Extencil

i'm creative, persistent, unstable and kamikaze.

✉ email: [email protected]

[Extencil @extencil]

> be @github
> be acquired by @Microsoft
> get annoyed because @ChaoticEclipse0 published 0-days or because @xploitrsturtle2 published github's compromise evidences / proofs that github was successfully breached
> start a ban-wave targeting any "hacker related profile"
> ban me on Monday around 4am without any notices
> let my appeal ticket rot forever under some infinite SLA with zero explanation for the ban
> lock me out from updating dozens of open-source repos i contribute to

dude, i know i don’t have a profile full of followers, stars, famous projects or hype-driven repos, and i’m still learning so i can publish better work, but what kind of insane policy is this?

randomly banning security researchers with no warning, no reason, not even a basic email explaining what happened, just because @msftsecresponse has beef with some other security researcher? are triagers’ egos really that weak?

i’ve already seen multiple people on X getting hit by the same thing (like @yebtimothy, @MiroslavSraga, @CollinsCaxton4, @wavey0x and another guy that i forgot his username here on X), so i’m definitely not the only one.

now imagine everyone else who doesn’t want to go public and is just taking this garbage silently, GEEZ

[SANS DFIR @sansforensics]

The SANS #DFIRSummit CFP is closing soon!

We’re looking for talks on:
- DFIR
- Threat Hunting
- Ransomware & Cyber Extortion

Share your research, tools, case studies, & lessons learned.

Submit by Friday, June 26, 5pm ET

Learn More & Submit a Proposal: https://t.co/fghn0o3Ejf

[bgpfix.org @bgpfixorg]

bgpipe v0.21.0 is out! 🚀
▸ ASPA route-leak detection
▸ rebuilt RPKI ROV + caching (RTR / HTTPS / JSON file)
▸ fully transparent proxy mode (Linux TPROXY)
▸ TTL control in connect/listen
▸ and an android-arm64 binary = BGP in your pocket! 😎
https://t.co/Jryk3FSiMA

[Prepakis Georgios @kernelstub]

Cognitor v1.0.2 is out.

Windows patch-diff research got a serious lab upgrade:

- new IOCTL extraction without BinExport
- generic ioctl_zap reachability harness
- noob vs elevated reachability parsing
- prepatch/patched driver A/B swap scripts
- crash pull → finding seeds
- sidecar coverage audits
- IOCTL diffing + CTL_CODE decode
- attack-surface ranking
- full lab dossier JSON + Markdown handoff

https://t.co/rchD5E9xVj

[Alex @xaitax]

It seems MS will address this now as CVE-2026-50656 with release for tomorrow but their API already exposes it?
https://t.co/YOkWkKZezQ

[Extencil @extencil]

https://t.co/Pr3xwEJ3v6 works really well too! 😎

besides being fully open-source, auditable, unlicensed, it has 56 different hostnames, some really cool ones are: @reads.phrack.org, @smokes.thc.org, @segfault.net, @ghetto.eurocompton.net, @lulz.antisec.net, @revil.org, @lockbit.io, @polkit.org, @metasploit.io, @kerberoast.org, @johntheripper.org and a bunch more.

its a community-operated project, free from corporate sanctions. it also doesnt require a platform account to steal your metadata and dress it up as "business interests". no forwarding limits, no address limits, and theyll never charge you a single cent for it.

there are also firefox and chrome extensions to create aliases on demand automatically, and the api key is unlimited.

[IPFire Project @ipfire]

Cloud is convenient, but it’s not always in your best interest. Self-hosting can reduce long-term costs, increase control, and improve security. #SelfHosting #EnterpriseIT #OpenSource #CloudComputing

[Prepakis Georgios @kernelstub]

Windows LPE -> Priv Util via embeded psexec-> nt-authority\system

Eden is a great project which I contributed to made by @marinaiced , using it I managed to escalate from base user permissions to system level.

