Socialk@s

r2 devotee; retro-gaming lover; ocasional CTF player; constant reader; hacking the hours away since 2015...

[Hack The Box @hackthebox_eu]

The king has fallen. The throne is empty. Who will claim the realm?

Cyber Apocalypse 2026 is coming.

Join Hack The Box’s largest community event of the year and take on five days of relentless cybersecurity challenges built to test real-world skills.

Compete against thousands of hackers worldwide, connect with the community, showcase your skills to global organizations and recruiters, and fight for your share of a massive prize pool.

Get more than 200 points and claim your certificate of attendance.

For the glory. For the training. For the prizes. For the certification.

Register now: https://t.co/Kj7DXYU1hE

#HackTheBox #CyberApocalypse2026 #CTF #CyberSecurity #CyberSkills #InfoSec #CaptureTheFlag

[Dark Web Informer @DarkWebInformer]

‼️ Nightmare Eclipse is back on GitHub under a new alias and has released a new Windows Defender vulnerability zero-day called RoguePlanet.

PoC: https://t.co/n0xF6uGt4u

New GitHub Account: https://t.co/qwU93VedpH

[vx-underground @vxunderground]

All these fucking dorks at Anthropic do is yap about how insane their product is and how end-of-the-world it will be

Someone tell these jabronis to shut the fuck up, holy Christ they're so annoying

[Micromanía @MicroManiaPapel]

Mil gracias por la recepción que está teniendo esta reedición del primer número de #Micromanía, de 1985. A este ritmo las unidades previstas se van a agotar mañana... ❤️❤️❤️❤️❤️

[The Lunduke Journal @LundukeJournal]

While the Linux Kernel is quickly becoming “Vibe Coded”, many other Open Source projects are outright banning all AI / LLM contributions.

QEMU - “Policy is to DECLINE any contributions which are believed to include or derive from AI generated content.”

NetBSD - AI generated code is “presumed to be tainted code, and must not be committed.”

Zig - Total ban on using AI in any way. “No LLM-generated content”, “No LLMs for translation.”, “No LLMs for finding bugs.”, “No talking about use of chatbot/LLM services.”

OBS Studio - “Code must be human written.”

[Armin Ronacher ⇌ @mitsuhiko]

This is such a good post. https://t.co/IdmAnh18Nt

[Zack Korman @ZackKorman]

Major companies are getting pwned by browser extensions and npm packages, but they think deploying AI agents will go fine.

Good luck, have fun.

[Haider. @haider1]

Creator of C++, Bjarne Stroustrup:

AI-generated code isn't ready — it generates more bugs, more bloat, more security holes, and is nearly impossible to validate

"senior developers are already retiring rather than deal with it"

The problem is that even a small prompt change can shift the entire codebase in unpredictable ways

[Daniel Púa @devploit]

working in cybersecurity nowadays:

> wake up
> read "new critical vuln just dropped"
> summon dev and SRE in the incident channel
> patch, scan, rotate secrets, redeploy
> check logs to make sure you are not already cooked
> take a deep breath and go to sleep

> wake up
> read "new critical vuln just dropped"...

WELCOME TO THE AI ERA

[RetroBarcelona @RetroBarcelona]

La Gran Enciclopedia de las Videoconsolas ya se puede adquirir en primicia en #RetroBarcelona2026 con la portada exclusiva creada por @Jennestudios!

Recordad que a las 13:00 tenemos charla del autor, @FlorentGorgesFR y @HeroesdePapelES anunciará algo que hará temblar las redes!

--

La Gran Enciclopèdia de les Videoconsoles ja es pot adquirir en primícia a #RetroBarcelona2026 amb la portada exclusiva creada per @Jennestudios!

Recordeu que a les 13:00 tenim xerrada de l'autor, @FlorentGorgesFR i @HeroesdePapelES anunciarà una cosa que farà tremolar les xarxes!

[International Cyber Digest @IntCyberDigest]

‼️🚨 Pwn2Own Berlin 2026 just hit a wall. For the first time in 19-years, ZDI rejected dozens of working zero-day RCE submissions because organizers ran out of contest slots.

Rejected hackers are now going public with PoC demos and direct vendor disclosures, breaking Pwn2Own's usual secrecy.

▪️ AI surfaces a massive wave of 0-day RCEs.
▪️ Submissions overwhelm ZDI past max capacity.
▪️ Slots run out. Researchers with working chains get rejected.
▪️ "Revenge disclosures" begin. ← we are here.

Confirmed casualties so far:
▪️ @xchglabs : 86 vulnerabilities prepared (PyTorch, NVIDIA, Linux KVM, Oracle, Docker, Ollama, Chroma, LiteLLM, llama.cpp). All rejected. Now reporting directly to vendors with writeups dropping as patches land.
▪️ @ggwhyp : full-chain Firefox RCE on Windows. Rejected. Publicly demoed (HTML page → cmd.exe → calc.exe). Responsibly disclosed to Mozilla.
▪️ @yunsu_dev : working RCE chain, rejected. Submitting elsewhere.
▪️ @ryotkak : tried to register for 3+ weeks. ZDI confirmed "at maximum capacity, can't add extra contest days." Considered canceling flight and hotel.
▪️ @anzuukino2802 : Claude Code RCE PoC. Rejected.
▪️ @desckimh : 0-day RCEs in Ollama and LM Studio. Rejected.

