Aels

That USA Secret Service's Most Wanted guy.
The FBI still owes me 10m$.
Truth, Love, JavaScript.

[Zoltan Kochan @zkochan]

seems like "curl -fsSL" is the most popular package manager

[NOBUNAGA🇯🇵🏯_夏樹蒼依 @japan_nobunaga]

The reason there is so little racism in Japan is simple: Japanese people basically dislike everyone.

Race has nothing to do with it. We just do not want to deal with other human beings.

That is why we carefully follow manners and social rules, so we can avoid bothering one another and keep interaction to a minimum.

This is who Japanese people really are, and it is the complete opposite of Americans.

Forget hugs and handshakes. We do not even want to make eye contact. Ideally, nobody would come within 15 feet of us.

We are already crammed together on this tiny island. Everyone has had enough.

Understanding this is the single biggest key to understanding Japanese people.

[SEKTOR7 Institute @SEKTOR7net]

Analysis of Meduza stealer's techniques and attack vector.

A post by Teoderick Contreras.

Source: https://t.co/lVmAETuyL8

#redteam #blueteam

[Aels @AelsMartin]

@AlvieriD "Oh shit. Here we go again..."(c)

[Ryx @PadhiyarRushi]

Oracle WebLogic Core unauth RCE via T3/IIOP

CVE-2026-70756 (CVSS 9.8): unauthenticated attacker with network access can fully compromise WebLogic Server. Affects 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0. Classic high-value middleware surface!

https://t.co/HO08RlvCwV

#Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #RCE #Enterprise

[Interlap @interlap01]

SimSlim just crossed 2,000 GitHub stars!

Huge thanks to everyone who contributed, reported issues, tested changes, and helped make it much better than the thing I originally released.

https://t.co/8wEyRQZ1d2

[Valentin Ignatev @valigo]

When I was about 20yo I read a story about how US big tech pays a lot of money through bug bounties, so I got inspired and hacked a local branch of one Russian bank.

"Hacked" as in I started typing in random shit into search bar until it broke with a Java exception, and this exception listed paths on the server, and if you put the path into the url bar you get unprotected access to their server, and can just navigate around, download any internal file and stuff like that.

I got super excited, so I sent them email documenting the repro and prepared for the response to get my praise and bounty, or maybe even a job offer.

About a week or two later I got a call from an unknown number, and some guy told me that if I tell this anyone and don't "delete all traces of access" they'll find me and break my legs.

This was my very first experience "searching for a job" in big tech, I guess maybe it explains my distrust in it.

[Nicolas Krassas @Dinosn]

One Login, Two RCEs: CVE-2026-90822 and CVE-2026-90823 https://t.co/rgsQkK90Jp

[Subhamoy @neo_subhamoy]

It's so peak 😭

[Programmer Humor @PR0GRAMMERHUM0R]

The HTTP layer and the actual truth have never once agreed on anything.

[wyck 📴 @wyckoffweb]

Scammers found a way to make people drain their own wallets without sending them a phishing link.

They uploaded YouTube tutorials showing people how to build an AI crypto trading bot with Claude.

People followed the tutorial themselves.

Copied the code.

Deployed the smart contract themselves.

Funded it from their own wallets.

And approved every transaction themselves.

Except the “trading bot” had no trading logic.

It was built to send their ETH straight to the scammers.

224 wallets lost 274.6 ETH, worth about $517,000 when it was stolen.

The median victim lost 1 ETH.

Some victims even got an error after getting drained telling them to deposit another 50% to fix the bot.

They literally got people to build, fund and approve their own wallet drainer.

You've got to be very careful this days

[Abdelhamid Naceri @MSNightmare2000]

Made a funny tool, completely denies defender from updating so you're stuck with your current version if the tool is running in the background,
https://t.co/5usGRBvPRn
I think it can be better

[ℏεsam @Hesamation]

how to turn a simple $6,500 bounty into a WSJ exclusive.

[daniel @hackermondev]

i used to love reading security writeups, i found it really interesting to see the thinking process behind how they found really impressive vulnerabilities.

nowadays security writeups consist of prompting AI and effortlessly finding vulnerabilities with zero effort

[International Cyber Digest @IntCyberDigest]

‼️ Things took a turn today as Clop's ransomware leak site, where the gang publishes stolen files to pressure victims into paying, now shows Pokémon ASCII art and a note from ShinyHunters telling it not to make threats next time.

ShinyHunters says it had full access to the server and pulled source code, system logs and the private keys to Clop's onion service. It plans to give the gang 72 hours to make contact, then extort it.

BleepingComputer confirmed the defacement and the uploaded file. ShinyHunters says the attack is payback for a Clop member allegedly threatening to kill them after a falling-out over last year's Oracle E-Business Suite campaign.

[Ryan Moran (remo) @rmoskovy]

Why does Cl0p onion DLS show ShinyHunters page? Defaced?
http://santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad[.][onion/

[Aels @AelsMartin]

@rmoskovy Well, at least this is a "gentlemen's duel".

[Gareth Heyes \u2028 @garethheyes]

I built a new home for my book, JavaScript for Hackers.

Every payload on the page is real. Click one and it pops in your browser.

Then learn to build your own: parenthesis-free calls, non-alpha JS from just !+[]{}, DOM clobbering, SOP bypasses, the latest XSS. 1/4

[Abdelhamid Naceri @MSNightmare2000]

I want to highlight the 200,000$ is worth of vulnerabilities dumped, not court costs, you think yellowkey would've gone for cheap ?
it was not fun burning cash for a protest