bdsecure

vuln researcher

[0xor0ne @0xor0ne]

Apple SEAR is hiring a security researcher focused on server platform and secure computing!

Apply here: https://t.co/TS0dUP6rBX

We're looking for talented researchers who love breaking server infrastructure, cloud security architectures, confidential computing, and secure server platforms.

Feel free to reach out if you have any questions.

#infosec

[CryptoCat @_CryptoCat]

LLMs Winning at Pwn2Own 👀

https://t.co/aVChWvJEth

[Chaofan Shou @shoucccc]

vibe coded a fuzzing ai agent last month and let it run for a week using my $200 claude max.

it then found 21 high/critical vulnerabilities in Chrome.

[PortSwigger Research @PortSwiggerRes]

The voting has concluded, and we're thrilled to announce the top ten web hacking techniques of 2025! Massive thanks to everyone in the community for sharing their hard-earned discoveries, plus the panel and everyone who nominated or voted!
https://t.co/mjzzM4S7k0

[bdsecure @ibehnam]

@ali_z7798 @markpash bitchat @jack

[Ryan Naraine @ryanaraine]

NEW! Fresh words for your ears this weekend. (presented by @material_sec Security). We talk about the escalating protests in Iran, the expected cyber effects, and parallels with cyber operations and Venezuela power cuts @hkashfi @craiu @juanandres_gs

SPOTIFY https://t.co/RUAwYRcY7p

[chompie @chompie1337]

Watch XOR’s talk CUDA de Grâce: Owning AI Cloud Infrastructure with GPU exploits

Kernel + driver bugs aren’t just a LPE problem, they’re a cloud problem. With the explosion of AI in the cloud, NVIDIA’s GPU drivers have become a valuable attack surface

https://t.co/cIYKcYMb6L

[Pumpkin 🎃 @u1f383]

My HEXACON talk video is out! It covers a small race condition in the Linux kernel’s io_uring. I recommend watching it at 1.25× speed since I’m still not great at speaking 😅
https://t.co/lMuweA7PyU

Here is the slide!
https://t.co/9jPoKMzxwL

[Adel Ka @0x4D31]

🚀 open-sourced santamon — a lightweight macOS detection sidecar that reads Santa's ES telemetry, runs CEL detection rules locally, and only ships signals to a tiny backend. built for my home lab; might be useful for others too. bug reports + PRs welcome! https://t.co/C8Dv9yu7d8

[Karsten Hahn @struppigel]

Windows API arsenal by
@0x6970
for reversers

https://t.co/OkbYRx8wse

[OpenAI @OpenAI]

Now in private beta: Aardvark, an agent that finds and fixes security bugs using GPT-5.

https://t.co/xwtJhfDM3X

[Hexacon @hexacon_fr]

We've just released the challenges used during Hexacon 2025 Speedrun! Check them out and train for next year 🏆

https://t.co/IV8qP6syFr

[SinSinology @SinSinology]

NEED YOUR HELP!

My Friend/Teacher Soroush (@irsdl) Is looking for a new company to join, you know him as the .NET-God, the guy who has popped exchange, sharepoint, has maintained ysoserial_.net for years, contributed to the exploitation scene numerous times, taught all of you about what .net ghost webshells are, taught you about what viewstate exploitation is, how .net remoting exploitation issues can be solved, iis cookieless, web_config exploitation, countless of blogs, talks, techniques,...
but companies keep saying:

"we aren't hiring right now!"

if i was in position of hiring, woudln't wanna miss out on having one of THE BEST in my team

you're retweet is Extremely appreciated ❤️‍🔥

soroush, if you see this, don't hate me, had to do it without telling you

[tsunekoh @tsunek0h]

@wtsdev @nullcon Thank you for your interest! The PoC code and technical details are now available. You can find them here:
https://t.co/i4PwOhLaiw

[Codie Sanchez @Codie_Sanchez]

I think about this at least 1x a week.

[André Baptista @0xacb]

The AI-powered hacking space is moving fast.

CAI was already pretty solid, and Strix just dropped last week.

👉 CAI: https://t.co/yIpENddmyD
👉 Strix: https://t.co/vhLN08uHm3

Anyone tried these yet?

[Ryan Naraine @ryanaraine]

Three Buddy Problem - Episode 59: Apple drops another emergency iOS patch and we unpack what that “may have been exploited” language really means: zero-click chains, why notifications help but forensics don’t, and the uncomfortable truth that Lockdown Mode is increasingly the default for high-risk users. @craiu @juanandres_gs

We connect the dots from ImageIO bugs to geopolitics, discuss who’s likely using these exploits, why Apple’s guidance stops short, and the practical playbook (ADP on, reboot often, reduce attack surface) that actually works.

🎧 LISTEN anywhere https://t.co/lv7xhNbZx1

Plus, we debate Microsoft throttling MAPP access for Chinese vendors, the idea of “letters of marque” for cyber (outsourced offense: smart deterrent or Pandora’s box?), and dissect two case studies that blur APT and crimeware: PipeMagic’s CLFS zero-day and Russia-linked “Static Tundra” riding seven-year-old Cisco bugs.

Apple: https://t.co/oCuZWt3BqL

Spotify: https://t.co/7bLwlbqzt2

[bdsecure @ibehnam]

@zseano I'm so sorry for your loss. There are no words for the pain of losing someone so suddenly. 🖤🌱

[Phrack Zine @phrack]

Phrack turns 40.
The digital drop is live.
Download it. Archive it. Pass it on.
💾 https://t.co/JbEbf6xoVQ
#phrackat40 #phrack72

[Phrack Zine @phrack]

At long last - Phrack 72 has been released online for your reading pleasure!

Check it out: https://t.co/R0PKIifRDA