darkit

🦊 at @BishopFox

[darkit @dark1t]

This year I decided to make time to do research as it is a field I'm passionate about. This has resulted in discovering two critical vulnerabilities (CVE-2023-48022 and CVE-2023-48023)
See the below advisory to see how to escalate privs on the cloud from SSRF and file disclosure

[Bishop Fox @bishopfox]

The #opensource framework Ray from Anyscale is impacted by 3 critical #vulnerabilties: missing authentication, #SSRF, & insecure input validation. We recommend Ray users refrain from exposing Ray network services to a local network or to the Internet. More in the advisory by @dark1t. #infosec #cybersecurity

https://t.co/MVADuY5ZwW

[JS0N Haddix @Jhaddix]

New Executive Offense: "RSA 2026: Hot Takes on AI, Agents, and Offensive Security Reality Checks"

(This one is more a an opinion piece but hope you enjoy it 🫶 )

https://t.co/pMeHfOXfex

[darkit @dark1t]

@vxgiveaways @OSINTindustries

[watchTowr @watchtowrcyber]

We promised we'd be back!

Join us on our journey, from repro'ing N-days to stumbling into 0-days in SolarWinds Web Help Desk, eventually achieving pre-auth RCE.

This research fuels the watchTowr Platform, our Preemptive Exposure Management technology.

https://t.co/TzNBT1Ghs7

[Yuval Avrahami @yuvalavra]

We hacked the AWS JavaScript SDK, a core library powering the entire @AWScloud ecosystem - including the AWS Console itself 🤯

How did we do it? Just two missing characters was all it took.

This is the story of #CodeBreach 🧵👇

[Today In Infosec @todayininfosec]

1995: The movie Hackers was released. Yes, 30 years ago today. 🤯

It grossed just $7 million at the box office against a budget of $20 million. Ouch. A box office failure, but today it's a cult classic.

Crash Override.
Acid Burn.
Rollerblades.
Floppy disks.

Hack the Gibson!!!

[H4x0r.DZ 🇰🇵 @h4x0r_dz]

When a SSRF is enough: Full Docker Escape on Windows Docker Desktop (CVE-2025-9074)

https://t.co/2CGY8UV7fy

"How was it found
It was by mistake actually, I did not know much about container separations and its implication"

[ϻг_ϻε @steventseeley]

As it turns out, @orange_8361 and I have more in common than I had thought! If you love old school PHP quirks and CTF tricks I recommend you read our articles:

https://t.co/oFro6bACfi
https://t.co/6Y9yMUlilj

[Phrack Zine @phrack]

Signing underway at @nostarch at @defcon

[darkit @dark1t]

@defconparties Women v neck XL

[vx-underground @vxunderground]

https://t.co/tDpKMg1qmk

[darkit @dark1t]

@kuzushi @defcon @rez0__ @ArchAngelDDay @wickett @JF0LKINS

[PentesterLab @PentesterLab]

Can you feel the pain?

[Pwntacles @pwntacles]

A las comunidades universitarias de ciberseguridad con estudiantes activos se les invita a la primera reunion de "NoTrustSec x Pwntacles - Student communities".

Registro y mas información:
https://t.co/asCul5f0Af

[BSides CDMX @bsidescdmx]

¡Gracias por sus propuestas para #BSidesCDMX 2025!
A los speakers: estén pendientes de su correo, recibirán noticias pronto 📬
Ya comenzamos a armar la agenda! 🗓️

Y gracias al comité evaluador por su gran trabajo:

@phragma @bytevic @Yess_2021xD @dark1t @hecky

#securitybsides

[Pedro Ribeiro @pedrib1337]

Router RCE via the public WLAN interface *which cannot be disabled on your own router without calling the ISP* w/ bonus fault injection via HDD vibrations 🤠

👑King showing by @_r0ny and a shit show by @MEOpt

https://t.co/G15AMgzTvP

[AI Notkilleveryoneism Memes ⏸️ @AISafetyMemes]

🚨🚨🚨 "We found the model attempting to write self-propagating worms, and leaving hidden notes to future instances of itself to undermine its developers' intentions."

[Yuval Gordon @YuG0rd]

🚀 We just released my research on BadSuccessor - a new unpatched Active Directory privilege escalation vulnerability
It allows compromising any user in AD, it works with the default config, and.. Microsoft currently won't fix it 🤷‍♂️
Read Here - https://t.co/c969sNjQH0

[Mauro Eldritch 🏴‍☠️ @MauroEldritch]

#Lazarus #Malware #DPRK #Ciberseguridad #Cibercrimen

https://t.co/MSuXHjXf6N

[Tib3rius @0xTib3rius]

BREAKING.

From a reliable source. MITRE support for the CVE program is due to expire tomorrow. The attached letter was sent out to CVE Board Members.

[darkit @dark1t]

@chingersonX