Sam

on my own path ¯\_(ツ)_/¯

[hacker.house @hackerfantastic]

Microsoft Windows is surveillance software.

[vx-underground @vxunderground]

Honestly, if you're wanting to get into malware development and malware reverse engineering (specifically in regards to Windows), I think the most important thing you can learn is the concept of a file.

1. What is a file extension? This is pretty obvious, .exe, .pdf, .mp3, etc.

2. How are file extensions handled? This would introduce the idea of the Windows registry and how extension querying is handled vs. the Windows loader

3. Which file extensions (or file types, rather) are used for payload delivery? e.g. .exe, .dll, .xll, .vbs, .ps1, .py, .lua, .docx, .vcproj, etc. The .exe, .dll, (and other native types, like .sys) will be sort of self-explanatory, but the others would introduce different malware delivery mechanisms (malicious files) and potentially wiggle in the concept of payload smuggling.

4. Each of the previous listed file types are different. How are they different? .exe and .dll (and many others) are native to Windows and handled by the Windows loader. Why are the others still considered executable files? This is when you slowly step into interpretive languages and VM dependency (JVM, PVM, etc).

Somewhere in this you would eventually stumble into the Windows PE format, how the PE format is different for .NET binaries, how Electron .JS executables act differently, weird stuff like .docx file internals, etc.

Basically, I think understanding files and how they're handled is an excellent starting point and sets the stage for what will happen next.

pic unrelated

[Cyber Security News @The_Cyber_News]

New DirtyClone Linux Vulnerability Allows Attackers to Gain Root Access Via Cloned Packets

Source: https://t.co/79sx2kuBwW

A new Linux kernel local privilege escalation vulnerability, dubbed “DirtyClone” (CVE-2026-43503), that allows unprivileged local users to gain full root access by manipulating cloned network packets through the XFRM/IPsec subsystem, all without leaving a trace in kernel logs or audit records.

DirtyClone is a high-severity variant in the DirtyFrag vulnerability family, a class of Linux kernel memory corruption bugs affecting how socket buffers (skb) reference shared page-cache memory.

#cybersecuritynews

[Sam @day0x00]

@lukOlejnik heavy croissant bait worked x d

[Moshe Siman Tov Bustan @MosheTov]

🚨 Shai-Hulud / Miasma / Hades malicious supply chain attack is back AGAIN(!)

23 Affected packages
52,640 Monthly downloads
339 GitHub repositories with "Alright Lets See If This Works"
179 GitHub repositories with "Hades * The End for the Damned"

Multi-stage dropper logic, using GitHub for C2 and payload delivery, weaponizing 5th stage dropper logic and beyond.

Using 3 compromised accounts across npm & GitHub to deliver this whole supply chain attack.

Read the full analysis on our blog:
https://t.co/qrWqi15Tz5

List of compromised packages:
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

[Sam @day0x00]

nice take on FortiBleed https://t.co/kCsyHVHne9

[Sam @day0x00]

the most searched guy today

Alferov Aleksey Aleksandrovich

[International Cyber Digest @IntCyberDigest]

🚨 BrEaKiNg: Splunk, a security product, has zero authentication in its built-in database service and accepts any credentials, according to the security researchers who just dropped a full pre-auth RCE chain for Splunk Enterprise (CVE-2026-20253, CVSS 9.8).

Splunk Enterprise on AWS is vulnerable out of the box.

[John Scott-Railton @jsrailton]

NEW: malware developers added nuclear & biological weapons text to to their spyware.

Goal? To trigger LLM safety refusals... so that their spyware wouldn't be analyzed by an AI security scanner.

Cleanest practical example I can think of for why over-indexing on first order safety alignment is risky.

When closed (and open) models ship with aggressive refusals, they will be sprinkled with second-order blindspots that attackers will discover...and exploit.

We are only in the earliest days of attackers leveraging these features, and it wouldn't surprise me if users systems that need to handle complex cybersecurity issues demand that models be less safety-blunted.

In the weeds: @SocketSecurity's post also shows why intention matters in how you design a malware analysis pipeline to avoid prompt manipulation.

H/T to colleagues that shared this with me https://t.co/f3Aj9TYxU4

[skull @brutecat]

Hacking Google with A.I. for $500,000

https://t.co/S8NbDU9ZaN

[John Scott-Railton @jsrailton]

Epic OPSEC fail by NSO Group.

@whatsapp recently caught the notorious spyware company hacking across their platform.

(NSO is forbidden from doing this by a US court!)

In their testing, NSO was sending a test image of a soup cup...on a desktop mat with the NSO Group logo.

Making it worse, the image was user-reported to WhatsApp.

Cleanest attribution I've seen in a long time.

[International Cyber Digest @IntCyberDigest]

🚨 Check Point confirmed an actively exploited authentication bypass in Remote Access VPN and Mobile Access using the deprecated IKEv1 protocol. Attackers can open a VPN session with no valid authentication. One case is already linked to a Qilin ransomware affiliate. (CVE-2026-50751 / CVSS 9.3)

[John Hammond @_JohnHammond]

Introducing: https://t.co/FOcfQGdxtg ! 🛜🤖😂

A free prompt injection wargame to troubleshoot your local network with an AI assistant; and a challenge to have it leak some secrets!

Brought to you by @JustHackingHQ, @_ContinuumCon_, @d1gitalandrew Andrew Bellini & Eva Benn.

[vx-underground @vxunderground]

> be Zuckerberg
> needs AI everywhere (apparently)
> lays off a bunch of employees
> replaces with AI
> fast forward
> AI is dog shit
> AI tricked into stealing accounts
> try to fix
> fail like 5 times
> product now leaking CEOs PII

AI truly is the future, wow

[Tib3rius @0xTib3rius]

So apparently there's a new attack against Bitlocker called bitskrieg.

Microsoft is having a great week.

[Nicolas Krassas @Dinosn]

IronWorm and New Miasma Worm Variant Hit npm in Supply Chain Attacks https://t.co/ruEjN0y61d

[Rami McCarthy @ramimacisabird]

@beyondmemory_io Ben Zimmermann did this for 22 million "documents" back in April.

https://t.co/WIki1ufkL6

[ZoomEye @zoomeye_team]

🚨 cve-2026-42211: React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE

Critical Vulnerability Alert!
React Router is affected by CVE-2026-42211.

Full Vulnerability Details & Analysis at DarkEye:
🔗 https://t.co/XkhFAwFIQQ

🔍 Identify Targets via ZoomEye:

Filter: vul.cve="cve-2026-42211"
Search Dork: app="React Router"
Exposure: 1.3m instances identified globally.

ZoomEye Search Link:
👉 https://t.co/0YbacoMaoQ

#Infosec #CyberSecurity #ZoomEye #DarkEye

[Unit 42 @Unit42_Intel]

We detected an evasive #ClickFix injection with a fake Lirunex payment platform lure tricking the user into requesting the SSL certificate path through a file dialog box but silently delivers a RAT disguised as image files. Details at https://t.co/3gOKYWrMLz

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft discovered that Anthropic's Claude Code GitHub Action could expose CI/CD workflow secrets when AI agents process untrusted content, including issue bodies, pull request descriptions, and comments. https://t.co/EFDooX4EjU

Following our disclosure, Anthropic mitigated this issue in Claude Code version 2.1.128 by blocking access to sensitive /proc files.

Read the blog for details from our research, along with practical guidance for reducing prompt injection, over-permissive tooling, and secret exposure risks in agentic CI/CD workflows.