Scrow

Pentester | Mentor @Guardia_School

[Cyber Security News @The_Cyber_News]

🚨 Critical 18-Year-Old NGINX Vulnerability Enables Remote Code Execution Attacks

Source: https://t.co/JRMGVhvuEC

A critical heap buffer overflow vulnerability, lurking in NGINX's source code since 2008, has been publicly disclosed. This vulnerability has been publicly disclosed, along with a working proof-of-concept exploit that can enable unauthenticated remote code execution (RCE) against one of the most widely used web servers in the world.

Assigned a CVSS score of 9.2, CVE-2026-42945 resides in NGINX's ngx_http_rewrite_module. This engine powers URL rewriting and variable assignment in virtually every modern NGINX deployment.

#cybersecuritynews

[开发者Hailey @IndieDevHailey]

恐怖！用家Wi-Fi就能知道隔壁墙后的人在干什么！
开源项目 RuView 在GitHub已经冲到 5万+星，直接炸了！

完全不用摄像头，也不用戴任何设备，就靠家里普通的WiFi信号，就能穿墙透视：

- 隔壁有几个人、在哪个位置、是走路还是躺着，全看得见
- 实时看人体姿态（17个关键点）
- 睡觉时自动测呼吸和心率
- 有人跌倒立刻报警，动作识别超准

用WiFi CSI + AI，把你家路由器直接变成隐形雷达！
没有视频、没有录像，隐私安全拉满，天然符合GDPR，完全本地跑，不上云。
ESP32几块钱就能玩，Docker零硬件也能直接试。

[pira;) @0xPira]

QUER SE DESAFIAR COM WEB HACKING?
https://t.co/40xxK1qcew
https://t.co/42fQ9J0eUp
https://t.co/dyrajCyj60
https://t.co/6bAOwUu1fH

QUER SE DESAFIAR COM EXPLORAÇÃO BINÁRIA?
https://t.co/8GKG8XwDhl
https://t.co/PaZLQh4YIA
https://t.co/i0KICBl3Sh
https://t.co/Tapjepoxjl

QUER SE DESAFIAR COM CRIPTOGRAFIA?
https://t.co/Kd9HrRxFJ9
https://t.co/Haey6o9oqV
https://t.co/ieUXHHOMDF

QUER SE DESAFIAR COM ENGENHARIA REVERSA?
https://t.co/E1kpWfyi8E
https://t.co/xAgtETuio0
https://t.co/oI9smjdU77
https://t.co/roerii4wtO
https://t.co/YmJ0XkSWa0

QUER SE DESAFIAR COM FORENSICS?
https://t.co/WvASrNB7Vn
https://t.co/Htm9ZeeLom
https://t.co/vxeGzu6FcH

QUER SE DESAFIAR COM OSINT?
https://t.co/hyeg8cKWaJ
https://t.co/3hGGTGIWpu
https://t.co/9FU2L1k3gK
https://t.co/pTFzF6ID8Y

QUER SE DESAFIAR COM TUDO?
https://t.co/0VnJrPWyqu
https://t.co/sOy2NcukDv

[vx-underground @vxunderground]

People are asking how the OSINT nerds found the guy that drained the cancer bro.

Well, it's very shrimple

The shitty malware sent all the stolen data to a Telegram the scammers made.

We connected to the Telegram channel using the same credentials that were inside of the shitty malware

Inside the channel was the scammer(s)

We got their Telegram IDs

OSINT nerds used their Telegram IDs to see if they were in any other public facing chatrooms.

One of the scammers in there was in several fraud chatrooms. He advertised looking for a video game programmer to make a basic 2D game. He also advertised needing help with some malware stuff.

In a different chatroom he talked about how much he likes skateboarding.

In a different channel he shared his Instagram and was sharing photos of himself next to expensive cars

Then, OSINT nerds looked at his Instagram which had a LinkTree. His LinkTree linked to literally everything about the guy including his YouTube, PayPal, Kick, Twitter, etc.

So either he is a master of disguise, and ran a year long detrace campaign to throw off OSINT nerds in the event he's caught scamming

Or alternatively, he wasn't aware public Telegram chatrooms are public and could be searched easily.

