0x4b

ᚠᚱᛖᛖᛞᛟᛗ ᛁᛊ ᚨᚾ ᛁᛚᛚᚢᛊᛁᛟᚾ.

[Theo - t3.gg @theo]

Security things from the last few days:
- CopyFail (linux pwn'd)
- CopyFail 2/Dirty Frag
- 13 advisories in Next.js
- Over 70 CVEs addressed in MacOS 26.5
- ~50 CVEs addressed in iOS 26.5
- YellowKey (Windows Bitlocker pwn'd entirely)
- GreenPlasma (Windows privilege escalation)
- CVE-2026-21510 and CVE-2026-21513 confirmed to be used by Russia for Windows RCE
- CVE-2026-32202 separately confirmed to be used by Russia for sensitive document access
- Mini-Shai Hulud (over 300 JS and Python packages compromised via GitHub Action cache poisoning)
- Google confirms they have identified AI-powered exploitation of zero days in an unidentified "open-source, web-based system administration too"
- Canvas (popular LMS used in most schools) pwn'd entirely
- PAN-OS (palo alto networks) pwn'd with a 9.3 severity CVE-2026-0300

Are you scared yet?

[Nana Sei Anyemedu @RedHatPentester]

The SILENT WITNESS ON YOUR COMPUTER WAITING FOR YOU TO GET INTO TROUBLE.

Most people believe that deleting a folder, clearing recent files, or wiping their history is enough to hide their tracks on a computer. What they don’t realize is that Windows quietly keeps a hidden record of the folders they open, even after those folders are deleted or the drive is removed. These records are called Shellbags, and they are one of the most powerful and incriminating artifacts available to forensic investigators.

Shellbags appear inside two registry hives NTUSER.DAT and USRCLASS.DAT and they store detailed information about a user’s folder-browsing activity. This includes local folders, USB drives, external hard drives, network shares, and even directories that no longer exist. Each time a user opens a folder in Windows Explorer, the system automatically creates or updates a Shellbag entry. These entries contain timestamps, folder paths, the hierarchy of subfolders, the order in which a folder was accessed, and even the specific view settings used by the user. Because of this, Shellbags reconstruct a user’s exact navigation trail long after the person believes the evidence is gone. What makes Shellbags truly dangerous is the fact that they survive actions that users typically rely on to cover their tracks.

Deleting a folder does not delete the Shellbag. Formatting a drive does not delete it. Even privacy tools and cleaners like CCleaner or BleachBit cannot reliably erase Shellbag data, because the information is deeply embedded within registry hives that standard cleaning utilities do not touch. The only way to remove Shellbags is through advanced forensic wiping, and attempting such wiping is, in itself, a sign of suspicious behavior.

Forensic examiners rely heavily on Shellbags because they expose the truth even when a suspect tries to lie.

If a person denies ever accessing a directory, the Shellbags can show when that folder was opened, how many times it was accessed, and whether it was located on an internal drive, an external USB, or a deleted partition. This makes Shellbags extremely valuable in investigations involving insider threats, data theft, fraud, child exploitation, unauthorized data access, and corporate disputes. In many cases, Shellbags become the deciding factor that disproves a suspect’s story. In the screenshot, the highlighted red section shows three important keys inside the registry.

When all of this information is combined, Shellbags become a silent witness that never forgets. They reconstruct a hidden story of user activity that the person cannot deny, overwrite, or talk their way out of. This is why Shellbags remain one of the most feared artifacts for anyone attempting to conceal their actions on a Windows computer. You can delete the folder… but Shellbags still show it existed

Even if you format a drive or delete the directory, Windows has already logged:

1. The folder name
2. Its full path
3. When it was opened
4. How many times it was opened
5. The view settings (icon mode, window size)
6. The order in which folders were browsed

This means forensic investigators can prove someone accessed:

“Secret” directories
Hidden folder structures
USB drives or removable media
Folder paths used for storage of illicit or suspicious
Folder paths used for storage of illicit or suspicious data even if the folders are long gone.

