InfoSecOne

.PL 🇵🇱/ .IE🇮🇪 Product/Platform Security Engineer, Penetration Testing && DevSecOops!...

[InfoSecOne @InfoSecOne]

@jwgoerlich @johnwilander For normal browsing use @DuckDuckGo and @brave if you're extra sensitive use @virtualbox and @NordVPN for mail @ProtonMail or @ProtonVPN 😉🦀 If you're journalist you might consider @Tails_live ... Well I've said too much already 😜

[InfoSecOne @InfoSecOne]

@MegaBasedChad QWERTYÓŹŻŁŃŚĆDŻ 😂 Polish Pro!

[Michał Leszczyński @icedevml]

Nagranie z mojej prezentacji na tegorocznym @CONFidenceConf

"[PL] [CVE-2026-9058] Pełne ominięcie uwierzytelniania w ZUS, e-Sądzie, Usługach Elektronicznych Ochrony Zdrowia i kilku innych systemach administracji publicznej"

https://t.co/4YOK23E7xe

#Cybersecurity

[BRute Logic @BRuteLogic]

JWT Auth Bypass TestBed

https://t.co/qoYUYTxduT

Test your skills: 18 main tests with variations.

A proprietary tool with 40+ techniques for Brute One will be available this week to spot all these cases in the wild in a matter of seconds.

https://t.co/ThMs09G3Hp

[Steven Murdoch @sjmurdoch]

My article on hidden messages within GPS signals was featured on @404mediaco. https://t.co/uuZAO643Uv

[Adam Haertle @[email protected] @adamhaertle]

Czego wam najbardziej brakuje podczas pobytu w innych krajach Europy? Mi:
- BLIKa / PayU
- Paczkomatów
- Żabki
- Allegro
- mObywatela
- taniego internetu
- zasięgu 4G / 5G
- restauracji czynnych bez przerwy w środku dnia

Co ważnego pominąłem?

[Miyakatz @the_art_of_nerd]

CI/CDのペンテストに関する知識つけたいなと思って良い教材がないか調べてたら、CTF形式で学べるcicd-goatをみつけた👀
Docker上で動くので、手元にDocker環境があればサクッと遊べていい感じ。
https://t.co/GvMjM2dPOf

[InfoSecOne @InfoSecOne]

@BartoszBorz Buy @188-190

[InfoSecOne @InfoSecOne]

@VibeCoderPL Co trzyma Geralt w ręku? 🙊
Będzie też o Weselu, będzie też Jaskier!

[InfoSecOne @InfoSecOne]

@AnalizyD @RobertPietraga Mam podobnie… 33 płatki śniegu ❄️

[InfoSecOne @InfoSecOne]

@czary_miary @AnalizyD Bo grają tacy w wieku 35+

[InfoSecOne @InfoSecOne]

@Macronextcom Czekamy tydzień, skupujemy na dołku , po około 190-222 PLN

[InfoSecOne @InfoSecOne]

@FinansowyUmysl Optymalizacje podatkowe, ZUS i VAT zabierają 1/3 dochodów rocznie.

[Aikido Security @AikidoSecurity]

tl;dr When you delete a Google API key, it says it’s immediately deleted. Our testing says ~23 minutes.
During that window, an attacker with a leaked key keeps access to your data and enabled APIs (including Gemini).

[InfoSecOne @InfoSecOne]

@MissPookems Burnout Paradise , PS3 ❤️‍🔥

[Het Mehta @hetmehtaa]

Every 3rd website you visit runs Nginx.

18,959,833 of them can be hijacked right now.

A bug from 2008 just got a working exploit.

CVE-2026-42945 (CVSS 9.2)

No login. No access. Just one HTTP request.

→ Heap overflow → Worker process → RCE

Patch ASAP to Nginx 1.31.0 or 1.30.1

PoC is already out:
https://t.co/O4556KGjqD

[Bojan Tunguz @tunguz]

This is bad. And it’s only going to get worse from now on.

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft is investigating mistralai PyPI package v2.4.6 compromise. Attackers injected code in mistralai/client/__init__.py that executes on import, downloads hxxps://83[.]142[.]209[.]194/transformers.pyz to /tmp/transformers.pyz, and launches a second-stage payload on Linux. The file name transformers.pyz appears deliberately chosen to mimic the widely used Hugging Face Transformers library and blend into ML/dev environments.

The main payload is a credential stealer, but it also includes country-aware logic; it avoids Russian-language environments and contains a geo fenced destructive branch that has 1-in-6 chance of executing rm -rf / when the system appears to be in Israel or Iran.

To mitigate this threat: isolate affected Linux hosts, block 83[.]142[.]209[.]194, hunt for /tmp/transformers.pyz, pgmonitor[.]py, and pgsql-monitor.service, and rotate exposed credentials.

[InfoSecOne @InfoSecOne]

@walutomat co się dzieje u Was dzisiaj z powiadomieniami na iOS?
Poszło już ponad 20 - Ankieta i nagrody…
No bez przesady!!

[Aurelien @Aurelien_Gz]

oh boy… this is madness

these UIs crafted with unreal 5 and blender are next level sorcery

[InfoSecOne @InfoSecOne]

@wladziu3 @Lukasz_Helisz Pytanie sztos: Łukasz już się nauczył, my też, a inni właśnie Googlują „odcięcie”