Nemesis Breach and Attack Simulation

Challenge your security before attackers do! Continuously and with persistence!

[Nemesis Breach and Attack Simulation @Persistent_Psi]

We scanned thousands of hosts for CVE-2026-48710 and found something important: being behind a reverse proxy, CDN, or Cloudflare is not always enough protection. In some setups, X-Forwarded-Host can still be used as a bypass. (1/2)

[Nemesis Breach and Attack Simulation @Persistent_Psi]

If backend middleware trusts X-Forwarded-Host and updates the ASGI scope, the malicious value can still reach ASGI and Starlette. We’ve updated the https://t.co/wWB8e92ADO scanner to test this automatically. Re-check your hosts! #badhost (2/2)

[Nemesis Breach and Attack Simulation @Persistent_Psi]

We scanned thousands of hosts for CVE-2026-48710 and found something important: being behind a reverse proxy, CDN, or Cloudflare is not always enough protection. In some setups, X-Forwarded-Host can still be used as a bypass. (1/2)

[Markus Vervier @marver]

Full details of CVE-2025-53773 (RCE via Copilot in VSCode, Visual Studio, and other IDEs..) thanks to @gitlab and in particular @joernchen for the collaboration.

[Nemesis Breach and Attack Simulation @Persistent_Psi]

🚨 New RCE in Visual Studio & Copilot (CVE-2025-53773)!
0-Click command execution via prompt injection in READMEs/code comments. AI can alter settings & execute commands, risking CI/CD pipelines.
Patch now!

Full details: https://t.co/9HmJDmAnSW

[Nemesis Breach and Attack Simulation @Persistent_Psi]

Here's Claude Desktop using the Nemesis MCP servers to set up a test scenario from a malware sample analysis, fully automated!
If you're a researcher and have cool ideas and applications for AI automation with Nemesis, sign up to the wait list here: https://t.co/z2GcuAaAkr

[Markus Vervier @marver]

We've released the first breach and attack simulation MCP - Nemesis MCP server integration is here: https://t.co/BRMobCK9uA

[Nemesis Breach and Attack Simulation @Persistent_Psi]

434c53388db2cc62e6f2070f77e69f174a78abf65c058b22c1fb2fcaedeb2d62

[Markus Vervier @marver]

🙏 The eSIM/eUICC Security Training at @hardwear_io was also a lot of fun for me to hold. I'm happy to have had such a knowledgeable group with a great dynamic!

[Nemesis Breach and Attack Simulation @Persistent_Psi]

Proud to announce that PSI has secured a $1M investment from Georg Wicherski, ex-CrowdStrike.

This means we’re doubling down on combining DORA compliance with Breach and Attack Simulation, growing our team, and wave of new features.

Grateful for the belief in our team!

[Nemesis Breach and Attack Simulation @Persistent_Psi]

Digital Operational Resilience Act Series: Regulator Reactions and Information so far.

https://t.co/Jc5tzA0fl5

#DORA

[hardwear.io @hardwear_io]

📢 Attention all security engineers, researchers and developers!

Let's uncover the secrets of eSIM along with @marver at #hw_ioNL2024; learn about secure deployment practices, potential attack surfaces, and much more!

Link: https://t.co/ydeppocmh2

#esim #euicc #securityexperts

[Nemesis Breach and Attack Simulation @Persistent_Psi]

A remote code execution vulnerability has been identified in Windows systems that can compromise devices via WiFi. Ensure your safety and learn how to protect yourself: https://t.co/ww9a2EBW7X

CVE-2024-30078

[b33f | 🇺🇦✊ @FuzzySec]

CVE-2024-30078 Kunlun Lab 👀🔥 https://t.co/4G7DoWbjC0

[Nemesis Breach and Attack Simulation @Persistent_Psi]

How our team found a bypass for phishing proof @okta MFA and how it was handled:

https://t.co/JEV5RUmmxO

[antisnatchor @antisnatchor]

Read about how our @Giutro and Nikos from @Persistent_Psi bypassed @okta Verify "phishing-resistant" features.

https://t.co/iidlTQeLim

All your sessions are belong to us 🎣

[Nemesis Breach and Attack Simulation @Persistent_Psi]

Mike Cartoscelli joins the PSI team as our new COO! Having 29 years of experience in technology, he will focus on bringing our Breach and Attack Simulation (BAS) product Nemesis to a wider market and focus on how Nemesis can assure compliance to the DORA regulatory framework.

[Nemesis Breach and Attack Simulation @Persistent_Psi]

Hope to see you at @nullcon 2024. The PSI team is looking forward!

[NULLCON @nullcon]

Raise your hand ✋ if you believe in practical learning rather than theory!

We've got you covered with our #NullconBerlin2024 7 hands-on, in-person Training sessions.

Training Objectives: https://t.co/v4vP7Fg5Hl

#infosectraining #ethicalhacking #cybersecurity

[Nemesis Breach and Attack Simulation @Persistent_Psi]

Learn from the best or get phished like the rest, attend the training at @nullcon Berlin 2023 by our expert @Giutro: https://t.co/xEIcbZIuUY

[Markus Vervier @marver]

Want to know how to audit large software projects effectively? Eric Sesterhenn and myself will teach what you need to know @nullcon: https://t.co/nbcnSWhezN

[Cooper @Ministraitor]

Embedded Threats: A Deep Dive Into The ESIM World
- Markus Vervier
https://t.co/RC1PfjWgQt
#hacklu @hack_lu