[0x4b @0x4b_]

@levelsio ~C[ J@F 4@F=5 ;FDE FD6 2 5:776C6?E 3C@HD6C 7@C @?46] s@ =:E6C2==J E96 D2>6 E9:?8D J@F 5@ ?@H 3FE DE:== 42? FD6 25 3=@4<]

[Pirat_Nation 🔴 @Pirat_Nation]

Switch to Firefox asap

[0x4b @0x4b_]

@JakeSucky %96 @?=J 3C2:?\C@E >@C@? :D @NICKMERCS :? E9:D D46?2C:@]

[0x4b @0x4b_]

@nixcraft @e @c @h p=H2JD] w2G6] p] u2==324<]

[0x4b @0x4b_]

@nixcraft @e @c %96JV== 36 :?4C65:3=J 5F>3 E@ ;FDE DH:E49 2?5 @?=J 56A6?5 @? H92E E96J 49@@D6 H9:=6 92G:?8 ?@ @E96C A=2E7@C> E@ 72==324< E@] x7 E96J DH:E49 E@ >24 @C =:?FI[ H92E 92AA6?D H96? D@>6E9:?8 92AA6?D E92EVD >24 @C =:?FI DA64:7:4 3C62<D E96 DJDE6> =:<6 H92E C646?E=J 92AA6?5] }@H H92En

[0x4b @0x4b_]

@lauriewired x H@F=5 ?@E 36 DFCAE:D65 :7 {@4<q:E DE2CED EC62E:?8 E96> =:<6 9@H E96J 2C6 36:?8 EC62E65 2E E9:D A@:?E H:E9 9@H >F49 3667 :D 92A
A6?:?8 36EH66? E96> 4FCC6?E=J]

[Dark Web Informer @DarkWebInformer]

⚠️Cybersecurity Acronyms⚠️Paul Baird (credit in sub-post), put together a good periodic table of Cybersecurity acronyms.

#CTI #Darknet #DarkWeb #DarkWebInformer #Cybercrime #Cybersecurity #Cyberattack #OSINT #Infosec

[GitHub @github]

May the 404's not be with you

[0x4b @0x4b_]

@SwiftOnSecurity ~9n %92E D@F?5D G6CJ 8@@5P

|J A2DDH@C5 :Di %9:$%@%p==f(_CzdPYU/

[0x4b @0x4b_]

q@C56C=2?5Da U ` 92D 8@E E@ 92G6 D@>6 @7 E96 36DE >FD:4 xVG6 6G6C 962C5]

[0x4b @0x4b_]

%9:D :D G6CJ ?:46 E@ 962CP u:?2==J D@>6E9:?8 FE:=:K:?8 rCJDE2=D\zJ36CVD =2EE:46 32D65 zt|]

https://t.co/9i4uZjQlw5

#e2ee #signal #bleepingcomputer

[LetsDefend @LetsDefendIO]

Detecting phishing emails in 10 ways

[@mikko @mikko]

The ALPHV ransomware group has posted a long message about MGM Resorts on their leak site.

[vx-underground @vxunderground]

All ALPHV ransomware group did to compromise MGM Resorts was hop on LinkedIn, find an employee, then call the Help Desk.

A company valued at $33,900,000,000 was defeated by a 10-minute conversation.

[BleepingComputer @BleepinComputer]

Qakbot botnet dismantled after infecting over 700,000 computers - @serghei
https://t.co/tIwTismEZ4

[Fusion Intelligence Center @ StealthMole @stealthmole_int]

Five hacker groups have joined together to create an organization called "The Five Families," similar to the intelligence alliance known as "Five Eyes."

The hacker groups within this organization are "ThreatSec," "GhostSec," "Stormous," "Blackforums," and "SiegedSec."

[BleepingComputer @BleepinComputer]

File sharing site Anonfiles shuts down due to overwhelming abuse - @LawrenceAbrams
https://t.co/uaoW7fqTdh