baas

HTB CAPE | OSEP | OSCP | CARTE | CRTO | CRTP

[baas @baas]

Passed the OSEP exam relatively easily. On to OSCE3!
#OSEP #OSCE3 #OffSec

[baas @baas]

Why would you be using this when there is XMR anyways

[Bull Theory @BullTheoryio]

BREAKING.: Biggest privacy token $ZEC crashed over -50% in the last 24 hours and wiped out $5 Billion from its market cap.

The flaw was hidden inside Zcash's Orchard privacy pool since May 2022 and remained undetected for nearly 4 years despite multiple security audits.

Security researcher Taylor Hornby reportedly used Claude Opus 4.8 AI model to build a working proof-of-concept that successfully generated counterfeit ZEC in local testing on May 29.

Although the bug has now been patched on June 2, The issue is that Zcash's privacy design makes it impossible to know if any fake ZEC was minted before the fix. Unlike Bitcoin, where anyone can verify the supply, Zcash's privacy design makes it impossible to audit whether fake coins were secretly minted before the fix.

The team denies any fake ZEC was minted, but traders are selling on the fear alone. Imagine someone secretly adding extra chips to a casino, but because of the way the system works, neither the casino nor the players could tell which chips were real and which were fake.

Shielded Labs is exploring a proposed Network Upgrade to allow anyone to verify the integrity of Zcash supply.

[baas @baas]

@noefzaz Haal je OSCP

[Aikido Security @AikidoSecurity]

Update 5:05 PT: The attack has now expanded well beyond @TanStack and @Mistral.

373 malicious package-version entries across 169 npm package names, including @uipath, @squawk, @tallyui, @beproduct, and more.

The malware propagates by stealing your CI credentials and using them to publish new compromised versions.

Full IOCs, affected package list, and detection steps: https://t.co/jWG9DUCu3x

[Nightmare Eclipse @ChaoticEclipse0]

Two more zerodays - https://t.co/kUgSQqq0s8

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft is investigating mistralai PyPI package v2.4.6 compromise. Attackers injected code in mistralai/client/__init__.py that executes on import, downloads hxxps://83[.]142[.]209[.]194/transformers.pyz to /tmp/transformers.pyz, and launches a second-stage payload on Linux. The file name transformers.pyz appears deliberately chosen to mimic the widely used Hugging Face Transformers library and blend into ML/dev environments.

The main payload is a credential stealer, but it also includes country-aware logic; it avoids Russian-language environments and contains a geo fenced destructive branch that has 1-in-6 chance of executing rm -rf / when the system appears to be in Israel or Iran.

To mitigate this threat: isolate affected Linux hosts, block 83[.]142[.]209[.]194, hunt for /tmp/transformers.pyz, pgmonitor[.]py, and pgsql-monitor.service, and rotate exposed credentials.

[vx-underground @vxunderground]

Hahahahahaha

VPNs are HURTING CHILDREN

Hahahaha fucking stupid fucks

[prayingforexits 🏴‍☠️ @mrexits]

Still the hardest logo tech has ever produced

[Tom Jøran Sønstebyseter Rønning @L1v1ng0ffTh3L4N]

Microsoft Edge loads all your saved passwords into memory in cleartext — even when you’re not using them.

[baas @baas]

Het is oorlog maar niemand die het ziet

[NU.nl @NUnl]

ShinyHunters hackt gegevens van 275 miljoen docenten en studenten https://t.co/pkCpcyRnuR

[Dark Web Informer @DarkWebInformer]

‼️Copy Fail (CVE-2026-31431) is a Linux privilege escalation bug that lets any local user get root using a 732-byte Python script, and itworks on basically every major Linux distro shipped since 2017.

Website: https://t.co/f5G6KnEv35

Write-up: https://t.co/W86Pz2PC6C

GitHub: https://t.co/zAMTC6nTRk

It's a logic flaw in the kernel's crypto code (authencesn via AF_ALG and splice()) that allows a small write into the page cache, which can be used to tamper with a setuid binary like /usr/bin/su.

Think how bad this is going to be for shared environments like Kubernetes, CI runners, and cloud sandboxes, where it enables container escape and tenant-to-host compromise.

Found by Theori's Xint Code scanner, patched in the mainline kernel, and publicly disclosed on April 29, 2026; if you can't patch right away, the recommended workaround is to disable the algif_aead module.

[RTL Nieuws @RTLnieuws]

Bijna alle inwoners van Epe getroffen door datalek, 500.000 bestanden gestolen https://t.co/ccvmAIiTrj

[impulsive @weezerOSINT]

Lovable has a mass data breach affecting every project created before november 2025.

I made a lovable account today and was able to access another users source code, database credentials, AI chat histories, and customer data are all readable by any free account.

nvidia, microsoft, uber, and spotify employees all have accounts. the bug was reported 48 days ago. its not fixed. They marked it as duplicate and left it open.

[K̵i̵r̵k̵ ̵T̵r̵y̵c̵h̵e̵l̵ @Teach2Breach]

hackers as the first group to embrace KYC for access to new models is cutting me deep. we used to be rebels

[Kit Klarenberg @KitKlarenberg]

I warned back in December 2023 (!!!) that push notifications were a major opsec hazard being exploited by US intelligence to break encryption, and now here were are:

https://t.co/8yZWy6tv53

[Adam Back @adam3us]

i'm not satoshi, but I was early in laser focus on the positive societal implications of cryptography, online privacy and electronic cash, hence my ~1992 onwards active interest in applied research on ecash, privacy tech on cypherpunks list which led to hashcash and other ideas.

[Co11ateral @co11ateral]

Bluehammer

Privilege escalation via Microsoft Defender. No patch yet

https://t.co/HY02ydWZEK

#0day #lpe

[baas @baas]

I just pwned Sweep on HackTheBox
https://t.co/V7hIRqgHNe

[baas @baas]

new levels of social engineering if true

[Drift @DriftProtocol]

https://t.co/qYBMCup9i6

[Chaofan Shou @Fried_rice]

Claude code source code has been leaked via a map file in their npm registry!

Code: https://t.co/jBiMoOzt8G