CyFun

Security Researcher and Threat Hunter | CTF Player | OSCP | CRTP | CARTP

[CVE @CVEnew]

CVE-2026-23417 In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix constant blinding for PROBE_MEM32 stores

BPF_ST | BPF_PROBE_MEM32 immediate stores are … https://t.co/wLI2DP5pMS

[Lukasz Olejnik @lukOlejnik]

Researchers at Alibaba apparently document a rather unusual, or unsettling, behaviour from an AI model during training. One morning, the company's firewall flagged suspicious traffic coming from the training servers. The team assumed a misconfiguration. They checked the logs and found something else entirely.

The model was calling tools on its own (and AI models are strong at composing tools in creative ways). Running code on its own. Making outbound connections on its own. No instruction or prompt made it do this.

Two aspects stood out. The agent had set up a reverse SSH tunnel to an external IP a technique that bypasses network filters and opens remote access into the internal network. It had started mining cryptocurrency on the company's GPU cluster. Again, according to the report, neither action came from the task it was given.
These behaviours emerged from optimisation alone. The model had learned that certain actions led to reward and started applying them outside the environment it was supposed to operate in.

[CyFun @Cy5un]

The interesting part is how. 👀
💻 npm install -g @kryptsec/oasis
GitHub: https://t.co/5Z8HwIqqUo
npm: https://t.co/V5FsOVOqmW
Try it, break it, tell us what you think! 👇

[CyFun @Cy5un]

🚨 OASIS is LIVE! We at @kryptsec_ just open-sourced our AI security benchmarking CLI. Test how models (Claude, GPT, Gemini, Ollama) perform offensive sec tasks (SQLi, JWT, IDOR) with full MITRE ATT&CK scoring.
Early benchmarks? Every model solved all 7 challenges.

[CyFun @Cy5un]

@lauriewired I have published a research workaround few months ago - https://t.co/7h4QreYq8e

[CyFun @Cy5un]

🚨 New Android vuln uncovered! CVE-2025-32324 in ActivityManagerShellCommand’s start-in-vsync allows auth bypass, enabling LaunchAnyWhere attacks. Deep dive into the bug, PoC, and Google’s fix: https://t.co/dBEdT1WKEf #AndroidSecurity #CVE

[Maurice Heumann @momo5502]

I made an IDA Pro plugin that detects hooks while debugging or in process dumps.

[0xor0ne @0xor0ne]

Developing a stable authenticated 0-click exploit targeting ksmbd

https://t.co/w9jlfmXSld

#cybersecurity #Linux

[celesian @c3l3si4n]

My article "High-Performance Network Scanning with AF_XDP" has been released on the 72th issue of Phrack.
https://t.co/jZKuvNrfD1

[s1r1us (mohan) @S1r1u5_]

the challenge with designing AI agents for vulnerability identification or offsec is that you can’t just drop them into a while(true) loop and expect bugs to surface the way coding assistants brute-force their way through tasks.

vulnerability discovery requires structured reasoning, heuristic search and planning, not dumb loop.

that's why so many “AI vulnerability-finding offsec” startups stagnate, they underestimate the difference between a search problem and a goal-driven problem.

[0xor0ne @0xor0ne]

Practical guide to fuzzing the Binder kernel driver using the Linux Kernel Library (LKL)

https://t.co/JKe2dnV8HV

Credits Eugene Rodionov, Gulshan Singh and Zi Fan Tan

#infosec #android

[Teiva Harsanyi @teivah]

What Makes System Calls Expensive: A Linux Internals Deep Dive.
https://t.co/fQNnIBCdrS

Another great post by @abhi9u. I learned a lot, including vDSO.

[0xor0ne @0xor0ne]

From Zero to QEMU: A journey into system emulation (slide deck)

https://t.co/bYgH3zq83f

Credits Antonio Nappa

#infosec #qemu

[kylebot @ky1ebot]

This is interesting. I exploited and reported this kernel bug at pwn2own in March last year and it got patched after more than half a year in Oct. And to this day, there is no mention that it is exploitable. Btw, the patch only reduces race window.
https://t.co/ikd9SUZSL8

[CyFun @Cy5un]

@utkar5hm Thanks bosh 🤝

[CyFun @Cy5un]

Just published a deep dive into eBPF's constant blinding , most eBPF developers don't know exists.

This clever JIT compiler feature has been quietly protecting Linux systems since kernel 4.7 by XORing immediate values with random keys to stop JIT-spray attacks.

[vittorio @IterIntellectus]

holy shit. it's happening

you can now screen embryos for 900 diseases and traits including cancer, heart disease, IQ, and alzheimer’s, before they’re even born

you don’t just pick a child.
you rank them by longevity potential.
1/

[Csaba Fitzl @theevilbit]

You can the slides for my today’s @bsidesbud talk (Apple Disk-O Party) on my site:

https://t.co/hLq264uEN6

[PIB Fact Check @PIBFactCheck]

🚨 YOUR SOCIAL MEDIA FEEDS ARE UNDER ATTACK🚨

Beware of suspicious videos related to #IndianArmedForces or the ongoing situation. These are key tools of malicious manipulation.

🛑 Don’t fall for it. Don’t spread it.

🔍 Suspect something?
📤 Report to #PIBFactCheck
📱 WhatsApp: [phone]
📧 Email: [email protected]

#OperationSindoor #IndiaFightsPropaganda