Brady Bloxham

[International Cyber Digest @IntCyberDigest]

‼️🚨 Pwn2Own Berlin 2026 just hit a wall. For the first time in 19-years, ZDI rejected dozens of working zero-day RCE submissions because organizers ran out of contest slots.

Rejected hackers are now going public with PoC demos and direct vendor disclosures, breaking Pwn2Own's usual secrecy.

▪️ AI surfaces a massive wave of 0-day RCEs.
▪️ Submissions overwhelm ZDI past max capacity.
▪️ Slots run out. Researchers with working chains get rejected.
▪️ "Revenge disclosures" begin. ← we are here.

Confirmed casualties so far:
▪️ @xchglabs : 86 vulnerabilities prepared (PyTorch, NVIDIA, Linux KVM, Oracle, Docker, Ollama, Chroma, LiteLLM, llama.cpp). All rejected. Now reporting directly to vendors with writeups dropping as patches land.
▪️ @ggwhyp : full-chain Firefox RCE on Windows. Rejected. Publicly demoed (HTML page → cmd.exe → calc.exe). Responsibly disclosed to Mozilla.
▪️ @yunsu_dev : working RCE chain, rejected. Submitting elsewhere.
▪️ @ryotkak : tried to register for 3+ weeks. ZDI confirmed "at maximum capacity, can't add extra contest days." Considered canceling flight and hotel.
▪️ @anzuukino2802 : Claude Code RCE PoC. Rejected.
▪️ @desckimh : 0-day RCEs in Ollama and LM Studio. Rejected.

Reported impact: a community-estimated 150+ researchers tried to register. Accepted contestants are now being warned about collisions. Rejected vulnerabilities going to bug bounty programs may trigger pre-event patches that invalidate the work of those who got in.

ZDI has not publicly addressed the capacity issue. The event still runs May 14-16 in Berlin.

[BlackSnufkin @BlackSnufkin42]

shipping v5 of LitterBox after way too many late nights

real EDR in the loop now. drop an agent on your VM, fire payloads at it, alerts land back with full call stacks. Elastic Defend + Fibratus work. new UI + better performance — notes in the release.

https://t.co/NWCd3KIxXh

[Brady Bloxham @bradybloxham]

@therealshodan I don’t think this is a hot take. I think it’s spot on and will happen across all skilled industries, not just cyber. AI is going to eat the skills gap.

[Asuka Nakajima | 中島明日香 @AsuNa_jp]

BlackHatAsiaの発表スライドをSpeaker Deckに公開しました！(I’ve published my Black Hat Asia presentation slides on Speaker Deck!)

https://t.co/stoM9qXDYA

[Cipher007 @xCipher007]

SysWhispers4 just dropped !!!
https://t.co/dCGboy3rwQ

[HackerRalf @hacker_ralf]

AdaptixC2 v1.2 is out!

* New UI cross platform styles
* Server side AxScript Engine
* Async BOFs

Full update info: https://t.co/01pE4jxZ83

[Panos Gkatziroulis 🦄 @ipurple]

Stuck Without Coercion options? Why not just Coerce MDE? https://t.co/527byZfAjZ

[Anthony Morris ツ @amorriscode]

SSH support is now available for Claude Code on desktop

Connect to your remote machines and let Claude cook, TMUX optional.

[Lost Isle @playlostisle]

The Lost Isle OPEN PLAYTEST is available now!

🎮 Join by downloading the Demo: https://t.co/yGU3ap6EpQ
🏆 Win exclusive prizes
📅 Play until February 16

#demomonday #survivalgame #playtest #indiedev #gamedev

[Elon Musk @elonmusk]

@cb_doge Doing what I can for justice. It’s messed up that so many people are getting away with hurting minors. The prosecution counter for Epstein clients can’t be zero.

[Lost Isle @playlostisle]

You asked for it, and here we are: A new Lost Isle OPEN PLAYTEST is coming during the Steam PvP Fest! 🏝️☠️

📅 February 9-16
🏆 Join our Discord and win exclusive skins
🎮 Download the demo and play for free
🔗 https://t.co/yGU3ap6EpQ

#demo #playtest #indiegame #survivalgame

[Claude Code Changelog @ClaudeCodeLog]

1/3: Claude now supports authorized security testing, CTFs, and educational security work (not just defensive). It still refuses harmful use: destructive techniques, DoS, mass targeting, supply chain compromise, and malicious detection evasion. Dual-use tools require explicit authorization context.

Diff: https://t.co/oTMNVRdIWb

[Romern @Romerrn]

@Defte_ I just installed a clean version of Server 2022 (20348.169), setup it up as a DC, and tried to create a keycredential. That worked. Than I installed the latest cumulative update (KB5073457) and now it does not work anymore. So it seems to be a recent change.

[MagicSword @magicswordio]

Attackers don’t need stolen certificates. They only need 8 bytes. By flipping 4 bytes in the PE checksum and 4 in the certificate padding, they generate 2⁶⁴ unique driver hashes while keeping Microsoft’s digital signature valid.

Why it matters:
- Those 8 bytes sit outside the region Windows verifies.
- Every variant looks “signed and trusted.”
- Hash-based blocking becomes useless overnight.

That’s how TrueSightKiller evolved into 2,500+ signed variants. All trusted by Windows, all capable of killing EDRs in seconds.

Check out: https://t.co/8ldbtHVJBa

[Panos Gkatziroulis 🦄 @ipurple]

Bypassing Windows Administrator Protection https://t.co/jUk6Nv26Mw

[Secorizon @secorizon]

Responder 3.2.2.0 is out!
This new version comes with two new poisoners: RDNSS and DNSSL.
Inject an IPv6 DNS server on all workstation present on your subnet.
2 new options were added: --rdnss and --dnssl https://t.co/W1ZkLo6Gj3
These two new poisoners are highly effective :)
For more info about DNSSL attack, refresh your memory here:
https://t.co/bGi1mctJzK

[Brady Bloxham @bradybloxham]

Not gonna lie, this looks amazing.

[Amazon MGM Studios @AmazonMGMStudio]

Discover your true power. Watch the Teaser Trailer for Masters Of The Universe now, and see the movie only in theaters June 5.

[Brady Bloxham @bradybloxham]

@w3bd3vil So true, it’s become worthless.

[Binni Shah @binitamshah]

Lock picking robot : https://t.co/0UMH8Shcyl

[Nic Losby @Blurbdust]

The blog with how to use the rainbow tables for Net-NTLMv1 is finally live!
https://t.co/LjN9y6PHXA

My slides from presenting at BRCC are still available if you're curious about how crazy of a three year journey it was to get them created.
https://t.co/NfFotEh7ah