Melo

In encryption we trust.

[Melo @enigmelo]

I discovered a pretty cool bypass of the keystroke obfuscation measures introduced in #OpenSSH 9.5.

You can read about it here:
https://t.co/JeJEzwx8Gd

[AI Security Institute @AISecurityInst]

OpenAI’s GPT-5.5 is the second model to complete one of our multi-step cyber-attack simulations end-to-end 🧵

[AI Security Institute @AISecurityInst]

We conducted cyber evaluations of Claude Mythos Preview and found that it is the first model to complete an AISI cyber range end-to-end. 🧵

[AI Security Institute @AISecurityInst]

Can AI agents conduct advanced cyber-attacks autonomously?

We tested seven models released between August 2024 and February 2026 on two custom-built cyber ranges designed to replicate complex attack environments.

Here’s what we found🧵

[Stephen Sims @Steph3nSims]

An Introduction to using Artificial Intelligence (AI) for Vulnerability Research https://t.co/952iFabRqd

[Melo @enigmelo]

@hackermondev Very interesting research!

[Melo @enigmelo]

@safe0x17 This has been my weekend(s) project for a while now, never got to crack the internals of GodPotato, though. Am curious if you ever found a public blogpost about this or just went off the public repo to reverse/convert the logic. Great stuff!

[Xander Davies @alxndrdavies]

Jailbreaking evals ~always focus on simple chatbots—excited to announce AgentHarm, a dataset for measuring harmfulness of LLM 𝑎𝑔𝑒𝑛𝑡𝑠 developed at @AISafetyInst in collaboration with @GraySwanAI!
🧵 1/N

[0xdf @0xdf_]

Got interested in a diary from the @sans_isc about OFBiz Exploitation. Will show the exploit on Bizness (from @hackthebox_eu), and show how the patch for CVE-2024-32112 didn't fix the exploit, but the one for CVE-2024-36104 did.

https://t.co/1mRxN35Tei

[Melo @enigmelo]

Although overshadowed by the RCE, this was patched today in OpenSSH 9.8!

https://t.co/grFbowrqs5

Good stuff @damienmiller

[Melo @enigmelo]

I discovered a pretty cool bypass of the keystroke obfuscation measures introduced in #OpenSSH 9.5.

You can read about it here:
https://t.co/JeJEzwx8Gd

[Melo @enigmelo]

I'll hopefully publish the paper itself once it is graded (unless they fail me lol). Until then, if you are interested, you can read a summarised version of the research here:
https://t.co/LQx7rv2cp2

[Melo @enigmelo]

The patch was introduced to mitigate keystroke-based timing attacks on the SSH protocol, which is a topic that I extensively researched in my final year at uni.

I wrote SSHniff, an SSH metadata analyser, which you can find here:
https://t.co/dDeod1gTbM

[Patrick Breyer #JoinMastodon @echo_pbreyer]

🇬🇧 Vote on #ChatControl postponed – a triumph in our fight to defend the digital privacy of correspondence and secure encryption. 💪 Thank you!
But the next attempt will come. The critical governments need to get their act together now:

https://t.co/rehi36rsxL

[Mullvad.net @mullvadnet]

Chat control is a corrupt proposal pushed forward through undemocratic methods. The Belgian version is no different. The European Council should follow the European Parliament’s lead and reject it.
https://t.co/4o1q3tVHsv

[Meredith Whittaker @mer__edith]

📣Official statement: the new EU chat controls proposal for mass scanning is the same old surveillance with new branding.

Whether you call it a backdoor, a front door, or “upload moderation” it undermines encryption & creates significant vulnerabilities

https://t.co/g0xNNKqquA

[Melo @enigmelo]

@threatactress @hackthebox_eu Definitely a missed opportunity on my part lol
Hope you enjoyed the box :)

[Hack The Box @hackthebox_eu]

Everything’s a blur 🫣
A new #HTB Seasons Machine is coming up! Blurry created by @enigmelo will go live on 8 June at 19:00 UTC. POV will be retired!
✓ Medium
✓ Linux
→ Join the competition & start #hacking: https://t.co/vh0CExdDOT
#HackTheBox #CyberSecurity #NewRelease

[Melo @enigmelo]

Thought I was going crazy.. not how I wanted to spend my Sunday lol
Thanks to these fellas, too:
https://t.co/YYKYu4RBVR

[Melo @enigmelo]

"It's always DNS"- except when your ISP is at fault.. So I was trying to figure out why pihole fails to resolve https://t.co/EDCbsMgZdE, but only when using DNSSEC. Turns out 'ole gov's DNSSEC is fine, but VirginMedia messes up Packet Fragmentation, causing truncated keys...