cybersecurityspot

Security Engineer

[Alex Zajac (🍔,🧠) @itsalexzajac]

An engineer built an interactive book on data structures and algorithms of 680 pages:

[Mehmet @xenit_v0]

Siber guvenlik testi icin ayri ayri 185 arac kurmak yerine tek bir komutla hepsini indirebilirsiniz.

Hackingtool adli acik kaynak proje v2.0 surumunu yayimladi. Kali Linux veya Parrot OS kurulu bir makinede tek satirlik bir curl komutuyla 185'ten fazla pentest aracini otomatik kuruyor. Arama (/), etiket filtreleme (t) ve oneri (r) komutlariyla istediginiz araca saniyeler icinde ulasabiliyorsunuz.

20 kategoride arac mevcut: anonimlesme, bilgi toplama, SQL enjeksiyonu, kimlik avi, web saldirisi, adli bilisim, bulut guvenligi, mobil guvenlik, Active Directory ve daha fazlasi. Her aracin yaninda kurulum durumu ve guncelleme butonu gosteriliyor.

v2.0 ile uc yeni kategori eklendi: Active Directory saldirilari, Cloud Security ve Mobile Security. Docker destegi de geldi, sanal ortamda izole calistirabiliyorsunuz.

Proje 52 binin uzerinde GitHub yildizi almis. Tamamen ucretsiz ve acik kaynak. Izinli sizma testi icin tasarlanmis.
github: https://t.co/gLVza0GOAl

[Rich kids of claude @yasinaktimur]

🚨 son dakika : antropic’in sır gibi sakladığı Mythos bir kullanıcı tarafından tersine mühendislik ile açık kaynaklı olarak yayınlandı:

https://t.co/PiKnq7tSe1

[Tib3rius @0xTib3rius]

I saw this on LinkedIn. The AWASP Top Ten, a "vibe-researched and vibe-coded" alternative to the OWASP Top Ten.

https://t.co/wgMz9WAqgu

It's...interesting to say the least. 😅

Credit: https://t.co/RpTIq8UwjV

[HackerOne @Hacker0x01]

Point-in-time pentests can’t keep up, while fully autonomous testing creates noise.

The solution? HackerOne Agentic PTaaS pairs specially trained AI agents with elite human validation to deliver results based on real-world exploitability, not theory.

This 50-second video shows you how it works.

[Andrej Karpathy @karpathy]

A few random notes from claude coding quite a bit last few weeks.

Coding workflow. Given the latest lift in LLM coding capability, like many others I rapidly went from about 80% manual+autocomplete coding and 20% agents in November to 80% agent coding and 20% edits+touchups in December. i.e. I really am mostly programming in English now, a bit sheepishly telling the LLM what code to write... in words. It hurts the ego a bit but the power to operate over software in large "code actions" is just too net useful, especially once you adapt to it, configure it, learn to use it, and wrap your head around what it can and cannot do. This is easily the biggest change to my basic coding workflow in ~2 decades of programming and it happened over the course of a few weeks. I'd expect something similar to be happening to well into double digit percent of engineers out there, while the awareness of it in the general population feels well into low single digit percent.

IDEs/agent swarms/fallability. Both the "no need for IDE anymore" hype and the "agent swarm" hype is imo too much for right now. The models definitely still make mistakes and if you have any code you actually care about I would watch them like a hawk, in a nice large IDE on the side. The mistakes have changed a lot - they are not simple syntax errors anymore, they are subtle conceptual errors that a slightly sloppy, hasty junior dev might do. The most common category is that the models make wrong assumptions on your behalf and just run along with them without checking. They also don't manage their confusion, they don't seek clarifications, they don't surface inconsistencies, they don't present tradeoffs, they don't push back when they should, and they are still a little too sycophantic. Things get better in plan mode, but there is some need for a lightweight inline plan mode. They also really like to overcomplicate code and APIs, they bloat abstractions, they don't clean up dead code after themselves, etc. They will implement an inefficient, bloated, brittle construction over 1000 lines of code and it's up to you to be like "umm couldn't you just do this instead?" and they will be like "of course!" and immediately cut it down to 100 lines. They still sometimes change/remove comments and code they don't like or don't sufficiently understand as side effects, even if it is orthogonal to the task at hand. All of this happens despite a few simple attempts to fix it via instructions in CLAUDE . md. Despite all these issues, it is still a net huge improvement and it's very difficult to imagine going back to manual coding. TLDR everyone has their developing flow, my current is a small few CC sessions on the left in ghostty windows/tabs and an IDE on the right for viewing the code + manual edits.

Tenacity. It's so interesting to watch an agent relentlessly work at something. They never get tired, they never get demoralized, they just keep going and trying things where a person would have given up long ago to fight another day. It's a "feel the AGI" moment to watch it struggle with something for a long time just to come out victorious 30 minutes later. You realize that stamina is a core bottleneck to work and that with LLMs in hand it has been dramatically increased.

Speedups. It's not clear how to measure the "speedup" of LLM assistance. Certainly I feel net way faster at what I was going to do, but the main effect is that I do a lot more than I was going to do because 1) I can code up all kinds of things that just wouldn't have been worth coding before and 2) I can approach code that I couldn't work on before because of knowledge/skill issue. So certainly it's speedup, but it's possibly a lot more an expansion.

Leverage. LLMs are exceptionally good at looping until they meet specific goals and this is where most of the "feel the AGI" magic is to be found. Don't tell it what to do, give it success criteria and watch it go. Get it to write tests first and then pass them. Put it in the loop with a browser MCP. Write the naive algorithm that is very likely correct first, then ask it to optimize it while preserving correctness. Change your approach from imperative to declarative to get the agents looping longer and gain leverage.

