Patrick Davidson Tremblay

Red Team Lead - Any sufficiently advanced persistent threat is indistinguishable from magic.

[Justin Elze @HackingLZ]

A Long-running BOF Component Contract

https://t.co/cgwS1kIWD5

[Aman Kharwal @amankk_9]

Build a Production Ready LLM API.
https://t.co/rTyayvc41q

[Nicolas Krassas @Dinosn]

Unauthenticated RCE as QSECOFR via IBM i Management Central https://t.co/p5iqhIU2UE

[Florian Roth ⚡️ @cyb3rops]

I spent the last weeks building LLM benchmarks for a very specific reason:

We want to use AI in RuneAI to help with THOR finding triage, and I needed a better baseline for model selection than generic LLM leaderboards.

Security-event triage is its own thing.

A model can be great at coding, reasoning or vulnerability writeups and still be a bad fit for deciding whether a messy endpoint finding should be suppressed, reviewed or escalated.

In real deployments this will likely happen inside agentic workflows with tools, memory, context handling and feedback loops. But before testing the whole system, I wanted a clean baseline:

How does the model behave when it only gets the enriched finding itself?

Blog post with the reasoning and methodology:
https://t.co/KQPOPDWP1B

Interactive benchmark results:
https://t.co/pvVhTBJsz0

Repo:
https://t.co/Fw3uW9nu2a

Maybe useful for others building SOC / security-event triage benchmarks.

[Tom Dörr @tom_doerr]

Reverse engineers Android APKs using LLMs

https://t.co/jFQPEXurgA

[Amit Shekhar @amitiitbhu]

New article: LLM Routing

Read here: https://t.co/grhxFDXsCt

[Manabu Ori @orimanabu]

非公式ですが、OpenShiftの中の人が作った、eBPFを使って再起動なしでCopy Fail(CVE-2026-31431)をmitigateする実装です。AF_ALG AEADのbindをブロックするeBPFプログラムをDaemonSetでばらまいてロードします。kubectl apply -f daemonset.yamlするだけ https://t.co/uWwFIHos75
#openshiftjp

[Smukx.E @5mukx]

Reverse Engineering a Signed Kernel Driver with 13 Hardware Access Primitives

Blog:- https://t.co/CeX1hSnv2p

[FuzzingLabs @FuzzingLabs]

New blog post: exploring NVIDIA’s open-source GPU drivers.

Kernel modules, IOCTL attack surface, mmap primitives, UVM internals, and CPU↔GPU interactions (pushbuffers → firmware).

Not just graphics: a large, exposed kernel surface.

https://t.co/2LO5vVXdM0

[Mira @_miraarim_]

interestingly, kernel anti-cheats share many similarities to EDR.

the conclusion is that the ultimate cheat is an vision based llm controlling the inputs, which is similar to web-scraping.

thanks for the writeup and insights @s4dbrd!

https://t.co/wDZ7zPiPT5

[Pingiskok @pingiskok]

Every JWT writeup online covers 2–3 attacks and stops.
I got tired of jumping between 40 blog posts, so I wrote the whole thing. All in one place.
https://t.co/iCSzQ4GjcS

#infosec #appsec #bugbounty #websec #jwt

[Clandestine @akaclandestine]

GitHub - zeroc00I/LLM-anonymization: Reverse proxy for Claude Code that anonymizes sensitive pentest data (IPs, hashes, credentials, hostnames, PII) before it reaches Anthropic. Dual-layer detection: local Ollama LLM + regex safety net, with per-engageme https://t.co/mSZFqyZryy

[Nicolas Krassas @Dinosn]

Production-grade MCP server giving Claude 27 security intelligence tools across 21 APIs — CVE lookup, EPSS scoring, CISA KEV, MITRE ATT&CK, Shodan, VirusTotal, and more. https://t.co/j9PtJbGo2M

[Suraj Malhotra @MrT4ntr4]

Releasing NtWARden - Windows Analysis and Research Toolkit 🦉

https://t.co/MwoJaQTI5G

- Processes, Services, Network, ETW, IPC, Registry
- Kernel Callbacks, SSDT, BYOVD scanning, GDT/IDT
- Per-process analysis - direct syscalls, user hooks, etc
- Remote Inspection
- and more!

[ö @r0keb]

Good morning! Just published a blog post exploiting a VMware Guest To Host. A UaF Heap Feng Shui base address leakage to bypass ASLR and a stack-based buffer overflow to achieve RCE.
https://t.co/tCARJAKrEx

[Tom Dörr @tom_doerr]

Mindmap for Azure penetration tests

https://t.co/kCx4f1wyyf

[blackorbird @blackorbird]

DPRK Malware Modularity: Diversity and Functional Specialization
Espionage Oriented
Financial Operations
Disruptive / Coercive

https://t.co/6QwmD6DIKt

[NASA @NASA]

We see our home planet as a whole, lit up in spectacular blues and browns. A green aurora even lights up the atmosphere. That's us, together, watching as our astronauts make their journey to the Moon.

[Robert Morton @Robert4787]

When a former CIA case officer and station chief talks tradecraft, it’s worth paying attention. The basics haven’t changed, it’s still about trust, access, and patience, just adapted to a new world. #CIA #HUMINT #Spycraft
https://t.co/Cuzhkztn4R

[Bruno Pinheiro @brunopinheiroms]

olha só, é oficial ... "decidiram" virar open source hehehe
https://t.co/d6RUs3c3Hi

#bolhasec #bolhadev