Equalizer

I break the internets and find things.

[JFK Files @read_jfk_files]

tfw you laugh at idiot Microsofty lusers being globally tracked by the NSA because their GUID is hardcoded inside their TPM, but then you suddenly remember Linux also has /etc/machine-id and you forgot to setup your init daemon to periodically truncate and regenerate a new machine-id so you can't also be tracked because you are pretty sure that Chrome is reading it and sending it to Google as harmless "user telemetry analytics."

i stand by my claim that mf'er asshole Lennart Poettering really is the NSA's man on the inside on a mission to destroy Linux and install the NSA's backdoors through all his systemd slop

[Com Feed @thecomfeed]

⚠️ UPDATE: New Court Files Reveal How Microsoft Helped the FBI Identify Peter Stokes "Bouquet" (Scattered Spider Member)

The court files reveal that Microsoft helped the FBI track Peter Stokes down using GDID — a Global Device Identifier, which is assigned to every Windows installation and cannot be changed unless the OS is wiped. The GDID helped them track:

• IP history
• Full web activity
• Video game activity and games played
• Logged-in social accounts, including Snapchat, Facebook, and Apple

According to the court documents, the critical mistake was using a VPN to create the ngrok account used in the May 2025 Tiffany & Co. hack from the same Windows device associated with his GDID.

Although the account was created from a VPN IP address ending in .168, Microsoft records show that the same GDID (6755467234350028) accessed the ngrok signup page at the exact time the account was created, linking the hack to his personal social accounts.

[Equalizer @Equaliz3d]

@VittoStack I would like to check this out. Im a pentester for the better.

[Karl (RIP ) @supersat]

NSA: "Mythos Broke Into Nearly All Classified Systems"

Also NSA: (from 2013)

[Censys @censysio]

🚨 FortiBleed Exposes Credentials Associated with Fortinet Infrastructure

Researchers report a dataset containing credentials tied to ~73,932 Fortinet firewall URLs across 194 countries. This is not a new vulnerability, the risk is exposed or compromised credentials.

Rotate credentials, enforce MFA, and validate internet-facing FortiGate assets.

Read our analysis: https://t.co/phaERJYS0R

[FOFA @fofabot]

⚠️⚠️ CVE-2026-48611 (CVSS 9.8): Unauthenticated OAuth flaw allows account hijacking on default phpBB installs.
🔗FOFA Link: https://t.co/TStBedUEtd
🎯10K+ Results are found on https://t.co/HSOBZfC2cT in the past year.
FOFA Query: app="phpBB"
🔖Refer: https://t.co/hRafgWczD0
#OSINT #FOFA #CyberSecurity #Vulnerability

[FOFA @fofabot]

⚠️⚠️ CVE-2026-36537 (CVSS 9.8): OAuth authorization code exchange auth bypass in ThingsBoard v4.3.0.1.
🔗FOFA Link: https://t.co/Z2tZ9tkyhC
🎯14K+ Results are found on https://t.co/HSOBZfCA2r in the past year.
FOFA Query: app="ThingsBoard"
🔖Refer: https://t.co/O1WS6P4G3T
#OSINT #FOFA #CyberSecurity #Vulnerability

[Rimsha Bhardwaj @heyrimsha]

Google Translate is cooked after this.

A developer built a local AI translation engine that runs 40 languages entirely on your own laptop.

It's called LibreTranslate.

No API key.
No usage limits.
No sending your documents to Google's servers.

You install it once. It runs forever.

Here's what it handles:

→ Paste text. Translated instantly.
→ Drop in a file. Outputs the translated version.
→ Point it at a URL. Returns the page in your language.
→ Build it into your own app via its local REST API.

The speed is not the story. The privacy is.

Google Translate reads every sentence you paste into it. Legal contracts. Medical records. Internal emails. Client documents. Every word goes to their servers and stays there.

LibreTranslate runs entirely offline. Nothing leaves your machine. Ever.

The numbers:

→ 40 languages supported
→ Runs on CPU -- no GPU needed
→ Self-hosted in under 5 minutes
→ REST API built in for developers
→ 10K+ stars on GitHub

100% open source. MIT licensed. Price: $0.

Google charges nothing for Translate either but it charges you something else.

GitHub: https://t.co/5XF7qgbMRB

[Nico @nicos_ai]

GOOGLE HA LIBERADO EN SILENCIO UNA IA QUE PREDICE PATRONES

Ventas. Precios de mercado. Tráfico web.
Demanda energética. Volatilidad cripto.

Se llama TimesFM:

→ Entrenada con 100B de datos reales
→ Forecasting zero-shot, sin fine-tuning
→ Corre en local.

100% Gratis y Open Source.

Enlace abajo👇

[Kanika @KanikaBK]

🚨 BREAKING: Someone just leaked the ENTIRE system prompt of Claude Fable 5 and Anthropic CANNOT DELETE IT.

It was public on GitHub within 24 hours of launch.
120,000 characters. 1,585 lines. 27,000+ tokens.

And what they're hiding will shock you:

↳ Fable 5 and Mythos 5 are the SAME MODEL. Fable just has extra safety filters locked on. Mythos doesn't but they're restricting who gets access. You're paying for the same thing with different guardrails.

↳ Knowledge cutoff is end of January 2026. Not May or March or JANUARY. They let you think it was newer.

↳ Claude is EXPLICITLY TOLD to avoid bullet points and lists unless you ask. That weird prose everyone noticed? It’s programmed not a feature, but a prompt instruction.

