JParticle 🇨🇦🇺🇦

CTI Analyst | Triathlete | love what you do | I post what I find interesting.

[JParticle 🇨🇦🇺🇦 @JParticle0]

“The forest was shrinking but the trees kept voting for the axe, for the axe was clever and convinced the trees that because his handle was made of wood he was one of them.”
― Turkish Proverbs

[John Hammond @_JohnHammond]

Introducing: https://t.co/FOcfQGdxtg ! 🛜🤖😂

A free prompt injection wargame to troubleshoot your local network with an AI assistant; and a challenge to have it leak some secrets!

Brought to you by @JustHackingHQ, @_ContinuumCon_, @d1gitalandrew Andrew Bellini & Eva Benn.

[Black Hole @konstructivizm]

Mind-blowing breakthrough: Scientists just captured the first-ever image of an electron’s “orbit” inside a hydrogen atom!Peering into the absolute tiniest building blocks of matter has always been insanely difficult — not only because atoms are unimaginably small, but because the quantum world plays by bizarre rules. Electrons don’t zip around in neat little planetary paths like old textbooks suggested. Instead, they exist as fuzzy probability clouds governed by quantum physics.And then there’s the Heisenberg uncertainty principle: the very act of trying to observe something this small can change its https://t.co/TMjfixjVAF, thanks to a groundbreaking new “quantum microscope” technique called photoionization microscopy, researchers have done what was once thought impossible. They’ve visualized the nodal structure of an excited electron’s wave function in a hydrogen atom — essentially photographing the probability cloud where the electron is most likely to be found. The result? A stunning, direct look at one of nature’s most fundamental quantum states. This isn’t a classical photo of a single electron whizzing around — it’s a mapped interference pattern revealing the beautiful, probabilistic reality of the quantum realm. Reality is weirder (and more beautiful) than we ever imagined.

[GrapheneOS @GrapheneOS]

In April, @mullvadnet provided sponsored DataPacket servers for GrapheneOS in Dallas and Frankfurt which each have 50Gbps peak bandwidth capacity. These now serve a large portion of the updates to GrapheneOS users and add a lot of capacity to our other services including our anycast authoritative DNS.

We also have sponsored servers from ReliableSite, Cherry Servers, Zare and Xenyth. There are a total of 8 sponsored servers where 7 are primarily update mirrors. The update mirror servers also serve our website and network services as a replacement for VPS instances for the locations we have them.

We host 2 anycast networks with our own ASN and IP space in order to self-host anycast DNS servers providing the authoritative DNS resolution for all of our services. Both IPv4 /24 blocks we use for anycast DNS were obtained for free via from ARIN via NRPM 4.10 along with the IPv6 space.

We host 2 anycast networks with our own ASN and IP space in order to self-host anycast DNS servers providing the authoritative DNS resolution for all of our services. Both IPv4 /24 blocks we use for anycast DNS were obtained for free via from ARIN via NRPM 4.10 along with the IPv6 space.

If one of our DNS servers goes down or fully loses connectivity, BGP routing across the internet will quickly adjust to send traffic to the other servers in the network. If a DNS resolver fails to get an answer from one of the anycast DNS networks, it will automatically fall back to the other one.

Our GeoDNS was recently massively improved via @ipinfo sponsoring us with free access to their standard GeoIP database. They use over 1300 probes to scan the internet instead of relying on very inaccurate/incomplete WHOIS/geofeed data. We nearly always use the right server thanks to this database.

We need additional dedicated servers for updates and other services in APAC where bandwidth is more expensive (Singapore, Sydney and Tokyo). We also need another server in North America to go along with our 2nd server from Cherry Servers in Amsterdam used to provide our opt-in geocoding service.

We have enough bandwidth for updates in Europe and North America to handle quite a lot of further userbase growth. We do need additional servers for other things. Several other server providers contacted us with sponsorship offers but we mainly need several APAC servers now which is more costly.

[NetAskari @NetAskari]

"Now, an investigation by ICIJ, with the help of cybersecurity analysts at Toronto University’s Citizen Lab, has found that the incident was part of a sophisticated offensive strategy against ICIJ and its network following the 2025 publication of China Targets." https://t.co/oiY0mFGqqA

[vx-underground @vxunderground]

Yeah, so pretty much this guy is releasing an exploit in solidarity with Nightmare Eclipse guy. He said he notified GitHub about the exploit 60 minutes before releasing this paper.

