M@r0l$

simply man

[Gadi Evron @gadievron]

When there isn’t yet a patch, like w/ a named Linux vuln, eBPF as a “patching” strategy is what these two very experienced teams out there are doing right now.

Check out what Cloudflare and Datadog did.

Cloudflare:
https://t.co/0nRSBs9ajf

Datadog:
https://t.co/a3zjQufnww

[CERT Polska @CERT_Polska]

‼️ Nowa aktywność grupy UNC1151/Ghostwriter

Zespół CERT Polska zaobserwował w ostatnich miesiącach zmianę w sposobie działania grupy UNC1151 - znana z operacji dezinformacyjnych oraz phishingów na polskich dostawców poczty elektronicznej (Onet, Wirtualna Polska, Interia), od paru miesięcy przygotowuje swoje kampanie celując również w użytkowników Gmaila.

🔗 Szczegółowy opis zagrożenia wraz z przykładami znajduje się w artykule na naszej stronie:https://t.co/8UawqXj0Gy

Grupa atakuje osoby zaangażowane w życie polityczne, aktywne społecznie, zajmujące eksponowane stanowiska, naukowców, dziennikarzy, pracowników administracji publicznej i służb mundurowych, a także inne osoby powiązane z nimi poprzez relacje rodzinne lub towarzyskie.

Przejęte skrzynki poczty elektronicznej są przeszukiwane pod kątem listy kontaktów, wrażliwych dokumentów czy powiązanych kont.

🚩 Grupy APT (Advanced Persistent Threat), takie jak UNC1151, to podmioty, których działalność cyberprzestępcza może być powiązana z działaniem obcych państw. W CERT Polska stale monitorujemy ich aktywność w polskiej cyberprzestrzeni, a wnioskami dzielimy się w naszych raportach.

[cr3ghost @cr3ghost]

One of the best FREE Windows exploit development and security research blogs out there. Kernel pool exploitation. PTE overwrites. HVCI and kernel CFG bypass. XFG internals. Browser type confusion. Kernel shadow stacks. Secure kernel internals. ARM64 Pointer Authentication bypass. ETW and PPL research.

Covers everything from ROP fundamentals all the way to cutting edge ARM64 and VBS security research. Still actively publishing in 2026.

https://t.co/tyfevXiWOp

Author: @33y0re

#ExploitDevelopment #WindowsInternals #ReverseEngineering

[M@r0l$ @m4r0ls]

@x33fcon The best presentation 👍💪

[/ˈziːf-kɒn/ @x33fcon]

"#EDR Introspection" talk at #x33fcon by Levi Cailleret - https://t.co/vVdJbPDTc1 - #maldev

[0xor0ne @0xor0ne]

3-part series on Linux kernel bug hunting: KASAN, Syzkaller, and kernel fuzzing by @slava_moskvin_

Part 1: https://t.co/b61r4je69j
Part 2: https://t.co/DQ8j6YfN2C
Part 3: https://t.co/Myjt0BpsPy

#infosec

[M@r0l$ @m4r0ls]

@compileandpush At the runner + AI layer — runs are fresh subprocesses, AI calls independent. State that must exist is explicit: SQLite, per-project git (history = free undo/diff), RAG index rebuilt from files. Killed incidental state — queues, sessions, caches — not state itself.

[M@r0l$ @m4r0ls]

Just shipped Playforge v0.0.1 🔧

Self-hosted web #UI for #Ansible — one docker compose up --build.

Works fully offline with #Ollama.

👉 https://t.co/wBVu50Zl2c

[M@r0l$ @m4r0ls]

Still developing the proxy module. Just released v0.4.0.

https://t.co/HgfDo7byR4

#go #proxy

[MatheuZ @MatheuzSecurity]

Linux Kaspersky 0day: unloading LKMs directly from userspace.

Kaspersky rejected my report, so I'll be publishing the full technical write-up soon

#Linux #Kernel #0day #VulnerabilityResearch

[M@r0l$ @m4r0ls]

X/twitter scrape which is working - at May 11 2026.

enjoy!
https://t.co/Cmx6DJajVI

#twitter #python #scrape

[M@r0l$ @m4r0ls]

Tcpdump_go https://t.co/qRFEhuq1tq
modern tcpdump alternative in #Go.
#tcpdump #github #fun

[Rishi @rxerium]

🚨 Palo Alto has disclosed a zero day: CVE-2026-0300 (CVSS 9.3) - a buffer overflow vulnerability in the Captive Portal service of PAN-OS.

Nuclei template for fingerprinting PAN-OS:
https://t.co/9h3Fihh3Y3

This issue is applicable only to PA-Series and VM-Series firewalls that are configured to use User-ID™ Authentication Portal - Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.

No patches are available yet, only workarounds. Full details and mitigations are in the official advisory.
https://t.co/gtNOVl24fg

[0xor0ne @0xor0ne]

Autonomous vulnerability research with Claude Code + MCP

https://t.co/MT4LbPOVGU

#infosec #llm

[7h3h4ckv157 @7h3h4ckv157]

claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.mdfile that primes Claude with expert-level methodology for a specific attack surface from SQLi to shellcode, EDR evasion to exploit development.

Resource: https://t.co/0XvEqoqPfv

[M@r0l$ @m4r0ls]

Ever needed to set system proxy (not just read it) in #Go?
Most tools stop at env vars — but some apps need OS-level control (vpn, #proxies).

https://t.co/HgfDo7byR4

still in developing but maybe someone use or inspire it.

module :https://t.co/HgfDo7byR4

#devops

[M@r0l$ @m4r0ls]

Jeśli ktoś szuka mieszkania na wynajem to może się przydać tool tego typu:

https://t.co/VCDlX5rhOQ

Prosty monitoring #OLX + powiadomienia o nowych ofertach

#python #rent #apartment #LLM

[Microsoft Threat Intelligence @MsftSecIntel]

The Russian military intelligence actor Forest Blizzard has conducted large-scale exploitation of vulnerable small office/home office (SOHO) devices to hijack DNS requests and enable persistent, passive visibility and reconnaissance at scale. https://t.co/6oONFAtP20

By compromising edge devices that are upstream of larger targets, threat actors could take advantage of less closely monitored assets to pivot into enterprise environments. We have identified over 200 organizations and 5,000 consumer devices impacted by Forest Blizzard’s malicious DNS infrastructure.

Microsoft Threat Intelligence is publishing this research to increase awareness of the risks associated with insecure home and small-office internet devices and to give users and organizations tools to mitigate, detect, and hunt for these threats where they might be impacted.

[M@r0l$ @m4r0ls]

Spent my Easter fixing my #Go wrapper for #Shodan

• simple API
• fast queries
• clean Go interface

Perfect for recon, automation & security tooling.

Release available , enjoy
https://t.co/S4BImjAS9m

[Steven Lim @0x534c]

🔥🤖 M365 Connector for Claude – Why SecOps Must Care

Monitoring the M365 Connector for Claude is critical because when ResultType=0, it means an Entra Global Admin has granted permissions, enabling Claude to directly access SharePoint, OneDrive, Outlook, and Teams—a governance decision with major security implications that SecOps must track closely. Meanwhile, ResultType=90095 shows end users attempting to use the connector without the admin grant, signaling demand, shadow IT risk, and adoption pressure. By watching both signals, defenders gain visibility into where governance decisions meet user behavior, ensuring connector risks are managed before they escalate.

KQL Code:
https://t.co/NGuwSLgvKF

#Cybersecurity #M365ConnectorClaude #Entra #Governance