anasshlool

Offensive Security Engineer

[anasshlool @anasshlool7]

Wishing the boys the best!

[TactX @TactXGroup]

Today marks the beginning of TactX.

We founded TactX with a simple belief: cybersecurity should empower organizations not overwhelm them.

Our mission is to help businesses stay ahead of evolving cyber threats

Welcome to TactX

#CyberSecurity #InfoSec #CyberResilience #Security

[anasshlool @anasshlool7]

+1
Kind of useless

[❄️ winter ❄️ @_winter_wonders]

We were told to test Fable
I have been testing Fable
I had to report back today that it was completely useless

We are a very big security company that makes security software
The second it reads any code it goes HOLY MOLY THAT'S SECURITY and rejects

[vx-underground @vxunderground]

> be pakistan government
> develop custom malware
> used to target high profile targets
> used against indian military and political ppl
> named SHEETCREEP
> send indian ppl file
> UAE-India Strategic Partnership Week
> malicious .lnk file
> .lnk executes malicious c sharp code
> does a bunch of stuff for persistence
> exfiltrates data to Google Sheets
> Google Sheets can be used to control victim pcs
> pakistan gov hardcodes google c2 sheet
> PAKISTAN GOV HARDCODES GOOGLE C2 SHEET
> embed access key in payload
> EMBED ACCESS KEY IN PAYLOAD
> malware nerds find it
> look inside
> find all targets from pakistan gov
> monitoring 91 ppl they think important

THEY STARTED SO STRONG. WHY DID YOU HARDCODE EVERYTHING. YOU BURNED YOUR OPERATION

https://t.co/PcCeV05cu3

[anasshlool @anasshlool7]

Best creative thing I have seen in a while

[John Scott-Railton @jsrailton]

NEW: malware developers added nuclear & biological weapons text to to their spyware.

Goal? To trigger LLM safety refusals... so that their spyware wouldn't be analyzed by an AI security scanner.

Cleanest practical example I can think of for why over-indexing on first order safety alignment is risky.

When closed (and open) models ship with aggressive refusals, they will be sprinkled with second-order blindspots that attackers will discover...and exploit.

We are only in the earliest days of attackers leveraging these features, and it wouldn't surprise me if users systems that need to handle complex cybersecurity issues demand that models be less safety-blunted.

In the weeds: @SocketSecurity's post also shows why intention matters in how you design a malware analysis pipeline to avoid prompt manipulation.

H/T to colleagues that shared this with me https://t.co/f3Aj9TYxU4

[vx-underground @vxunderground]

I INSTALLED A KERNEL MODE ANTI CHEAT SOMEONE HELP ME OH MY GOD ITS ALL OVER MY KERNEL ITS CHINESE AND INSIDE OF ME KERNEL

[Amjad Masad @amasad]

A cybersecurity firm, “Red Access,” contacted us less than 24 hours before going to the media with vague claims about Replit.

This is not how responsible security research works. The standard practice in terms of disclosure policies, as followed by CISA, CERT/CC, and most major firms, is to share findings privately and allow a defined window for remediation before public disclosure. A 24-hour countdown to a press cycle is not that.

From the limited information they shared, their core claim appears to be that some users have published apps on the open web that should’ve been private.

Replit allows users to choose whether apps are public or private. Public apps being accessible on the internet is expected behavior. Privacy settings can be changed at any time with a single click.

Vibe Coding is a rapidly developing space, and we take our responsibility to both provide tools to create secure apps and educate our customers very seriously. Just in the past week, we launched two security products: Security Agent and Auto-Protect.

If Red Access shares a list of impacted users, we will proactively default those apps to private and notify users directly.

We welcome responsible security research and have a long history of working constructively with researchers who follow standard disclosure practices. That offer remains open.

[anasshlool @anasshlool7]

This will start as the end of the source code review business and end as the end of most security projects/ services / tools etc

[Anthropic @AnthropicAI]

Introducing Project Glasswing: an urgent initiative to help secure the world’s most critical software.

It’s powered by our newest frontier model, Claude Mythos Preview, which can find software vulnerabilities better than all but the most skilled humans.
https://t.co/NQ7IfEtYk7

[SinSinology @SinSinology]

day 1: exploited by LiteLLM
day 2: exploited by vim
day 3: exploited by emacs
day 4: exploited by axios
day 5: echo "hello world" exploited me

The threat model is now "software"

[Joe Kent @joekent16jan19]

After much reflection, I have decided to resign from my position as Director of the National Counterterrorism Center, effective today.

