v0ldemort

Vulnerability Engineer on the FLARE team @Google 👾 CTFd with Kernel Sanders 🚩opinions are my own

[Yeeth Security @YeethSecurity]

New malicious vscode extensions targeting Solidity developers yet again, this time hiding malware in an MP4 video named “The Duck Song.mp4”

[v0ldemort @bkojusner]

That’s a super clean lineup, v excited

[Stephen Sims @Steph3nSims]

I am very pleased to announce the official author team for the 7th edition of Gray Hat Hacking through @MHEducation. The book will be published in mid-2027.

Join me in welcoming: @chompie1337, @natashenka, @zodiacon, @ale_sp_brazil, @gf_256 to the team, along with 6th ed. authors @mosesrenegade & @htejeda!

A big thanks to @allenharper for carrying the book since the First Edition, as well as all authors across all editions.

Note: This is a mock up cover

[s1r1us @S1r1u5_]

On July 25, we hacked OpenAI.

Two bugs let us take over ChatGPT/Codex accounts of OpenAI employees (+some unaffiliated users) and reach connected services: Outlook, Slack, GitHub, etc.

We proved it with a PR in OpenAI’s internal codebase . It took us <72h. 🧵

[v0ldemort @bkojusner]

Already got some challenges I wanna try it on 👀

[Patrick Smith @patrickgwsmith]

I’m working on a WebAssembly debugger. You can even time-travel backwards!

[Tim Blazytko @mr_phrazer]

The recording of "Deobfuscation in the Age of Agentic Reverse Engineering" is now public:

https://t.co/jMO0GHRM8l

We (CC @nicolodev) show how to use agents to break protections found in anti-cheats, DRM systems & commercial protectors.

Slides: https://t.co/Fz2DhU2RlT

[0xor0ne @0xor0ne]

Series on Android SELinux internals (@8kSec)

Part 1: https://t.co/r8RhF2WIhE
Part 2: https://t.co/57bpqR5IgM
Part 3: https://t.co/SOOqLt0Xdq
Part 4: https://t.co/7DcJeMuol5

#infosec

[Abdelhamid Naceri @MSNightmare2000]

Kaspersky 0day ? Anyone ?
https://t.co/vWYLAS3kuT

[v0ldemort @bkojusner]

Now is a critical moment to keep pushing supply chain security forward -> SCINTX is the way

[Yeeth Security @YeethSecurity]

Supply chain security has no shared vocabulary.

Every vendor in their own silo. Every attack is described in different terms.

No central record.

No coordination.

We proposed SCINTX to the Eclipse Foundation as a starting point 🧵

[Yeeth Security @YeethSecurity]

Supply chain security has no shared vocabulary.

Every vendor in their own silo. Every attack is described in different terms.

No central record.

No coordination.

We proposed SCINTX to the Eclipse Foundation as a starting point 🧵

[v0ldemort @bkojusner]

@l33tdawg @thsottiaux @OpenAI I think it was something about CN characters consuming fewer tokens when the agent is thinking, happening here too smh

[tmp.0ut @tmpout]

We are pleased to release tmp.0ut 5 Volume!

Get your viruses, rootkits, strange ELFs, weird machines, tiny files, cool art, and phresh beats here!!

https://t.co/tZLM50HOc0

[Duncan Ogilvie 🍍 @mrexodia]

Had some fun with DeepSeek-V4-Flash-0731 while at the airport! https://t.co/Ek9soDcNgC

[CCob🏴󠁧󠁢󠁷󠁬󠁳󠁿 @_EthicalChaos_]

Want to run an entire Tailscale daemon from memory inside a C2 implant with zero disk artifacts, no kernel drivers, traffic indistinguishable from HTTPS to a CDN, and relay connections from the victim network back through the tailnet.

Now you can. Enjoy!

https://t.co/WmBlShAnLr

[domas @xoreaxeaxeax]

New exploit: “xor dword [0xf80c2094], 1<<22”

Unlocks CPU microcode, the platform security processor, system management mode, and every internal processor register, all at once, on 100 million AMD CPUs. As far as I can tell can’t be fixed.

https://t.co/sgAfneFSsf

[v0ldemort @bkojusner]

Initial Access Vector you say 👀👀👀

[hacker.house @hackerfantastic]

@Dropbox @msftsecresponse @sslcorp @MalwareVillage @Mandiant @CrowdStrike 🇰🇵FULL-CHAIN: Initial Access Vector https://t.co/3m0PXS5dXZ (stage1 DocSend loader) https://t.co/mMpD1zljb3 (stage2 toolkit) https://t.co/J8FEr04i1x

[Borja Martínez @Qm9yamFN]

DEFCON 34: You can find our research here:

https://t.co/sEzW29Z1Ul

[Blackstorm Security @blackstormsecbr]

(CTF) Kernel Exploit Dojo

https://t.co/R4yfZRN6pF

#ctf #exploit #cybersecurity #informationsecurity #infosec #vulnerability #kernel

[Smukx.E @5mukx]

A hands-on walkthrough of exploiting a Windows stack buffer overflow and bypassing DEP using a manually crafted ROP chain, leveraging VirtualAlloc to prepare executable memory and building the entire chain from scratch without relying on Mona.

Blog:- https://t.co/CzFyUXIsln

[yan @bcrypt]

if you’ve been on either side of a bug bounty you know the joy in it is gone now. it’s just AI reports coming in, AI patches going out, and decreasing human understanding of either. i wonder what is left of the security industry once the fun clever hacking parts are all outsourced to AI.