Darekid Barrique

[CodeRabbit @coderabbitai]

langflow. bun. ant-design. nuxt. vue. mermaid. pnpm. trpc.

Over 600,000 GitHub stars between them, and CodeRabbit reviews it all, for free.

Next stop: more than $10M into OSS over the next year, counted at what it costs us.

Heres how and why 👇

[Nicolas Krassas @Dinosn]

Reverse engineer anything with agents, from app behavior down to native binaries.
https://t.co/hJCBQtSU4D

[OccupytheWeb @three_cube]

Sysinternals is among the best tools to determine whether you have hacked!

https://t.co/JHyYvS3UTt

[Dhiyaneshwaran @DhiyaneshDK]

🚨 CVE-2026-21589 - Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Read

Nuclei Template : https://t.co/EvNb3MvnP0

Reference: https://t.co/zszpScosyZ

#bugbounty #hackwithautomation #atlassian

[0xMarioNawfal @RoundtableSpace]

10 OPEN-SOURCE GITHUB REPOS THAT CAN AUTOMATE WORK WHILE YOU SLEEP:

AutoHedge — https://t.co/gbj3PFIUAw
Vibe Trading — https://t.co/0rudpZZjZq
Claude Ads — https://t.co/wuVV4Wlt0p
TopRank — https://t.co/OJnIkC3ecv
FinceptTerminal — https://t.co/BbZyY5pnll
Agentic Inbox — https://t.co/bbdTWF654P
Context Mode — https://t.co/yPY35LU0pf
CamoFox Browser — https://t.co/95UBGSFQxN
Open Higgsfield AI — https://t.co/TVJnSKpMip
Hyperframes — https://t.co/uWikFN3mSI

[The Hacker News @TheHackersNews]

🚨 A public Telerik UI PoC chains a padding oracle into unauthenticated RCE.

TantoSec’s exploit for RadAsyncUpload forges encrypted state and loads a DLL, but only on specific non-default configurations.

Inside the chain → https://t.co/tmvIIbR3Ns

[bcoles @_bcoles]

KASLD v0.4.0 released.

Linux #KASLR derandomization tool.

Memory regions now carry a certainty rating: "guaranteed" proven values/ranges, and "likely" narrower guesses that can be wrong (from heuristics/side-channels).

+18 leak components (120 total).

https://t.co/NDUxBpgqE5

[The Hacker News @TheHackersNews]

🛑 A critical VMware flaw can turn local VM admin access into host code execution.

Broadcom fixed CVE-2026-59346 and an HGFS flaw in Workstation and Fusion 26H1u1. Both affect 25H2 and 26H1, with no workarounds or known exploitation.

How the code execution paths work: https://t.co/dCuVR33NuP

[BleepingComputer @BleepinComputer]

Attackers conceal phishing lures using invisible Unicode characters
https://t.co/vbbdhTMIiX

https://t.co/vbbdhTMIiX

[0xor0ne @0xor0ne]

Experiments with local open-weight LLMs to detect vulnerabilities (@xmartinaxo)

https://t.co/4vv8W1oeBc

#infosec

[7h3h4ckv157 @7h3h4ckv157]

Reverse Engineering Playlist

By: IronByte
Source: https://t.co/B8NfdsFXR5

[周览资源 @grgerwcwetwet]

推荐一个开源项目 Prompt-Optimizer，一个专门用来优化提示词（Prompt）的工具。

这个项目它可以分析和改进你的原始提示词结构，让模型输出更贴合预期，而不必盲目去试各种组合。

GitHub：https://t.co/mScyVIYXQ5

[鑫源 Ai @aiyuange]

🔥 【AI逆向不再“脑补”，每条结论都被二进制亲自盖章】

📌 项目定位：
Reverify 是一个专治“AI 胡说八道”的逆向工程助手。平时让大模型看二进制，它经常脑补偏移量和结构，坑到你怀疑人生。Reverify 的做法很硬核：让模型提假设，让确定性工具当裁判，拆解、比对、模拟执行——所有结论必须过二进制本身这一关，VERIFIED 才给通过。小白也能秒懂：AI ��责猜，工具负责验，验不过闭嘴重猜。

⚡️ 核心优势：
▫️ 工具会“审稿”：每条结构/算法结论都要被字节级验证，返回 VERIFIED / REFUTED，不信 AI 一张嘴。
▫️ 开箱即用：纯 Python 核心，PE/ELF/Mach-O 解析、AOB 扫描、Frida Hook 生成全都有，不装 Ghidra 就能跑。
▫️ 引擎可升舱：`pip install "reverify[full]"` 原地升级 capstone + unicorn + lief，性能拉满，装没装一看 `backends` 就知道。
▫️ 对 Agent 原生友好：自带 MCP 服务器，Claude Code、Cursor 直接调用，还能批量验证 claims，CI 跑挂就拦下幻觉。
▫️ 十八般武艺：指令模拟、Protobuf/TLV 解析、二进制 diff/patch，恶意样本分析、CTF、互操作研究都能干。

🎯 实战落地场景：
- 接恶意样本分析私活的独立安全顾问：拿它跑 `auto` 自动分���，再用 `verify` 验证结论，交付报告底气足，客单价敢往上抬。
- 做安全工具/插件商店的开发者：把常用验证流程打包成配置模板或 MCP 工具链，一份开发 N 次售卖，躺收复购。
- CTF/技术博主：写“AI 逆向翻车实录”测评帖引流，再顺手接逆向工具链商单，流量变现两不误。
- 企业二进制合规审计人员：AI 先扫，工具后验，SSRF/文件边界 audit 直接自动化，帮公司省人天，就是你谈涨薪的本钱。

🔗 项目直达： https://t.co/6u0Kkkujtu

🏷 标签：#AI逆向工程 #开源工具 #副业赚钱 #信息安全 #MCP

[BleepingComputer @BleepinComputer]

Critical Elementor Pro flaw exploited to take over WordPress sites
https://t.co/oLY96nqMOW

https://t.co/oLY96nqMOW

[0xor0ne @0xor0ne]

LLVM based analysis of the relationship between compilers, obfuscation, and de-obfuscation

https://t.co/7rfwhEczcz

Credits Robert Yates (@quarkslab)

#infosec

[BleepingComputer @BleepinComputer]

Hackers exploit Sangoma Switchvox flaw to deploy reverse shells
https://t.co/efXPtQ0Xya

https://t.co/efXPtQ0Xya

[Nicolas Krassas @Dinosn]

RzWeb: Rizin in the browser with local MCP so agents can RE binaries without uploading them https://t.co/5LvT4AqAn3

[The Hacker News @TheHackersNews]

🛑 A BGP hijack delivered a malicious Virtualizor update that established persistent root access.

A valid certificate prevented connection warnings. One provider found 5 of 34 checked hypervisors compromised.

Virtualizor says check every server.

Read: https://t.co/UKTxcwrBDT

[BleepingComputer @BleepinComputer]

WordPress backup plugin flaw exposes millions of sites to takeover attacks
https://t.co/oPvnj0mKpX

https://t.co/oPvnj0mKpX

[The Hacker News @TheHackersNews]

‼️ A public PoC shows how CrowdStrike Falcon’s macro remediation can be abused for privilege escalation.

FalconFlank works on fully updated Windows 11 25H2 and Windows Server 2025. CrowdStrike has not yet commented.

Read: https://t.co/yN3FInp26x