Nhan

[Sam Thomas @xorpse]

We @binarly_io just open-sourced our VulHunt framework at @REverseConf!

GitHub: https://t.co/G7bRkP81Gu
Documentation: https://t.co/LSNxpHXGNj
Slack: https://t.co/RMFggNV9sM

https://t.co/recuxjHJZh

[Chaitanya @ant4g0nist]

new kid coming to reverse engineering town…his name is Snowball 🐇

[R136a1 @TheEnergyStory]

This blog post provides an in-depth analysis of #Turla's #Kazuar v3 loader and how it tries to slip past modern defenses:

• Sideloading via MFC satellite DLLs
• Control flow redirection trick (+ POC)
• Patchless ETW and AMSI bypasses (+ POC)
• Extensive COM usage for registry, file and folder operations (+ partial POC)
• Strings encryption (+ IDAPython decryption script)
• Including IOCs and Yara rules

https://t.co/FK8uAq9iyK

[0xor0ne @0xor0ne]

Analyzing XLoader malware with Generative AI/LLM

https://t.co/wpRq9BJnME

Credits @_CPResearch_

#infosec #malware

[Ivan Velichko @iximiuz]

Everyone knows eBPF load balancers beat user-space LBs by avoiding packet copies and context switches.

But here's a little-known fact: you can build your own eBPF LB, with backend selection and session affinity, in 200 lines of C

Teodor proves it (again) https://t.co/0gHzbxZlmc

[Outflank @OutflankNL]

Let's play peekaboo with PatchGuard! Read our blog post about hiding processes on modern Windows systems with HVCI enabled:
https://t.co/8q7cAo6pSo

[Tivadar Danka @TivadarDanka]

I wrote a 4000-words long article about all the math you need to know for machine learning.

Trust me, you want to bookmark this:

https://t.co/sV52SBB16J

[dis0rder @dis0rder_0x00]

As promised here is my approach to using the Windows Debugging API to inject shellcode (w/o direct process read/write)

Had a lot of fun playing with this! (Currently tested agains MDE & Elastic)

https://t.co/Yn4HI68OwF

[MalDev Academy @MalDevAcademy]

Later this week, we will be releasing DumpBrowserSecrets which will extract passwords, tokens, cookies and more from Chrome, Edge, Brave, Opera, Opera GX, Vivaldi, and Firefox with one command.

This will be an improved version of DumpChromeSecrets. https://t.co/Bc5OcDXCdc

[MatheuZ @MatheuzSecurity]

Singularity rootkit now can bypass SELinux enforcing mode without audit logs on ICMP trigger, conntrack/netlink filtering (conntrack, ss, SOCK_DIAG), UDP hiding + setup script

https://t.co/MKRjVgBROo

#linux #rootkits #malware #evasion #antiforensics

[Abhishek🌱 @Abhishekcur]

By far the most comprehensive guide for virtual machines, literallyy.
-great for understanding low level concepts
-it's kind of very detailed guide
the whole thing is soo structured and anyone can understand vm.

[Muqsit 𝕏 @mqst_]

🍥 A Comprehensive & Practical Introduction to CodeQL

Blog: https://t.co/wAfup7ASUw

Author: @jorge_ctf

[ℏεsam @Hesamation]

Harvard's just open-sourced their ML Systems textbook. it's extremely practical for not just learning how to build and train models, but to build production systems (the skill that actually matters). topics are cool af:
> building autograd, optimizers, attention, and a mini-pytorch from scratch to truly learn how an ML framework runs. (i love this the most)
> basics of DL, batch sizes, precision, model architectures, and training
> ML performance optimization, HW acceleration, benchmarking, efficiency

so this is not just an intro to machine learning, it's the full package from the beginning to the actual end. right now you can read the book and access the code for free. this is one of the best books I've seen dropping in 2025, so don't sleep on it.

here's the repo (you can find the book link there): https://t.co/5OEWPBNaJp

[Ivan Velichko @iximiuz]

If you are learning Linux, networking, containers, or Kubernetes, check out my work at https://t.co/enVaqlOx2f. You'll find:

- 60+ free playgrounds (remote Linux VMs)
- 100+ SysAdmin/DevOps problems (practice)
- Dozens of deep dives (theory)
- Lots of helpful technical diagrams

[Alex Plaskett @alexjplaskett]

Reviving Discarded Vulnerabilities: Exploiting Previously Unexploitable Linux Kernel Bugs Through Control Metadata Fields

https://t.co/gP0wdeaJOs

[Faith 🇧🇩🇦🇺 @farazsth98]

Finally, here is the blog post containing all the details about how I wrote this PoC: https://t.co/P555NpBaZO

The ~4-5 millisecond race window was more than enough to trigger the vulnerability, but is it enough for a full exploit? Or do I need to extend it? We'll see 😉

[Dulge @dulgex]

ida pro x binja 🤷
#idapro #binja

[Alexandre Borges @ale_sp_brazil]

From Coverage to Causes: Data-Centric Fuzzing for JavaScript Engines:

(paper) https://t.co/feTDgsJhB2
(project) https://t.co/z5tqTrEJ6Z

#fuzzing #vulnerability #javascript #exploitation #llm

[Zion Leonahenahe Basque @mahal0z]

Do LLMs actually help hackers reverse engineer and understand the software they want to exploit?

We ran the first fine-grained human study of LLMs + reverse engineering.
To appear at NDSS 2026.

Interested? Some quick findings in 🧵👇
Paper: https://t.co/h4oBWjSgd3

[Viacheslav Biriukov @brk0v]

🦀 Want to really squeeze Linux I/O? Here’s a modern take: build an S3-style blob store in Rust and go deep on the I/O path.

- Direct I/O
- io_uring
- Atomic writes
- Block device

https://t.co/xP4YxH7aIl
#rust #rustlang