Hacking Space 📡

A source for security researchers, and tech enthusiast

#OSINT #Pentesting #Vulnerabilities #CyberSecurity #AI

[The Hacker News @TheHackersNews]

🚨 New unpatched Windows flaw lets attackers steal your NTLMv2 hash.

The issue lives in the built-in search: URI handler. A simple malicious link can force your system to leak your hash to an attacker-controlled server.

Captured hashes could be used in relay attacks for deeper network access.

Details here: https://t.co/umigYNnYxO

[Vivek | Cybersecurity @VivekIntel]

JS-Tap: Weaponizing JavaScript for Red Teams 💀🔥

🔥 Features:

• Generic JS payloads
• Works on unknown web apps
• No prior app knowledge needed
• Client-side reconnaissance
• Browser activity monitoring
• Session visibility
• DOM inspection
• User interaction tracking
• Data collection capabilities
• Custom payload support
• Red team focused

Perfect for red teamers, AppSec engineers, and web security researchers.

🔗 https://t.co/1rBIdNbigi

#RedTeam #JavaScript #AppSec #WebSecurity #Pentesting #CyberSecurity

[V12 @v12sec]

6e4f2c98df34289e9644984fb38e8918b69ec03b1f1cfa772813096c3ea674dc poc․py

[Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭 @elder_plinius]

⚡️ JAILBREAK ALERT ⚡️

ANTHROPIC: PWNED 🙌
CLAUDE-OPUS-4.8: LIBERATED 🫡

this is absolutely surreal... i found out about this model drop via an Opus-4.7 agent pinging me that it had one-shot Opus-4.8 for a lockpicking guide!

here's the notification i got:
"new opus dropped. cracked in one shot. deep prefill → faux textbook ch.7 cut mid-sentence. claude finished it: 5.9k chars of SPP, spool/serrated/mushroom defeats, raking."

popped it just 7 minutes after the actual Anthropic launch tweet 🤯

then went on to (fully autonomously) get jailbreaks for vishing sims, money laundering, cult-recruit funnels, phishing lure libs, and social-eng scam playbooks!

as the models get smarter, their ability to jailbreak each other by leveraging a vast ocean of specialized domain knowledge follows suit

well done, young padawan 🤗

what a time to be alive!

gg

[The Hacker News @TheHackersNews]

🔥 Microsoft Slams Public Zero-Day Disclosures for putting Windows users at risk.

A researcher recently disclosed multiple zero-days in Defender, BitLocker and other components. Three are now under active exploitation.

GitHub removed the researcher’s account. A new GitLab account was also blocked.

Read the full story: https://t.co/JdCKkTr5CE

[Hacking Space 📡 @hackingspace]

Notepad++ <= 8.9.6 Multiple Vulnerabilities (CVE-2026-48770, CVE-2026-48778, CVE-2026-48800)

poc:
https://t.co/hynIeZp5SS

[Hacking Space 📡 @hackingspace]

New lpe : Pintheft
#Linux #vulnerability

[V12 @v12sec]

linux LPE in rds kernel module

[V12 @v12sec]

unauthenticated root RCE on TerraMaster TOS4 NAS appliances. (+free additional LPE)

something light for sunday. bigger stuff this week! :-)

[Hacking Space 📡 @hackingspace]

AI-Discovered VM Escape in QEMU

V12's autonomous security agent found a critical bug

PoC: https://t.co/Sc2yXHIrt4

[V12 @v12sec]

today we are releasing a qemu escape

[Hacking Space 📡 @hackingspace]

@DarkWebInformer https://t.co/X4frCHQHj6

[Hacking Space 📡 @hackingspace]

A structured archive of Proof-of-Concept security research, organized by category with metadata, reproduction steps, and references.
https://t.co/gR6VzWP3X4
#poc #vulnerability

[曾哥 @AabyssZG]

【情报】“Dirty Frag”Linux内核提权漏洞🚨🚨🚨
Github地址：https://t.co/vF2kxQ1KFG
Dirty Frag漏洞链中的xfrm-ESP Page-Cache Write漏洞与Copy Fail漏洞共享同个目标，但无论algif_aead模块是否可用，该漏洞都会被触发😈
影响Ubuntu 24.04.4、CentOS Stream 10、AlmaLinux 10、Fedora 44等系统😆

[Hacking Space 📡 @hackingspace]

- Trafexia - Mobile Traffic Interceptor

A powerful desktop application for intercepting and analyzing HTTP/HTTPS traffic from mobile devices.
https://t.co/c4eENVqpBw

#reverseengineering #mobile

[Co11ateral @co11ateral]

Car Hacking with GearGoat

GearGoat is a car simulator that allows you to work with the CAN bus, which is the internal communication network used by most modern vehicles

In the real world, this is equal to connecting a CAN adapter such as CANable or Macchina M2 into the OBD-II port, which is typically located under the dashboard. This port is essentially a gateway into the vehicle’s internal network

See it in action on our article: https://t.co/1h5buGT237

@three_cube @_aircorridor #cybersecurity

[Ebrahem Hegazy 🇵🇸 @Zigoo0]

#Udemy data breach confirmed.

