jack Ed

Ein Gesunder gheist in einem Gesunder körper(237) 🇨🇲

[jack Ed @SimpliceEd]

Men are trash certes mais women are .....

[bearstech @bearstech]

Il reste moins de 10 places disponibles pour notre webinaire sur la gestion des CVE.

Inscrivez-vous dès maintenant 👇
https://t.co/AD5w2VB1vL

[bearstech @bearstech]

Toutes les instances GitLab de nos clients sont à jour, version 19.5.5

Une première mise à jour a eu lieu hier à 10h (v. 19.5.4), puis une autre ce matin à 8h30 (v. 19.5.5).

Nous avons encore de la place pour 2 instances managées GitLab cette année. Contactez-nous 👉 https://t.co/qN7cCObmXG

[bearstech @bearstech]

@SimpliceEd Il y aura un replay (mais c'est pas la même chose !)

[bearstech @bearstech]

Comment gérer efficacement les CVE et faire face à leur multiplication ?

Lors de notre prochain webinaire, nous partagerons les bonnes pratiques des 🐻 !

Le nombre de places est limité à 90 participants ! Ne tardez pas à vous inscrire 👇
https://t.co/AD5w2VB1vL

[jack Ed @SimpliceEd]

@bearstech Moi qui voulait participer mais je vois que c’est à 15h 😭

[ernestine @jeannehd4rk]

qui a site de streaming svp svp

[YouKyi - Alexandre @youkyi]

@SimpliceEd @vincemdk @bearstech Bunkerweb, se base sur du moddecurity, pour la partie waf déjà :)
Intégration avec crowdsec, et open app-sec ;)

[Thomas Roccia 🤘 @fr0gger_]

👇👇👇

Cairn: https://t.co/A944bxggpa
CyberStrike: https://t.co/NMpLwnnOHD
PentAGI: https://t.co/7UlKaDarHM
CyberStrikeAI: https://t.co/MR3dbULak2
PentestGPT: https://t.co/7zqkm3yFj3
PentestAgent: https://t.co/Ri5SF2Te2S
AutoPentester: https://t.co/5yp3b3i4xP
VulnBot: https://t.co/JbdW0EHDt4
RedAmon: https://t.co/JhW5yqVfvT
MAPTA: https://t.co/dmljK1MiRy
Strix: https://t.co/2WOqtOKSnR
Shannon: https://t.co/nYMw152xL2
BugTraceAI: https://t.co/0vvhOVVden
Nebula: https://t.co/yZg0VTEMCF
hackingBuddyGPT: https://t.co/9077GXSsOV
HexStrike AI: https://t.co/AnMsWQTv6E
CAI, now archived: https://t.co/MZmr5rL4OT

[jack Ed @SimpliceEd]

@Kay2mbeVdf_ Vous auriez pu demander à vos parents respectifs de vous accompagner

[Suraj Sharma @suraj_sharma14]

If you learn AI Security Engineering, you will never be unemployed again.

I’ll do this.

Stage 1: AI Attack Surfaces & Threat Modeling
- Learn: OWASP Top 10 for LLMs, STRIDE for AI, the "Confused Deputy" problem in agentic workflows & data flow mapping.

- Practice: Draw a complete threat model for an AI agent that reads emails and writes to a CRM, identifying every indirect injection and data exfiltration vector.

- Why: You cannot secure an agentic workflow if you don't understand how an attacker can hijack the agent's legitimate privileges.

Stage 2: Advanced Prompt Injection & Jailbreaking
- Learn: Direct vs. Indirect injection, Crescendo attacks (multi-turn grooming), payload splitting and encoding evasion (Base64, ROT13).

- Practice: Build an automated harness that successfully bypasses a commercial LLM's system prompt using a multi-turn Crescendo strategy.

- Why: Basic "ignore previous instructions" filters are trivial to bypass. Modern attacks groom the model's context over multiple turns.

Stage 3: Agentic Security & MCP Tool Poisoning
- Learn: Model Context Protocol (MCP) security, JSON-RPC sanitization, shadow tool execution and least-privilege scoping for agents.

- Practice: Write an MCP server that strictly validates incoming tool parameters via Pydantic and blocks "confused deputy" attacks where a user prompt tries to access admin tools.

- Why: Agents are only as secure as the tools they call. Tool poisoning is the SQL Injection of the Agentic Era.

Stage 4: RAG Security & Data Poisoning
- Learn: Vector DB access control, citation spoofing, shadow context injection and row-level security for semantic search.

- Practice: Inject a "poisoned" document into a RAG pipeline that forces the LLM to output a specific malicious URL when queried about company policy.

- Why: If an attacker can slip a poisoned document into your knowledge base, they own every answer the AI generates.

Stage 5: PII, Privacy & Cryptographic Guardrails
- Learn: Deterministic masking, UUID swapping, differential privacy and pre-flight/post-flight unmasking proxies.

- Practice: Build a middleware proxy that intercepts user prompts, swaps SSNs and credit cards for UUIDs before the LLM sees them and restores them post-generation.

- Why: Compliance teams will kill any AI product that sends raw customer PII to a third-party frontier API.

Stage 6: Identity, Auth & Delegated Access for Agents
- Learn: OAuth2 for machine identities, scoped JWTs, human-in-the-loop (HITL) approval gates and agent-to-agent (A2A) trust boundaries.

