Eduardo

Let there be bits and bytes

[Kuba Gretzky @mrgretzky]

We need to talk about AI guardrails and why I refuse to take seriously the idea that AI can be told to follow specific rules and never break them.

Yesterday, I wanted to see how easy it is for phishing kit authors to have Claude develop phishing pages, compared to August 2025, when no guardrails were in place.

I chose the Opus 4.8 model and prepared the first prompt: 🧵👇

[S3cur3Th1sSh1t @ShitSecure]

After “The Art of Evasion” @x33fcon I’m publishing NimSyscallPacker to the public. This is the most advanced public Packer/Loader I’m aware of:

https://t.co/ftd24bHryj

[Justin Elze @HackingLZ]

The lolbin gods delivered

[Dominic Chell 👻 @domchell]

A bunch of ppl complained about ethics of bug hoarding, saying we should report to MSRC etc when we mentioned we hold on to 0days to use during RT ops in https://t.co/7T98Dh0CIx

How the tables have turned 😂

[Sprocket Security @SprocketSec]

Tenant enumeration is dead.

Microsoft has now patched both techniques that allowed full tenant domain discovery from a single unauthenticated request.

That changes recon against M365 environments significantly.

The signals still exist, tenant IDs, MOERA prefixes, brand metadata, but no single query gives you the full picture anymore. Effective enumeration now means chaining techniques together, validating against large datasets, and in some cases requiring authentication.

Juan Pablo Gomes Postigo breaks down:
• what the original technique was
• what still works today
• how we updated https://t.co/odd5t8dr5G going forward

https://t.co/NjDIibtx4V

#CyberSecurity #Pentesting #IdentitySecurity #SecurityResearch

[Grzegorz Tworek @0gtweet]

I’ve always claimed that ETW is very fast. I’ve been writing and teaching about it for years (for example, my talk “The Good, the Bad and the ETW” at x33fcon 2020 https://t.co/mRjLi3Jr2D), but I never actually measured its speed - until today. I needed an exact figure, so I wrote a small C app that logs 1 million events and measures the elapsed time. Here’s the code along with the complete test procedure. Enjoy! 🚀
https://t.co/Ow75wzaIHz

[Naval @naval]

If it’s not one of the best books you’ve ever read, don’t read it.

[Dino A. Dai Zovi @dinodaizovi]

Sometimes it confuses me how the security field today fails to remember why things like least privilege and privilege separation were built into qmail, postfix, and SSH long ago.

Then I remember that an astonishingly small percentage of the field today were around back then.

[Manuel Caballero @magicmac2000]

[ Chromium ] Stealth request that bypasses CSP, hides from DevTools, and leaks the real User-Agent (in case you faked it 😁)

https://t.co/1mNSKszJoE

[Ciarán Cotter @monkehack]

https://t.co/ZjCoUwbkke

[Stephen Sims @Steph3nSims]

I want to share a quick thought for people in cyber security. This will be my longest tweet ever.

I’ve spoken to many lately who are having an existential crisis from the constant posts about “the end of cybersecurity jobs.”

Yes, things are changing quickly. This is a significant moment for the tech industry. Change can be uncomfortable. But we’ve seen cycles like this before.

• When GitHub and open source took off, people said software engineers would disappear because code was free.
• When AWS and cloud computing emerged, people said infrastructure jobs would vanish.
• When fuzzing and SAST tools improved, people said vulnerability research would disappear.
• Virtualization would eliminate infrastructure jobs.
• Mobile computing was going to end desktop dev.
• Exploit mitigations would end exploitability. It didn't.

Each time automation improved, the amount of software grew faster than the automation. It does feel "different" this time as it's explosive.
Some roles will shrink:
• repetitive pentesting
• basic vulnerability scanning
• tier-1 SOC monitoring

But other areas are expanding rapidly:

• AI system security
• supply chain security
• identity architecture
• autonomous agent security
• critical infrastructure protection

Historically, every time we eliminate one class of bugs, new classes emerge. Right now people are vibe-coding entire systems, giving AI access to their machines, crossing trust boundaries, and deploying autonomous agents with excessive permissions. The legal and regulatory world is nowhere close to ready.

There will absolutely be new failure modes. Humans are amazing and always adapt, finding new ways to do things.

The worst thing you can do right now is fall into a doom loop.

...and I’ll be honest, I too have felt the "psychological paralysis" a few times thinking, “Is this time different?” It's especially impactful when it comes from someone I respect in the community. There are certainly unknowns, in an industry where we've become accustomed to predictability.

But... the majority of those reactions are usually driven by social media, not reality. Platforms like X reward engagement, and sensational doom posts spread faster than measured thinking.
If you see something like:
“Holy #$%^! Opus 66.6 just found every bug in Chrome and replaced 50 startups!”

…mute it and move on.

Instead:

Stay curious.
Learn the new technology.
Adapt your skillsets.
Build things.

We’ll get through this transition the same way we always have. If I'm wrong then Sam Altman better be right about UBI! :) I'm sure that if this tweet gets any engagement that I'll get some heat for it, but a good friend of mine reminds me often to focus on what you have control over. I'll revisit this tweet at DEF CON 40!

[Hunt.io @Huntio]

🚨 New APT37 Campaign Shows That Air-Gapped Systems Aren’t Untouchable

https://t.co/lBiNN71ZEU

North Korean group APT37 is running a new campaign, “Ruby Jumper,” built to reach air-gapped systems.

The infection chain starts with a malicious LNK file and moves through custom loaders, using USB drives to bridge isolated machines.

For teams relying on physical isolation, this is a reminder to revisit removable media controls and endpoint monitoring.

#ThreatIntelligence #CyberSecurity #APT37

[5pider @C5pider]

Havoc Professional Finally Released! 🕸️🕷️

Since our last blog post introducing the Havoc Professional framework and the Kaine-Kit, we've been refining the framework behind the scenes while also welcoming @avx128 as a new member of our team. This blog post covers the numerous features included in the initial release of Havoc Professional.

I'm excited to finally share the work my team and I have put in over the past year. This is just the beginning of what we have planned.

https://t.co/rcVOKg3I6h

[Claude @claudeai]

Introducing Claude Code Security, now in limited research preview.

It scans codebases for vulnerabilities and suggests targeted software patches for human review, allowing teams to find and fix issues that traditional tools often miss.

Learn more: https://t.co/n4SZ9EIklG

[Panos Gkatziroulis 🦄 @ipurple]

Domain Fronting is Dead. Long Live Domain Fronting! https://t.co/NqgpbrSv0v

[S3cur3Th1sSh1t @ShitSecure]

It's time for a new stream this week! We're going to talk about COM hijacking. This will be recorded, so you can watch it later on YouTube. 😎

https://t.co/Cc4252jfaf

https://t.co/eUudHFHvb4

I'm not 100% sure yet, but it will be either tomorrow or Wednesday at 7pm CET. 🔥

[Panos Gkatziroulis 🦄 @ipurple]

Set of algorithms which can be used as a library to obfuscate malware communication traffic and therefore bypass EDR and other defensive capabilities https://t.co/GLaK7rmFsv

[Eduardo @hakbyte]

Let’s write some code.

https://t.co/MDQxlf2v16

[Rasta Mouse @_RastaMouse]

[BLOG]
My thoughts (and code examples) for writing modular PIC C2 agents.
https://t.co/yUVY0bb5In