[SaxX ¯\_(ツ)_/¯ @_SaxX_]

Le @SecretService des USA a démantelé un réseau de +300 serveurs SIM et 100 000 cartes SIM à New York.
Ils attribuent cette opération à un acteur malveillant très probablement parrainé par un état -on parle souvent de "state sponsored actor"-

Le dispositif visait à paralyser les systèmes de télécommunications et de mener des attaques téléphoniques anonymes.

Ils se rejouissent de cette opération qui laissait peser une vraie menace avant l'arrivée des dirigeants mondiaux à l'Assemblée Générale des Nations Unies.

📰https://t.co/KkcWWcQRQJ

[Aleekk @aleekk0]

Decided to do some digging to track down the scammers who stole $32k from a cancer patient.

His clueless bimbo girlfriend couldn’t help but flex on TikTok with money stolen from multiple victims.

The biggest mistake most of these scammers make is showing off their lifestyle on social media, leaving clues for everyone to trace them.

1/4

[Kévin GERVOT (Mizu) @kevin_mizu]

I've released a DOMLogger++ config that helps detect any replacements occurring in a DOMPurify output by inserting and tracking a canary value at runtime.

I think it highlights how useful DOMLogger++ can be for tracking JS execution :D

👉 https://t.co/ScqNSP1j8b

1/3

[Scrow @ScrowHacking]

@The_SoCruX @Guardia_School Merci ☺️ Oui je reposte les vidéos sur insta également

[7h3h4ckv157 @7h3h4ckv157]

DEF CON 32 - 2024 Media Server link:

https://t.co/63g0M1oDT7

#defcon32 #Defcon #infosec #Hacking #infosecurity #CybersecurityNews

[gmh5225.eth @gmhzxy]

.NET assembly loader with patchless AMSI and ETW bypass
https://t.co/81Lz2zrgTX

[Het Mehta @hetmehtaa]

Introduction to Windows Kernel Exploitation for Beginners

Part 1: https://t.co/iytco8khA0
Part 2: https://t.co/Kr5z56e0pV
Part 3: https://t.co/sdI2uEndk6
Part 4: https://t.co/6DmUNO3iQU
Part 5: https://t.co/CW1ulPqGqq

#windows #infosec #kernal #exploit #100xSecurity

[7h3h4ckv157 @7h3h4ckv157]

Conference presentation slides:

Credit Link: https://t.co/TxX2iPGycD

- Black Hat USA 2024 slides (3-8 August,2024)
- REcon 2024 Slides (28-30 Jun,2024)
- Offensivecon 2024 (May 10-11,2024 Berlin)
- Blackhat Asia 2024 (April 16-19, 2024 Marina Bay Sands / Singapore)
- Blackhat Asia 2023
- Offensivecon 2023
- Blackhat USA 2023
- Recon 2023
- Blackhat Europe 2023

[Guardia Cybersecurity School @Guardia_School]

Aujourd'hui TikTok s'est fait pirater ! 790Go de données utilisateurs (y compris des informations bancaires) exfiltrées.

https://t.co/oonu9My0wX

[Guardia Cybersecurity School @Guardia_School]

Quelques détails techniques sur la dernière vulnérabilité 'Dirty Cred' révélée lors de la BlackHat 2022 :

https://t.co/Z8dbECcaw4

[Zhenpeng (Leo) Lin @Markak_]

The latest Google Pixel 6 pwned with a 0day in kernel! Achieved arbitrary read/write to escalate privilege and disable SELinux without hijacking control flow. The bug also affects Pixel 6 Pro, other Pixels are not affected :)

[Guardia Cybersecurity School @Guardia_School]

2 nouvelles CVE qui permettent de prendre le contrôle à distance de ton iPad, iPhone ou Mac 📱💻

https://t.co/3pMDqgNAV3

[Guardia Cybersecurity School @Guardia_School]

Voici un rapport d’Incident/Réponse (source interne) qui donne un peu plus de détails sur la cyber attaque qu’a subi Cisco il y a quelques jours :

https://t.co/PTa9d2YByR

[Guardia Cybersecurity School @Guardia_School]

Le gouvernement des Etat-Unis double la récompense et offre dorénavant 10M$ pour des renseignements sur les cyber groupes nord-coréens 😮

https://t.co/Gouf9zK2AV

[briankrebs @briankrebs]

A new user on the Russian cybercrime forum Exploit just posted a video claiming to show a zero-day, remote code execution exploit in Google's latest Chrome browser running on Windows 10. Asking price: $2M. h/t @HoldSecurity