Christian Biehler

[Christian Biehler @cssec]

Ernsthaft schockierend wäre es, wenn unser digitalminister mit der Schreibmaschine schreibt ..,,

[ntv Nachrichten @ntvde]

Hinweis auf Nutzung fehlte: Digitalminister Wildberger ließ Texte von KI schreiben https://t.co/A8ry0CLq8D

[DirectoryRanger @DirectoryRanger]

SMB alternative ports
https://t.co/sYMSZ4HNZw

[Dark Web Intelligence @DailyDarkWeb]

🚨 NOW, THIS IS INTERESTING. BreachForums and TeamPCP have announced what they describe as a “Supply Chain Competition” centered around the alleged public release of the “Shai-Hulud” tooling.

According to the underground forum post:
• participants are encouraged to conduct software supply chain compromises
• a monetary reward of $1,000 USD in XMR is being offered
• actors are instructed to use the alleged “Shai-Hulud” tooling during attacks
• submissions reportedly require proof of access or compromise
• winners are allegedly determined based on downstream impact and package download volume

The post references:
• software package ecosystem abuse
• open-source distribution attacks
• package/repository compromise scenarios
• supply chain propagation tactics
• public hosting of the tooling via underground infrastructure

This development is significant because it reflects an evolution in underground ecosystems:
threat actors are increasingly gamifying cyber operations through:
• competitions
• public rankings
• collaborative tooling releases
• affiliate-style attack ecosystems
• community-driven malware development

The operational model resembles a blend of:
• bug bounty culture
• ransomware affiliate programs
• open-source collaboration
• competitive cybercrime ecosystems

Even if portions of the tooling or claims are exaggerated, these types of campaigns can still:
• accelerate copycat attacks
• lower barriers for inexperienced actors
• increase package poisoning attempts
• normalize supply chain targeting
• encourage opportunistic compromise activity

Organizations should immediately review defenses related to:
• software supply chain security
• dependency trust validation
• CI/CD pipeline hardening
• package signing enforcement
• repository integrity monitoring
• developer credential exposure
• anomalous package update behavior
• open-source dependency governance

Security teams should closely monitor for:
• suspicious package updates
• malicious dependency injections
• typosquatting packages
• unexpected maintainer changes
• build pipeline anomalies
• unauthorized GitHub/GitLab actions
• npm/PyPI ecosystem abuse
• credential leakage tied to developers

This also highlights a broader industry shift:
supply chain attacks are no longer exclusively associated with highly sophisticated state operations.

Underground communities are now actively:
• operationalizing supply chain tradecraft
• sharing offensive automation
• incentivizing mass-impact attacks
• distributing reusable tooling
• commoditizing software ecosystem abuse

At this time:
• the full operational capability of the alleged tooling remains unverified
• the scale of adoption is unclear
• authenticity of all related source code releases has not been independently confirmed

However, the public encouragement of supply chain attacks alone represents a concerning escalation in underground threat actor culture.

#CyberSecurity #SupplyChainSecurity #ThreatIntelligence #DarkWeb #TeamPCP #BreachForums #SoftwareSecurity #DevSecOps #OpenSourceSecurity #Infosec #CyberThreats #DDW #Intelligence

[Anuj @anujcodes_21]

🚨 Anthropic just showed a 24-minute workshop on how to actually do prompts for Claude.

Taught by the people who built it.

Free. No registration. No paywall.

I've seen $300 courses that don't cover what they teach in the first 8 minutes.

Watch it and bookmark it now.

[The Hacker News @TheHackersNews]

🚨 The average time from CVE disclosure to working exploit has dropped to roughly 10 hours in 2026, down from 56 days in 2024.

The report says AI-assisted attackers can breach systems in 73 seconds while many defenders still rely on manual workflows.

Read why the gap is widening: https://t.co/BXRAj94wT9

[The Hacker News @TheHackersNews]

The internet had another normal week...

💀 Poisoned installers
🔥 Firewall zero-days
🐧 Linux rootkits
☁️ Cloud hijacks
🎣 OAuth theft
🪤 ClickFix traps
🤖 AI bug hunting
⚠️ Fake updates everywhere

⚡ Weekly cyber recap just dropped: https://t.co/9jtiJWXp9f

[vx-underground @vxunderground]

Big news for Blue Team nerds

That nerd who released those Microsoft 0days has created two new repos on GitHub with spooky sounding names indicating they will be releasing two new Windows 0days.

Very cool

https://t.co/VaWFtW5lFi

[Nicolas Krassas @Dinosn]

Three LLMs review your design plan in parallel — paste 30 lines into your CLAUDE.md, no install needed. https://t.co/Rz1FDPkR0N

[Fabian Bader @fabian_bader]

In my latest blog "Now You See Me: AADGraphActivityLogs" I explore the newly released Azure AD Graph logs and demonstrate how you can detect tools like ROADtools and AADinternals that rely on this API and have been under the radar for defender so far.

https://t.co/TXlkbsqKHa

[Clandestine @akaclandestine]

GitHub - elementalsouls/Claude-OSINT: Two paired Claude skills · 90+ recon modules · 48 secret-regex patterns · 80+ dorks · 9 read-only credential validators · 27 attack-path templates · 5,500+ lines of structured tradecraft. Drop-in https://t.co/JqEj7fSRfQ

[The Hacker News @TheHackersNews]

macOS attacks are now hiding in system features.