I don't do web stuff, and I'm not a VSCode nerd, so I'm confused by the underlying technologies.

If you're a stinky GitHub and VSCode nerd maybe you'll understand.

tl;dr click github dev, github dev opens editor, in github dev editor have javascript, javascript does shortcuts automatically. github treats javascript shortcuts as real human input, or something. use javascript shortcut stuff to automatically install vscode extension. the vscode extension steals your data

tl;dr tl;dr user clicks 1 link, 1 click steals all data from your github

https://t.co/uh17usZeEH

[JParticle 🇨🇦🇺🇦 @JParticle0]

@CalltoActivism this is what failing looks like

[Kate O'Keeffe @Kate_OKeeffe]

NEW: At least 7 Chinese universities that support the country’s armed forces and defense industry are seeking access to Nvidia’s H200 chips, the most powerful AI processors ever allowed by the US to be sold in China:
https://t.co/271DabtERv
with the great @eastland_maggie

[Annmarie Hordern @annmarie]

John Costello, the Wirescreen analyst who wrote the report, said the data showed “directly and irrefutably” that U.S. technology was equipping the Chinese military.

“What number of advanced Nvidia chips in P.L.A. hands does the company consider acceptable?” he asked.
https://t.co/Ba25uSnp2R

[Black Hole @konstructivizm]

What the solar eclipse looked like from Earth's orbit.

[vx-underground @vxunderground]

Hello,

If you're a person who enjoys malware and/or knows Python and wants to see malware that targets STEAM and GAMERS, I have the source code to a malware I have named "Stealer.Python.GMBA.Manipulator".

This malware was originally noted on Xitter from @GMBA.

In summary, this Python malware kills the Steam process and relaunches it with the "-cef-enable-debugging" flag. Because Steam is a Chromium app, this allows the malware payload to manipulate Steam web pages with web socket gunk and Javascript gunk.

This malware can "modify" user inventories, "block users", etc. It is all a facade designed to trick and social engineer Steam users into giving their expensive Counter Strike stuff to them.

It appears to be written using AI. Regardless of that fact this malware is creative and I like it.

The malware source code to this can be found under the "/Python/" directory. It is named "Stealer.Python.GMBA.Manipulator.7z".

This malware campaign is still active and the C2 is still live. If you execute the __main__.py file you might cook yourself, so be careful. Alternatively, you can run this in a VM and send the malware campaign authors pictures of Goatse.

https://t.co/mphEJjPJkh

[NetAskari @NetAskari]

The Chinese government is not just into surveilling their own populations and residents but also their administrative staff.

Not just for traditional EDR but also for documents they request, store on their registered devices etc. We looked into one of the tools they use:'confidentiality management system'. Developed by the company Super Red Technologies.

Read our investigation into how the software operates, how internal networks of the Chinese state are structured and how they are surprisingly transparent, being stripped of most baseline security like TLS, so traffic can be monitored. Worth a read...

https://t.co/nYf2NEiYOf

[NetAskari @NetAskari]

"signalling logs, packet captures, routing data, and other telecommunications sources to trace the methods and origins of advanced surveillance activity. This analysis identified 4G infrastructure associated with operator networks based in Israel, the United Kingdom, and the Channel Islands." https://t.co/FjmagECZxh

[JParticle 🇨🇦🇺🇦 @JParticle0]

@sfali789 @elonmusk This is Elon just being a fucking twat, he's just trying to keep everyone divided. He's a fucking BITCH!

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft has identified an active supply chain attack using typosquatted npm packages to steal cloud and CI/CD secrets. On May 28, 2026, a single threat actor operating under newly created maintainer alias vpmdhaj published 14 malicious packages within a 4-hour window. https://t.co/jC3f2m6EBp

The packages typosquat well-known OpenSearch, ElasticSearch, DevOps, and environment-configuration libraries, and several spoof the upstream OpenSearch project’s repository URL in their package.json to appear legitimate.

