Varys

Somewhere in between foodie, wine lover and security geek Python 💙|Personal tweets|GSNA/GPEN/GCFR | cancer survivor

[Varys @_ChezDaniela]

#btvvirtual is one of the ways - check @BlueTeamVillage tweets for updates

[DEF CON @defcon]

We’re excited to see all the DEF CON people here with us in Vegas, but we’re also thinking of everyone out there who can’t make it in this year. There are still a few ways to participate from the comfort of your own keyboard:

[rekdt @rekdt]

live, laugh, lockbit

[Varys @_ChezDaniela]

@elder_plinius

[Varys @_ChezDaniela]

« Yak2 though — the round galaxy/mirror sunglasses, the wild hair, the beard, the flower garlands, the colorful patchwork jacket, the wooden bead necklace. This yak has opinions. This yak has attended conferences. This yak has seen things injected into WordPress sites that it cannot unsee and it is PASSIONATE about telling you. » - my favorite LLM 😇

[Varys @_ChezDaniela]

I do believe in segmentation - private AI subscription is more than you have free time to use anyway. Good to help you with private errands, lists, maybe learn new things, plan a trip rtc etc. No need to use an enterprise subscription for thzt 🤷🏻‍♀️. Besides thet most basic agents are better off as cron jobs anyway 😁

[Varys @_ChezDaniela]

I am designing my Defcon stickers for this year and I managed to add a purple shark disco ball in the first one 🫡

[The Hacker News @TheHackersNews]

One crafted GitHub issue was enough.

In agent mode, Claude Code treated hidden instructions as trusted commands. It leaked OIDC workflow credentials that attackers could replay for repo write access.

The action bypassed checks on bot actors too.

Fixed in v1.0.94. Audit your workflows.

[security.nl @securitynl]

WordPress-plug-ins geplaagd door cross-site scripting en SQL Injection #securitynl https://t.co/Rx3NMY72kk

[The Hacker News @TheHackersNews]

⚠️ Hackers are taking over #WordPress sites through a form plugin.

The bug is in Everest Forms Pro and lets unauthenticated attackers run code, create admin accounts, and plant web shells.

Update to v1.9.13 now.

Get the full details ➝ https://t.co/xtCBclT9UU

[Varys @_ChezDaniela]

Maybe if the extradate this one somewhere else …. 🤷🏻‍♀️ In NL seems one can get away with such activity. 100% sure he is budy with these activities right now again ….

[DeepBlue Security & Intelligence @DeepBlueInfoSec]

Man die bij Allekabels en Scoupy miljoenen klantgegevens stal veroordeeld https://t.co/EJx6E1PG4c

[Tib3rius @0xTib3rius]

So apparently there's a new attack against Bitlocker called bitskrieg.

Microsoft is having a great week.

[The Hacker News @TheHackersNews]

🛑 Google and YouTube ads are delivering FlutterShell, a new #macOS backdoor that passed Apple notarization with valid Developer IDs.

The malware can hijack Chrome traffic, run shell commands, alter files, and update its behavior from attacker servers.

Read: https://t.co/ELUmQYd4n8

[International Cyber Digest @IntCyberDigest]

‼️🚨 A new npm supply-chain attack compromised 57 packages across over 286 malicious versions in under 2 hours. The attackers used self-replicating malware, a new version of the Miasma worm, which also used evasion techniques to stay under the radar.

The payload targets CI/CD and developer credentials, including GitHub Actions secrets, cloud credentials, Vault tokens, SSH keys, npm and GitHub tokens, and password-manager stores. This variant also injects AI coding assistant config files at `.claude`, `.cursor`, `.gemini`, and `.vscode` paths, a separate persistence and repo-poisoning angle.

[The DFIR Report @TheDFIRReport]

"On the 18th day of the intrusion, during the second round of threat actor activity, the threat actor moved to final objectives involving the deployment of ransomware across the environment. Using their injected Winlogon process...

Report: https://t.co/Mdbthjk2PA

[The Hacker News @TheHackersNews]

🚨 Fake sites mimicking Ghidra, dnSpy, and SpiderFoot are ranking in Google searches to deliver malware.

They show real download URLs on hover, but clicks route users through a gated TDS to Remus Stealer, AnimateClipper, and SessionGate.

Learn more: https://t.co/DeF1cpFWR3

[security.nl @securitynl]

NCSC waarschuwt voor datalekken als gevolg van misconfiguraties #securitynl https://t.co/sQSWiSFL5H

[BleepingComputer @BleepinComputer]

The U.S. sanctions Nobitex crypto exchange used by ransomware
https://t.co/CE4Xf9ZwXb

https://t.co/CE4Xf9ZwXb

[Varys @_ChezDaniela]

Year of the RAT continues

[BleepingComputer @BleepinComputer]

Chinese hackers use new Atlas RAT malware in European cyberattacks
https://t.co/KQZYZJbukf

https://t.co/KQZYZJbukf

[Cyber Security News @The_Cyber_News]

⚠️Five OpenClaw 0-Days let Attackers to Hijack Trusted AI Agent Access

Source: https://t.co/2a2EwBz82h

Five zero-day flaws in OpenClaw allowed attackers to bypass trust boundaries and hijack AI agent access across multiple messaging platforms. OpenClaw, which integrates AI agents with services such as Slack, Discord, Microsoft Teams, Matrix, and Telegram, relies heavily on user-defined allowlists to determine who can interact with an agent.

This trust model assumes that only explicitly approved identities can issue commands to agents that may have access to sensitive data, internal APIs, or system-level execution capabilities. The vulnerabilities stem from a recurring design flaw in which human-readable identifiers, such as display names, are resolved to stable user IDs during service initialization.

#cybersecuritynews

[OX Security @OX__Security]

🚨 BREAKING: Meet IronWorm

a new malware campaign is infecting npm packages, stealing developer credentials, compromising GitHub repos, and republishing malicious packages to spread further.

☠️ Credential theft
🪱 Self-propagation
🥷 eBPF rootkit
🧅 Tor-based C2

Full technical analysis to come — follow @OX__Security for updates

#CyberSecurity #npm