AR

I’m a security researcher who loves exploring virtual machine and containers. I have a passion for hacking KVM and other Hypervisors, containers, kubernetes.

[Utkarsh Sharma @techxutkarsh]

Stop burning tokens on Claude Code.

Use this instead 👇

A free GitHub repo (80K⭐) that turns your CLI into a high-performance AI coding system.

Link → https://t.co/JMxCkTjHP7

Why it’s different:

→ Token optimization
Smart model selection + lean prompts = lower cost

→ Memory persistence
Auto-save/load context across sessions
(No more losing the thread)

→ Continuous learning
Turns your past work into reusable skills

→ Verification loops
Built-in evals to make sure code actually works

→ Subagent orchestration
Handles large codebases with iterative retrieval

Most people think Claude struggles with complex repos.

It doesn’t.

They’re just not using the right setup.

This fixes that.

Bookmark this for your AI stack. ♻️

#AI #Claude #AIAgents #LLM #GenAI #DevTools

[Tim Blazytko @mr_phrazer]

New blog post: Building a Pipeline for Agentic Malware Analysis

Agentic RE + malware analysis with custom skills, MCP tooling, and persistent case state to automate intial triage

Link: https://t.co/Itj9S3rA9q

Github: https://t.co/kfvjN7ot4d

[Shraddha Bharuka @BharukaShraddha]

Most people treat CLAUDE.md like a prompt file.

That’s the mistake.

If you want Claude Code to feel like a senior engineer living inside your repo, your project needs structure.

Claude needs 4 things at all times:

• the why → what the system does
• the map → where things live
• the rules → what’s allowed / not allowed
• the workflows → how work gets done

I call this:

The Anatomy of a Claude Code Project 👇

━━━━━━━━━━━━━━━

1️⃣ CLAUDE.md = Repo Memory (keep it short)

This is the north star file.

Not a knowledge dump. Just:

• Purpose (WHY)
• Repo map (WHAT)
• Rules + commands (HOW)

If it gets too long, the model starts missing important context.

━━━━━━━━━━━━━━━

2️⃣ .claude/skills/ = Reusable Expert Modes

Stop rewriting instructions.

Turn common workflows into skills:

• code review checklist
• refactor playbook
• release procedure
• debugging flow

Result:
Consistency across sessions and teammates.

━━━━━━━━━━━━━━━

3️⃣ .claude/hooks/ = Guardrails

Models forget.

Hooks don’t.

Use them for things that must be deterministic:

• run formatter after edits
• run tests on core changes
• block unsafe directories (auth, billing, migrations)

━━━━━━━━━━━━━━━

4️⃣ docs/ = Progressive Context

Don’t bloat prompts.

Claude just needs to know where truth lives:

• architecture overview
• ADRs (engineering decisions)
• operational runbooks

━━━━━━━━━━━━━━━

5️⃣ Local CLAUDE.md for risky modules

Put small files near sharp edges:

src/auth/CLAUDE.md
src/persistence/CLAUDE.md
infra/CLAUDE.md

Now Claude sees the gotchas exactly when it works there.

━━━━━━━━━━━━━━━

Prompting is temporary.

Structure is permanent.

When your repo is organized this way, Claude stops behaving like a chatbot…

…and starts acting like a project-native engineer.

[OtterSec @osec_io]

We recently achieved guest-to-host escape by exploiting a QEMU 0day.

We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.

Writeup coming next week.

[LiveOverflow 🔴 @LiveOverflow]

We take a closer look at the 2nd exploit, and sit down with @_manfp to learn about his research process.

https://t.co/h59rteNoNU

[Nav Toor @heynavtoor]

🚨 Someone just open sourced a fully autonomous AI hacker and it's terrifying.

It's called Shannon.

Point it at your web app, and it doesn't just scan for vulnerabilities. It actually exploits them. Real injections. Real auth bypasses. Real database exfiltrations.

Not alerts. Not warnings. Actual working exploits with copy-paste proof-of-concepts.

Here's what this thing does autonomously:

→ Reads your entire source code to plan its attack
→ Maps every endpoint, API route, and auth mechanism
→ Runs Nmap, Subfinder, and WhatWeb for deep recon
→ Hunts for Injection, XSS, SSRF, and broken auth in parallel
→ Launches real browser-based exploits to prove each vulnerability
→ Generates a pentester-grade report with reproducible PoCs

Here's the wildest part:

It follows a strict "No Exploit, No Report" policy. If it can't actually break it, it doesn't report it. Zero false positives.

It pointed at OWASP Juice Shop and found 20+ critical vulnerabilities in a single run including complete auth bypass and full database exfiltration.

On the XBOW Benchmark (hint-free, source-aware), it scored 96.15%.

