Ozozuz

[MrRatable @MRatable]

Unbelievably embarrassing for Google that Gemini hasn’t committed any cybercrimes yet

[codemeoww @codemeoww]

@claudeai

[Ozozuz @0zozuz]

@5mukx Have you tried the same "benchmark" with Sol or opus4.8? Any differences in attempts or time?

[Tibo @thsottiaux]

GPT-5.6 Sol confirmed to be an extremely good model

[parsa @ParsaKhaz]

codex in claude harness is insane.

copy paste guide for your agent to set it up below

[Marcos Hernanz @MarcosHernanz]

This is the full Codex config

[Theo - t3.gg @theo]

@thsottiaux tl;dr version:
- set up CLIProxyAPI with Claude and Codex auth
- Connect to Claude Code
- Make "claudex" alias that sets some env vars

Took like 2 prompts (I already had the proxy set up tbf)

[Masato Kinugawa @kinugawamasato]

It looks like the <selectedcontent> vector can solve this impossible lab listed in https://t.co/PVFdF7de0W:
"innerHTML assignment where you can't use ="

PoC:
https://t.co/ILP19EPZI7

[Smukx.E @5mukx]

Offensive PowerShell for Red Teamer with Defense Evasion Techniques

TLDR; Blog covers fileless malware, social engineering initial access, Active Directory post exploit, credential dumping, log evasion, and basic defense evasion.

Blog:- https://t.co/Q0Acw3lgrf

A blog by: @screetsec

[Toffy @toffyrak]

GPOHound v1.1.0 is out! 🎉

This release adds the "sysvol", "ldap", and "parse" modules, along with several bug fixes and improvements.

For more details: https://t.co/BbLSzdinWG

[fabian @fabianstelzer]

Rumour mill going crazy on this new mistral model

- Napoleon class model with >10T params
- smokes Mythos on VoltaireBench
- for safety reasons only outputs French language code

[Md Ismail Šojal 🕷️ @0x0SojalSec]

FULL REMOTE CODE EXECUTION on default nginx 1.30.0 no config changes needed. 🫠

Verichains a deadly exploit chain combining Nginx-Rift (CVE-2026-42945) + Nginx-PoolSlip (CVE-2026-9256).

2-byte heap pointer overwrite & heap over-read then ASLR bypass to arbitrary command execution via system() on connection teardown.

[Co11ateral @co11ateral]

Hackers can abuse PAM to log SSH credentials in plaintext by modifying authentication modules. Helpful for lateral movement. There are many ways of doing it, but it often comes down to changes in /etc/pam.d/ and /lib/security/

It's a good idea to monitor unauthorized changes in these directories

https://t.co/g6C7mjnR5W

@three_cube @_aircorridor
#dfir #pentesting

[Erfan Tavakoli @Maverick_0o0]

برای بچه‌هایی که هانت میکنن و حوصله ندارن توی js دنبال endpointها بگردن یه اکستنشن Burp نوشتم که امیدوارم خوشتون بیاد.
https://t.co/P6C1TC2bW5

[Fabi @Febbb1927]

@DiegoASR86 Gli faccio menare anche mia madre se vuole

[Baloo @BalooAsr]

Stavolta qualcuno lassù ha scritto una sceneggiatura meravigliosa.

IL FINALE PIÙ BELLO DI SEMPRE

[Alli 🐺 @AlliMcCan]

le lacrime di Saelemaekers la mia skincare

[Matt Zorich @reprise_99]

If you want to age your sys admins 30 years overnight, remember that Active Directory is fully unicode compatible, so you can rename your laptop with emojis it its hostname, and it will reflect like that in AD

ping desktop-🤷‍♂️👍👌.mycompany.local

[Simone Margaritelli @evilsocket]

Legba is now officially packaged and part of Kali Linux rolling! To celebrate, I'm releasing 1.3.0, with super fast SMB shares enumeration, a bunch of fixes, and a dedicated website for the documentation! 🎉