Carlos

[X-C3LL @TheXC3LL]

I just wrote a post for @AdeptsOf0xCC! Yes, we are live again! 🦉

In this post I RE a sound protocol (yes soundwaves!) used by Eufy and also we recover and decrypt wifi credentials from its flash memory.

From your doorbell to your home network => https://t.co/F46CpaLfXL

[Sandro Bruscino @SandroBruscino]

Median gap between a public fix commit and CVE disclosure: 18 days. Measured across 26,803 CVEs.

Time for an LLM pipeline to turn that commit into a working exploit: 6 to 53 minutes.

97.1% of CVEs are patched before disclosure. The diff is the disclosure.

https://t.co/O8Pa33JE3D

[Carlos @deyavito]

@patowc @MADRID Se nota que alguien ha estado por Japón... xD

[Altered Security @AlteredSecurity]

Get ready for our next Hacker Summer 2026 webinar!

From Initial Access to Persistence: Abusing Synced Passkeys in Azure

Learn how attackers can abuse synced passkeys in Azure to convert initial access into long-term persistence, and explore practical techniques for detection and mitigation.

The session will be led by @NathanMcNulty, who will share practical insights and real-world attack scenarios.

17 July 2026 | 12:00 PM ET | 2+ Hours

Register now:
https://t.co/WTr11NU0WE

#HackerSummer2026 #AzureSecurity #RedTeaming #CyberSecurity #AlteredSecurity

[Aurélien Chalot @Defte_]

I have suspected the klist.exe could be used to dump local tickets but never had time to check that out correctly. This guy did and explains it very well! Only requires local admin rights, no system, to dump all TGT's on the computer

https://t.co/5lYSxQpXq7

[Carlos @deyavito]

Oye @elparkingapp ¿cuándo tenéis previsto notificar a los usuarios de @ParkingDoor sobre esta #vulnerabilidad? @la_Mutua #CVE-2025-41100

[Carlos @deyavito]

#ParkingDoor #ElParking #mutuamad #mutuamadrileña

[Outflank @OutflankNL]

We worked with @_dirkjan to get this as an exclusive into Outflank Security Tooling with a new tool called ROADtune.

ROADtune allows red teamers to:
- bypass CAP by faking device compliance registration
- loot secrets from applications pushed to compliant devices

Cool stuff!

[https://mastodon.social/@antoniovazquezblanco @antonvblanco]

You can now parse small code snippets by directly pasting them into Ghidra. I've made an extension for that. See https://t.co/NY4YDrBqJO

[Jean-Michel Besnard @jmbesnard_maz]

Want to check for #ESC15 ? Use the following cypher with #BloodHound
MATCH p=(:Base)-[:MemberOf*0..]->()-[:Enroll|AllExtendedRights]->(ct:CertTemplate)-[:PublishedTo]->(:EnterpriseCA)-[:TrustedForNTAuth]->(:NTAuthStore)-[:NTAuthStoreFor]->(:Domain) WHERE ct.enrolleesuppliessubject = True AND ct.authenticationenabled = False AND ct.requiresmanagerapproval = False AND ct.schemaversion = 1 RETURN p

Thanks @Jonas_B_K
More information available here: https://t.co/RiRtKsN7B5

[_leon_jacobs(💥) @leonjza]

gowitness v3 is out! A huge task, but I refactored basically _everything_ for version 3 in just over a week, followed by also writing the longest release notes of my life! Hopefully it's the best version yet.

A lot has changed, so feel free to dig in. 🤖

🧵👇

[_leon_jacobs(💥) @leonjza]

In this example I'm "jumping" SSH. Using a shared secret between the server and the client, my ssh command dynamically populates the the port flag based on whatever the port number will be server-side.

[Dreg @therealdreg]

It's already reading a flash! Bus Pirate v5 -> flashrom though I still have some bugs, like the CDC getting stuck sometimes. But here you can see the flash content (after detection, etc.) @dangerousproto

[Balthasar @BalthasarMartin]

Today at #Troopers24 we released Certiception – the ADCS honeypot we always wanted to have.

Blog: https://t.co/2NCzLTtItc
Source code: https://t.co/WLSMq2Bl8m
Slide deck, including our guide to deception strategy: https://t.co/xEAUPhqaGR

[Chris Wysopal @WeldPond]

If your website uses https://t.co/0V2y6VHu8n, remove it immediately.

In Feb, a Chinese company bought the domain & Github account. Since then, this domain was caught injecting malware on mobile devices via any site that embeds https://t.co/SmvnQ0E0nS
https://t.co/hrkaPYA80j

[Carlos @deyavito]

@Inversor00 @X @El_Retuiteador2 @Jonisoy @luisant_Nanfu @accountant_inv Buscaba algo similar, gracias!

[Inversor07🕵️‍♂️ @Inversor00]

¡Quiero regalar mi plantilla de seguimiento financiero en @X ! Solo necesitas dar ❤️RT a este tweet y comentar para recibirla. Sígueme para poder enviártela por MD. ¡Juntos podemos ayudar a más personas a controlar sus finanzas! 📊💰

[Dreg @therealdreg]

Do you remember when @FTDIChip 's driver bricked chinese clone chips? @s0sinh4 & I have code some POCs to brick original FT232R that don't use an external clock (almost all boards, right?) FreeBSD+Windows+Linux(WIP). On Windows from non-admin user, wtf!

https://t.co/BZnIquUJiU

[Ax Sharma @Ax_Sharma]

A GitHub flaw lets attackers upload executables that appear to be hosted on a company's official repo, such as Microsoft's—without the repo owner knowing anything about it.

The following URLs, for example, make it seem like these ZIPs are present on Microsoft's source code repo:

https://github[.]com/microsoft/vcpkg/files/14125503/Cheat.Lab.2.7.2.zip
https://github[.]com/microsoft/STL/files/14432565/Cheater.Pro.1.6.0.zip

But they are not. These ZIPs are #malware.

An attacker, while commenting on any GitHub commit/PR, can "attach" a file that gets assigned a URL slug containing the name of the repo where the comment was made. Even if the comment is never actually posted or later deleted by the attacker, the link to the file remains live!

And, the repo owner (Microsoft in this case) would have no knowledge of or control over such files.

Threat actors have been abusing this flaw to distribute malicious executables under the false pretense that these are coming from credible organizations' code repos.

[Anthony Weems @amlweems]

I've been reverse engineering the xz backdoor this weekend and have documented the payload format and written a proof-of-concept exploit for the RCE. The payloads are signed with an ED448 key, so I patched my own key into the backdoor for testing. :-)

https://t.co/CvKo3xPRkP