GhostPwner

AppSec Engineer | Security Researcher | CTF Player

[Lupin @0xLupin]

Insane research from @kevin_mizu at @assetnote ! Really mind blowing stuff 🔥

[s1r1us @S1r1u5_]

let’s go!!!!

1. remember when i said a $200 claude/codex account can have 1000x ROI? this why.
2. game recognizes game, meta security invited harsh to meet at defcon and appreciated how cool the bug was, instead of being angry, surprising
3. image parsers, parsers in general, will keep giving.

[Vishakha Singhal @vishisinghal_]

The guy who created Claude Code ( @bcherny ) recently leaked how his team uses Claude.

One CLAUDE.md that you drop into your project.

Inside: past errors, conventions, rules - Claude reads it every session.

Boris uses this every day at Anthropic:

[Akshay 🚀 @akshay_pachaar]

How to setup your Claude code project?

TL;DR

Most developers skip the setup and just start prompting. That's the mistake.

A proper Claude Code project lives inside a .𝗰𝗹𝗮𝘂𝗱𝗲/ folder. Start with 𝗖𝗟𝗔𝗨𝗗𝗘.𝗺𝗱 as Claude's instruction manual. Split it into a 𝗿𝘂𝗹𝗲𝘀/ folder as it grows. Add 𝗰𝗼𝗺𝗺𝗮𝗻𝗱𝘀/ for repeatable workflows, 𝘀𝗸𝗶𝗹𝗹𝘀/ for context-triggered automation, and 𝗮𝗴𝗲𝗻𝘁𝘀/ for isolated subagents. Lock down permissions in 𝘀𝗲𝘁𝘁𝗶𝗻𝗴𝘀.𝗷𝘀𝗼𝗻.

There are two .𝗰𝗹𝗮𝘂𝗱𝗲/ folders: one committed with your repo, one global at ~/.𝗰𝗹𝗮𝘂𝗱𝗲/ for personal preferences and auto-memory across projects.

The .𝗰𝗹𝗮𝘂𝗱𝗲/ folder is infrastructure. Treat it like one.

The article below is a complete guide to 𝗖𝗟𝗔𝗨𝗗𝗘.𝗺𝗱, custom commands, skills, agents, and permissions, and how to set them up properly.

[spidey @lochan_twt]

things anthropic launched in 2026 (so far) :

- claude cowork
- added connectors and skills to free plan
- claude opus 4.6
- claude sonnet 4.6
- claude haiku 4.5
- claude code security
- claude code review
- claude code desktop preview
- added voice mode in claude code
- claude in powerpoint
- claude in excel
- sharing context across excel and powerpoint
- investment banking, HR, PE, wealth management, design plugins
- added integrations, connectors to cowork
- claude market-place
- memaory feature and memory export
- added inline visualisations in chat
- launched skills api
- 1M context window
and many more..

bonus :
- claude will be adfree
- refused pentagon deal
- # 1 on app store
- raised $30B Series G at $380B valuation

claude is on a generational run

[spaceraccoon | Eugene Lim @spaceraccoonsec]

I found a remote code execution on the latest TP-Link Tapo webcam models! The path to code execution wasn't direct and involved an interesting chain (3 CVEs). Check out my blogpost for more details!

https://t.co/cSv3M7gemQ

[dawgyg @thedawgyg]

Just remember... When your AI agent accidentally deletes a production database on your target while your letting it do the hacking for you, your the one that will face charges, not the bot.

[STÖK ✌️ @stokfredrik]

Tldr: ”I don’t want Anthropic to train on my code/security research data.”

• If on consumer, Opt-out of conversation training in the the ui ö under account/privacy) notice this only qualifies for future conversations.

• Use a launcher or set these env settings to avoid accidentally sending telemetry data :

#!/usr/bin/env bash
set -euo pipefail

export CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1
export DISABLE_TELEMETRY=1
export DISABLE_ERROR_REPORTING=1
export DISABLE_BUG_COMMAND=1
export DISABLE_AUTOUPDATER=1

# Make sure OpenTelemetry isn't enabled
unset CLAUDE_CODE_ENABLE_TELEMETRY

exec claude "$@"

pro tip:
• If in ui, never use the thumb up or down in the chat, since that’s is used for, well training.

• use incognito chats

Glhf

[Justin Gardner @Rhynorater]

Beautiful
https://t.co/IyZ1WH31xG

[Uphold Markets @UpholdMarkets]

Welcome to Uphold Markets.

Your source for institutional grade insights, token fundamentals, and market data from @UpholdInc.

Follow us for weekly crypto market reports & top gainers.

[Dark Web Informer @DarkWebInformer]

🚨 CVE-2025-14847: MongoDB Unauthenticated Memory Leak Exploit

GitHub: https://t.co/YqFsskU3cV

A proof-of-concept exploit for the MongoDB zlib decompression vulnerability (MongoBleed) that allows unauthenticated attackers to leak sensitive server memory.

[s1r1us @S1r1u5_]

Wow, Kudos to Vercel for trying whatever they can do to stop this attack.

A CTF challenge of parser differentials dropped. And with a huge bounty!! CTFers do your thing!

[React @reactjs]

There is critical vulnerability in React Server Components disclosed as CVE-2025-55182 that impacts React 19 and frameworks that use it.

A fix has been published in React versions 19.0.1, 19.1.2, and 19.2.1. We recommend upgrading immediately.

https://t.co/kue7kd0XEX

[Bour Abdelhadi @BourAbdelhadi]

Hey everyone! I’ve been building rep+, a lightweight HTTP Repeater inside Chrome DevTools. No proxy setup or certificates. Just open DevTools and start poking requests. It also has built-in AI for explanations and attack ideas. I’ll share one rep+ feature every day.
Try it 👇

[s1r1us @S1r1u5_]

Slides for my talk at HackAICon

Hacking with AI, Hacking AI.

[s1r1us @S1r1u5_]

Few thoughts on this
1. Anthropic sneaks into everyone’s claude chats???
2. The blog looks exaggerated without any details on what the attack is, its not useful for anyone except for marketing.
3. It’s definitely not fully autonomous hack as it might sound, someone who is already good automated few parts of it.

[cybernerd🤖 @ce3nerd]

OWASP Top 10 2025 is here and the shift is another level.

[Florian Roth ⚡️ @cyb3rops]

Exposed WSUS 😵‍💫

[BSidesLisbon @Bsideslisbon]

Proud to announce that @ethiack will host this year’s #BSidesLisbon CTF!
Test your offensive security skills in realistic challenges and compete against top hackers.
🗓️ Quals start Friday, 9PM

Register now 👉 https://t.co/wa8XoYsT06

#CTF #Cybersecurity #OffensiveSecurity

[GhostPwner @ghostpwner]

From Porto to Lisbon on Sept 25 for HackAIcon by @ethiack 🤖

If the AI can survive Lisbon traffic without rage-quitting, then yes… we’re all doomed.

🎟️ https://t.co/b5XuPMKwCO

#HackAIcon