Jean-Pierre GARNIER

Adversary Hunter && Threat Researcher - ♥infosec, code and mojitos - Opinions are mine

[Jean-Pierre GARNIER @codeyourweb]

#fastfinder 3.6.0 released! Memory scan capability,
cross-architecture (x86/x64/arm), enhanced logging, SIEM log forwarding and tons of optimizations

#DFIR #threathunting #IOC #YARA
https://t.co/7nWClkkckA

[Dark Web Informer @DarkWebInformer]

‼️Copy Fail (CVE-2026-31431) is a Linux privilege escalation bug that lets any local user get root using a 732-byte Python script, and itworks on basically every major Linux distro shipped since 2017.

Website: https://t.co/f5G6KnEv35

Write-up: https://t.co/W86Pz2PC6C

GitHub: https://t.co/zAMTC6nTRk

It's a logic flaw in the kernel's crypto code (authencesn via AF_ALG and splice()) that allows a small write into the page cache, which can be used to tamper with a setuid binary like /usr/bin/su.

Think how bad this is going to be for shared environments like Kubernetes, CI runners, and cloud sandboxes, where it enables container escape and tenant-to-host compromise.

Found by Theori's Xint Code scanner, patched in the mainline kernel, and publicly disclosed on April 29, 2026; if you can't patch right away, the recommended workaround is to disable the algif_aead module.

[Jean-Pierre GARNIER @codeyourweb]

@anyrun_app @msftsecurity Did you really make the exact same mistake exactly one year later? It's been back on @anyrun_app for the past few hours

[Binni Shah @binitamshah]

rzweb : A complete browser-based reverse engineering platform built on Rizin, running entirely client-side via WebAssembly : https://t.co/lAkYHVHPvI

[Jean-Pierre GARNIER @codeyourweb]

Already five years, Time flies so quickly... At the end of 2021, I developed #fastfinder to simplify triage using #YARA. 2026 is an opportunity to reinvest time in this project with a V3 featuring tons of new features #DFIR #CERT #threathunting

https://t.co/7nWClkkckA

[Jean-Pierre GARNIER @codeyourweb]

@_0b1d1 PDF

[Jean-Pierre GARNIER @codeyourweb]

@_0b1d1 Dm allowed. Interested by your work.

[Jean-Pierre GARNIER @codeyourweb]

@_0b1d1 Interested in the full document, but at first glance it appears to be a thorough piece of work. Could you share the full content?

[Stephan Berger @malmoeb]

New blog post: Tear Down The Castle - Part 2
https://t.co/7QPqW0UbRh

I analyzed 250 PingCastle Reports, grouping the findings along the categories I used for my 10 AD Commandments series.

The number of affected domains is stated within each finding, i.e., in how many domains we found the misconfiguration or the vulnerability.

[Yuval Gordon @YuG0rd]

Many missed this on #BadSuccessor: it’s also a credential dumper.
I wrote a simple PowerShell script that uses Rubeus to dump Kerberos keys and NTLM hashes for every principal-krbtgt, users, machines. no DCSync required, no code execution on DC.

[Jean-Pierre GARNIER @codeyourweb]

And here's a little project
to monitor network traffic and logging directly over endpoints interfaces. First proof-of-concept with local pcap and HTTP API forwarder (fully tested on #SEKOIA plaftform).

https://t.co/snyHhjOLmK

#soc #cybersecurity #networksecurity

[Eric Morillot @EricMorillot]

Quel génie a fait ça ??? 🤣🤣🤣

#Ukraine #Russie #USA

[Akshay 🚀 @akshay_pachaar]

Microsoft has released its own document parser for LLM use!
.
.
Introducing MarkItDown, a 100% open-source, one-stop solution for effortlessly converting any file to Markdown—perfect for text analysis, indexing, and more!

Here’s what makes it special:

↳ Converts PDF, Word, Excel, PPT, images, audio to markdown
↳ Extracts EXIF, OCR, and transcripts automatically
↳ Available via CLI, Python API, or Docker
↳ Offers LLM-based image descriptions
↳ Supports batch conversions

Link to the repo in next tweet!
_____
Find me → @akshay_pachaar ✔️
For more insights & tutorials on AI and Machine Learning.

[Eroktic @Eroktic]

Reviews are MOSTLY NEGATIVE - Gray Zone Warfare
vid is up on yt #GZW #GrayZoneWarfare

[Jean-Pierre GARNIER @codeyourweb]

https://t.co/xD870yWt6D

[Katie Nickels @likethecoins]

Kudos to @DragosInc for sharing details of a recent event. The adversary compromised a new employee's personal email address and impersonated them to get access. How would you protect against that?

[Florian Roth ⚡️ @cyb3rops]

I remember a time when people here in Europe still had issues storing their corporate emails on US mail servers - nowadays you store the master keys to your company on their servers

🎵 … for the times they are a-changin'

[Florian Roth ⚡️ @cyb3rops]

Priorities

[Alexis Kauffmann @framaka]

[Android] Une trentaine de "Privacy Friendly Apps" proposées par @SECUSOResearch qui :
- are Open Source (GPLv3) and their source code can be viewed an Github by anybody
- used minimal permissions
- do not neither tracking mechanisms nor advertisement
https://t.co/PjNNNydYLT

[Chetan Nayak (Brute Ratel C4 Author) @NinjaParanoid]

Unable to extract credentials via DPAPI or Mimikatz? Don't worry. Microsoft got your back. Just use 'rundll32 keymgr.dll, KRShowKeyMgr' to extract all the stored passwords on the host, be it a target server, FTP or chrome's HTTP creds, microsoft has you covered. #redteam