Andy

To the moon and cyber security.

[Roan @RohOnChain]

this is the most DANGEROUS thing on internet today

REA (Reverse Engineer Anything) - this open source MCP lets your AI agent reverse engineer any app, down to the binary

i just reverse engineered TradingView, now I am using their premium indicators for FREE - software is cooked

here is how to use REA to reverse engineer TradingView:

1. point REA at TradingView's publicly observable interface and map every major feature, from chart interactions to indicators and alerts

2. trace how the interface behaves when you switch symbols, change timeframes, add indicators, draw levels, and update chart layouts

3. use REA's available MCP tools to investigate authorized software artifacts and trace application logic wherever the evidence allows

4. feed those findings into Claude Opus 5.5, which turns the investigation into a technical specification and an implementation plan

5. rebuild the charting engine independently, with real market data, candlesticks, technical indicators, drawing tools, and persistent watchlists

6. add a quant backtesting engine that tests strategies against historical data, accounting for fees, slippage, and drawdowns

7. test every component, compare its behavior against documented and observable results, fix failures, and keep iterating until the system actually works

8. you end up building your own TradingView-style quant research terminal from scratch, with source code you control and features you can keep extending

i won’t say anything more:

[Pepecoin @pepecoins]

🐸 $Pepecoin Official Links 🐸

Website: https://t.co/AEiU6qA3Pa

Virtual World: https://t.co/b65oQtSihu

TG: https://t.co/b1RxBIASJl

CMC: https://t.co/PWNYNx2ZVv

Uniswap: https://t.co/sGZPonkjhR

CA: 0xa9e8acf069c58aec8825542845fd754e41a9489a

[DCRoth @RothDC]

If you’re new to crypto, this is a must-read!

The truth is simple: Information is everything, and your network is your greatest asset.
Be intentional about who you follow; these choices will define your journey.
Surround yourself with the right people, and opportunities will arise.

This list will elevate your game 👇

[James Kettle @albinowax]

Two hours till my HTTP Terminator talk kicks off at SEC-T! You can catch the livestream at 9:15 UTC:
https://t.co/pZfwk4xXcS

[blackorbird @blackorbird]

OMG
The first zero-click worm to spread through WeChat calls across iOS and Android.
https://t.co/XdE1UJIdRP

[Vigolium @Vigolium]

We’ve open sourced Vigolium, a high fidelity vulnerability scanner built in Go 🦫🔓

with 250+ modules, low-noise by design, + AI agents that audit traffic and source code

Your application deserves a real security assessment 👇
https://t.co/FB7EfRD3C9

[Lunar @LunarResearcher]

Andrej Karpathy spent 8 years working at OpenAI and Tesla

Last week, he condensed everything he knows into one free 2-hour lecture

People spend $15K on bootcamps that teach less than half of this

You probably don't have two hours to watch it right now

Just don't let it disappear in your feed

Save it, watch it later, then read the guide below and build your first loop

[Wayne @waynoir]

Google dropped a free 2 hour course on full graph engineering, taking you from a single prompt to a hundred agents wired into loops and graphs

17:44 – Building your first agent
39:30 – Loop engineering, iterate, check, break
1:12:38 – Graph engineering
1:34:26 – Agents that throttle themselves
1:55:05 – Full graph for multi agentic systems

Most people build a single agent and stop there. This course shows the full system, where agents wire themselves into a graph on their own

Watch it today, then check out the graph engineering playbook below for a deeper breakdown

[Mahax @Mahaximus_]

https://t.co/RbVSSvaqXq

[Mahax @Mahaximus_]

Andrej Karpathy:

"Prompting is going away.

Delete everything, keep Graph."

In 1 hour he shows how to build Graphs, and why it's the only thing that will be left standing at the end.

The missing piece most people don't get: LLMs, prompts, agents, they're all steps. Graph is where you end up.

Watch it, then read the full guide on Graphs below.

[yousukezan @yousukezan]

DEF CON 34でAccentureの研究者2人が、USB機器をWindowsへ接続するだけでSYSTEM権限を取得できる「Plug and Pwn」を発表した。管理者権限やログイン中のユーザーを必要とせず、Windows Plug and Playが自動取得する署名済みドライバーパッケージを悪用する。

攻撃ではSierra Wireless機器をエミュレートし、Everyoneに読��書きを許可した名前付きパイプのSetDNS機能を使ってDNSを変更する。続いてSony FeliCa機器をエミュレートすると、コインストーラーが平文HTTPから設定ファイルを取得するため、攻撃者のサーバーへ誘導できる。

さらにパストラバーサルを利用し、SYSTEM権限で任意のファイルをディスクへ書き込む。研究者はSystem32へDLLを配置して読み込ませた。また、RDPのUSBリダイレクトを利用すれば、物理的なUSB機器なしでも一般ユーザーが偽のデバイス情報を送り、サーバー側にSYSTEM権限でドライバーを導入させられるという。

関連するコンポーネントにはSierra Wireless、Sony FeliCa、Wacom、Atheros、Intel RealSenseが含まれる。研究者はFaceDancer用スクリプトなどPoC一式を公開している。
https://t.co/TdiFqA3eno

[Guillermo Casaus @_guillecasaus]

🚨 Acaban de liberar una de las mayores bases de datos de malware en GitHub.

