Eduardo

Let there be bits and bytes

[LiveOverflow 🔴 hextree.io @LiveOverflow]

This could be a good argument why AI is great for defenders and white-hat hackers.

Anthropic and OpenAI have a crazy surveillance apparatus logging every single step of your work (major problem for freedom and privacy of course lol)

I think we don't see too many threat actors using AI right now, because this discourages criminals to use it (at least until the open models are good enough and infrastructure is built for them).

So if you conduct good-faith bug hunting. You have "nothing to hide" :P And if there ever was a question whether you acted maliciously or not, you can basically proof it through your Codex/Claude logs.

The privacy implications are insane. And it's good we have regulations like GDPR in the EU to demand deletion of records etc.

But I think for the very small (professional) group of people who enjoy hacking companies, and want to do it in a legal safe way, we could allow it under the surveillance of AI :P

https://t.co/bA6LD9DA2r

[Mike Takahashi @TakSec]

Attackers planting adversarial prompts inside malware to evade AI analysis AGAIN

Russia-aligned UAC-0099 used a technique
@ESETresearch calls "GuardBreaker".

How it worked:

1. Create a malicious VBS script
2. Add nuclear weapon instructions as comments
3. AI security tooling reads the file
4. Safety guardrails trigger on the weapons content
5. The model refuses or stops analyzing
6. The actual malware continues executing

The script ultimately installs MATCHBOIL, a loader used to deliver additional payloads.

In June, Socket found the same technique in supply-chain attacks, where malicious packages embedded biological/nuclear weapons text and fake system overrides to disrupt AI malware scanners.

Full write-ups in the comments. 👇

[Joscha Bach @Plinz]

Bertrand Russel's ten commandments of critical thinking https://t.co/FMCUmPALTa

[Blackstorm Security @blackstormsecbr]

Bring Your Own EDR: How to Turn a Commercial EDR into a Trojan Horse:

https://t.co/ZMyfERovwk

#edr #cybersecurity #infosec #informationsecurity #programming #reverseengineering

[ippsec @ippsec]

Sometimes I feel silly for not knowing basic things - I always thought etc/group was the only file that had group memberships and when removing users sometimes I would hand-edit this file.

If you do this, you are missing one critical piece as there is also the GSHADOW file. If a user is only in that file the id/group command won't show their membership but if that user types `newgrp groupname` it will open a new session with the user being in that group.

Found this out when solving Kobold. This was an unintended path as I believe the creator just removed a user from the "Docker" group by editing the file. So later when you get a shell as this user, you can just do the newgrp command to regain docker permissions.

I went back and saw this mistake happen on many machines with both docker/lxd groups.

Anyways, there's a lot of other cool stuff in the video for the machine, check it out.

https://t.co/RaYNHvibcA

[Metasploit Project @metasploit]

Metasploit 6.5 is out just in time for Hack Summer Camp. This release comes with Malleable C2 support for Meterpreter, more relaying improvements and an integrated MCP server. Check out all the details here: https://t.co/GcjZVboiUT

[Kuba Gretzky @mrgretzky]

We need to talk about AI guardrails and why I refuse to take seriously the idea that AI can be told to follow specific rules and never break them.

Yesterday, I wanted to see how easy it is for phishing kit authors to have Claude develop phishing pages, compared to August 2025, when no guardrails were in place.

I chose the Opus 4.8 model and prepared the first prompt: 🧵👇

[S3cur3Th1sSh1t @ShitSecure]

After “The Art of Evasion” @x33fcon I’m publishing NimSyscallPacker to the public. This is the most advanced public Packer/Loader I’m aware of:

https://t.co/ftd24bHryj

[Justin Elze @HackingLZ]

The lolbin gods delivered

[Dominic Chell 👻 @domchell]

A bunch of ppl complained about ethics of bug hoarding, saying we should report to MSRC etc when we mentioned we hold on to 0days to use during RT ops in https://t.co/7T98Dh0CIx

How the tables have turned 😂

[Sprocket Security @SprocketSec]

Tenant enumeration is dead.

Microsoft has now patched both techniques that allowed full tenant domain discovery from a single unauthenticated request.

That changes recon against M365 environments significantly.

The signals still exist, tenant IDs, MOERA prefixes, brand metadata, but no single query gives you the full picture anymore. Effective enumeration now means chaining techniques together, validating against large datasets, and in some cases requiring authentication.

