Vlad Rico

Pentester and UNIX guy //
PGP=0x11dc6625d03ded38 //
Trying to tweet only useful infosec related things

[Vlad Rico @RicoVlad]

@iMilnb Mdrr j'ai l'impression d'entendre quelqu'un de mon travail parler 👀

[International Cyber Digest @IntCyberDigest]

‼️🚨 BREAKING: 320,000 Fortinet firewall devices have been targeted in a campaign that has been dubbed 'FortiBleed'. Attackers were able to confirm 75,000 working credentials against the admin and SSL VPN interfaces.

The victims include really big names like Samsung, Oracle, Spotify, Sony, and more.

The data was first surfaced by researcher Volodymyr "Bob" Diachenko and analyzed by Hudson Rock and SOCRadar. The operation runs as a self-feeding loop. Attackers scan the internet for exposed Fortinet devices, then test each one against a curated list of passwords leaked from earlier Fortinet breaches and infostealer logs. Every successful login gets recorded into a verified database. They then turn each compromised box into a listening post, sniffing the traffic passing through the firewall to harvest fresh credentials, which go straight back into the scanner.

The scale is large. The group ran an estimated 1.16 billion credential attempts against more than 320,000 FortiGate targets, plus 2.1 billion brute-force tries against 160,000 MSSQL servers. In the deeper intrusions they intercept SSL VPN authentication hashes, crack them on a dedicated 45-GPU cluster, and move into internal Active Directory.

Diachenko confirmed full network compromises in Japan, Taiwan, Vietnam, Iraq, and Turkey, including a Turkish NATO defense contractor that had classified defense documents stolen.

If you run Fortinet, act now: rotate every VPN and admin credential, enforce MFA on all external gateways, restrict management access to approved sources, segment internal networks, and audit gateway logs for unusual logins. Hudson Rock has a free domain lookup at https://t.co/KLv2YiMtpm.

Data surfaced via the Hunt Intelligence, Inc. feed.

[Vlad Rico @RicoVlad]

@iMilnb @charmcli T'as pas précisé fr dans ton post ?

[iMil 🇪🇸🦇 @iMilnb]

Lutinos qui sont balls deep dans l'agentic, si vous avez/faites partie d'une startup de ce domaine dont vous pensez qu'elle roxe, pingez moi.

[BlackWasp @BlWasp_]

On May 29th I will be giving a talk at @sth4ck on synthetic stackframes, how they work, and their usefulness in EDR bypass.
See you there!

[Clandestine @akaclandestine]

🚨 Critical Linux Kernel Vulnerability Alert
Qualys has disclosed ssh-keysign-pwn: a 6-year race condition in __ptrace_may_access() that lets unprivileged local users read root-owned files.
A privileged process (e.g. ssh-keysign or chage) opens sensitive FDs. During do_exit(), after exit_mm() (mm=NULL) but before exit_files(), pidfd_getfd() can steal those FDs.
Impact: • Theft of host SSH private keys → real impersonation & MitM risk until keys are rotated
• Full read access to /etc/shadow → offline password cracking
Affected: All kernels before 31e62c2ebbfd (May 14, 2026) — Ubuntu, Debian, Arch, CentOS, Raspberry Pi OS and more.
Immediate action required: Apply the kernel patch NOW.
🔗 PoC: https://t.co/UZJyKb6Szj
🔗 Patch: https://t.co/rNU2YB4mVv…/31e62c2ebbfd
🔗 Full analysis: Phoronix & Qualys oss-security
#LinuxSecurity #KernelVulnerability #CyberSecurity #InfoSec #OpenSSH #PrivilegeEscalation #ThreatIntelligence #Linux #CyberThreat #PatchNow

[chompie @chompie1337]

kernel hackers go serverless
ring0 → cloud 9 ☁️ ??
brb pwning yr gpu nodes ✨

[Vlad Rico @RicoVlad]

@rockyluke_ @Scaleway Yo ! Je jette un caillou dans la mare mais si vous cherchez toujours début 2027, ca m'intéresse graaaave 🤩🤩 !

[Vlad Rico @RicoVlad]

@iMilnb Si t'es chaud de nous présenter un peu les sujets en live, jdcjdr ;)

[Vlad Rico @RicoVlad]

@iMilnb Tin ça me chauffe mais je connais vraiment peu netbsd 😢

[Vlad Rico @RicoVlad]

@iMilnb it works avec le patch !

[Vlad Rico @RicoVlad]

@iMilnb Propre !

[Charles Fol @cfreal_]

LIGHTYEAR:
- Can dump large files, even through a GET parameter
- Retrieves characters using dichotomy
- Does not cause PHP warnings

[Vlad Rico @RicoVlad]

@snifiboy @_Nidouille_ @nariod_sec obligé de te tag sur ce meme

[Тsфdiиg @tsoding]

I have no idea why Windows is still a thing. Microsoft should just turn it into a Linux Distro with Wine as the standard library, dump shitload of money on the Wine devs to deal with all the shit and stop wasting everybody's time.

[G Milgram @GGmilgram]

🔥Suite de l'enquête sur le bullshit des géobiologues imposés par des prefs. On va parler gaspillage d'argent public mais pas que. J'étais pas près ! Vidéo à voir vraiment (!)en entier🤐Merci pour vos RT et votre soutien, je vais surement en avoir besoin😅https://t.co/4cVA3wW9Kc

[Vlad Rico @RicoVlad]

@iMilnb I need le replay de cette session ! Jpourrai malheureusement pas être sur le live

[vx-underground @vxunderground]

Massive Pokemon leak today.

- Partial Black/White v2 dev builds & source patch files
- Pokemon Bank source code
- Pokémon HeartGold and SoulSilver source code
- Famicom tech demo from 2004
- Black/White Git
- Platinum full SVN

[s0ca @s0ca]

@Meta @facebook
Your last move against drugs is quiet annoying for some reasons.
I'm part of a small band called "Super Acid Bros"
For the record, our name has NOTHING to do with drugs. This is an absolute nightmare for a band our size who depend on the platform for reach 1/2