Martin

[Low Level @LowLevelTweets]

my bad bro?

[Jonas L @jonasLyk]

@KooKiz Thats not how it works- you just do a countdown untill its dropped as a zero day- suddenly they can reproduce it.

[Bobby Cooke @0xBoku]

Coding assembly == CRIME
@AnthropicAI @claudeai

[thaidn @XorNinja]

Someone from XBOW claimed that they found 23 nginx configs from GitHub vulnerable to nginx-rift.

It turns out 22 out of the 23 were actually PoCs of nginx-rift itself. Not sure about the remaining one. Good call from @julianor.

Here are the 4K nginx configs that we downloaded from GitHub: https://t.co/Ba27Ob6Ttz

We also did a brief analysis of nginx-poolslip, and couldn't find any vulnerable configs either. There were some close calls though.

We'll download and analyze more configs, and share our results later.

Hopefully from now on, whenever someone publishes a new nginx exploit, they also publish whether it can actually be exploited against configs found in the wild on GitHub.

Absence of evidence is not evidence of absence, but it still gives useful data points about how practical these exploits really are. Of course, people should patch anyway.

[Dodo on Security 🇵🇸 🇺🇦 @dodo_sec]

No. This is 20 pages of AI slop from a guy that discovered file locks and has no idea what an EDR does. Stop making stupid people famous

[Justin Elze @HackingLZ]

Firefox is finally going to solve browser security all while having 2% of browser market share.

[Brad Spengler @spendergrsec]

And to make sure you know it's important, they also published a CVE for this: https://t.co/i5MofhJooN A "vulnerability" that exists only when you provide dhash_entries=1 on the kernel commandline, resulting in a crash of the kernel at boot.

[Joseph Thacker @rez0__]

thank you claude

[def1ant @0xdef1ant]

"we had a good thing, you stupid son of a bitch! we had Lows. we had Mediums. we had renderer RCE bonuses, and it all ran like clockwork! you could have shut your mouth, let your fuzzers run, and made as much money as you ever needed! it was perfect! but no, you just HAD to go and flood the team with your AI-hallucinated slop reports"

[Jason Lang @curi0usJack]

It's not. Nobody look at this.

[Justin Elze @HackingLZ]

@gadievron CISOs are going to read ‘181 working Firefox exploits’ and think remote access. But those were generated with sandboxing and other protections off not how anyone runs Firefox. More vulnerabilities ≠ more real world exploit chains. That distinction matters

[David @dmcxblue]

@HackingLZ @mrd0x Damn I just woke up, I found out attacks are living of the land using legitimate windows binaries

[David @dmcxblue]

@RoundtableSpace Red Teamer here, I can 100% confirm that when I hack I use nmap, I like to run apt update and apt upgrade, and call web vulnerabilities a Red Team, this will replace all the Yellow Team, Orange Team, Black Team, PlayStation Team, Xbox Team in CyberSecurity

[Dan Neidle @DanNeidle]

Which of course you don't have.

What devilish hacking is required to get past this?

Press the "back" key a few times. Should take you back to your dashboard. Instead you get to *the* *other* *company's* *dashboard*.

[Patrik Grobshäuser @ITSecurityguard]

I finally let Claude do my pentest this week. Full 5-day engagement, zero human input. Here's what the client got: 😏

https://t.co/1PPuxhs4V9

#bugbounty #pentesting #AI #cybersecurity #infosec #claudeai

[Garrett @unsigned_sh0rt]

Open Twitter hoping to see some new blog about some new technique or something when I just end up finding yet another red team agent that runs Hydra

[Josh @passthehashbrwn]

It really annoys me that ClickFix has a name but especially when it's described as sophisticated or interesting. Oh wow you tricked someone into executing cmd /c, WE GOT AN APT OVER HERE!

[Josh @passthehashbrwn]

@_RastaMouse Need a lab that's just 500 SMB shares, the flag is 8 folders deep, and if you try to automate it your credit card gets charged

[Youssef Sammouda (sam0) @samm0uda]

$312,500 worth of stored/reflected XSS vulnerabilities in Meta’s Conversions API Gateway allowed Javascript code to run on any Facebook domain and millions of third-party websites. The flaw enabled zero-click Facebook account takeover and more:

https://t.co/7gWpR4LQ8x