Casperinous

[eversinc33 🤍🔪⋆｡˚ ⋆ @eversinc33]

Spent the last 2 weeks working on a devirtualizer for VMProtect 3.5 and learning Remill. Idk yet if I will blog about it, but I at least wanted to publish the code:

https://t.co/GLqKWpOOU7

The approach is different from my last blog, as it lifts the whole x86 code of the VM

[Vivek Galatage @vivekgalatage]

If low-level systems excite you, then you will enjoy reading this branch prediction blog from cloudflare.

https://t.co/scdxmks3NJ

[George Tziralis @gtzi]

“Three months ago, I went to Ukraine for a week. I ended up staying.”

@delian_ai’s Mark Melhorn on setting up shop and delivering where it matters.

“Even our CEO came for a four-week sprint to help solve some knotty issues and lived the same conditions.”

This is my very definition of a defense tech company.

[☔ @Whotfismick]

IT'S BEEN A REALLY LONG WEEK
(It's only Tuesday)

[trish @TrisH0x2A]

in 2000 a programmer discovered you can implement coroutines in C using the same switch trick as Duff's Device

it's called Tatham's Coroutine. it still compiles and is technically valid C

he used it in production inside PuTTY (the SSH client used by millions)

Simon Tatham's own words: "As far as I know, this is the worst piece of C hackery ever seen in serious production code."

[george hotz archive @geohotarchive]

The Eternal Sloptember https://t.co/kFIW7LNhNd

[Yibo Liu @34r7hm4n]

Rust reverse engineering is about to get a lot easier. 🦀

I'm thrilled to announce that Oxidizer, the first Rust decompiler, has been officially merged into angr!

Try it out: https://t.co/D9ILIgVH1K

You can also find the paper here: https://t.co/k97qZRvEAm

[secret club @the_secret_club]

Striga: Lifting x86 to LLVM IR with Python by @mrexodia

https://t.co/7iYajj8gIZ

[Zion Leonahenahe Basque @mahal0z]

For years, Rust binaries made reversing a nightmare. Modern decompilers only support C, lacking meaningful types, constructs, and language-specific functions. Led by @34r7hm4n, we're releasing our S&P work Oxidizer, the first deep Rust decompiler, built on angr!

Interested? 🧵👇

[Calif @calif_io]

Early this week, we had a meeting at Apple Park in Cupertino. While there, we also shared with Apple our latest vulnerability research report: the first public macOS kernel memory corruption exploit on M5 silicon, surviving MIE. It was laser printed, in honor of our hacker friends.

Full story: https://t.co/AmKMGUmWPt

[Spamhaus @spamhaus]

🕵️‍♂️We’ve observed a callback phishing campaign abusing legitimate PayPal invoice workflows. Here’s how it works⤵️

Attackers create invoices through PayPal, which are then delivered to recipients with instructions to contact the sender. The actual phishing occurs during this follow-up...

To make the campaign scalable and appear more legitimate, invoices are created through PayPal and sent via distribution lists created in Microsoft Outlook to addresses hosted on dedicated (criminal-owned) domains.

The target addresses act as “exploders” meaning they automatically redistribute incoming messages to large numbers of pre-configured emails.

As a result:

✅All messages are legitimately DKIM-signed by PayPal
✅Authentication is validated
✅Emails are then ARC-sealed by Outlook

For the final recipient, the messages appear fully authenticated and legitimate.

Subjects observed include ⤵️

✉️Invoice from Question ! Get in touch, 8OO_596_O886. PPL (TRX-#1234)
✉️Invoice from Question ! Get in touch, 8OO_596_O886. PPL (TRX-#1234)
✉️Invoice from Any Question. Get in touch,1-[phone]. PPL (TRX-#1ab23)
✉️Invoice from Any Question. Get in touch,1-[phone]. PPL (TRX-#1ab23)

@PayPal has been notified and is actively blocking the abuse from generating more invoices. @Microsoft has also been informed regarding the Outlook infrastructure involved.

[André Tavares @andretavare5]

proxy services powered by malware botnets https://t.co/95re3hGdDx

[R136a1 @TheEnergyStory]

Have you noticed that those deep-dive stories about complex Windows malware have pretty much vanished, especially in recent years? It feels like the era of "blockbuster" Windows malware has just gone silent, and this blog post tries to give some answers why.

https://t.co/sFsf3uPm5o

[安坂星海 Azaka || VTuber @AzakaSekai_]

IDA 9.3sp2 has been released. This update addresses...
*reads notes*

> idaclang: fixed an argument injection in CLANG_ARGV that could lead to arbitrary code execution when opening a malicious database

oh

[Zscaler ThreatLabz @Threatlabz]

Zscaler ThreatLabz has published a technical analysis on activity we believe to be orchestrated by Tropic Trooper, using military-themed lures and a trojanized SumatraPDF to deploy AdaptixC2 with a custom GitHub-based C2, then pivoting to Visual Studio Code tunnels for remote access.

Read more: https://t.co/myj0VbDZYr

[Zscaler ThreatLabz @Threatlabz]

Zscaler ThreatLabz has observed a wave of ransomware attacks that share similar TTPs with prior BlackBasta initial access brokers. These attacks start with spam bombing followed by vishing via Microsoft Teams and Quick Assist to deploy malware. ThreatLabz has linked these attacks to a relatively unknown ransomware group called Payouts King.

Check out our technical analysis of Payouts King ransomware including the file encryption methods (4,096-bit RSA + 256-bit AES CTR) and techniques to evade malware sandboxes, antivirus and EDR detection.

Link: https://t.co/CsMH0onbSi

[Casperinous @Casperinous]

@fumik0_ So should we expect another blogspot soon ?

[Fumik0_ @fumik0_]

You're Not the Worst One Here https://t.co/1gPCZQK0Ze

[EXPMON @EXPMON_]

Adobe has confirmed our findings and has issued an emergency security update for all Adobe Reader (and other affected products) users.

https://t.co/2cOeuZ9Gn0

The underlying exploited zero-day vulnerability has been rated Critical (CVSS 9.6) and is tracked as CVE-2026-34621. It appears that Adobe has determined the bug can lead to arbitrary code execution — not just an information leak. This aligns with our findings and those of other security researchers over the last few days.

EXPMON would like to thank Adobe for releasing this emergency security update quickly to help protect users.

UPDATE NOW!

#expmon #zeroday #0day #pdf #adobereader #CVE-2026-34621