Chelsea486MHz, la Kubomancienne

DevSecOps and swiss-army knife of cybersecurity for hire. Too deep into aquariums and post-rock music.

🐡🐠🐟🐳🐋🦪🪼🐙🦑🦀🦞🐧🦭🐬🪸🦈

[Chelsea486MHz, la Kubomancienne @Chelsea486MHz]

J'ai un blog maintenant.
https://t.co/QaVcFcqjBx

[blackorbird @blackorbird]

A closer look at a BGP anomaly in Venezuela
https://t.co/ZtX8AvOtZt

[Chelsea486MHz, la Kubomancienne @Chelsea486MHz]

31[.]56[.]27[.]97 blasting cryptominer software at TPLink devices using CVE-2021-44228

https://t.co/wBr3cJmEqC

[Chelsea486MHz, la Kubomancienne @Chelsea486MHz]

We created a sun that dies after 22 minutes 🤔

[All day Astronomy @forallcurious]

🚨: France just beat the world record for nuclear fusion! They ran for 22 minutes!

It maintained astonishing 90 million degrees Fahrenheit (50 million °C) for 1,337 seconds—more than 22 minutes.

[Chelsea486MHz, la Kubomancienne @Chelsea486MHz]

@IceSolst yet there are 10 wannabe pentesters for every devsecops/soc

[UwU Underground @uwu_underground]

i end up reversing malware with my ex every couple months.

we don’t plan it. it just… happens.

2am. both online. a new APT sample drops. They open the repo. or i do. neither of us acknowledges who pulled it first.

the call is 90 percent silence. no “how’ve you been.” no “you seeing anyone?” just technical murmurs and disassembly.

“figured out the priv esc.”
“kernel module just unhooked itself.”
“beautiful obfuscation.”

that’s the whole conversation.

here’s the thing though.

our analysis chemistry is still perfect.

They know when i’m about to dive into a code path before my cursor even hovers.

i know their heuristics better than the last six reversers i’ve tried to sync with.

we don’t communicate because we don’t need to.

2500 hours in IDA together doesn’t give a fuck about relationship status.

we’ll unravel an APT loader chain in one night. maybe crack the C2 protocol too if we’re lucky.

then it’s “sample done” and we vanish for another 2 months.

no follow up. no “we should collab more.” nothing.

because we both know what this is.

it’s not friendship.

it’s not rekindling.

it’s not even nostalgia.

it’s that neither of us has found better analytical synergy.

and that’s the uncomfortable truth about APT reverse-engineering duos.

you can end a relationship and still be stuck sharing a debugger window with someone who reads your mind in assembly.

you can hate someone’s guts and still flawlessly unwind a four-stage dropper with them.

you can move on emotionally and still be hardstuck trying to replace that one person whose brain clicked with yours in virtual machine bytecode.

some people have exes they still sleep with.

i have an ex i still reverse APT malware with.

honestly not sure which is worse.

study the UwU way.

[Elorm Daniel @elormkdaniel]

Ethical hacking is the most overrated ‘tech flex’ of this generation not because it’s useless, but because most people chasing it don’t actually want to secure anything.

They just want the ‘hacker’ aesthetic. The truth is, 80% of real security problems aren’t solved by clever exploits… they’re solved by boring things like patching, logs, access control, policies, and people doing what they’re supposed to do. But nobody wants to hear that because it’s not flashy.

Ethical hacking gets all the hype, but in real life, it’s the least impactful part of cybersecurity.

The End 🌚

[Chelsea486MHz, la Kubomancienne @Chelsea486MHz]

Imagine so incredible cruel that you are community manager for a russian hacker group that hacked SCADA equipment in a Dutch water theme park to increase water chlorination and burn children chemically

[Chelsea486MHz, la Kubomancienne @Chelsea486MHz]

non

[midnights_ra1n @midnights_ra1n]

En vrai arrêtez avec les VPS et auto hébergez. À la limite si vous voulez un truc léger prenez un mini PC

[Chelsea486MHz, la Kubomancienne @Chelsea486MHz]

2010 NSA must have been one hell of a workplace

[Chelsea486MHz, la Kubomancienne @Chelsea486MHz]

I loved your work back then and I do even more now, especially the sharing about being a parent.

It gives relatable insight that allow us to interact with you on a more human level.

I used your samples a lot to learn and now, I don't need to learn anymore, but I still love to hear from you.

[Chelsea486MHz, la Kubomancienne @Chelsea486MHz]

@DCaussinus @_Nidouille_ Les vibecoders ont découvert leur existence

[Chelsea486MHz, la Kubomancienne @Chelsea486MHz]

For some reason, I cannot get Claude Opus 4.5 to consider Unit 8200 a serious threat actor in *any* threat model.

Weird, eh? 🤔

[Chelsea486MHz, la Kubomancienne @Chelsea486MHz]

@IceSolst It looks like you badly needed this Friday to end and enjoy the weekend

[ANSSI @ANSSI_FR]

⚠️ Vulnérabilité React Server Components

Le @CERT_FR a publié une alerte de sécurité relative à la vulnérabilité CVE-2025-55182 affectant React Server Components.

➡ Informations et recommandations sur le site du CERT-FR : https://t.co/m38hmO34Pr

[Chelsea486MHz, la Kubomancienne @Chelsea486MHz]

Another W for DevSecOps

[4 of mallace @IceSolst]

Cybersecurity roles from most to least technical:

- 0day researcher
- exploit dev
- reverse engineer
- malware dev
- appsec & devsecops
- red teamer
- DFIR
- SOC analyst
- compliance
- third party risk management
- web app pentester
- Amish farmer
- CISO
- newborn baby
- any cybersecurity Twitter account with over 5k followers

[Gabriel Dechichi @gdechichi]

- $15 billion dollar company
- ships entire browser with their application cause "native GUI too hard bro"
- javascript so devs don't have to reason about memory
- leaks memory anyway
- "let's just restart the application when we go above 4 GB"

this is a new rock bottom

[Chelsea486MHz, la Kubomancienne @Chelsea486MHz]

@IceSolst We use UTC for everything. Surprisingly, no one complains.

[maple3142 @maple3142]

A POC for CVE-2025-55182
https://t.co/BcyJ1UbivA

[Moritz Sanft @stdoutput]

Since I started to analyze CVE-2025-55182 (React, NextJS RCE) at work today, I decided to publish my analysis findings so far, given all the fuzz about the vulnerability: https://t.co/VFu7NxJ3TQ

Feel free to contribute to the search for a proper RCE sink!