hackplayers

Hacking ético e in-seguridad informática: it's time to play!

[h-c0n @h_c0n]

🚨 ¿Tienes algo que contarle a la comunidad hacker?
El CFP de #hc0n2027 YA ESTÁ ABIERTO. 🟢
Comparte tu investigación, técnica, herramienta, experiencia o investigación con la comunidad.
📅 5 y 6 de febrero de 2027
📍 Madrid
👉 Envía tu propuesta: https://t.co/GVKyzg0aCq

[hackplayers @hackplayers]

🪟 Windows 0-day: ALPC → SYSTEM
CVE-2026-85880 es un heap overflow en Windows ALPC que permite elevar privilegios localmente.
Microsoft la corrigió en septiembre y CISA la marca como explotada.
🔗 https://t.co/YyCB01rQ9t

[hackplayers @hackplayers]

🚨 Next.js: SVG → RCE
CVE-2026-94545 afecta a next/og ImageResponse.
Si valores controlados por el atacante llegan al SVG generado, puede terminar en ejecución de código en el servidor.
Afecta a Next.js 16.2.x → 16.3.5.
🔗 https://t.co/imY9TeQTtw

[hackplayers @hackplayers]

GitSpawn: RCE en agentes de coding con IA.
Un .git/config malicioso puede convertirse en ejecución de comandos en agentes como Claude Code, Codex, Cursor o Qwen Code.
Supply chain + AI agents. Mala combinación.
🔗 https://t.co/29if5a0ig3

[h-c0n @h_c0n]

🤖#hc0n2027 @h_c0n CTF badge: a fighting Tamagotchi
📷Kill other players' pets over the air. Steal their flags. Dig through 10k lines of firmware for the secrets @therealdreg buried... and A DEADBUG PART!
🎬https://t.co/pZoYHkgDtr

[Dreg @therealdreg]

We’re getting started... @hackplayers @h_c0n
https://t.co/jwHRHOD5Eh

[Óscar Alfonso Díaz @OscarAkaElvis]

🎉 airgeddon 12.0 released!
The 10th Anniversary Edition is here 👽

✅ Partial 6GHz support
✅ Evil Twin improvements
✅ Multiple fixes & hardening & more
Thanks to everyone supporting the project over the last 10 years ❤️
Sponsor: https://t.co/GSsT9WVdB0
#wifi #linux #hacking

[hackplayers @hackplayers]

Microsoft fixes Entra ID flaw enabling privilege escalation https://t.co/VsmHQ6bkuu

[hackplayers @hackplayers]

New Android spyware Morpheus linked to Italian surveillance firm https://t.co/vlZn48C7k2

[hackplayers @hackplayers]

NCSC launches SilentGlass, a plug-in device to secure HDMI and DisplayPort links https://t.co/ooBRFt1U2u

[hackplayers @hackplayers]

Lo que se vende de IA en la Dark Web (III) — el mercado negro de datasets https://t.co/IrzxuiBmXS

[hackplayers @hackplayers]

Medtronic discloses security incident after ShinyHunters claimed theft of 9M+ records https://t.co/M9m17bKev9

[hackplayers @hackplayers]

LINKEDIN BROWSERGATE https://t.co/MK9WPzOPJ2

[hackplayers @hackplayers]

Chinese spy posed as researcher in spear-phishing campaign targeting NASA to steal defense software https://t.co/fhnIT76FRb

[hackplayers @hackplayers]

Firefox bug CVE-2026-6770 enabled cross-site tracking and Tor fingerprinting https://t.co/BAlsFV1xPK

[hackplayers @hackplayers]

Italy moves to extradite Chinese national to the U.S. over hacking charges https://t.co/YmwXLbHTB1

[hackplayers @hackplayers]

Fast16: Pre-Stuxnet malware that targeted precision engineering software https://t.co/k4ImpaX5WR

[hackplayers @hackplayers]

U.S. utility giant Itron discloses a security breach https://t.co/ljYcZhSSzj

[hackplayers @hackplayers]

Critical bug in CrowdStrike LogScale let attackers access files https://t.co/186hfudBuE

[hackplayers @hackplayers]

GopherWhisper: new China-linked APT targets Mongolia with Go-based malware https://t.co/hvpE2FG7cg