ExtremePaperClip

Lifelong Student of Everything! #InfoSec Engineer, Digital Forensics, Linux Geek, #BlueTeam, History Buff, Loads of Fun (tweets&opinions=mine)

[ExtremePaperClip @ExtremePaperC]

THIS is how you learn. It’s one thing to read books about hacking, and it’s quite another thing to learn by doing. This right here 👇 is how you learn by doing.

[TryHackMe @tryhackme]

🚨 We've released a 4th network room

After all that enumeration, we are finally ready to start exploitation of the TryHackMe domain!

Exploits in store:
🔴 ACL exploits
🔴 Kerberos Delegation
🔴 AD Certificates, Golden Tickets & many more!

https://t.co/oRbJYWVbvz

[vx-underground @vxunderground]

Yeah, so pretty much this guy is releasing an exploit in solidarity with Nightmare Eclipse guy. He said he notified GitHub about the exploit 60 minutes before releasing this paper.

I don't do web stuff, and I'm not a VSCode nerd, so I'm confused by the underlying technologies.

If you're a stinky GitHub and VSCode nerd maybe you'll understand.

tl;dr click github dev, github dev opens editor, in github dev editor have javascript, javascript does shortcuts automatically. github treats javascript shortcuts as real human input, or something. use javascript shortcut stuff to automatically install vscode extension. the vscode extension steals your data

tl;dr tl;dr user clicks 1 link, 1 click steals all data from your github

https://t.co/uh17usZeEH

[ExtremePaperClip @ExtremePaperC]

@anton_chuvakin “Of course I know SIEM… and he doesn’t like you!”

[ExtremePaperClip @ExtremePaperC]

@lennyzeltser I’ve played around with this. It’s quite easy to set up, and cheap to use.

[ExtremePaperClip @ExtremePaperC]

@mattjay MATT!!! That’s awesome!! Some day you gotta go to Maui and go explore the ocean there. If you can, investigate when the whales are active. I can’t tell you how amazing it is to hear whales talking in all directions around you. It’s beautiful

[ExtremePaperClip @ExtremePaperC]

I feel like this isn’t getting the attention it should. We shall see towards the end of June.

[Steven Lim @0x534c]

🖥️Monitoring Secure Boot Certificates with KQL

Windows devices that rely on Secure Boot certificates issued in 2011 will reach their expiration in June 2026. The clock is ticking — defenders need to act now to avoid surprises when certificates lapse.

With the KQL query below, you can quickly identify your fleet of Microsoft Defender for Endpoint (MDE) devices whose Secure Boot certificates are set to expire, giving you visibility and time to plan remediation before the deadline hits.

DeviceTvmSecureConfigurationAssessmentKB
| where ConfigurationName == @"Ensure devices are updated to Secure Boot 2023 certificates and boot manager"
| join DeviceTvmSecureConfigurationAssessment on ConfigurationId
| where IsCompliant == false

#Cybersecurity #DefenderXDR #SecureBootCertificates

[ExtremePaperClip @ExtremePaperC]

@infosec_fox https://t.co/WP0U4kVdAa

[m0n1 @m0n1x90]

Saw CVE-2026-41096 pop up on X and the description immediately caught my attention: a heap overflow in the Windows DNS client, triggered by a single UDP response. No interaction, no auth. I wanted to understand how it works, so I pulled the DLLs and started digging.

[ExtremePaperClip @ExtremePaperC]

@HackingDave Go to the year 65535 💻 🤓

[ExtremePaperClip @ExtremePaperC]

@mattjay @gleeda

[ExtremePaperClip @ExtremePaperC]

This album. That’s all. Just go listen to it. Mmkay?

[striga @striga_ai]

PoCs for Apache Tomcat Unauth RCE (CVE-2026-34486) and Apache httpd Pre-auth RCE (CVE-2026-23918) are now public on our Github.

Tomcat exploit is fully reliable. httpd chain works in a controlled lab setup with a known info leak.

https://t.co/D3dg5iTuwP
https://t.co/2zyr1ds4Mo

[ExtremePaperClip @ExtremePaperC]

@vxunderground The DANCING tho. 🤣🤣🤣

[Ubuntu @ubuntu]

Dirty Frag Linux kernel local privilege escalation vulnerability (CVE-2026-43284) mitigations are now available.

Read the blog for details: https://t.co/h13u1l5YCy

[V4bel @v4bel]

💥 Introducing "Dirty Frag"

A universal Linux LPE chaining two vulns in xfrm-ESP and RxRPC. A successor class to Dirty Pipe & Copy Fail.

No race, no panic on failure, fully deterministic. ~9 years latent.
Ubuntu / RHEL / Fedora / openSUSE / CentOS / AlmaLinux, and more.

Even if you've applied the "Copy Fail" mitigation, your Linux is still vulnerable to "Dirty Frag". Apply the Dirty Frag mitigation.

Details:
https://t.co/9nqku4svkY

[Brian Pak @brian_pak]

Hey everyone. We’ve seen the discussions around Copy Fail (CVE-2026-31431) and the disclosure process. We appreciate the passion from distro maintainers, defenders, and the broader Linux community. This is a serious issue, and we want to share some context on our side in good faith. 🧵

[rootsecdev @rootsecdev]

I too woke up and choose violence today as the fail-copy POC dropped.

Made a clean exploit including fixing the UID post exploitation without rebooting the target server. Smoke those CTF’s in hack the box.

https://t.co/nRiFyXQzRe

[vx-underground @vxunderground]

CVE-2026-31431 a/k/a CopyFail

> Linux LPE
> Description sounds like AI slop
> Exploit is legit
> Impacts every Linux kernel from 2017 - Now
> Proof-of-concept released
> It's Wednesday?

https://t.co/FXgjWW7lOV

[ExtremePaperClip @ExtremePaperC]

@gabsmashh Make it a SONG 🎵

[spencer @techspence]

OWASP has released their Autonomous Penetration Testing Standard.

I have not read it yet. Anyone else look at this?

https://t.co/MewKPc1syG

[ExtremePaperClip @ExtremePaperC]

@mattjay Me too.