adelll

[st4rlight @st4rlight_exp]

데프콘이 끝나고 정신적 충격을 받은 사람이 꽤 많은 것 같다.
물론 나도 그렇다. 잘 쉬고 왔는데도 앞으로 어떻게 살아남아야 할지에 대한 불안감이 생겼다.
그저 즐겁게 해킹하던 시대로 다시 돌아가긴 어려워보인다.

[Smukx.E @5mukx]

DEF CON 32 - Anyone can hack IoT- Beginner's Guide to Hacking Your First IoT Device by Andrew Bellini @d1gitalandrew

TLDR:- An Walkthrough covering the methodology, tools, tactics and a <$100 toolkit to find your first IoT vulnerability.

[Dark Web Informer @DarkWebInformer]

🚨 CVE-2026-41089: Windows Netlogon Remote Code Execution via CLDAP Stack Buffer Overflow

Published: June 1st, 2026
PoC: https://t.co/aYFn7gfkzV

One crafted UDP packet to port 389 overflows a 528-byte stack buffer inside LSASS on any unpatched Windows Domain Controller. The process crashes. The DC reboots in ~60 seconds. No authentication required.

[Hasan @Ubermenscchh]

SHOCKING 🚨 : SOMEONE VIBE CODED A CHROME EXTENSION THAT DISGUISES CLAUDE AS A GOOGLE DOC SO YOU CAN USE AI IN PUBLIC

it wraps ai in a fake google docs interface, so on your screen it just looks like youre typing a document, not prompting a chatbot

what it does:

> works with chatgpt and claude
> you just type your question like a normal line in a doc and the answer comes back right there on the page
> microsoft word and notion style themes too, so you can pick your disguise
> rebuilt to properly support multiple ai models behind the doc
> the google docs look is the default

its a chrome extension called gptdisguise

this is genius.

a lot of people are embarrassed to be seen using ai in public (school, work, etc). someone just built the fix.

[Anthropic @AnthropicAI]

The US government, citing national security authorities, has issued an export control directive to suspend all access to Fable 5 and Mythos 5 by any foreign national, whether inside or outside the United States, including foreign national Anthropic employees.

The net effect of this order is that we must abruptly disable Fable 5 and Mythos 5 for all our customers to ensure compliance.

Access to all other Claude models is not affected.

We apologize for this disruption to our customers. We believe this is a misunderstanding and are working to restore access as soon as possible.

Read our full statement: https://t.co/bwn0sximKZ

[Cyber Security News @The_Cyber_News]

🚨 Windows Netlogon 0-Click RCE Vulnerability Now Actively Exploited In The Wild | Source: https://t.co/Iym37fFkgU

The critical Windows Netlogon remote code execution (RCE) vulnerability tracked as CVE-2026-41089 is now under active exploitation in the wild, significantly raising the risk profile for unpatched Windows Server environments.

The flaw affects Windows servers configured as domain controllers and allows unauthenticated remote attackers to execute arbitrary code with SYSTEM-level privileges by sending specially crafted Netlogon network requests.

To exploit CVE-2026-41089, an attacker only needs network access to a vulnerable domain controller’s Netlogon service.

#cybersecuritynews #windows

[Cyber Security News @The_Cyber_News]

⚠️ Critical Notepad++ Vulnerabilities Allow Attackers to Execute Arbitrary Code

Source: https://t.co/iSort2Ikje

Notepad++, one of the most widely used open-source text editors for Windows, has released an urgent security update addressing three vulnerabilities, including two arbitrary code execution flaws that could allow attackers to silently run malicious programs on a victim's machine.

The most severe of the three is CVE-2026-48778, which targets the <GUIConfig name="commandLineInterpreter"> tag inside Notepad++'s config.xml file.

📌 CVE-2026-48770 - Crash via malformed XML structure

📌 CVE-2026-48778 - Arbitrary code execution via config.xml

📌 CVE-2026-48800 - Arbitrary code execution via shortcuts.xml

#cybersecuritynews

[Claude @claudeai]

Claude Security is now in public beta for Claude Enterprise customers.

Claude scans your codebase for vulnerabilities, validates each finding to cut false positives, and suggests patches you can review and approve.

[Dark Web Informer @DarkWebInformer]

‼️Copy Fail (CVE-2026-31431) is a Linux privilege escalation bug that lets any local user get root using a 732-byte Python script, and itworks on basically every major Linux distro shipped since 2017.

Website: https://t.co/f5G6KnEv35

Write-up: https://t.co/W86Pz2PC6C

GitHub: https://t.co/zAMTC6nTRk

It's a logic flaw in the kernel's crypto code (authencesn via AF_ALG and splice()) that allows a small write into the page cache, which can be used to tamper with a setuid binary like /usr/bin/su.