Payloads stored in Spotlight metadata let attackers run code without suspicious files, using native scripting and protocols to move and persist outside standard monitoring.

🔗 Learn how macOS built-ins are being weaponized → https://t.co/fvQGYlTZ3N

[Florian Roth ⚡️ @cyb3rops]

Some people asked what I meant by “uncensored Opus 4.5-level open source models”

This isn’t hypothetical. Every time a strong open model drops, within days (sometimes hours) someone republishes a modified version without the original safety layers

“Uncensored” usually means the guardrails are stripped or weakened:
- refusal / policy layers removed or bypassed
- system prompts altered to ignore restrictions
- alignment tuning undone or diluted
- fine-tuned specifically to comply with harmful or sensitive requests

So you end up with a model that doesn’t say “I can’t help with that” anymore

And these aren’t running in some lab

Many of them run on hardware that’s accessible:
- high-end consumer GPUs
- Mac Studio (M3/M4)
- Strix Halo mini PCs (~$3k)
- or dedicated rigs in the $25k–150k range

That’s well within reach for serious threat actors

And those models are completely unrestricted and can be used day and night.

Compare that to something like Mythos:
- tightly controlled access
- heavy filtering and monitoring
- accounts can get flagged or shut down
- expensive at scale

From an attacker perspective, it’s not even close

I’d take a slightly less capable model fully under my control over a more powerful one someone else controls any day

https://t.co/m0t9jSRc5R

[Graeme @gkisokay]

The Local LLM Cheat Sheet for your 32GB RAM device

I was asked to put together a practical lineup of local models that fit comfortably on a 32GB machine.

At this tier, you start getting access to real flagship-class local models, plus a growing number of custom quants. But for most people, these are the core models worth knowing first.

Flagship Models

Qwen3.5 27B / GGUF / Q6_K_M
The best overall 32GB flagship. General chat, writing, research, and agent workflows. Great if you want one model that can handle almost everything well.

Qwen3.6-35B-A3B / GGUF / UD-Q4_K_M
Best MoE flagship. Stronger for coding, reasoning, and tool use than most smaller generalists.

Gemma 4 31B / GGUF / Q6_K_M
Dense premium model. Writing, analysis, reasoning, and high-end local chat. Heavier than the MoE options, but excellent when quality matters more than speed.

Models for Fast Flagship Use

Gemma 4 26B A4B / GGUF / Q6_K_M
Great balance of speed and quality for general assistant work, coding, agent tasks, and research. This is one of the best 32GB picks if you want something that feels high-end without dragging.

DeepSeek-R1 Distill Qwen 32B / GGUF / Q4_K_M
Offline reasoning engine. Best for math, logic, deliberate analysis, and step-by-step problem solving.

Mistral Small 24B / GGUF / Q6_K_M
Tool-calling specialist. Strong for assistants, chat workflows, local business tasks, and function calling. Available for 24GB machines.

Models for Companion Use

Qwen3.5 9B / GGUF / Q6_K_M
Best sidekick. Fast drafts, search loops, cheap retries, and secondary agent work. Even on a 32GB machine, you still want a smaller model around for support tasks.

Llama 3.1 8B / GGUF / Q6_K_M
Long-context companion. RAG, doc ingestion, codebase chat, and long prompts. The output quality is not the sharpest anymore, but it is still useful when needing simple tasks fast.

From what my community tells me, the best single models are Qwen3.5 27B or Gemma 4 31B.

For two models, the strongest general pairing is Qwen3.5 27B + Qwen3.5 9B.

If you are more code-heavy, Qwen3.6-35B-A3B + Llama 3.1 8B.

Let me know what models you are running on 32GB, and which ones have actually been worth the RAM.

[Florian Roth ⚡️ @cyb3rops]

. @mubix shared this on LinkedIn and thought some of you might find it useful: “A Practical Reprioritization Guide for CISOs Entering the AI Vulnerability Era”

https://t.co/UaJUb82ecG

[Clandestine @akaclandestine]

GitHub - zeroc00I/LLM-anonymization: Reverse proxy for Claude Code that anonymizes sensitive pentest data (IPs, hashes, credentials, hostnames, PII) before it reaches Anthropic. Dual-layer detection: local Ollama LLM + regex safety net, with per-engageme https://t.co/mSZFqyZryy

[DirectoryRanger @DirectoryRanger]

VMkatz. Extract Windows credentials directly from VM memory snapshots and virtual disks, by @Nikaiw
https://t.co/RpdzUEdrLs

[mthcht @mthcht2]

🎉 Hundreds of new malicious browser extensions added to https://t.co/kYGDIyKGGY !

[Paul Couvert @itsPaulAi]

1. Download Google AI Gallery

- App Store: https://t.co/Do2AMfPjYi
- Google Play: https://t.co/RCouTHXU6r

Source code available here: https://t.co/KKUgxtz6kt

[Nicolas Krassas @Dinosn]

BitLocker's Little Secrets: The Undocumented FVE API https://t.co/VnUJ4LXcJE

[Daily CyberSecurity @the_yellow_fall]

TokenFlare is a 2026 serverless AITM phishing framework for Entra ID. It features built-in Intune Conditional Access bypass and Cloudflare Worker deployment.

#TokenFlare #M365Security #PhishingSimulation #EntraID #CyberSecurity2026 #RedTeaming #Cloudflare
https://t.co/7Vulyg9axx