9MF

[r1cksec @r1cksec]

Materials for Malware Development: Evading EDR from Loaders to the Kernel presented at DEF CON 34 and BSidesLV 2026. Covers EDR Architecture, EDR evasion, C2 customization, and kernel-level techniques.

https://t.co/QmfjIpy1I1

#infosec #cybersecurity #redteam #pentest

[cr3ghost @cr3ghost]

Infosec tradecraft just became reusable by AI agents.

SpecterOps just open-sourced:

79 skills.
22 reusable agents.
26 plugin families.

BloodHound. Cobalt Strike. Outflank C2. Ghidra. Binary Ninja. Ghostwriter. Recon. AppSec. Code review. C2 development. Reverse engineering. Adversary simulation. Windows + macOS tradecraft.

And this is NOT just for red teamers.

Vulnerability researchers:
These workflows could accelerate code review, patch analysis, 1-day research and potentially help with 0-day discovery when paired with real research expertise.

Reverse engineers + malware analysts:
Give agents structured workflows, references and tooling instead of starting every investigation from a blank prompt.

Blue teams + detection engineers:
Study the same offensive tradecraft, emulate attacker behavior, build better detections and start asking what telemetry survives increasingly agent-assisted operations.

DFIR + threat intel:
Understand what adversaries may automate next and turn repeatable investigative knowledge into reusable workflows.

Red teamers:
BloodHound attack paths, recon, C2 development, adversary simulation and operator tradecraft are becoming increasingly agent-assisted.

This isn't another collection of AI prompts.

It's practitioner knowledge being turned into reusable, reviewable security workflows.

Potentially useful for everyone from CTF learners and newcomers all the way to malware analysts, reverse engineers, exploit devs, red teams, blue teams and vulnerability researchers.

This is only the beginning.

@SpecterOps Skills:
https://t.co/Cj77Ir3Qlj

@OutflankNL and @kyleavery breakdown:
https://t.co/q5sEaZlp1E

#Infosec #RedTeam #ReverseEngineering

[XSS Payloads @XssPayloads]

@garethheyes Some payloads from the article

<alert(1) onfocus="attributes[0].value=localName,new onfocus" autofocus tabindex=1>

<JAVASCRIPT:ALERT(1) onfocus=location=localName autofocus tabindex=1>

[zere @j_zere]

A short and simple XSS writeup: "Turning JavaScript Error Handling into XSS"

https://t.co/Fqx4coB5mk

[Init1Security @init1security]

What a great project for all your Initial Access needs!! Working for various Operating Systems Windows/Linux/macOS great work!!

https://t.co/kbBCznszak

[Quang Vo @smuggiekeplar]

I wrote a short blog post about capability of Chrome Debugging Protocol in Red teaming. My favorite caps are probably Browse as victim and able to retrieve raw password from Password Manager extensions.
#redteam
https://t.co/Fs9GwIfbE5

[Maher Azzouzi @maherazz2]

VsockDrop: unprivileged Linux kernel LPE in the io_uring/vsock zerocopy path, no user namespaces needed. Bug affects Linux 6.7 -> 7.0.10, fixed in 7.0.11.

PoC video: Ubuntu 26.04 LTS on bare metal.
Exploit + mini write-up here:
https://t.co/NwgoPPBsTJ

[Smukx.E @5mukx]

In this research, I turn Chrome Remote Desktop into a complete red team scenario that can be used for monitoring and even leads to spying.. I explain different use cases how to make it possible and operate without triggering security solutions..

Link :- https://t.co/6ZeFjVAUVF

[Abhishek @aacle_]

I Connected Claude Code direct to Burp via MCP

one command:

```
claude mcp add burp --transport sse http://127.0.0.1:9876
```

that's literally it.

after that Claude start working by himself:

- browse my proxy history
- do auto-recon on target
- create testing todo-list
- play with requests and responses
- find bugs while i do other stuff

i just give him scope. he do the grinding. i do the thinking.

result so far: **11 confirmed bugs**

real bugs. not hallucination. i verified each one.

https://t.co/4ritanX0F4

[Hors @horsicq]

obfus.h is the very powerfull compile-time obfuscator for C (win32/64). Supports virtualization, anti-debugging, control flow obfuscation and other code mutation techniques to prevent disassembly or decompilation. #CodeSecurity #Obfuscation #infosec

https://t.co/i6dnpRJUAF

[0xedh @0xedh]

You don't need a USB. You need to look like one.

Emulate the device, Windows fetches a signed package off Windows Update and runs vendor code as SYSTEM. Arbitrary code execution, LPE, standard user or empty logon screen.

DEF CON 34 talk w/ @Qm9yamFN.
Link at the first comment.

[R.B.C. @G3tSyst3m]

Hey everyone! Here's my latest blog post demonstrating another Initial Access method, this time using WebDav to bypass Smartscreen, MOTW, and another pesky alert.

https://t.co/dFItBnx2oM

[XSS Payloads @XssPayloads]

An unexpected XSS vector by @garethheyes

<alert(1) onfocus="attributes[0].value=localName, new onfocus" autofocus tabindex=1>

[Masato Kinugawa @kinugawamasato]

<select>
<selectedcontent></selectedcontent>
<option>
<script>alert()//executed without the closing tag

[Jessie Ho @j3ssie]

We've just dropped @Vigolium v0.3.0 🔥

New in this release:
- New JavaScript engine that extracts real endpoints from obfuscated code
- Two-way Burp Bridge: Vigolium reads traffic directly from Burp (and vice versa)
- Smoother CLI & agent experience
- Expanded module registry + a lot of optimizations

Full changelog: https://t.co/92aCIWVoun

[Tiziano Marra @_MrTiz]

Intel #CET killed traditional #callstack #spoofing. Here is how to bypass modern #EDRs telemetry anyway.

New: CET-Compliant Callstack Spoofing via Thread Pool & Enum callbacks.

Manual shadow stack resync via JMP & #INCSSPQ. Article & Rust PoC included👇

https://t.co/fJOmAcFGOa

[hugeh0ge @hugeh0ge]

I found a Linux 0day vuln with @rqda_A, and $80,000+ rewarded for it by Google kernelCTF!
The vuln has been surprisingly hidden for about 19 years.
We've published an English version of the blog post!

https://t.co/Xsx1GyEtT4

[V4bel @v4bel]

💥 Introducing "Januscape" (CVE-2026-53359)

A Guest-to-Host Escape in KVM/x86 exploiting a UAF in the shadow MMU. Triggerable on both Intel and AMD hosts. Threatens x86 public clouds (GCP, AWS) that expose nested virtualization.

"16 years" latent. Successfully used as a 0-day exploit in "Google kvmCTF".

To the best of public knowledge, the first KVM exploit research triggerable on both Intel and AMD.

Details: https://t.co/df5GPpVfeA

[blasty @bl4sty]

more phresh linux LPE sl0pday being dropped at https://t.co/FgelJA8IoC (736b380e28d0) w00t w00t

[Print3M @Print3M_]

I’m sharing my slides from @x33fcon 2026.
Inside ~15 examples of abusing traitorware to execute your payload via trusted & signed binaries (e.g. VLC Player, SublimeText) and how to find more of them.

Recording will be published soon.

https://t.co/M2jpnNA5XI