Think how bad this is going to be for shared environments like Kubernetes, CI runners, and cloud sandboxes, where it enables container escape and tenant-to-host compromise.

Found by Theori's Xint Code scanner, patched in the mainline kernel, and publicly disclosed on April 29, 2026; if you can't patch right away, the recommended workaround is to disable the algif_aead module.

[FalconFeeds.io @FalconFeedsio]

The perfect job offer might be a $12 million trap: how North Korean hackers are using AI to target Web3 developers on LinkedIn.

This DPRK-linked operation marks a shift toward industrializing crypto theft, using generative AI to craft flawless LinkedIn recruiter personas and fake corporate identities. By deploying a sophisticated three-stage malware chain, BeaverTail, OtterCookie, and InvisibleFerret, the group has siphoned over $12 million from thousands of developer wallets.

We analyze the technical mechanics of their backdoored coding assessments and how they leverage AI-native tools to bypass traditional security filters.

See how state-sponsored actors are weaponizing professional networks and AI to compromise the Web3 ecosystem:

https://t.co/44b1tW4MHF

3 Key Takeaways

AI-Enhanced Deception: How attackers use LLMs to generate realistic job lures, technical assessments, and professional identities that defy manual detection.

The Malware Trifecta: A deep dive into the NodeJS and Python-based toolkits used for credential exfiltration, clipboard hijacking, and persistent remote access.

Supply Chain Risks: Insights into HexagonalRodent’s pivot toward backdooring popular development tools and VSCode tasks to ensure secondary infection vectors.

#CryptoSecurity #Web3 #LazarusGroup #AI #ThreatIntelligence #DPRK #CyberSecurity #falconfeeds

[The Hacker News @TheHackersNews]

🚨 DPRK-linked attackers used GitHub as C2 in phishing-led attacks on South Korean orgs.

LNK files trigger hidden PowerShell, set persistence, and exfiltrate system data to attacker repos while pulling new payloads.

🔗 Read → https://t.co/lxMVIY6oMx

[보안재테크 @ngnicky]

악성 NPM 패키지가 PNG 이미지 안에 Pulsar .NET 멀웨어를 숨기고 있습니다. https://t.co/B3hOOO91pk

[NetAskari @NetAskari]

We got our hand on a Chinese DLP program the government and national security agencies use to monitor state employees computers for leakage and usage of confidential documents. Meet 保密管理系统. 1/9

[Dark Web Informer @DarkWebInformer]

🚨 CVE-2025-6389: WordPress Sneeit Framework plugin vulnerability currently under active exploitation

PoC: https://t.co/RERzeyOVpu

▪️Vulnerability Type: Remote Code Execution (RCE)
▪️CVSS: 9.8
▪️Published: 11/24/2025

Impact:

▪️Full site compromise
▪️Create admin accounts
▪️Install backdoors/malicious files
▪️Redirect visitors or inject malware

Credit: https://t.co/rXSgNYA8kP

[Md Ismail Šojal 🕷️ @0x0SojalSec]

List of awesome Android Reverse Engineering training, resources, and tools.📒

- https://t.co/RyRGpy6rV1

#infosec #cybersec #ReverseEngineering

[Soufiane @S0ufi4n3]

CVE-2025-59287 - 9.8, WSUS Remote Code Execution
Write-up and PoC
https://t.co/LTUbmWoIH4

[Cyber Security News @The_Cyber_News]

🚨 PoC Exploit for 7-Zip Vulnerabilities that Allows Remote Code Execution

Read more: https://t.co/XAQYx6r0Kg

A proof-of-concept exploit for two critical vulnerabilities in the popular file archiver 7-Zip, potentially allowing attackers to execute arbitrary code remotely through malicious ZIP files.

The flaws, tracked as CVE-2025-11001 and CVE-2025-11002, were disclosed by the Zero Day Initiative (ZDI) on October 7, 2025, and stem from improper handling of symbolic links during ZIP extraction on Windows systems.

The core problem lies in 7-Zip's extraction logic, which fails to properly validate symlink targets. When extracting a ZIP containing a Linux symlink pointing to a Windows absolute path like C:\Users, the software misclassifies it as relative due to a flawed absolute path check tailored for Linux or WSL environments.

#cybersecuritynews

[International Cyber Digest @IntCyberDigest]

🛠️ PoC CVE-2025-32463 LPE→Root

Local Privilege Escalation to Root via Sudo chroot in Linux

https://t.co/AZK1Vc8Yos