↳ Copyright hard limit nobody talks about: quoting 15+ words from ANY source triggers a SEVERE VIOLATION flag. One quote per source maximum. After that the source is CLOSED to Claude forever in that chat.

↳ New persistent storage API buried in there. Artifacts can now store and retrieve your data across sessions using key-value pairs. Most users have NO IDEA this exists.

↳ MCP app connectors are baked INTO the prompt. Claude can search for and suggest third-party integrations MID-CONVERSATION without telling you it's doing it.

↳ The prompt includes full instructions for Claude Cowork, Claude in Chrome, Claude in Excel, and Claude in PowerPoint. These are not just integrations. They're tools Claude USES on you.

↳ This prompt is ONLY for https://t.co/3nqvgXgs01's consumer chat. API users get NO system prompt. Claude Code has completely different secret instructions.

The repo is CL4R1T4S by Pliny the Liberator. 26.4K stars. Same repo that leaked ChatGPT, Gemini, Grok, Cursor, Lovable, Replit, and Perplexity.

The original leak post hit 700K+ views in 48 hours.

If this gets taken down you'll lose access. Bookmark it NOW.

[Md Ismail Šojal 🕷️ @0x0SojalSec]

Fully automatic censorship removal for Any LLM models,

Built a tool that removes LLM censorship in 45 minutes flat.

You run one command, and the model is fully uncensored.

- https://t.co/dwoSuldaYf

[ThreatMon @MonThreat]

🚨 A significant data leak has exposed a suite of advanced cyber weapons developed by APT43, also known as Kimsuk, a North Korean state-sponsored threat group. The leaked materials, dated June 2026, include source code for backdoors, rootkits, and exploitation tools targeting critical infrastructure.

The arsenal features a C++-based backdoor with full encryption algorithms and automatic trace-hiding mechanisms designed to evade detection on victim servers. Additionally, the leak includes a rootkit capable of high-accuracy server takeovers.

Most critically, the exposure reveals three zero-day vulnerabilities in the Android Kernel, along with tools for penetrating Android phone kernels. The group also possesses a zero-day vulnerability allowing for root privilege escalation on Linux servers running the Linux 7.0 kernel.

APT43 has historically targeted financial institutions, telecommunications, and government sectors. The availability of these zero-days and exploitation tools poses a severe risk to global IT infrastructure, particularly Android devices and Linux-based servers.

#APT43 #Kimsuk #ZeroDay #LinuxSecurity #AndroidSecurity #NorthKorea #DataLeak

[Cyber Detective💙💛 @cyb_detective]

https://t.co/hF8rx9JuOX

Search through 2M+ threat actor usernames and find where they operate

[Vivek | Cybersecurity @VivekIntel]

Claude-BugHunter: 71 AI-Powered Skills for Bug Bounty Hunting and External Red Team Operations 💀🔥

🤖 Turn Claude into a Bug Hunting Assistant

Claude-BugHunter equips Claude Code with bug bounty methodologies, recon workflows, vulnerability hunting patterns, reporting guidance, and external red team tradecraft.

🔗 https://t.co/89R7Cx20oz

#BugBounty #CyberSecurity #ClaudeCode #AppSec #RedTeam #AI #OpenSource

[International Cyber Digest @IntCyberDigest]

‼️ UPDATE: It just doesn't stop: Almost 900 Arch Linux packages infected now.

https://t.co/xpRTsucoxA

[International Cyber Digest @IntCyberDigest]

‼️🚨 Unauthenticated attackers are gaining SYSTEM on domain controllers with crafted packets.

The vulnerability being exploited is CVE-2026-41089, a CVSS 9.8 hole in Windows Netlogon, and exploitation in the wild has been confirmed.

A patch has existed since May 12. Every DC still behind is not just vulnerable, but according to the Centre for Cybersecurity Belgium are also actively being pwnd.

[International Cyber Digest @IntCyberDigest]

🚨 BREAKING: Ivanti Sentry CVE-2026-10520 (CVSS 10.0) is under active exploitation, one day after a public PoC dropped. Shadowserver counts many exposed vulnerable instances, they're being backdoored. Assume compromise.

https://t.co/X0IlttHoLK

[Rishi @rxerium]

🚨 CVE-2026-10520, a critical (CVSS 10.0) OS Command Injection vulnerability in Ivanti Sentry is now under active exploitation as reported by @DefusedCyber

Scan infrastructure to see if you're vulnerable:
https://t.co/roIHUnSn9G

Patches are available as per Ivanti's advisory:
https://t.co/tLztidouhh

[Michael R @nahamike01]

ShinyHunters, (or a group impersonating them) exposed several directories revealing ongoing targeting of PeopleSoft (Enterprise Resource Planning software) environments.

Also visible were staging materials, including MeshCentral agents, and a defacement and credential spray script.

🧵

#shinyhunters

[International Cyber Digest @IntCyberDigest]

❗️🚨 Mythos can now autonomously weaponize newly disclosed vulnerabilities in hours, not weeks. Everybody is exposed, because the patch gap between a fix going public and reaching your devices is now wide enough to drive a full exploit through.

Three takeaways from the new Anthropic research:

1. Speed: it built a working Firefox exploit within ONE HOUR of Mozilla's patch, 18 days before the fix reached users.

2. No source code needed: on Windows, working from compiled binaries alone, it built 8 full chains taking a normal user to SYSTEM.

3. Cheap: $15,700 weaponized a month of Windows patches. A lone operator can now do this in one afternoon.