Once installed, the packages harvest AWS credentials, HashiCorp Vault tokens, and CI/CD pipeline secrets from the host environment. Read the blog from the Microsoft Defender Research team to an in-depth analysis, as well as mitigation, detection, and hunting guidance.

[JParticle 🇨🇦🇺🇦 @JParticle0]

@xgigglypuff where did giggly go?

[vx-underground @vxunderground]

Chat, I don't want to be that guy, but I think Microsoft has really pissed off security researchers and we're approaching the tipping point.

This Eclipse guy has really rocked the boat for Microsoft.

[International Cyber Digest @IntCyberDigest]

‼️ After the MSRC blog post about Nightmare-Eclipse, researchers are coming forward with their own MSRC horror stories.

The response from the security community isn't going Microsoft's way. As they’re not backing Microsoft.

Gabriel Landau, a well-known Windows security researcher, says he reported a Device Guard bypass with a 90-day window. MSRC told him it met their bar and they'd fix it, then asked him to hold disclosure for extra months. He agreed on the condition they issue a CVE. They patched it silently, decided after the fact it "didn't meet the bar," and never issued the CVE. In his words: "MSRC strung me along for a few extra months to keep me quiet, then broke their word."

Another researcher, rootsecdev, says he responsibly disclosed a legacy-auth flaw that allowed password spraying while avoiding smart lockout. Five months later, MSRC replied that it "doesn't meet the bar for servicing," silently fixed it, and closed the case.

Microsoft's post was meant to defend their coordinated disclosure policy. Instead it became a thread of researchers explaining why they've stopped trusting their process.

[Dark Web Informer @DarkWebInformer]

🚨 Allianz allegedly targeted in ~500 internal Docker images leak

A threat actor on an underground forum is claiming to release a full dump of roughly 500 Docker images, totaling around 40 GB, allegedly originating from Allianz internal infrastructure.

The actor claims the images contain exposed configuration files, source code, credentials, and private keys.

𝗪𝗵𝗮𝘁'𝘀 𝗮𝗹𝗹𝗲𝗴𝗲𝗱𝗹𝘆 𝗲𝘅𝗽𝗼𝘀𝗲𝗱:

• Exposed configuration files with API keys, DB passwords, and service tokens
• Internal microservices with source code
• Hardcoded credentials for staging and prod environments
• TLS private keys and internal CA certs

𝗗𝗲𝘁𝗮𝗶𝗹𝘀:

𝗧𝗮𝗿𝗴𝗲𝘁: Allianz
𝗦𝗲𝗰𝘁𝗼𝗿: Insurance / Financial Services
𝗔𝗰𝘁𝗼𝗿: hackformetome
𝗖𝗹𝗮𝗶𝗺: Full dump of internal Docker images
𝗘𝘅𝗽𝗼𝘀𝘂𝗿𝗲: ~500 Docker images (~40 GB)
𝗣𝗿𝗶𝗰𝗲: 10 Points
𝗢𝗯𝘀𝗲𝗿𝘃𝗲𝗱: May 28, 2026

💥 Stop guessing what's redacted. Paid subscribers see everything: https://t.co/281Qjc6p2J

[Microsoft Threat Intelligence @MsftSecIntel]

The Gentlemen ransomware, a ransomware-as-a-service (RaaS) platform managed and operated by a threat actor that Microsoft Threat Intelligence tracks as Storm-2697, enables attacks at scale conducted by affiliates. https://t.co/QUUyt0AYc6

[Cyber Security News @The_Cyber_News]

⚠️ Critical Notepad++ Vulnerabilities Allow Attackers to Execute Arbitrary Code

Source: https://t.co/iSort2Ikje

Notepad++, one of the most widely used open-source text editors for Windows, has released an urgent security update addressing three vulnerabilities, including two arbitrary code execution flaws that could allow attackers to silently run malicious programs on a victim's machine.

The most severe of the three is CVE-2026-48778, which targets the <GUIConfig name="commandLineInterpreter"> tag inside Notepad++'s config.xml file.

📌 CVE-2026-48770 - Crash via malformed XML structure

📌 CVE-2026-48778 - Arbitrary code execution via config.xml

📌 CVE-2026-48800 - Arbitrary code execution via shortcuts.xml

#cybersecuritynews