Se llama Malware Research Hub y contiene miles de muestras recopiladas durante más de 50 años para que investigadores y profesionales de ciberseguridad puedan analizarlas en entornos controlados.

Esto es lo que incluye:

→ 2.699 muestras de malware de diferentes épocas
→ Especímenes de familias como Stuxnet y LockBit
→ Un catálogo forense con 80 familias documentadas
→ Herramientas para investigadores y analistas de seguridad
→ Muestras aisladas y cifradas para reducir el riesgo de ejecución accidental

Lo más importante:

No estamos hablando de simulaciones ni ejemplos creados para un curso.

El repositorio contiene malware real y debe tratarse únicamente en laboratorios aislados y siguiendo estrictamente sus reglas de contención.

Es un recurso orientado al análisis, investigación y formación práctica en ciberseguridad.

Repo 👇

[Smukx.E @5mukx]

DEF CON 32 - Anyone can hack IoT- Beginner's Guide to Hacking Your First IoT Device by Andrew Bellini @d1gitalandrew

TLDR:- An Walkthrough covering the methodology, tools, tactics and a <$100 toolkit to find your first IoT vulnerability.

[vx-underground @vxunderground]

I sat down and did some schizo ranting for my attempt at a book I might name "Malware 4 Noobs" (no idea yet).

Here is my introduction segment, part zero (no reforms or changes made yet).

If you're noob, please read and give feedback.

https://t.co/h3p0gVpeRR

[Kun Chen @kunchenguid]

there's a famous "karpathy claude.md" being shared around here https://t.co/c9v7DSFlyF with a whopping 177k stars

two things you should know about this file -
1. it's NOT actually from andrej karpathy
2. i've got empirical evidence it'll hurt your agent performance

thread 👇

[Superman @thesupermannx]

China open-sourced a peanut-sized OCR that parses entire 100-page PDFs in one shot..

It's called Unlimited-OCR. Only 3B params. Runs locally.

Every other OCR tool chops your doc into pages and loses the thread. this one reads the whole thing in a single pass.

→ One-shot "long-horizon" parsing (32K context window)
→ Multilingual, out of the box
→ 93% on the standard parsing benchmark (+6 over baseline)
→ <0.11 error rate past 40 pages
→ Runs 100% locally on your own hardware
→ Works with Transformers, vLLM, SGLang, Docker, Ollama, llama.cpp

Traditional cloud OCR (Textract, Google Vision, Azure Doc Intelligence) costs $1.50–$15 per 1,000 pages.

This runs on your machine. For free. Forever.

Baidu built it explicitly to push DeepSeek-OCR one step further. Already at 1.9M downloads on Hugging Face and most people have no idea it exists yet.

100% open source.

[The XSS Rat - Proud XSS N00b :-) @theXSSrat]

File upload bugs are still everywhere. My 2026 playbook:

1. Map every upload — profile pic, resume, CSV, KYC, support attachments. Different code paths, different bugs.

2. Beat the extension filter:
- shell.PHP (case)
- shell.php.jpg / shell.jpg.php
- .phtml .php5 .phar .pht
- %00 null byte
- shell.php;.jpg (IIS)

3. Spoof Content-Type: image/jpeg in Burp. Half the time it's the only check.

4. Beat magic bytes — prepend GIF89a; to your PHP. Valid image header, valid PHP.

5. SVG = XML = <script>. Stored XSS via image view. Bonus: XXE via DOCTYPE.

6. Path traversal in filenames + Zip Slip in ZIP uploads.

7. Look at what processes the file after upload — ImageMagick, FFmpeg, headless Chrome PDF renderers. SSRF + LFI hide there.

8. Race the antivirus — upload, hammer the URL before the scanner deletes.

9. Trap: hunters test the obvious field and leave. Real bugs live in admin/import/bulk uploads no one tests.

10. Report on IMPACT not the upload. ".phtml uploaded" = medium. ".phtml + RCE PoC at /uploads/" = critical.

What's the wildest upload bug you've found?

[Het Mehta @hetmehtaa]

Best malware analysis blogs on the internet:

Malware Unicorn → https://t.co/ctP9ISZeC5
Hexacorn → https://t.co/cUtJxUUaGV
Didier Stevens → https://t.co/2swSJFTQrR
DFIR Report → https://t.co/7IjW1sjoRU
Malware Traffic Analysis → https://t.co/Cptin440m2
MalwareTech → https://t.co/H8uYA8FFzy
Elastic Security Labs → https://t.co/VtBvJNHn6z

[Steven Cheng @stevencheng]

If you don’t have air conditioning at home, be sure to watch this video. I’ll show you how to build a powerful DIY air conditioner in just a few minutes.