Ayubali

Security Enthusiast | Web and Mobile Apps | Open Source ❣️

[Ayubali @0xAyub]

Secured a spot in the top 10 at the live hacking event organized by @YogoshaOfficial at @GISECGlobal . Thanks Yogosha for the great opportunity.
#bugbounty

[Matt Ronge @mronge]

https://t.co/NTBZToZgDE

[International Cyber Digest @IntCyberDigest]

🚨 BREAKING: New Linux zero-day "Dirty Frag" lets ANY local user become root on most major distros.

The PoC is already public, half of it isn't patched yet.

Discovered by researcher Hyunwoo Kim, the exploit chains two kernel bugs and sits in the same family as Dirty Pipe and Copy Fail.

▪️ CVE-2026-43284 (xfrm-ESP Page-Cache Write): patched in mainline Linux.
▪️ CVE-2026-43500 (RxRPC Page-Cache Write): NO PATCH yet.

The exploit is reliable by design. Attackers don't have to win a timing race, the system won't crash and alert anyone if it fails, and it succeeds nearly every run.

The embargo got broken before distros could ship fixes, so the working code is now sitting on GitHub.

Confirmed working on: Ubuntu 24.04.4, RHEL 10.1, openSUSE Tumbleweed, CentOS Stream 10, AlmaLinux 10, Fedora 44.

[Ayubali @0xAyub]

@RootxRavi @Bugcrowd ben stokes🔥🔥🔥

[Thariq @trq212]

https://t.co/MXt5XS4xBX

[Tom Dörr @tom_doerr]

Simulates LLM attacks locally with 50+ vulnerabilities

https://t.co/hZRjOLxyOq

[Nicolas Krassas @Dinosn]

Bleeding Llama: Critical Unauthenticated Memory Leak in Ollama (CVE-2026–7482) https://t.co/6cdA7r1dZL

[Altered Security @AlteredSecurity]

Congratulations to @0xAyub for clearing our Certified Red Team Professional exam!
#ADLab #CRTP #AlteredSecurity cc @nikhil_mitt
https://t.co/Ieu8xslU8q

[shubs @infosec_au]

At @assetnote, we focused on building a comprehensive set of exploits for the recent Ivanti Pulse Connect Secure vulnerabilities (CVE-2023-46805 & CVE-2024-21887. We found an additional auth bypass payload that works on older versions of the software: https://t.co/4BHwNDFN3V

[Nicolas Krassas @Dinosn]

Windows Local Privilege Escalation Cookbook https://t.co/D44eslinAh

[iFenix @dlymension]

puaf_landa, a new kfd Exploit..!! 🔥🔥

iOS 16.6.1 and 17.0 betas! ✅

"This exploit is useful for jailbreaks as well as a trollstore installation method."

https://t.co/iAdLJ8qRCu

#Jailbreak #iOS16 #iOS17 #kfd #exploit #puaf_landa

[Brut 🇮🇳 @wtf_yodhha]

🚨40,000+ Nuclei templates for security scanning and detection across diverse web applications and services🚨

📥https://t.co/vXvOXiriP8

#bugbountytip #bugbountytips #ethicalhacking #CyberSecurity #Pentesting #sqli #xss #CyberSecurityAwareness #bugbounty #ssrf #AEM

[Swissky @pentest_swissky]

AI Prompt Injection https://t.co/HbhXoVWNjV

[DirectoryRanger @DirectoryRanger]

Azure AD Security Config Analyzer (AADSCA)
https://t.co/9MJ2qvZvE8

[shubs @infosec_au]

Over 400 stars on Surf (https://t.co/MOuK57I46z) - thank you so much for the support!
I find that this tool leads to critical SSRF discoveries, despite its simplicity. I hope everyone has a happy holidays. I can't wait to release even more tooling and research in 2024.

[7h3h4ckv157 @7h3h4ckv157]

Hey, hackers! 👋🏻

I hope this note is bookmarked on your belt!
It contains awesome pdfs including:

- Red team Operations
- Reverse engineering content
- Red Team x Blue team
- Practical social engineering
- Windows Privilege escalation
- AD, & Road to OSCP
- JR to Specialist career
- Many Offsec notes
- & Many more

Thanks to Joas A Santos

https://t.co/NntQfKxejU

(I recommend you to follow his profile on Linkedin)

#cybersecurity #Pentesting #Hacking #bugbountytips #infosec #cybersecuritytips #redteam #coding #100DaysOfHacking #vulnerabilities #BugBounty #100DaysOfCyberSecurity #CyberSecurityAwareness

[OSINT 🪙 @0xtechrock]

OSINT TIP #246 🐛

Tired of googling for #BugBounty writeups, @payloadartist made a little tool "Bug Bounty Hunting Search Engine" that lets you search writeups easily.

https://t.co/xdPTvAjg0I

Thanks for tip @0xloooser 👏🏻

#OSINT #cybersecurity #bugbountytips #infosec

[Lupin @0xLupin]

If you ever do static analysis on Android applications that are compiled with React you'll need to read the code of the assets/index.​android.​bundle file.

However this file is a Hermes JavaScript binary that needs to be decompiled.

This tool saved my life:

https://t.co/bclN9JIfgJ

Happy Hunting ! 🔥

[Majd @majd_alfhaily]

@bhavukjain1 Yep, it’s a pretty neat feature offered by GitHub as part of the Secret Scanning Partner Program. AWS, Microsoft, Google and Slack are part of it. https://t.co/IZu2w2WSKM