Fun. I didn't anticipate that with agents programming feels *more* fun because a lot of the fill in the blanks drudgery is removed and what remains is the creative part. I also feel less blocked/stuck (which is not fun) and I experience a lot more courage because there's almost always a way to work hand in hand with it to make some positive progress. I have seen the opposite sentiment from other people too; LLM coding will split up engineers based on those who primarily liked coding and those who primarily liked building.

Atrophy. I've already noticed that I am slowly starting to atrophy my ability to write code manually. Generation (writing code) and discrimination (reading code) are different capabilities in the brain. Largely due to all the little mostly syntactic details involved in programming, you can review code just fine even if you struggle to write it.

Slopacolypse. I am bracing for 2026 as the year of the slopacolypse across all of github, substack, arxiv, X/instagram, and generally all digital media. We're also going to see a lot more AI hype productivity theater (is that even possible?), on the side of actual, real improvements.

Questions. A few of the questions on my mind:
- What happens to the "10X engineer" - the ratio of productivity between the mean and the max engineer? It's quite possible that this grows *a lot*.
- Armed with LLMs, do generalists increasingly outperform specialists? LLMs are a lot better at fill in the blanks (the micro) than grand strategy (the macro).
- What does LLM coding feel like in the future? Is it like playing StarCraft? Playing Factorio? Playing music?
- How much of society is bottlenecked by digital knowledge work?

TLDR Where does this leave us? LLM agent capabilities (Claude & Codex especially) have crossed some kind of threshold of coherence around December 2025 and caused a phase shift in software engineering and closely related. The intelligence part suddenly feels quite a bit ahead of all the rest of it - integrations (tools, knowledge), the necessity for new organizational workflows, processes, diffusion more generally. 2026 is going to be a high energy year as the industry metabolizes the new capability.

[Tom Dörr @tom_doerr]

List of OSINT tools for penetration testing and information gathering

https://t.co/KnyRO2bUcl

[Swapna Kumar Panda @swapnakpanda]

3000+ Interview Questions

❯ SQL
https://t.co/NlXFyworRa

❯ JavaScript
https://t.co/Uq2zg0grvm

❯ Java
https://t.co/prAPr7s8WM

❯ Python
https://t.co/vErW1vzDSU

❯ DSA
https://t.co/n8bgWiiMoA

❯ OOPs
https://t.co/XNHtDl3hv7

❯ HTML/CSS
https://t.co/aMvZF0k5ga

❯ React
https://t.co/2CnJmAq2aN

❯ Git
https://t.co/24ZbOl7HoX

❯ Practice Questions
https://t.co/FuC6Y8a4so

* I will be adding new questions to these collections regularly. More topics will be covered.

** Are you looking for some other topic? Please mention below.

[cybersecurityspot @2runca]

https://t.co/pMber1F5UW

[7h3h4ckv157 @7h3h4ckv157]

Recently I saw an AI powered workflow automation and AI Agents platform for AppSec, Fuzzing & Offensive Security.

Need to try!

Source: https://t.co/iEeLxXV5dE

[cybersecurityspot @2runca]

https://t.co/KUMYytJI2U

[Amjad Masad @amasad]

3 minute tutorial on making apps with Grok 3 and deploying instantly with Replit.

[cybersecurityspot @2runca]

https://t.co/Evf5GOzWq6

[Selman Kahya @SelmanKahyaX]

5-10 senede yazılım dünyasının ve geliştiricilerin sorumluluklarının kökten değişeceğine inanıyorum.

hala cursor, v0, windsurf, bolt, devin gibi servisleri kullanarak bir proje geliştirmediyseniz bugün her şeyi bırakın, basit bir proje geliştirin.

geçtiğimiz 1-2 senedir bu alandaki gelişmeleri değerlendirip, 3-5 seneye neler olacak fikir yürütmeye çalışın.

[Tim Willis @itswillis]

Project Zero Blogpost recap for the month:

https://t.co/YOYvYMAI6j — @j00ru doing another deep dive into the Windows Registry

https://t.co/7YTQHR4txG — Nick Galloway's dav1d fuzzing case study

(new) https://t.co/lJtcwGjC8k — an update on using LLMs to find vulns

Enjoy! 🎉

[dmnk.bsky.social @domenuk]

Project Zero blog:
LLMs find 0days now! 👀

And: our fuzzer setup did *not* reproduce it! https://t.co/xz6j2fzrWe

[Ivan Fratric 💙💛 @ifsecure]

Don't panic now, but LLM-based agent discovered a previously unknown real-world vulnerability. Details in https://t.co/AS4V0J4Mcp

[Mehmet INCE @mdisec]

4 zero-day Remote Code Execution of Cohesive Networks VNS3.

It's product designed for securing multi-cloud environments with a all-in-one capabilities (virtual router, switch, firewall, protocol re-distributor, and SSL/IPSec VPN concentrator)

Tldr: After many many years of exploiting command injection issue, I'm gonna get $(${IFS}) tattoo for sure.

[Harshleen @0xharshleen]

Notes and Resources for CISSP📝

📌CISSP-Study-Resources
🔗https://t.co/nImNaivlQx

📌CISSP Notes
🔗https://t.co/qtK7gsChqa

📌awesome-CISSP-CCSP
🔗https://t.co/Oob0ApAjQs

📌CISSP-Cheat-Sheet
🔗https://t.co/XKWnZo8yjt

[Celil ÜNÜVER @celilunuver]

C-00000291*.sys dosyasi driver degil, 0xAAAAAA headeri ile baslayan kendi custom dosyalari. BSoD veren driver csagent.sys , bu dosyayi load edip, crash oluyor. İmza dosyasiysa eger, detayli incelemedim, dogrudan driverda parse etmek cidden fail. Bu tarz islemler AV’lerde user-mode’a tasinali cok oldu.