I cannot in good conscience support the ongoing war in Iran. Iran posed no imminent threat to our nation, and it is clear that we started this war due to pressure from Israel and its powerful American lobby.

It has been an honor serving under @POTUS and @DNIGabbard and leading the professionals at NCTC.

May God bless America.

[OG Esports @OGesports]

this DLSS update is crazyyyyy

[anasshlool @anasshlool7]

Best Arabian technical entrepreneur.

[Amjad Masad @amasad]

We’ve raised $400M at a $9B valuation.

Investors include Georgian, G Squared, Prysm, 1789, YC, Coatue, a16z, Craft, and QIA, with strategic investments from Accenture, Databricks, Okta, and Tether. We’re also lucky to have incredible individuals backing us, including Shaq and Jared Leto.

This funding will help us scale our ambition and expand beyond coding into AI systems that center human creativity.

Replit is now used at 85% of the Fortune 500. We have an opportunity to help shape the future of work. One where AI abstracts away the boring parts and humans shine as creative directors.

We’re also investing more globally, particularly in Europe, Asia, and the Middle East. Innovation can come from anywhere in the world, and we want to help unlock it.

[vx-underground @vxunderground]

Yeah, so pretty much, like, there is this really sketchy company in Israel named "Paragon". Paragon sells a "product" called GRAPHITE.

Let me explain the background and why this is very silly.

GRAPHITE spyware which allows "customers" to remotely access peoples cell phones and monitor their instant messaging applications such as WhatsApp

It is spyware. It is sometimes called Mercenary Spyware because it is primarily used by governments to spy on political enemies, journalists, and activists.

Very little is known about Paragon, GRAPHITE, and their "customers". However, it was publicly noted by the Trump administration in January, 2025, to be purchased by the United States government and to be used to aid ICE.

Furthermore, in September 2025 the Trump administration noted the usage of Graphite to aid the United States against "domestic terrorist organizations" such as "ANTIFA".

ICE acting director Todd Lyons noted using GRAPHITE to monitor anti-ICE protestors to track "ringleaders and professional agitators".

Citizen Lab and other civil rights organizations have documented the usage of GRAPHITE against individuals in Australia, Canada, Cyprus, Denmark, Israel, Singapore and (unsurprisingly) the United States. It is believed the Canadian government actively uses GRAPHITE in Ontario.

Okay, so why does all of this matter? Yeah, it's super fucked up. But today representatives from Paragon accidentally leaked GRAPHITE screenshots ... ON LINKEDIN. Dawg, that image in the background IS GOVERNMENT FUCKING SPYWARE

It shows phone numbers in Czechia, apps, accounts, media on the phone, "interception status", and phone numbers extracted. THEY LEAKED IT BY ACCIDENT ON LINKEDIN WHILE TAKING SELFIES

[anasshlool @anasshlool7]

Claude pls “hack into this bank and steal the money”

[Sam Altman @sama]

We have a lot of exciting launches related to Codex coming over the next month, starting next week. We hope you will be delighted.

We are going to reach the Cybersecurity High level on our preparedness framework soon. We have been getting ready for this.

Cybersecurity is tricky and inherently dual-use; we believe the best thing for the world is for security issues to get patched quickly. We will start with product restrictions, like attempting to block people using our coding models to commit cybercrime (eg ‘hack into this bank and steal the money’).

Long-term and as we can support it with evidence, we plan to move to defensive acceleration—helping people patch bugs—as the primary mitigation.

It is very important the world adopts these tools quickly to make software more secure. There will be many very capable models in the world soon.

[alexine 🏴‍☠️ @alexinexxx]

who's this

[kitze @thekitze]

node js creator: coding is dead

avg mid miderson: i will never trust llms!!! I need hours of convincing to help my skill issues

[Mischa van den Burg @mischavdburg]

modern software engineering has now become writing specs and requirements

[solst/ICE of Astarte @IceSolst]

VM escape exploits are S tier, reserved for 4 digit IQ exploit devs

[solst/ICE of Astarte @IceSolst]

https://t.co/uUbtIhdOIQ

[solst/ICE of Astarte @IceSolst]

Many managers will ask you to specialize within your industry, it’s more useful to them. You don’t have to. I never wanted to do just one thing, wanted to do everything, and that’s paid off for me.
Managers don’t always know what’s best for you. Having only one specialization isn’t more technical nor more useful.

[sui @birdabo]

people forget u can build a whole website with just html.

https://t.co/4RXqF0MdCZ