Jeff Barron

Offsec engineer | Nim/C/Python | I break things so others stay safe.

[Jeff Barron @_jeffaf]

In the latest issue of Cred Relay, I talk about my two ASUS CVEs and how not to ship slop.

https://t.co/6nMpuzEvSO

[Jeff Barron @_jeffaf]

@steipete @yashhq_22 He said be honest

[Adam Cochran (adamscochran.eth) @adamscochran]

The day after the CEO lays off a ton of staff and says:

“Non-technical teams are now pushing code to production with AI”

@coinbase has a major outage on their trading engine, and even their status page doesn’t work.

😂

[V4bel @v4bel]

💥 Introducing "Dirty Frag"

A universal Linux LPE chaining two vulns in xfrm-ESP and RxRPC. A successor class to Dirty Pipe & Copy Fail.

No race, no panic on failure, fully deterministic. ~9 years latent.
Ubuntu / RHEL / Fedora / openSUSE / CentOS / AlmaLinux, and more.

Even if you've applied the "Copy Fail" mitigation, your Linux is still vulnerable to "Dirty Frag". Apply the Dirty Frag mitigation.

Details:
https://t.co/9nqku4svkY

[Jeff Barron @_jeffaf]

@vxunderground It's a terrible company.

[Jeff Barron @_jeffaf]

I've written the first article in a series on maldev with Nim.

First up, a simple shellcode loader, cross-compiled from Linux.

Next: process injection and payload encryption.

https://t.co/1Ha05gxtu9

[Jeff Barron @_jeffaf]

@satyanadella Just don't make me use "new" outlook

[Jeff Barron @_jeffaf]

@thegrugq Become Mythos-ready, buy nord VPN today!

[Jeff Barron @_jeffaf]

@HackingDave Mythos may just be the old Claude we had in February.

[mRr3b00t @UK_Daniel_Card]

what a load of bollocks!

[Jeff Barron @_jeffaf]

Mythos finding bugs isn't a great leap from Opus. I've got CVEs coming from three different vendors that Opus helped me find.

[Jeff Barron @_jeffaf]

@kannthu1 I've been finding bugs with Opus since December. https://t.co/HPDdUMY9t9

[Jeff Barron @_jeffaf]

Did you know you can still use terminal escape sequences and they got a CVE as recently as 2024?
I cover that, ANSI bombs and what not to study for the OSCP in the latest issue of Cred Relay.

https://t.co/hI2BZZYANw

[Jeff Barron @_jeffaf]

@0xTib3rius It's over bros! 😂

[Jeff Barron @_jeffaf]

@elonmusk Kinda like this for openclaw https://t.co/HaMxhwR6sz

[Jeff Barron @_jeffaf]

Credit: Adiel Sol & the DREAM Security Research Team for the find.

[Jeff Barron @_jeffaf]

CVE-2026-32746 dropped this morning. Pre-auth buffer overflow in GNU telnetd, CVSS 9.8, no patch yet.

Read DREAM Security's disclosure, pointed Claude Code at it, had a working crash PoC within the hour.

https://t.co/KuWgsbM74L

[Init1Security @init1security]

After reviewing research from Elastic blogs and insights shared by Outflank, we took a deeper dive into .msc files and successfully developed a weaponized MSC without relying on apds.dll.

#redteam

[Jeff Barron @_jeffaf]

I fired up Claude Code and MCP Ghidra to reverse the kernel drivers on my gaming laptop. Found 9 vulnerabilities across 3 vendors. Here's the walkthrough and the prompt I used:

https://t.co/HPDdUMXBDB

[Jeff Barron @_jeffaf]

@HackingLZ Oh I can't wait to let openclaw at it