kljunowsky

Offensive Security @Deel

[Md Ismail Šojal 🕷️ @0x0SojalSec]

Zero-Click iPhone Hack via WhatsApp Images :

Quarkslab blog post analyzing the patch for Apple's iOS CVE-2025-43300 (a zero-click vulnerability in ImageIO via malformed DNG images, potentially exploitable through apps like WhatsApp)

Fascinating patch analysis: Incredible how just 2 bytes patched CVE-2025-43300, a zero-click out-of-bounds write in Apple's ImageIO. Triggered by sneaky DNG images,

CVE-2025-43300 stemmed from a mismatch in DNG/JPEG parsing, causing double writes and potential code execution. that could hijack your device via rogue images. Apple's August 2025 patch

- https://t.co/n5xmYSdISi

[Md Ismail Šojal 🕷️ @0x0SojalSec]

Pentesting framework for drone hacking👀

- https://t.co/CcIbykvG2y

#infosec #cybersec #bugbountytips

[GREG ISENBERG @gregisenberg]

yeah

[kljunowsky @milanshiftsec]

@milos_rs_ Šta bi izdvojio kao bitno sa ove konferencije?

[deel @deel]

Announcing our series E 🥳

Excited to bring new partners like @RibbitCap in for our next stage of growth!

[Charles Guillemet @P3b7_]

🚨 There’s a large-scale supply chain attack in progress: the NPM account of a reputable developer has been compromised. The affected packages have already been downloaded over 1 billion times, meaning the entire JavaScript ecosystem may be at risk.

The malicious payload works by silently swapping crypto addresses on the fly to steal funds.

If you use a hardware wallet, pay attention to every transaction before signing and you're safe.

If you don’t use a hardware wallet, refrain from making any on-chain transactions for now.

It’s still unclear whether the attacker is also stealing seeds from software wallets directly at this stage.

Excellent report here: https://t.co/5CtiZJHYsN

[kljunowsky @milanshiftsec]

Inspired by https://t.co/AsQNB209Xp: ai‑security‑agents - plug‑and‑play system prompts that enhance AI outputs for security. Roles: Web App Pentester, AppSec Architect, Threat Intel Hunter. Try it 👉 https://t.co/e6QpNg4RpK #AI #Cybersecurity #AppSec

[H4x0r.DZ 🇰🇵 @h4x0r_dz]

When a SSRF is enough: Full Docker Escape on Windows Docker Desktop (CVE-2025-9074)

https://t.co/2CGY8UV7fy

"How was it found
It was by mistake actually, I did not know much about container separations and its implication"

[kljunowsky @milanshiftsec]

@intigriti {Function("return JSON.stringify(globalThis.process.env)")()}
{Function("return require('child_process').execSync('id').toString()")()}

[kljunowsky @milanshiftsec]

@deel speed in action 🚨 P1 in Monza this weekend!
Building at @deel is like racing: speed wins - but safety keeps you in the game

Engineers ship fast.
The Security team rides shotgun, especially offensive 🫣
Zero brakes on features, zero compromise on security. 🏎️

[kljunowsky @milanshiftsec]

@YShahinzadeh @Ahmex000 Could you share the link?

[Linus ✦ Ekenstam @LinusEkenstam]

This AI tool is nuts

GeoSpy AI can find your location from a single indoors photo 🤯

[Rock&Folklor @HercegBluz]

Slika za istoriju ❤️

[Forum Bezbedan Balkan @BezbedanBalkan]

‼️Procurele su konfiguracije i VPN šifre Fortigate firewalla širom sveta. Za Srbiju je tu 31 uređaj. ODMAH promenite sve šifre na Fortigate uređajima ukoliko ih koristite. Više info na https://t.co/8hgkPrt46a

[kljunowsky @milanshiftsec]

@MiPnamic @tom_doerr Exactly.

[Nicolas Krassas @Dinosn]

New macOS Exploit Revealed: PoC for CVE-2024-54498 Breaks Sandbox Security https://t.co/yKcFCvXH2f

[Pućenje Ubija @_clapper_]

STUDENTI ETF-a
je-bo-te

[Živan Mirić @ZivanMiric]

Ovo je...ovo je nestvarno

[Bogdan Stojanov @bogdan_stojanov]

Svaki glasac SNS je saučesnik