Rahman

[Rahman @0xRhman]

@TwoSevenOneT Great work as always! Thank you for the article!

[Two Seven One Three @TwoSevenOneT]

New #redteam tool for blocking EDRs: EDRChoker
Instead of fully blocking the EDR agents' connections to their server, we can throttle their bandwidth so they consistently time out when sending data, which is effectively the same as blocking but avoids triggering "block" or "drop" packet events
#pentest #cybersecurity
Github: TwoSevenOneT/EDRChoker

[vx-underground @vxunderground]

Yeah, so pretty much this guy is releasing an exploit in solidarity with Nightmare Eclipse guy. He said he notified GitHub about the exploit 60 minutes before releasing this paper.

I don't do web stuff, and I'm not a VSCode nerd, so I'm confused by the underlying technologies.

If you're a stinky GitHub and VSCode nerd maybe you'll understand.

tl;dr click github dev, github dev opens editor, in github dev editor have javascript, javascript does shortcuts automatically. github treats javascript shortcuts as real human input, or something. use javascript shortcut stuff to automatically install vscode extension. the vscode extension steals your data

tl;dr tl;dr user clicks 1 link, 1 click steals all data from your github

https://t.co/uh17usZeEH

[Son Luong @sluongng]

Codex just found a “workaround” of not having sudo on my pc…

[Andre Gironda @AndreGironda]

Windows DNS Client RCE -- CVE-2026-41096 POC -- qdcount=0, a DNS OPT resource record (type 41), and 0xff bytes via example response -- https://t.co/wzSIXuCLPo

[Panos Gkatziroulis 🦄 @ipurple]

GhostTree - Unveiling Path Manipulation Techniques to Bypass Windows Security https://t.co/BazMYHXmrq

[Steven Lim @0x534c]

All you ever need to know about Claude from KQL threat hunting perspective!
https://t.co/QetVpjvOo7

[Rahman @0xRhman]

@theo

[V4bel @v4bel]

💥 Introducing "Dirty Frag"

A universal Linux LPE chaining two vulns in xfrm-ESP and RxRPC. A successor class to Dirty Pipe & Copy Fail.

No race, no panic on failure, fully deterministic. ~9 years latent.
Ubuntu / RHEL / Fedora / openSUSE / CentOS / AlmaLinux, and more.

Even if you've applied the "Copy Fail" mitigation, your Linux is still vulnerable to "Dirty Frag". Apply the Dirty Frag mitigation.

Details:
https://t.co/9nqku4svkY

[Panos Gkatziroulis 🦄 @ipurple]

📉 𝐂𝐲𝐛𝐞𝐫 𝐬𝐢𝐠𝐧𝐚𝐥 𝐢𝐬 𝐝𝐫𝐨𝐩𝐩𝐢𝐧𝐠.
📈 𝐀𝐈 𝐧𝐨𝐢𝐬𝐞 𝐢𝐬 𝐫𝐢𝐬𝐢𝐧𝐠.

To help, I created a list of active cybersecurity blogs written by people who still publish real research.
If you follow any of these already (or have gems I should add), let me know.

📌https://t.co/Zd6y7nSFyL

[International Cyber Digest @IntCyberDigest]

‼️🚨 Microsoft calls this "intended behaviour," so here we go.

How to dump the credentials of every user stored in Microsoft Edge:

1. Open Edge. Don't browse anywhere, just open it.
2. Flip to Task Manager, find Edge, expand the task.
3. Highlight the "browser" sub-task, right-click, and choose "Create Memory Dump."
4. Open the dump file and look for credentials.

The logged-in Windows user can dump every stored Edge credential with no additional rights. Which means any malware that user executes has those credentials for the asking.

Thanks to Rob VandenBrink at SANS: https://t.co/ebtVZxne4L

[Haidar @haider_kabibo]

So here is new local privilege escalation zero-day I discovered, not patched yet too :).
In simple terms, if you have a service like RDP that exposes an RPC server, there many system services running as SYSTEM connect to it as RPC clients. If that service is turned off (RDP is off by default), it seems that any other process in Windows can expose the same RPC server using the same endpoint.
Now all the RPC calls from that SYSTEM processes will come to this fake server and If the process that deployed the server has SeImpersonatePrivilege, it can escalate to SYSTEM by impersonate the RPC client.
In the white paper below, I describe five exploit paths you can abuse.
However it's architecture problem and maybe there are more. It's Not A Potato
https://t.co/DOfRFgYqI9

[Moritz @m_r_tz]

The FLARE team now freely distributes its quality reverse engineering and malware analysis educational content at https://t.co/bGCIjBfD3C. Launched with:
- Malware Analysis Crash Course
- Go Reversing Reference
- Intro to TTD

[MalDev Academy @MalDevAcademy]

We released a new public tool, 3LayersPersistence, that demonstrates 3 different persistence layers implemented in one executable.

https://t.co/JElB2vXvTg

The implementation uses WMI event subscriptions, DLL sideloading, and COM hijacking in a single workflow, with the executable patching itself into proxy DLLs at runtime, allowing execution through multiple persistence paths.

[Horizon3.ai @Horizon3ai]

🚨 Critical auth bypass → RCE in Cisco FMC (CVE-2026-20079, CVSS 10.0). We’ve released a Rapid Response test.

[TrustedSec @TrustedSec]

Who knew a really long string could make an Entra ID login disappear from the logs entirely? In our #blog, @nyxgeek breaks down how overflowing #Azure's sign-in logging mechanism allowed access tokens to be issued without a single log entry. Read it now! https://t.co/2joOibx3Ia

[blackorbird @blackorbird]

Extract Windows credentials directly from VM memory snapshots and virtual disks
https://t.co/tw8egmlhyg

[blueblue @piedpiper1616]

GitHub - sak110/CVE-2025-69219 · GitHub - https://t.co/SS9tF8BLlD

[Wietze @Wietze]

Yet another LNK flaw allows for target spoofing, yet executes any DLL, including remote ones via WebDAV. Even worse, unless you installed the Feb 2026 updates, MotW will be ignored.

See how this works on https://t.co/AI3BFj9p0Z

[Het Mehta @hetmehtaa]

"it's just a PDF generator, what's the worst that can happen"

LaTeX Injection: