic work https://blog.cryptographyengineering.com/2026/10/11/new-website-estimating-human-cryptanalytic-work/ by Nicolas Krassas.
- Sentinel - Userland EDR for Windows. ETW telemetry, behavioral correlation, MITRE ATT&CK https://github.com/psihijatrija/Sentinel by Panos Gkatziroulis.
- It looks like you can execute code by abusing .manifest files. by Panos Gkatziroulis.
- RT K̵i̵r̵k̵ ̵T̵r̵y̵c̵h̵e̵l̵ : BlackMagick c2 dev is coming along nicely. Added dns and an experimental icmp protocol, with support for h… by Panos Gkatziroulis.
- RT Clandestine: https://github.com/1xPwn/CVE-2026-16723 by Simone Margaritelli.
- RT Off-By-One Conference: Slide decks from OB1 2025 & 2026 are live! Catch up on talks you missed, revisit top sessions, or dive into the technic… by Alex Plaskett.
- Telegram Desktop vulnerability allowed any user file to be stolen https://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/ by /r/netsec.
- [PL] Nagranie z mojej prelekcji o (pseudo)terminalach pojawiło się na YouTube :) https://www.youtube.com/watch?v=Znbc4MDYvKA by Gynvael Coldwind.
- RT Nextron Research : An Iranian threat actor is still running a GitHub-based loader with low detection rate on VirusTotal, six weeks after first … by Florian Roth.
- CVE-2026-91768: FastCGI allowed_clients compared only 96 of an IPv6 address’s 128 bits https://daubois.dev/blog/cve-2026-91768-php-fpm-ipv6-allowed-cl… by /r/netsec.
- Hands Off the Keyboard: How AI Agents Run Real Intrusions https://breachcache.com/cases/hands-off-the-keyboard/ by /r/netsec.
- RT JP Aumasson: good reminder that, while tech-savvy orgs transition to PQC, many companies are riddled with legacy crypto: MD5, SHA-1, and RSA PKCS#1… by Halvar Flake.
- Malware-as-a-Service (MAAS) cyber range for Ludus. Automated offensive development pipeline with CI/CD-driven payload compilation, obfuscation, and ED… by Panos Gkatziroulis.
- by MalwareHunterTeam.
- Some “Discord C2 RAT agent” here: https://dicechecker[.]app/0b05d2aea7.ps1 " # —- Config (strings split to dodge static scanning) —- " … by MalwareHunterTeam.
- RT Jackie Singh 🇺🇸 IWillVote.com: Israeli spyware vendor NSO under fire AGAIN, this time for data exfiltration in Poland via Pegasus spyw… by Halvar Flake.
- RT B1lal: An analysis I ran on @etugenio surfaced an attacker server exposed as an open directory on port 8888 in Bulgaria🇧🇬. The operator moved… by batuu.
- Opendir: http://load.tender-confirmation[.]com:8080/file/ http://download.tender-confirmation[.]com:8080/file/ The “download” subdomain I already twee… by MalwareHunterTeam.
- RT BBC News (World): Hundreds of French supermarkets have been hit by a cyber-attack that caused their fridges and freezers to heat up. Read more: htt… by scriptjunkie (Matt).
- RT etugen.io: Elusium Malware, Upx, Dropper IP: 2[.]27.249.100 Platform: https://app.etugen.io/trashpile/2.27.249.100 #etugen #c2 #malware by batuu.
- CVE-2026-87902: WordPress Core unauthenticated path traversal in get page template page-template resolution leading to conditional RCE https://www.pru… by Swissky.
- frontier class vulnerabilities: it gets worse before it (maybe) gets better https:// shubs.io/frontier-class-vulner abilities-it-gets-worse-before-it-maybe-gets-better/.
- Part 2: Lypid. A user-friendly library to bridge reverse engineering workflows with DWARF (and PDB). https://www. romainthomas.fr/project/lypid/.
- Playing It SFAPE: Code Execution in Isolated User Mode https:// blog.doyensec.com/2026/10/13/S fape.html.
Tools and Exploits
Open-source, local-first desktop workbench for memory dump analysis and forensics.
SaaS platform for automated binary deobfuscation: unpacking, import fixing, OEP restore. Clears obfuscation layers before LLM-assisted analysis.
Official desktop GUI client for the Sliver C2 framework. Full operator interface with session management, implant generation, and task execution.
Toolkit for hijacking Claude Code agents via session injection and MCP server manipulation.
Open-source successor to QCSuper for accessing mobile baseband diagnostic protocols. Enables security research on cellular modem internals.
Microsoft releases an official MCP server for WinDbg, enabling natural language debugging grounded in actual debugger evidence.
Last year’s Pwn2Own Home Assistant Green exploit chain is now public. Six-bug SSDP chain achieving root on the target.
- gVisor Sandbox Escape PoC (Guest-to-Host) by Nicolas Krassas.
Guest-to-host sandbox escape PoC for gVisor release-20260928. Originally planned for Wiz zeroday-cloud-2026. Patched in release-20261005.
TOCTOU race condition variant that bypasses the v2.0.4 fix for CVE-2026-14891, persisting through the latest v2.0.7 release of HashiCorp Nomad.
Crashes a broken Windows service so its recovery action launches a given payload. No Event ID 7045 fired, evading common service creation detections.
More this week (10)
- Google halts open-source bug bounty program amid AI spam surge https://www.bleepingcomputer.com/news/google/google-halts-open-source-bug-bounty-progra… by BleepingComputer.
- Pushed some updates to this over the weekend, it has much more data now to show, some key features: - links to open source components - fix timel… by Csaba Fitzl.
- Hackers exploit critical Atlassian flaw after public PoC release https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-atlassian-fla… by BleepingComputer.
- RT Brute: Node.js RCE via EJS (<v6.0.0-alpha) Unsafe merge - Prototype Pollution leading to RCE via template rendering. {”proto”:{“client”:true,“e… by Rémi GASCOU (Podalirius).
- New CloudPEASS release! K8s-PEAS is the new Red Team k8s script from https://github.com/peass-ng/CloudPEASS. Use it to find the permissions of a compr… by HackTricks.
- RT ExploitGrid: Public PoC released for CVE-2026-59346, a critical VMware VMXNET3 integer overflow. CVSS 9.3 | ExploitGrid: 37.2 The flaw can enable g… by kmkz.
- RT Thomas Rinsma: Just released PoCs for the 6 LibreOffice bugs we found (@b0n0b0__ ). Including an .odb/.odt/.jar triple-polyglot for the RCE and my … by Nicolas Krassas.
- The largest open-source cybersecurity skills library for AI agents https://github.com/mukul975/Anthropic-Cybersecurity-Skills by Nicolas Krassas.
- Weird flex but okay. To me, this press release does more harm than good for Flock’s continued PR challeges, because a perfectly sane response might be, oh great: so now Flock gets to decide what’s a b.
- I expected better from Google - @nicodhnr What we found in Artemis, and why open-source credit matters. https://www.minitap.ai/blog/i-expected-better-… by Swissky.