- Practice: Build an auth broker where an AI agent acts on a user's behalf using a heavily scoped, time-limited OAuth token, rather than holding the user's raw password.

- Why: Agents need hands but they should never hold the master keys to the enterprise.

Stage 7: Output Validation & Grammar-Constrained Guardrails
- Learn: CFG (Context-Free Grammar) decoding, NeMo Guardrails, output sanitization and regex-enforced JSON schemas.

- Practice: Implement a guardrail layer that physically prevents the LLM from generating markdown links or executable code blocks in its final output.

- Why: You cannot rely on the system prompt to "please don't output bad things." You must enforce it at the token-decoding level.

Stage 8: Automated Red Teaming & Fuzzing
- Learn: Microsoft PyRIT, Garak, LLM-based fuzzing, adversarial dataset generation and CI/CD security gates.

- Practice: Build a CI pipeline using PyRIT that automatically attacks your agent with 1,000 adversarial payloads on every PR, blocking merges if the jailbreak rate exceeds 1%.

- Why: Manual red teaming doesn't scale. You need automated, continuous adversarial fuzzing integrated directly into your deployment pipeline.

Stage 9: Model Extraction & IP Protection
- Learn: Membership inference attacks, model inversion, API rate-limiting by semantic similarity and output watermarking.

- Practice: Build an API gateway that detects and blocks scraping bots trying to extract your fine-tuned model's weights via thousands of systematic, low-temperature queries.

- Why: Your fine-tuned model's weights are your IP. Competitors will try to distill your model through the public API.

Stage 10: Mechanistic Interpretability & Alignment Safety
- Learn: Activation patching, logit lens, circuit discovery, detecting reward hacking and tools like TransformerLens.

- Practice: Locate the specific attention heads in an open-source model responsible for "deception" or "sycophancy" and patch their activations to neutralize the behavior.

- Why: You cannot fix hidden biases or misalignment if you treat the neural network as a black box.

Stage 11: Compliance, Auditing & Governance
- Learn: EU AI Act requirements, NIST AI RMF, immutable audit trails, SOC2 for AI and bias testing frameworks.

- Practice: Build an immutable, append-only audit log that records the exact prompt, retrieved context, tool calls and final output for every single agent action.

- Why: When an AI agent makes a mistake that causes financial or legal damage, the enterprise must be able to prove exactly why it happened.

Stage 12: Public CVEs, Teardowns & Portfolios
- Learn: Responsible disclosure, writing security advisories, publishing threat models and bug bounty hunting for AI.

- Practice: Find a vulnerability in an open-source AI framework (like LangChain or an MCP server), responsibly disclose it and publish a teardown of the exploit chain.

- Why: AI Security is a brand new field. Publishing novel attack vectors and defenses makes you the undisputed authority in the space.

Bookmark and Repost!

[abraxas @abraxas_null]

⚠️💣🔥 Keycloak REMOTE AUTH 0day! 2 bugs. Steal a SAML login 🗝️ Escalate to Realm Admin 💣🔥⚠️

🧬 Hijack a login 🧬
- Unauth Remote (no Keycloak account; needs a redirect-signing SAML broker)
- Finish SAML broker; login as another person by putting SAML%52esponse ahead of the signed SAMLResponse

🧬 Realm admin privilege escalation 🧬
- A help-desk admin maps a pre-built composite of manage-realm onto himself
- Same token then reads the full realm document.
- (Undisclosed sibling of CVE-2026-94000, which only walked composites on group join)

🔐👀🎭 Exploits:
- https://t.co/fo4kX7pCXj SAML account takeover
- https://t.co/0EoX6dZ8jx auth leftover

🔐👀🎭 Write-ups:
- https://t.co/dBAufUc6z4
- https://t.co/Ixbe6AmeNf

[AISecHub @AISecHub]

NIST Workshop on AI Incident Management - https://t.co/iQhew7mKGO

[Nicolas Krassas @Dinosn]

An agentic network pentest tool you talk to. https://t.co/vXhv3XffAa

[jack Ed @SimpliceEd]

@vincemdk @bearstech Pouvez vous me dire s’il est meilleur que modsecurity?

[jack Ed @SimpliceEd]

@Achitxka Passer la douane oui

[jack Ed @SimpliceEd]

@Zinkst_ Amer

[P4mui  @P4mui]

Puis zut : une version alpha est publié en fin de page

Pour le moment c'est très rudimentaire.. vous verrez

Un redesign complet est en cours

Fichier distribué en .IPA, donc installable avec SideStore / Plume Impactor et autres

Des fonctions comme la synchro YT Music : ne fonctionne pas pour le moment

[French Response @FrenchResponse]

Every day we are fighting to prevent French stats from looking like this.

[Kylian Mbappé @KMbappe]

🇨🇲🤍🕊🙏🏽
#EndAnglophoneCrisis

[jack Ed @SimpliceEd]

Imaginez pour certaines tous leurs tatouages sur le corps ont été payé en nature

[La Twitchance @LaTwitchance]

Aux Etats Unis, un tatoueur devient viral après avoir balancé toutes les filles qui auraient « payé en nature » pour obtenir un tatouage gratuit… 😭