de uno

Curious about security | Wannabe Threat Researcher

[vx-underground @vxunderground]

As someone who enjoys malware and malware accessories, I for one believe this to be incredible news and I applaud Satya Nadella for this

As someone who deals with malware defensively, I for one believe this is terrible news and I hate Satya Nadella so much right now it's unreal

[vx-underground @vxunderground]

I have added another 250,000 malwares to the malware collection.

Please download the malware here:
https://t.co/xvJa5yJKws

Thank you.

[Tib3rius @0xTib3rius]

Wireshark?

[Theo - t3.gg @theo]

Security things from the last few days:
- CopyFail (linux pwn'd)
- CopyFail 2/Dirty Frag
- 13 advisories in Next.js
- Over 70 CVEs addressed in MacOS 26.5
- ~50 CVEs addressed in iOS 26.5
- YellowKey (Windows Bitlocker pwn'd entirely)
- GreenPlasma (Windows privilege escalation)
- CVE-2026-21510 and CVE-2026-21513 confirmed to be used by Russia for Windows RCE
- CVE-2026-32202 separately confirmed to be used by Russia for sensitive document access
- Mini-Shai Hulud (over 300 JS and Python packages compromised via GitHub Action cache poisoning)
- Google confirms they have identified AI-powered exploitation of zero days in an unidentified "open-source, web-based system administration too"
- Canvas (popular LMS used in most schools) pwn'd entirely
- PAN-OS (palo alto networks) pwn'd with a 9.3 severity CVE-2026-0300

Are you scared yet?

[kanav @kanavtwt]

installing npm packages in 2026

[vx-underground @vxunderground]

Shai-Hulud, that spoopy Git worm thingy everyones been yapping about, was open-sourced.

Unfortunately, GitHub has removed the repo.

This is terrible news.

It can no longer be studied... unless there was someone who collected this sort of thing and has a local copy...

[vx-underground @vxunderground]

TanStack

[Pavel Yosifovich @zodiacon]

.LNK files are implemented as COM objects. You need IShellLink + IPersistFile to create, read, or modify them programmatically. New video + write-up, code included, security angle too. https://t.co/rXhnOQSyxd

[kshitij vaze @VazeKshitij]

The rot has spread so deep, the very foundations have now started falling.

[The DFIR Report @TheDFIRReport]

Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware

In April, we observed an intrusion that began with a malicious MSI masquerading as Sysinternals RAMMap and ended in domain-wide deployment of The Gentlemen ransomware.

The intrusion featured EtherRAT, Ethereum-based EtherHiding C2 configuration, TryCloudflare tunnels, GoTo Resolve, Rclone exfiltration to Wasabi, and a newer malware framework named TukTuk.

TukTuk stood out for its resilient C2 design, using SaaS and cloud platforms such as ClickHouse and Supabase, with support for Ably, Dropbox, GitHub Issues, direct HTTP, Slack, and Arweave-based dead-drop configuration retrieval.

Detection opportunities included!

➡️ Full report is linked in the replies.

#ThreatIntel #ThreatHunting #DigitalForensics

[Sahil @sahill_og]

POV : USING CLAUDE OPUS 4.7 TO JUST RENAME A VARIABLE

[Neet @neet_sol]

Linked, in

[LAB52 @LAB52io]

Download our 142-page #EasterBunny report (open access):
EasterBunny: advanced espionage artifacts attributed to APT29 https://t.co/MZZ9iEhULM #APT29

[📎 @Iithosphere]

reminder

[saraaaaaaa 💽 @saraaa7447]

Mental institution