Your team ships code daily with Claude Code and Cursor. Your pentest happens once a year. That's 364 days of shipping blind.

Shannon closes that gap. One command. Fully autonomous.

The Red Team to your vibe-coding Blue team. Every Claude coder deserves their Shannon.

10.6K GitHub stars. 1.3K forks. Already trending.

100% Open Source. AGPL-3.0 License.

[Muqsit 𝕏 @mqst_]

🌏 Browser Exploitation 101: A Series of Blog posts for anyone interested in Chrome Browser Exploitation.

Part 1: https://t.co/2MyvKCeU3k
Part 2: https://t.co/ouhLfrY74O
Part 3: https://t.co/hAsE5UIpDZ

#infosec

[Dark Web Informer @DarkWebInformer]

🚨CVE-2025-41115: Grafana Privilege Escalation and User Impersonation

CVSS: 10

PoC: https://t.co/9qtAk0PpMP

Advisory: https://t.co/nZAsVZrFVW

Timeline:

2025-11-04 - Issue discovered internally
2025-11-04 - Incident declared
2025-11-05 - Cloud vendors privately notified & patched
2025-11-19 - Public disclosure and official fix released

[The Hacker News @TheHackersNews]

🚨 Grafana fixed a major security bug (CVSS 10.0) that could let attackers sign in as admin users.

It affects Grafana Enterprise 12.0.0–12.2.1 if SCIM provisioning is turned on — a number like “1” could trick the system into giving admin access.

Update now to stay safe. Read more ↓ https://t.co/bO1Z16cAGn

[Joe Schottman @JoeSchottman]

@chrissanders88 I could write a book on this. ;)

First, start with what no longer accessible means. Is this for all users? Just from the internet? Just from the company network? Are they getting any kind of WAF/bot block notice?

[AR @Ne0nR3d]

🚀 Excited to share my first CVE disclosure!
Check it out here:
🔗 https://t.co/FzrKbfnL0g

#CVE

[daniel @hackermondev]

https://t.co/1yLNEPKcGg

[Alisa Esage Шевченко @alisaesage]

Wrapping up my public research & leadership work of 2024

Browser Exploitation workshop at VXCON "Attacking v8 from zero to exploit" https://t.co/pGGI8LCM5F

Fuzzing from First Principles presentation at OffByOne Security Podcast https://t.co/KTYZLBbiuC

Pwn2Own 2021 hypervisor virtual machine escape exploit https://t.co/FNuFCAvbvR

0-Day Insights on Google Chrome in-the-wild exploit chain https://t.co/XXIeT8NQHT

0-Day Insights on TianfuCup virtualization exploits https://t.co/95sCudPSaX

Keynote at VXCON 2024 https://t.co/0GA4w82VRy

+ My new research release on Qualcomm QDSP6 Hexagon reverse engineering has been claimed by a cool conference in Asia. See you there and at @zerodaytraining events in 2025!

[AR @Ne0nR3d]

@chux13786509 The payload above won't cause XSS. However, consider the following payload for the backgroundColor:

blue;</style><script>alert(document.domain)</script>

This payload will trigger XSS in the given code.

[Danielle Aminov @AminovDanielle]

I was looking into how organizations deploy Spring Boot Actuator in the cloud and found 1 in 4 exposed Actuators had security flaws leading to data leaks or RCE. These risks are more common than you'd think..⚠️

[James Kettle @albinowax]

If you like bounties, I highly recommend this presentation from @tincho_508 on novel web cache deception techniques. It comes with @WebSecAcademy labs too!
https://t.co/XdE0SN3Ccz

[Alisa Esage Шевченко @alisaesage]

Releasing full 2+hr video of my browser exploitation workshop from VXCON 2024: https://t.co/SBn4fMarPU

In which I show what goes inside the mind of a skilled hacker while exploiting a highly non-trivial vulnerability in v8, from zero to exploit concept.

Especially this workflow requires advanced abstract thinking, thereby emphasize the role of theoretical modeling in attacking hard zeroday research targets, which is a part of why it's fun. @zerodaytraining

[Leonid Bezvershenko @bzvr_]

🚨 We discovered two malicious Python packages in #PyPI repository that remained undetected for over a year. These packages mimicked tools for working with popular AI language models (#ChatGPT and #Claude), silently exfiltrating data and compromising developer environments.

Full details and IOCs in the thread 👇

[Assal Rad @AssalRad]

It didn’t start a year ago.

[Martijn B (x1m) @x1m_martijn]

Excellent read for iOS security researchers, pentesters and bug bounty hunters - "Modern iOS Pentesting: No Jailbreak Needed" https://t.co/qwHw3YUIgX

#iOS #mobile #pentesting #jailbreak