pr3nk

Threat Intel & Malware Analysis

[pr3nk @_pr3nk_]

#flareon8

[Tom Dörr @tom_doerr]

Maps and ranks internet-facing attack surfaces automatically

https://t.co/niKYp0COwa

[Md Ismail Šojal 🕷️ @0x0SojalSec]

You can now run full macOS inside a Docker container.

Full Sequoia with KVM acceleration and a web viewer.
- run seamlessly
- Auto-install
- browser access
- No Mac required legally use at your own risk

Open-source For anyone who’s ever needed macOS capabilities without the hardware , testing iOS or builds.

[Blackstorm Security @blackstormsecbr]

HookChain: A Deep Dive into Advanced EDR Bypass Techniques:

https://t.co/dfOjh841ph

LACUNA Chain: Ghost Frames — defeats all EDR layers of call-stack-based detection:

https://t.co/hRZN9gwoIS

#cybersecurity #edr #infosec #informationsecurity #cybersecurity #programming

[Md Ismail Šojal 🕷️ @0x0SojalSec]

A 27B Uncensored model that built for specifically for offensive security tooling (need 12 GB)

- Fine-tuned on real bug bounty reports & CVEs
- Generates complete, ready-to-run Nuclei templates, Full CVE PoC script, Webshell upload bypass, and exploits, code reviews
- Zero refusals. Full artifacts every time.

trained with 2,541 of real bug bounty & offensive security reports.

Q6_K quant (21GB) for maximum quality on server-grade GPUs.

[How To Prompt @HowToPrompt__]

someone open-sourced a tool that checks if any email address exists, without ever sending a single email.

and it's 100% free and open-source.

[Nicolas Krassas @Dinosn]

I tried a Local AI model (Qwen 3.6 27b) for security research and it works surprisingly well. https://t.co/09HOfCr6vH

[Swissky @pentest_swissky]

Bullying LLMs into submission to find 0days at scale - @ZephrSec
https://t.co/calyUXd8sd

[Samir @SBousseaden]

gluegate - proxy memory allocation APIs through Firefox's signed mozglue.dll (MapRemoteViewOfFile, MozVirtualAlloc).

Benifit: make the final allocating module appear as a trusted Firefox component, which some detection logic may exclude to reduce false positives.

PoC + detection guidance:
https://t.co/wjglBCCY9P

[Md Ismail Šojal 🕷️ @0x0SojalSec]

You can now run full Windows inside a Docker container.

- 129.7 MiB image
- KVM hardware acceleration
- Web-based viewer

This is actually insane.

Legacy apps, testing, isolated environments,,

- https://t.co/8Crqs7skqW

[Raytar @Raytar]

Andrej Karpathy joined Anthropic five weeks ago.

Yesterday my friend on his team sent me the Claude.md file he actually uses.

It completely changed how I work with Claude.
From the very first message, the difference was obvious.

With this file, Claude finally stops fighting me and starts working exactly the way I need it to.

Bookmark it before it gets taken down.

Read it now, then check the article below.

[International Cyber Digest @IntCyberDigest]

An anonymous GitHub account is mass-dropping exploit PoCs framed as undisclosed 0-days, with a note telling readers to report them and "take credit for the CVE" themselves.

Coordinated disclosure, minus the coordination.

[Densel @luckyhacker43]

"My Complete Bug Bounty Hunting Workflow Every Command I Use" by Hacker MD 🤯����

👨‍💻 Hacker MD (BotGJ16)
🔗 https://t.co/5NTwPUrbR1

🔗 Join team 👉https://t.co/FeMz53HSN0

[Dark Web Informer @DarkWebInformer]

🚨 Here is another PoC for CVE-2026-55200 - Critical libssh2 Out-of-Bounds Write Vulnerability

PoC: https://t.co/MyxLJFZqWY

[kmkz @kmkz_security]

#Keycloak pwnage, all public.
1: CVE-2026-4282 forges admin tokens unauth
2: view-clients leaks every client secret, all versions, open #49220 (PoC: https://t.co/cHWnrejmtR)
3: restart revives rotated refresh tokens, CVE-2026-9802

Not every vuln has a CVE
https://t.co/ishDz8aqrN

[NetAskari @NetAskari]

1/3 "Shield-Cube" (盾立方) is China's evolving system to control and surveil network traffic. It is build on top of the 4 "honey" strategy: Honeypots, Honeynet(WAF), honey holes, honey points. It was tested during the last Winter Olympics on national infrastructure via Qi An Xin.

[Densel @luckyhacker43]

Unauthenticated RCE in Apache Tomcat (CVE-2026-34486) 🤯🔥

🔗 https://t.co/JR2KeraObE

🔗 Join team today 👉https://t.co/FeMz53HSN0

[dbugs @ptdbugs]

📌 NTLM Leak via UNC Path in Windows Sandbox

A researcher demonstrated a new PoC chain in which a Windows Sandbox ".wsb" configuration file uses the "HostFolder" parameter to point to a network (UNC) path. When such a file is opened, the system initiates SMB authentication, resulting in a NetNTLMv2 hash leak even before the sandbox is initialized.

The root cause is that the "Networking=Disable" parameter only affects the guest network, not the host, while "ReadOnly=true" restricts only write access and does not prevent the network connection itself. As a result, an attacker can use a ".wsb" file with a UNC path as a forced authentication primitive to capture host credentials.

📎 Article: https://t.co/2wGC5UF21n

#dbugs_attacks

[Hacking Articles @hackinarticles]

Crunch Wordlist Generation Guide 🚨

🔥 Telegram: https://t.co/upuP8k7Ev3
✴ Twitter: https://t.co/Za7rYIL1h6

Crunch is a powerful wordlist generator that helps attackers create custom password lists based on specific patterns, lengths, and character sets—essential for brute-force and dictionary attacks.

⚡ Key Highlights
🔢 Generate wordlists with min & max length
🔤 Customize character sets (alphabets, numbers, symbols)
🎯 Create pattern-based passwords (e.g., raj%%% or @%^)
📂 Save output directly into files

🛠️ Advanced Features
📡 Use predefined charset (charset.lst)
🚀 Start from specific string (-s option)
🔄 Generate permutations (-p / -q)
📦 Split & compress large wordlists (-b, -c, -z)

💡 Crunch can generate massive combinations quickly, but improper usage may create extremely large files—impacting system resources.

📖 Article: https://t.co/uHPKyNwmcX

#CyberSecurity #EthicalHacking #Pentesting #RedTeam #Wordlist #Bruteforce #Crunch

[7h3h4ckv157 @7h3h4ckv157]

DReconPy is a Python-based reconnaissance and attack surface discovery tool designed for ethical hackers, penetration testers, and bug bounty hunters. It automates the collection of publicly available information about a target domain to help security professionals identify potential testing opportunities quickly and efficiently.

Credit/Source: https://t.co/aZy9vETBQL

[Print3M @Print3M_]

I’m sharing my slides from @x33fcon 2026.
Inside ~15 examples of abusing traitorware to execute your payload via trusted & signed binaries (e.g. VLC Player, SublimeText) and how to find more of them.

Recording will be published soon.

https://t.co/M2jpnNA5XI