BackBox Labs

Ethical Hacking & AI-Driven Cyber Operations

[BackBox Labs @backbox_labs]

New @netbird 0day discovered!

Our research found a local privilege escalation affecting NetBird Linux clients (≤ 0.75.0), allowing local users to gain root via IPC design flaws.

Technical analysis: https://t.co/hKxdHyGcso

[Raffaele Forte @raffaele_forte]

Discovered a zero-day vulnerability affecting a modern zero-trust mesh networking implementation. Responsible disclosure is underway. Technical details will be shared soon.

https://t.co/KqIE6hlXUe

[BackBox Labs @backbox_labs]

This summer, leave your laptop behind.

BackBox AI is available on mobile. All you need is a
smartphone and an internet connection.

Try it:
https://t.co/s2LorjtgRb

[BackBox Labs @backbox_labs]

BackBox AI analyzed a live Android RAT from a single APK, extracting the implant, uncovering obfuscated C2 infrastructure, and producing evidence-backed attribution through adaptive AI-driven reasoning.

Read the full technical analysis:
https://t.co/K2JVvPV4ui

[BackBox Labs @backbox_labs]

La sovranità tecnologica nell'era dell'AI non è un tema futuro. È una scelta di oggi.

Modelli aperti, controllo dei dati e libertà di scelta: la nostra direzione.

https://t.co/7gHuaUEaM1

[BackBox Labs @backbox_labs]

New security advisory: Bettercap LPE affecting Debian, Ubuntu, Arch and derivatives.

Not a Bettercap code flaw, but an insecure service packaging issue.

https://t.co/fVGyZr2KZ7

[BackBox Labs @backbox_labs]

New security advisory: BackBox AI found a memory exhaustion DoS in Binwalk's CSMAN parser. A crafted file could trigger unbounded decompression during a normal scan. The issue was responsibly disclosed and fixed upstream.

https://t.co/Ab6le5Dgq9

[BackBox Labs @backbox_labs]

Security Advisory: Header Trust Issues in SearXNG

BackBox AI identified two header trust vulnerabilities in SearXNG, including a Host header injection that could lead to open redirect and cache poisoning, and an X-Forwarded-For based rate limiter bypass.

https://t.co/rxpkk90faE

[Raffaele Forte @raffaele_forte]

Hey pentesting distro maintainers (@kalilinux, @ParrotSec and others), DM us.

We identified a default package inherited from Ubuntu/Debian/Arch that allows local privilege escalation.

Details available privately for coordinated disclosure.

[BackBox Labs @backbox_labs]

Smarter, Not Bigger: how we built BackBox AI.

We prioritize system design over model size, building AI for real security workflows.

We also work pro bono with open source maintainers to surface vulnerabilities and strengthen critical infrastructure.

https://t.co/wM1GMRnOc4

[Raffaele Forte @raffaele_forte]

BackBox AI vs @AikidoSecurity vs @Xbow on Photoview, scored against @Doyensec 's independent review:

Same 6 High/Critical findings as Aikido, with 31% fewer submissions (22 vs 32). XBOW caught one chain we missed. Signal over noise, gaps and all.

https://t.co/Y6BaCzoGJf

[Raffaele Forte @raffaele_forte]

Following the launch of BackBox Labs, we also use Hack The Box to validate BackBox AI in benchmark scenarios.

Season 11: 5/5 challenges completed.

https://t.co/Am2yE55gpl

[BackBox.org @backbox_org]

We’re launching BackBox Labs (https://t.co/XeyD8fr51J), a new cybersecurity company built on years of experience from the BackBox open source ecosystem.

https://t.co/ektaw83mHT remains an independent community-driven open source project.

https://t.co/6xqHN4oWTj