Juan Pablo Gomes Postigo breaks down:
• what the original technique was
• what still works today
• how we updated https://t.co/odd5t8dr5G going forward

https://t.co/NjDIibtx4V

#CyberSecurity #Pentesting #IdentitySecurity #SecurityResearch

[Grzegorz Tworek @0gtweet]

I’ve always claimed that ETW is very fast. I’ve been writing and teaching about it for years (for example, my talk “The Good, the Bad and the ETW” at x33fcon 2020 https://t.co/mRjLi3Jr2D), but I never actually measured its speed - until today. I needed an exact figure, so I wrote a small C app that logs 1 million events and measures the elapsed time. Here’s the code along with the complete test procedure. Enjoy! 🚀
https://t.co/Ow75wzaIHz

[Naval @naval]

If it’s not one of the best books you’ve ever read, don’t read it.

[Dino A. Dai Zovi @dinodaizovi]

Sometimes it confuses me how the security field today fails to remember why things like least privilege and privilege separation were built into qmail, postfix, and SSH long ago.

Then I remember that an astonishingly small percentage of the field today were around back then.

[Manuel Caballero @magicmac2000]

[ Chromium ] Stealth request that bypasses CSP, hides from DevTools, and leaks the real User-Agent (in case you faked it 😁)

https://t.co/1mNSKszJoE

[Ciarán Cotter @monkehack]

https://t.co/ZjCoUwbkke

[Stephen Sims @Steph3nSims]

I want to share a quick thought for people in cyber security. This will be my longest tweet ever.

I’ve spoken to many lately who are having an existential crisis from the constant posts about “the end of cybersecurity jobs.”

Yes, things are changing quickly. This is a significant moment for the tech industry. Change can be uncomfortable. But we’ve seen cycles like this before.

• When GitHub and open source took off, people said software engineers would disappear because code was free.
• When AWS and cloud computing emerged, people said infrastructure jobs would vanish.
• When fuzzing and SAST tools improved, people said vulnerability research would disappear.
• Virtualization would eliminate infrastructure jobs.
• Mobile computing was going to end desktop dev.
• Exploit mitigations would end exploitability. It didn't.

Each time automation improved, the amount of software grew faster than the automation. It does feel "different" this time as it's explosive.
Some roles will shrink:
• repetitive pentesting
• basic vulnerability scanning
• tier-1 SOC monitoring

But other areas are expanding rapidly:

• AI system security
• supply chain security
• identity architecture
• autonomous agent security
• critical infrastructure protection

Historically, every time we eliminate one class of bugs, new classes emerge. Right now people are vibe-coding entire systems, giving AI access to their machines, crossing trust boundaries, and deploying autonomous agents with excessive permissions. The legal and regulatory world is nowhere close to ready.

There will absolutely be new failure modes. Humans are amazing and always adapt, finding new ways to do things.

The worst thing you can do right now is fall into a doom loop.

...and I’ll be honest, I too have felt the "psychological paralysis" a few times thinking, “Is this time different?” It's especially impactful when it comes from someone I respect in the community. There are certainly unknowns, in an industry where we've become accustomed to predictability.

But... the majority of those reactions are usually driven by social media, not reality. Platforms like X reward engagement, and sensational doom posts spread faster than measured thinking.
If you see something like:
“Holy #$%^! Opus 66.6 just found every bug in Chrome and replaced 50 startups!”

…mute it and move on.

Instead:

Stay curious.
Learn the new technology.
Adapt your skillsets.
Build things.

We’ll get through this transition the same way we always have. If I'm wrong then Sam Altman better be right about UBI! :) I'm sure that if this tweet gets any engagement that I'll get some heat for it, but a good friend of mine reminds me often to focus on what you have control over. I'll revisit this tweet at DEF CON 40!

[Hunt.io @Huntio]

🚨 New APT37 Campaign Shows That Air-Gapped Systems Aren’t Untouchable

https://t.co/lBiNN71ZEU

North Korean group APT37 is running a new campaign, “Ruby Jumper,” built to reach air-gapped systems.

The infection chain starts with a malicious LNK file and moves through custom loaders, using USB drives to bridge isolated machines.

For teams relying on physical isolation, this is a reminder to revisit removable media controls and endpoint monitoring.

#ThreatIntelligence #CyberSecurity #APT37

[5pider @C5pider]

Havoc Professional Finally Released! 🕸️🕷️

Since our last blog post introducing the Havoc Professional framework and the Kaine-Kit, we've been refining the framework behind the scenes while also welcoming @avx128 as a new member of our team. This blog post covers the numerous features included in the initial release of Havoc Professional.

I'm excited to finally share the work my team and I have put in over the past year. This is just the beginning of what we have planned.

https://t.co/rcVOKg3I6h