[The Hacker's Choice (@[email protected]) @hackerschoice]

A collection of THC stuff, curated by @extencil ❤️ Many of these we didn’t know were still floating around 🤙

(https://t.co/XcdR9zH50t)

[Extencil @extencil]

damn dude, that’s crazy. it sucks knowing they treat their own customers like this. did you add anyone else as an owner to prevent the org/enterprise from being automatically deleted?

i got a kind of "lucky" because i had added some members from https://t.co/I7W8xmhtjS as owners of the GitHub org too. otherwise we’d be fully locked out. this kind of behavior is honestly scary.

if i were an investor, i’d pull my money out just because of the uncertainty they’re creating for their own customers. like, who says they won’t ban the owner accounts of another company next, or the accounts tied to paid services and payment methods?

[Extencil @extencil]

> be @github
> be acquired by @Microsoft
> get annoyed because @ChaoticEclipse0 published 0-days or because @xploitrsturtle2 published github's compromise evidences / proofs that github was successfully breached
> start a ban-wave targeting any "hacker related profile"
> ban me on Monday around 4am without any notices
> let my appeal ticket rot forever under some infinite SLA with zero explanation for the ban
> lock me out from updating dozens of open-source repos i contribute to

dude, i know i don’t have a profile full of followers, stars, famous projects or hype-driven repos, and i’m still learning so i can publish better work, but what kind of insane policy is this?

randomly banning security researchers with no warning, no reason, not even a basic email explaining what happened, just because @msftsecresponse has beef with some other security researcher? are triagers’ egos really that weak?

i’ve already seen multiple people on X getting hit by the same thing (like @yebtimothy, @MiroslavSraga, @CollinsCaxton4, @wavey0x and another guy that i forgot his username here on X), so i’m definitely not the only one.

now imagine everyone else who doesn’t want to go public and is just taking this garbage silently, GEEZ

[The Hacker's Choice (@[email protected]) @hackerschoice]

THC FUN: Our tmux.conf that we use to upload/download from remote targets (via the terminal/PTY; no new TCP connection): 😜

https://t.co/YvUSYXwjQz

Try it 👉 Ctrl-b U 👈
No tools installed or needed on the remote target.
NO LOGZ == NO CRIME.

[Extencil @extencil]

@ryan_elfmaster congratulations! =]

[ElfMaster @ryan_elfmaster]

Good evening. I am excited to announce that Shiva, Arcana Research's advanced binary patching solution has been competitively assessed by the Defense Advanced Research Projects Agency (DARPA) and has been deemed "awardable" in the Expedited Research Innovation System (ERIS) Marketplace, making it available to view and easily procurable by the Department of War.

Shiva: https://t.co/MYfyikAJu7
Shiva github: https://t.co/VMtm40rWyr

ERIS program: https://t.co/jLDgazv0Sv

@DARPA

#DARPA #ERIS #BinaryPatching #innovation #NationalSecurity

[MatheuZ @MatheuzSecurity]

Trend Micro Deep Security Agent Research: Forcing bmhook/tmhook Reloads to Open a Protection Bypass Window

Full research: https://t.co/bZFOyMptG5

#rootkit #linux #edr #poc

[Richard Johnson @richinseattle]

Someone please hire @jonasLyk or throw him some contract work. He’s a very talented security researcher and C/C++ programmer. I’ve chatted with him about his research for years and would easily vouch for his ability to get things done on Windows, Android, etc.

[MatheuZ @MatheuzSecurity]

Kernel Rootkit is a new Telegram community for Linux/Windows rootkit research, ring0/ring3, stealth, defense, forensics and reverse engineering.

Join us, share knowledge and collaborate.

https://t.co/pZNOWPT2FF

#rootkits #security #windows #linux #cyber #malware #forensics

[MatheuZ @MatheuzSecurity]

I analyzed Trend Micro Deep Security Agent for Linux and found that a local event storm can force bmhook/tmhook reload cycles, opening a repeatable temporary protection bypass window.

Full write-up:

https://t.co/bZFOyMptG5

#linux #edr #rootkit #cybersec #security #research

[MatheuZ @MatheuzSecurity]

Linux Kaspersky 0day: unloading LKMs directly from userspace.

Kaspersky rejected my report, so I'll be publishing the full technical write-up soon

#Linux #Kernel #0day #VulnerabilityResearch

[TMZ @guitmz]

Let’s go!!

[tmp.0ut @tmpout]

Reminder that our CFP is still running! 🔥

Including the Rootkit Competition