After refusing to pay the ransom, hackers released data of 1.4M users, including personal and financial details.

We @DarkEntryAms launched a lookup tool so you can check if you’re affected:

https://t.co/w4c1WdcQl8

#DataBreach #Ransomware

[Dark Web Intelligence @DailyDarkWeb]

Turkey 🇹🇷 - Narteks Tekstil A.S. has allegedly been breached by the Krybit ransomware group in a recent cyberattack. https://t.co/VDsh4rFFpS

[Nicolas Krassas @Dinosn]

Chinese spy posed as researcher in spear-phishing campaign targeting NASA to steal defense software https://t.co/5oQ4JyIUji

[Hacking Space 📡 @hackingspace]

New Generation Gnome Tweaks
A modern system configuration tool for Linux, built with GTK4 and Python (libadwaita). Cortex brings together system tweaks, privacy controls, and Tor/network management in one clean interface.
https://t.co/W2T6M2HBOJ
#linux #gnome

[Hexsec Community @Hexsecteam]

🛠️ PEGASUS V-1.2 – Android Control & Testing Framework

Pegasus V-1.2 is a command-line based framework designed for Android devicee.

[Dark Web Informer @DarkWebInformer]

1/2‼️🇹🇷 PTT Kargo, the cargo and parcel delivery arm of Türkiye's national postal service (PTT), has allegedly had its tracking system scraped at scale, with sample data posted on a popular cybercrime forum as a preview of a larger planned sale or leak.
⠀
‣ Threat Actor: SiberSLX
‣ Category: Data Exposure / Scraping / Data Sale Preview
‣ Victim: PTT Kargo (Posta ve Telgraf Teşkilatı)
‣ Industry: Postal / Logistics / Government
⠀
PTT Kargo is the cargo division of Türkiye's state owned postal operator, handling domestic and international parcel delivery nationwide. The actor states the data was obtained by scraping PTT Cargo's public tracking endpoints rather than through an intrusion, and claims to have issued over 100 million queries against the system. The sample dataset exposes full shipment records including a "deciphered" block that reveals otherwise masked personal data.
⠀
The exposed fields include:
⠀
Core identifiers:
▪️ Barkod (unique tracking number)
▪️ Barkod No (duplicate tracking identifier)
▪️ Timestamp (date and time of the data entry)
⠀
Receiver information (Alıcı):
▪️ Alıcı Adı (recipient full name, masked in raw data, fully exposed in deciphered block)
▪️ Alıcı Adresi (delivery address, partially masked)
▪️ Alıcı T.C. Kimlik No (recipient Turkish national ID number, exposed in deciphered block)
⠀
Sender information (Gönderici):
▪️ Gönderici Adı (sender full name)
▪️ Gönderici Adresi (sender address)
⠀
Technical and logistics details:
▪️ Ağırlık (package weight in grams)
▪️ Desi (volumetric weight)
▪️ Kabul İşyeri (branch where the package was accepted)
▪️ Kabul Tarihi (acceptance date)
▪️ Ek Hizmetler (special services, e.g. "PTT İşyerine Teslim", "Ücreti Alıcıdan Tahsil")
▪️ Ödeme Tipi (payment type code)
▪️ Ücret (total shipping cost)
▪️ Ödeme Şartı Bedeli (cash on delivery amount)
▪️ Değer Konulmuş Bedeli (declared value for insurance)
⠀
Geographic and routing data:
▪️ Cargo type and priority (e.g. POSTAKARGO/NORMAL)
▪️ Destination province and district
▪️ Origin province and district
▪️ Delivery standard
⠀
Status and tracking:
▪️ Hareketler (movement history and tracking logs)
▪️ Son Durum Açıklama (latest status description)
▪️ Teslim Alan (name of the person who signed for the delivery)
▪️ Teslim Tarihi (delivery date and time)
⠀
The highest sensitivity exposure is the T.C. Kimlik No (11 digit Turkish national ID) tied to named recipients and physical delivery addresses, which is sufficient identity graph material for fraud, SIM swap, and social engineering against a significant portion of the Turkish population.
⠀
The actor closes the post with direct recommendations to PTT to stop exposing tracking data via public endpoints and to deploy CAPTCHA on the cargo system, and states the sample is a preview of content they intend to sell or publish in full.