Marek Sušický

Cybersecurity, SWENG, opendata. Vše jsou striktně osobní názory.

[Nicolas Krassas @Dinosn]

Unpatched NTLM Leakage in Windows search: URI Handler, Same Bug, No CVE, No Fix https://t.co/16QmKjbFHH

[Horizon3.ai @Horizon3ai]

🚨 @Horizon3Attack has discovered a hardcoded credentials vulnerability in Apache Solr that can provide full administrative access to SolrCloud clusters.

Rapid Response test now available.

[Marek Sušický @msusicky]

Prší a já vidím @MP_Praha kontrolovat bus pruh. Nečekané.

[Marek Sušický @msusicky]

@Don_Vito007 @SpravedlnostCZ Nikde jsem se nedočetl, jestli mu byl tedy ze zdravotních důvodů zrušen ŘP. Pokud se nemůže účastnit soudu, tak by neměl být způsobilý ani řídit.

[Marek Sušický @msusicky]

Toto zkazí den provozovatelům infostealerů...

[Xavier Rivera @XavierRiveraX]

Google Chrome is rolling out device-bound session credentials to all users. Session cookies get cryptographically tied to your device, so stolen cookies can't be replayed from a different machine. Attackers who exfiltrate your cookie database get nothing usable.

[Florian Roth ⚡️ @cyb3rops]

Oh, great
https://t.co/Z3eldzjcg6

[FalconFeeds.io @FalconFeedsio]

🚨DDoS Alert: 🇨🇿

DieNet claims to have targeted the website of Public administration portal in Czech Republic (https://t.co/NdVG22qdC0).

[Ed Targett @editortargett]

1 poisoned VSCode extension, 1 developer laptop; goodbye 3,800 private Github repositories. This Mini Shai Hulud wave is really something...

https://t.co/A4k9QmUo1v

h/t @AikidoSecurity team for being all over this as ever.

[Marek Sušický @msusicky]

Autonomní nástroje se posouvají dál a dál. Některé jsou připravené běžet každý den, ověřeno statisíci provedených testů.
Můžete použít opensource, ale rizika pak nesete sami.

[Horizon3.ai @Horizon3ai]

This attack path started in Linux…

…and ended with access to sensitive Windows data.

All because of one issue: SSH default credentials.

[Horizon3.ai @Horizon3ai]

This attack path started in Linux…

…and ended with access to sensitive Windows data.

All because of one issue: SSH default credentials.

[Gray Hats @the_yellow_fall]

Public PoC for NGINX CVE-2026-42945. An 18-year-old RCE flaw in the rewrite module enables server takeover. Update to NGINX 1.31.0 or 1.30.1 immediately.

#NGINX #CyberSecurity #InfoSec #RCE #Vulnerability #CVE #WebServer #PoC #GitHub #SysAdmin #TechNews
https://t.co/huz0K21JaR

[Zhenpeng (Leo) Lin @Markak_]

NGINX rift: We autonomously discovered this 18 yr old heap overflow (CVE-2026-42945) in @nginx impacting version 0.6.27 to 1.30.0. If you use rewrite and set directive, you maybe impacted! Please update your NGINX or change the config to mitigate it. Read more at https://t.co/KeoblrGL24

[impulsive @weezerOSINT]

I just reverse engineered the YellowKey BitLocker bypass

Microsoft shipped code that checks for a flag called "FailRelock" in every Windows 11 recovery image. When it's set to 1, after recovery unlocks your BitLocker drive, it never relocks it. All you need is a USB stick.

This code only exists in the recovery environment. Not in normal Windows. They left an entire debug testing framework in production.

[Florian Roth ⚡️ @cyb3rops]

the official OpenSearch client for Node.js has also been compromised

[Socket @SocketSecurity]

🚨 UPDATE: Mini Shai-Hulud has crossed from @npmjs into @pypi and is still spreading.

Newly confirmed compromised artifacts:

@​opensearch-project/opensearch: 3.5.3, 3.6.2, 3.7.0, 3.8.0 (1.3M weekly downloads)

mistralai: 2.4.6 on PyPI

guardrails-ai: 0.10.1 on PyPI

additional @​squawk/* packages on npm

guardrails-ai 0.10.1 executes malicious code on import. On Linux, it downloads git-tanstack[.]com/transformers.​pyz, writes it to /tmp/transformers.​pyz, and runs it with python3 without integrity verification.

The git-tanstack.​com domain displayed a message signed “With Love TeamPCP,” along with: “We've been online over 2 hours now stealing creds
Regardless I just came to say hello :^)”

The page also linked to a YouTube video and you can probably guess which one.

[International Cyber Digest @IntCyberDigest]

❗️ Linux is having a brutal week. Another local to root privilege escalation vulnerability just dropped: "Copy Fail 2: Electric Boogaloo."

This is the third Linux LPE in a row, after Copy Fail and Dirty Frag. The PoC is public on GitHub. There is still no coordinated patch.

https://t.co/6XifksYgZ6

[Marek Sušický @msusicky]

Univerzální resetovač hesla na linuxu :)
Uživatele platforem HTB, THM, ale i ti, co dělají třeba OSCP mají výhodu;)

[Xint @xint_official]

Patch your Linux boxes!

https://t.co/VWOUDbLAn2 is a trivially exploitable logic bug in Linux, reachable on all major distros released in the last 9 years. A small, portable python script gets root on all platforms.

Found by the teams at @theori_io and @xint_official
More details below
https://t.co/9f6T96PvPX

[Nicolas Krassas @Dinosn]

OpenSSH Flaw Allowing Full Root Shell Access Lurked for 15 Years https://t.co/PtMUAsSbsF