cybernerd🤖

Application Security🌼 Penetration Testing 🌼 API Security Person of the Year (2025) 🌼 30 under 30 in Cybersecurity 🌼 ex- @KPMG 🌼 ex-@Deloitte

[cybernerd🤖 @ce3nerd]

Just passed my over $10,000 exam, GIAC GWAPT Certified ✅ The journey was long, the late nights were real, and it was worth every bit. Huge thanks to @sisinerd who took a chance on me that I’m worth this & to @SANSInstitute for the incredible partnership with @cybersafehq

[Tib3rius @0xTib3rius]

We're cooked.

https://t.co/2k8cdKaHV6

[cybernerd🤖 @ce3nerd]

@qbitdojo Thanks

[cybernerd🤖 @ce3nerd]

If you have any solid indirect prompt injection resources please kindly share with me, thank you 🙏

[cybernerd🤖 @ce3nerd]

@kagex_ai Thanks

[cybernerd🤖 @ce3nerd]

@sitaramsaikk Thank you 😊

[cybernerd🤖 @ce3nerd]

@rdezso Thank you

[cybernerd🤖 @ce3nerd]

If you have any solid indirect prompt injection resources please kindly share with me, thank you 🙏

[Shanholo @ShanHolo]

Beyond #Artex, what other #offensive #AI frameworks should the cybersecurity community be watching?

A few on my radar:

🔹 CyberStrike
https://t.co/gC5QSBF1gY
🔹 Cairn
https://t.co/t5C21RHN6U
🔹 PentAGI
https://t.co/ZzJHCY1qid

Have you tried any of these? Let me know!

[cybernerd🤖 @ce3nerd]

@Olufela_Jr @UoPeople Congratulations 🎉🎊

[Binance @binance]

https://t.co/sU9dUqLQDH

[Dawid Moczadlo @kannthu]

I retired from cybersecurity, I now lay flooring

No more CVEs to worry about, I will go to sleep thinking that my floor is well done, without any worry that my Linux server is going to get hacked 30th time this week

Good luck with your vulnerable servers

[Critical Thinking - Bug Bounty Podcast @ctbbpodcast]

Smaller models can be very useful for bug bounty, we just have to be more specific with its' prompts instead of relying too much on the reasoning like we do with the high-end models.

We recently covered a bunch of ways to get more out of your hackbot setup regardless of model and hardware

- Split your agents by speciality, have one analyse JavaScript, another check authentication, and another handle recon. Narrow tasks make it easier to see what each agent actually tested.
- Use smaller models for boring work, like reading large JS bundles, inspecting APKs and identifying sources and sinks are useful "simple" jobs. Save stronger models for investigating promising leads.
- Don't lose evidence when summarising. Make agents preserve relevant code locations, requests and responses. A summary saying "possible injection" is useless if the next agent can't find the original source.
- Make another agent challenge the finding and verify the claimed impact. An SSRF callback doesn't automatically prove internal access, XSS doesn't automatically mean ATO, these things need to be tested by different agents.
- Test your prompts against known bugs, previously validated, to check whether changes to your harness improved results or made it worse.
- Keep agents separate, give them separate browser sessions, clear work assignments but a shared place to store results.

A smaller model with good tools, clear instructions and proper verification can be a lot more useful than most people think, we only need to use them a little bit differently!

[Binance @binance]

Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.

The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.

As an immediate precaution, Binance has:

- temporarily suspended deposits and withdrawals while security checks are completed;
- revoked the affected address authorisation;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.

Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.

Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.

https://t.co/ywB2mKFy0p

[Ted @TedPillows]

Binance hacker is swapping everything to $ETH.

[aaalex.hl @aaalex]

Polymarket frontend is injecting a malicious script to sell all your positions and withdraw funds

Do not interact with Polymarket, revoke permissions, do not even log in

[International Cyber Digest @IntCyberDigest]

‼️ BREAKING: The Binance hack has grown to about $5.6B drained across Ethereum, Bitcoin and Tron, on-chain trackers say.

If confirmed, it would be the biggest crypto heist on record.

Tether and Circle have frozen about $1.8B in stablecoins, and Circle says it acted "in coordination with law enforcement."

Binance hasn't confirmed any impact on user funds.

[DelCrxpto @DelCrxpto]

LIST OF EXCHANGES HACKED TODAY

- BINANCE - $3.5 BILLION
- BYBIT - $1 BILLION
- BITGET - $1 BILLION
- SWYFTX - $10 MILLION
- KuCoin - N/A

[Elon Musk @elonmusk]

Everyday is Zeroday

[Hans @hansaFL]

@KobeissiLetter