Stu4rt (he/him)

Researcher, Analyst, & @BSidesHTX Organizer
Wanna trade pcaps?

[Defused @DefusedCyber]

⚠️ We are observing actors sending test exploits against the recent Drupal vulnerability CVE-2026-9082 since this morning

Probes hit /jsonapi/node/* with a malformed filter[…][value][…] key, triggering the SQL injection bug to check whether the site is vulnerable.

No data-extraction payloads yet, so this is likely recon ahead of the real wave.

Monitor live attacks against Drupal 👉https://t.co/rEG9aqrq5l

[blackorbird @blackorbird]

The name ‘fast16’ is referenced in the infamous ShadowBrokers’ leak of NSA’s ‘Territorial Dispute’ components.

fast16.sys selectively targets high-precision calculation software, patching code in memory to tamper with results. By combining this payload with self-propagation mechanisms, the attackers aim to produce equivalent inaccurate calculations across an entire facility.

https://t.co/21xcadwNjU

https://t.co/e4m47EJDw4

[Threat Insight @threatinsight]

Our new Discarded episode explores the stealthy world of backdoors, malware detection, and the “secret signals” threat actors use to stay hidden.

Stream now for expert insights on signature development, PCAP analysis, and countering espionage tools.

🎙️ https://t.co/t0tET38lGz

[Gareth Heyes \u2028 @garethheyes]

🔥 Can you get RCE from an email address? Yep. In my NDC Manchester talk Splitting the email atom, I break down how RFC weirdness leads to auth bypasses, parser confusion, and full remote code execution. Watch here 👇 https://t.co/vUCY6Haqom

[tmp.0ut @tmpout]

We are excited to announce the CFP for the next tmp.0ut Volume 5!

https://t.co/BbNFql5d7I

[Stu4rt (he/him) @d1nqnt]

@_mccaulay @0xBoku @watchtowrcyber sick

[Stu4rt (he/him) @d1nqnt]

@naumovax https://t.co/2iwDgN6U2M

[Stu4rt (he/him) @d1nqnt]

@RussianPanda9xx @TheDFIRReport Za-mbie!

[Panda🐼 @realcyberpanda]

Like if you YOU'RE SAFE✌️

[Stu4rt (he/him) @d1nqnt]

@SquiblydooBlog Keep up the great work!

[Stu4rt (he/him) @d1nqnt]

@Malcoreio pick me, pick me please!

[Squiblydoo @SquiblydooBlog]

Debloat removes junk from inflated executables: https://t.co/yv0LBdVRdO

In v1.5.5, I added result-codes: telling the user which tactic was used. This allows measuring success and what tactics are used.

From 700 files, Debloat worked 97.8% of the time.

[Stu4rt (he/him) @d1nqnt]

@spaceraccoonsec consider /\/FontMatrix\s+\[[\d\s\.\-]*\(/ to match other transformations; ie. /FontMatrix [-0.1 0 0 0.1 0 0]

[Marc-André Moreau @awakecoding]

Wireshark now has an easy way to embed TLS pre-master secrets (SSLKEYLOGFILE) into a capture file from the GUI:

Edit -> Inject TLS Secrets

This will make it MUCH easier to save decrypted TLS sessions in a .pcapng file to share with others!

[Stu4rt (he/him) @d1nqnt]

@sherrod_im

[ET Labs @ET_Labs]

39 new OPEN, 42 new PRO (39 + 3) Connectwise Screenconnect ,Ghostlocker, Lumma Stealer, and more

Thanks: @Jane_0sint, @ConnectWiseCRU

https://t.co/3jKxyRSdZ2

[Drunk Binary @DrunkBinary]

Org know for dropping POCs for attention that exacerbates the problem, drops another POC, exacerbating the problem

[尺Ξn4tø 尺ødɿiguΞ5ǃ͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗͗ ็็้้้ @simps0n]

AppSec Ezine - 522nd Edition https://t.co/LiUgAMS5He #AppSec #Security

[Stu4rt (he/him) @d1nqnt]

@4ndr3w6S Notion + notion web clipper plugin

[Will @BushidoToken]

Sorry not sorry