Reported impact: a community-estimated 150+ researchers tried to register. Accepted contestants are now being warned about collisions. Rejected vulnerabilities going to bug bounty programs may trigger pre-event patches that invalidate the work of those who got in.

ZDI has not publicly addressed the capacity issue. The event still runs May 14-16 in Berlin.

[ElektroKill @elektrokilldev]

The first release candidate of dnSpyEx 6.6.0 is now available for download.

https://t.co/fIDgki3YGV

[Abhi @AbhiTheModder]

The world's fastest Android/DEX decompiler (garlic by @neocanable ) meets radare2 ( @radareorg ) 🔥

https://t.co/kRgT4X4PK4

[International Cyber Digest @IntCyberDigest]

‼️🚨 One of the world's largest Certificate Authorities, DigiCert, was compromised by a malicious screensaver file sent through a customer support chat. Their antivirus blocked the malware four times. The agent kept clicking. The fifth try got through.

27 code signing certificates were stolen and used to sign malware.

DigiCert ultimately revoked 60 certificates.

Per DigiCert's incident report, filed in Mozilla's CA compliance tracker as Bug 2033170, here is how it unfolded:

April 2: an attacker contacted a DigiCert helpdesk agent through the company's customer support chat channel, posing as a customer. The lure was a zip file pitched as a screenshot. Inside the zip was a .scr file. On Windows, .scr files are executables, and this one carried a malicious payload.

Opening a file a customer sent through the official support channel is what an agent is supposed to do. Support staff are the one role designed to accept files from strangers.

DigiCert's endpoint security blocked four infection attempts. On the fifth, the support analyst's machine was infected.

DigiCert detected the infection, ran an investigation, and concluded the incident was contained.

Eleven days later, an external researcher tipped DigiCert off about misuse of DigiCert-issued code signing certificates in the wild. That tip led to the discovery of a second compromised machine, belonging to a different support analyst, infected through the same vector. The EDR on that machine had not been functioning correctly, so the original investigation missed it.

The second machine gave the attacker access to DigiCert's internal support portal. That portal lets support staff reach limited views of customer accounts, including initialization codes for ordered but not-yet-issued code signing certificates. Combining a stolen initialization code with an approved order let the attacker pull a real, validly issued code signing certificate. They did this 27 times.

DigiCert's own list of what went wrong:

- File-type filtering on the customer support chat channel did not catch the .scr
- EDR coverage was inconsistent and incomplete, creating a blind spot
- Initialization codes for code signing certificates were not adequately protected

DigiCert says it got lucky. An outside researcher found the malware abuse before DigiCert did. Without that tip, the second machine and the active certificate theft might still be running today.

[Luke Stephens (hakluke) @hakluke]

BREAKING: CTF players rejoice worldwide as linux privesc suddenly becomes super easy.

https://t.co/PVJYH57OxR

[Dark Web Informer @DarkWebInformer]

‼️Copy Fail (CVE-2026-31431) is a Linux privilege escalation bug that lets any local user get root using a 732-byte Python script, and itworks on basically every major Linux distro shipped since 2017.

Website: https://t.co/f5G6KnEv35

Write-up: https://t.co/W86Pz2PC6C

GitHub: https://t.co/zAMTC6nTRk

It's a logic flaw in the kernel's crypto code (authencesn via AF_ALG and splice()) that allows a small write into the page cache, which can be used to tamper with a setuid binary like /usr/bin/su.

Think how bad this is going to be for shared environments like Kubernetes, CI runners, and cloud sandboxes, where it enables container escape and tenant-to-host compromise.

Found by Theori's Xint Code scanner, patched in the mainline kernel, and publicly disclosed on April 29, 2026; if you can't patch right away, the recommended workaround is to disable the algif_aead module.

[Iceman @herrmann1001]

RFID hacking community in 2026:
* Still cloning employee badges in 0.8 seconds
* Companies still using 125kHz like it’s 2005
* Me, explaining to security teams that their $40k access control is worth about tree fiddy

We’re not the villains, we’re the unpaid penetration testers.

Change my mind.

#RFID #Hacking #CyberSec

[vx-underground @vxunderground]

Meanwhile in Bug Bounty:

AI slop bug reports overflowing vendors. Vendors can't handle the slop. Slop code, slop exploits, and slop write-ups result in vendor exiting program.

AI slop is choking Bug Bounty

[Iceman @herrmann1001]

The latest Proxmark3 release is called BREAKMEIFYOUCAN!

Not a random name.

That is the actual 3DES factory default key NXP burned into every MIFARE Ultralight C they shipped since 2008.

Somebody finally broke it properly.

The paper drops the keyspace from 2^112 down to 2^28.

Counterfeit cards fall in under 60 seconds from a single card interaction. The tooling is merged: https://t.co/2CYKrRdv22

#Proxmark3 #RFID #NFC #MifareUltralightC #NXP #OpenSource

[impulsive @weezerOSINT]

Windows defender has been compromised.
right now there is a public unpatched exploit that gives any app on your windows PC full system admin access. no password. no popup. nothing

your antivirus doesnt stop it. your antivirus IS the exploit. windows defender is the attack vector

ransomware gangs can use this to encrypt your entire machine and steal every saved password, browser session, and discord token you have. fully patched windows 11. real time protection on

thread