When there isn’t yet a patch, like w/ a named Linux vuln, eBPF as a “patching” strategy is what these two very experienced teams out there are doing right now.
Check out what Cloudflare and Datadog did.
Cloudflare:
https://t.co/0nRSBs9ajf
Datadog:
https://t.co/a3zjQufnww
‼️ Nowa aktywność grupy UNC1151/Ghostwriter
Zespół CERT Polska zaobserwował w ostatnich miesiącach zmianę w sposobie działania grupy UNC1151 - znana z operacji dezinformacyjnych oraz phishingów na polskich dostawców poczty elektronicznej (Onet, Wirtualna Polska, Interia), od paru miesięcy przygotowuje swoje kampanie celując również w użytkowników Gmaila.
🔗 Szczegółowy opis zagrożenia wraz z przykładami znajduje się w artykule na naszej stronie:https://t.co/8UawqXj0Gy
Grupa atakuje osoby zaangażowane w życie polityczne, aktywne społecznie, zajmujące eksponowane stanowiska, naukowców, dziennikarzy, pracowników administracji publicznej i służb mundurowych, a także inne osoby powiązane z nimi poprzez relacje rodzinne lub towarzyskie.
Przejęte skrzynki poczty elektronicznej są przeszukiwane pod kątem listy kontaktów, wrażliwych dokumentów czy powiązanych kont.
🚩 Grupy APT (Advanced Persistent Threat), takie jak UNC1151, to podmioty, których działalność cyberprzestępcza może być powiązana z działaniem obcych państw. W CERT Polska stale monitorujemy ich aktywność w polskiej cyberprzestrzeni, a wnioskami dzielimy się w naszych raportach.
One of the best FREE Windows exploit development and security research blogs out there. Kernel pool exploitation. PTE overwrites. HVCI and kernel CFG bypass. XFG internals. Browser type confusion. Kernel shadow stacks. Secure kernel internals. ARM64 Pointer Authentication bypass. ETW and PPL research.
Covers everything from ROP fundamentals all the way to cutting edge ARM64 and VBS security research. Still actively publishing in 2026.
https://t.co/tyfevXiWOp
Author: @33y0re
#ExploitDevelopment #WindowsInternals #ReverseEngineering
3-part series on Linux kernel bug hunting: KASAN, Syzkaller, and kernel fuzzing by @slava_moskvin_
Part 1: https://t.co/b61r4je69j
Part 2: https://t.co/DQ8j6YfN2C
Part 3: https://t.co/Myjt0BpsPy
#infosec
@compileandpush At the runner + AI layer — runs are fresh subprocesses, AI calls independent. State that must exist is explicit: SQLite, per-project git (history = free undo/diff), RAG index rebuilt from files. Killed incidental state — queues, sessions, caches — not state itself.
Just shipped Playforge v0.0.1 🔧
Self-hosted web #UI for #Ansible — one docker compose up --build.
Works fully offline with #Ollama.
👉 https://t.co/wBVu50Zl2c
Linux Kaspersky 0day: unloading LKMs directly from userspace.
Kaspersky rejected my report, so I'll be publishing the full technical write-up soon
#Linux#Kernel#0day#VulnerabilityResearch
🚨 Palo Alto has disclosed a zero day: CVE-2026-0300 (CVSS 9.3) - a buffer overflow vulnerability in the Captive Portal service of PAN-OS.
Nuclei template for fingerprinting PAN-OS:
https://t.co/9h3Fihh3Y3
This issue is applicable only to PA-Series and VM-Series firewalls that are configured to use User-ID™ Authentication Portal - Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.
No patches are available yet, only workarounds. Full details and mitigations are in the official advisory.
https://t.co/gtNOVl24fg
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.mdfile that primes Claude with expert-level methodology for a specific attack surface from SQLi to shellcode, EDR evasion to exploit development.
Resource: https://t.co/0XvEqoqPfv
Ever needed to set system proxy (not just read it) in #Go?
Most tools stop at env vars — but some apps need OS-level control (vpn, #proxies).
https://t.co/HgfDo7byR4
still in developing but maybe someone use or inspire it.
module :https://t.co/HgfDo7byR4
#devops
Jeśli ktoś szuka mieszkania na wynajem to może się przydać tool tego typu:
https://t.co/VCDlX5rhOQ
Prosty monitoring #OLX + powiadomienia o nowych ofertach
#python#rent#apartment#LLM
The Russian military intelligence actor Forest Blizzard has conducted large-scale exploitation of vulnerable small office/home office (SOHO) devices to hijack DNS requests and enable persistent, passive visibility and reconnaissance at scale. https://t.co/6oONFAtP20
By compromising edge devices that are upstream of larger targets, threat actors could take advantage of less closely monitored assets to pivot into enterprise environments. We have identified over 200 organizations and 5,000 consumer devices impacted by Forest Blizzard’s malicious DNS infrastructure.
Microsoft Threat Intelligence is publishing this research to increase awareness of the risks associated with insecure home and small-office internet devices and to give users and organizations tools to mitigate, detect, and hunt for these threats where they might be impacted.
Spent my Easter fixing my #Go wrapper for #Shodan
• simple API
• fast queries
• clean Go interface
Perfect for recon, automation & security tooling.
Release available , enjoy
https://t.co/S4BImjAS9m
🔥🤖 M365 Connector for Claude – Why SecOps Must Care
Monitoring the M365 Connector for Claude is critical because when ResultType=0, it means an Entra Global Admin has granted permissions, enabling Claude to directly access SharePoint, OneDrive, Outlook, and Teams—a governance decision with major security implications that SecOps must track closely. Meanwhile, ResultType=90095 shows end users attempting to use the connector without the admin grant, signaling demand, shadow IT risk, and adoption pressure. By watching both signals, defenders gain visibility into where governance decisions meet user behavior, ensuring connector risks are managed before they escalate.
KQL Code:
https://t.co/NGuwSLgvKF
#Cybersecurity #M365ConnectorClaude #Entra #Governance