outhex

Low follower ratio, I must have no skills..

[outhex @outhex2]

@nickvangilder iirc you needed to add a passkey, advanced security, disable other recovery methods (like email, sms) and turn on advanced security.

I’m not sure but you might need to re-apply for daybreak blue

[Florian Roth ⚡️ @cyb3rops]

Two very useful posts on monitoring and hardening PHP services, plus an Nmap command to help find them in your environment:

1. Discovery with Nmap

Common and alternative web ports; HTTP headers that may expose PHP versions:

nmap -sT -sV --version-light -T4 --max-retries 1 --open -p 80,81,443,8000-8010,8080-8090,8181,8443,8880,8888,9000,9001,9080,9090,9443 --script http-headers --script-timeout 10s --script-args 'http-headers.path=/index.php,http-headers.useget=true' <target>

Look for X-Powered-By: PHP/.... Fast inventory check; hidden PHP deployments can be missed, and version banners don’t confirm vulnerability.

2. Huntress: Monitoring and detection

• Confirmed facts and remaining questions
• Suspicious PHP child processes, shells and downloaders
• Webshells and other post-exploitation activity
• My process-watcher for Linux process visibility

https://t.co/XLx8za50cZ

3. Vincent Schmalbach: Hardening and patching

• Temporary nginx/Apache filters and upload-progress settings
• WAF/origin bypass checks
• Package and backport verification
• PHP-FPM/worker restarts, container rebuilds
• Side effects and checks for compromise

https://t.co/30YfHmqIcR

Temporary measures are stopgaps. Prepare to apply the official fixes as soon as available.

[katexbt.hl @katexbt]

oh my god this is worse than we thought

here's @Ledger $86M exploits explained

> cryptobilis was a reputable and authorized Ledger/Trezor/OneKey dealer for over 4 years

> they decided to sell the company to a Chinese guy (most likely patsy for DPRK) from northern China in MARCH 2026

> the "Chinese guy" modded the devices within the supply chain itself (physical), namely Nano X devices, to contain an implant module

> ledger validity/genuineness check CANNOT detect this because hw wasn't actually tampered with, just spied on

> quoting @MagicalTux:

" implant just monitors what's shown on the screen, will take note of the seed as it's shown to you, then transmits it to 3rd party"

> former owner chimes in on X (pic below) to say that "they were under a NDA" to not mention anything to anyone for 6 months

> they obviously didn't alert any of their partners that they were authorized to sell devices of... because NDA, duh!! its in the name!

> conveniently, funds start getting siphoned a few weeks before this magical NDA due date, and being laundered across all blockchains

[Hugging Models @HuggingModels]

This is a goldmine, bookmark worthy.

[factorydoge @factorydoge69]

this ledger supply chain attack is crazy

they soldered on an esim, LTE module, and separate CPU wtf

[SEKTOR7 Institute @SEKTOR7net]

Entropia - a compiled language for Windows shellcode.

It collapses the usual chain of compiler, linker and position-independence transform into one compiler that emits PIC x86-64 shellcode or Cobalt Strike BOFs directly.

OPSEC tricks like polymorphism, direct syscalls and ETW/AMSI patching ship as plain compiler flags.

A tool by @EntropyKit

Source: https://t.co/QGGP6cVMkm

#redteam #blueteam

[outhex @outhex2]

@S1r1u5_ Wtf, I haven’t even had coffee yet and I’m reading this nonsense.

[clibm079 @clibm079]

An index of public APT reports, 2018–2026.

https://t.co/Pi3bydzkeT

[beamnxw ./ @beamnxw]

this is pure f*cking treasure

these 10 agent skills have 3.49M combined downloads and form a complete working stack

planning. react performance. databases. ideation. interface systems. branding. visual polish. search. browser work. production UI

01 grill-with-docs
▸ https://t.co/bAZECpykZO

02 vercel-react-best-practices
▸ https://t.co/WgaBlBtjm6

03 supabase-postgres-best-practices
▸ https://t.co/QfhRz1bYRi

04 brainstorming
▸ https://t.co/IlbrmGxOB9

05 ui-ux-pro-max
▸ https://t.co/AdMZOXiABl

06 brandkit
▸ https://t.co/h6Quxsunw5

07 impeccable
▸ https://t.co/SOQ94JsacQ

08 seo-audit
▸ https://t.co/Jvna02e9K3

09 browser-use
▸ https://t.co/B4l5R6kXu3

10 shadcn
▸ https://t.co/fGrCr7aLnA

the stack covers the full product loop:

pressure-test the plan ⮕ shape the system ⮕ build the interface ⮕ harden the database ⮕ polish the experience ⮕ audit discovery ⮕ run the workflow in a real browser

save this, then select your gpt-6 astra use case ⭣

[chuplung @choopyplug1]

Anthropic just dropped a 13-page PDF on Agent Memory - 5 layers that cut token cost 90% and make your agent actually learn:

here's the 5-layer memory architecture:

layer 1 → working memory - the context window. everything the agent sees right now. when it fills up, old context dies. most agents stop here and wonder why they're broken

layer 2 → episodic memory - what happened. full interaction logs with timestamps. the agent recalls that the deploy failed Tuesday at 3am because the migration script had a typo

layer 3 → semantic memory - what is true. facts, entities, relationships stored as a knowledge graph. "user prefers TypeScript" lives here. doesn't expire when the session ends

layer 4 → procedural memory - how to do things. the agent tried 3 approaches, one worked. that method becomes a reusable skill. next time it skips straight to what worked

layer 5 → forgetting - what to delete. an agent that never forgets accumulates contradictions. old preferences override new ones. the user moved cities but the agent still recommends restaurants in the old one

the result: Mem0 stores 1,800 tokens per query instead of 26,000. Snowflake added one ontology layer - 20% better accuracy, 39% fewer tool calls. memory pays for itself on day one

this 13-page PDF is what separates a chatbot from an agent that actually learns

don't scroll past this one ↓

[Natalie Silvanovich @natashenka]

Project Zero is hiring!

https://t.co/LTjxJTQ3DQ

Please share with anyone you think would be great for the role. DMs are open for questions.

[spencer @techspence]

Regular reminder… this hardening series by Jerry Devore is super awesome. There’s no way you won’t learn things by reading these.

Part 1 - Disabling NTLMv1
Part 2 - Removing SMBv1
Part 3 - Enforcing LDAP Signing
Part 4 - Enforcing AES for Kerberos
Part 5 - Enforcing LDAP Channel Binding
Part 6 - Enforcing SMB Signing
Part 7 - Implementing Least Privilege

Link to all articles 👇
https://t.co/JNDMfVqoDP

[outhex @outhex2]

@RockstarGames What is Kenzie from love island doing here wtf 😂

[☔ @Whotfismick]

Me refusing to sleep because i didn't get enough time to feel like human after work

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft has identified a supply chain attack on the Mastra-AI npm ecosystem, with 80+ packages compromised through npm account takeover. The attacker introduced a phantom dependency into the compromised packages. The malicious dependency was published by a single anonymous maintainer less than 24 hours ago.

The compromised [email protected] adds the dependency easy-day-js@^1.11.21 (typosquat of "dayjs"), which resolves to v1.11.22. The post-install script runs node setup.cjs, which downloads and executes a remote payload.

The post-install script in [email protected]:

1. Bypasses TLS: Disables SSL verification (NODE_TLS_REJECT_UNAUTHORIZED=0) to communicate with attacker C2 without certificate errors
2. Writes tracking files: Creates ~/.pkg_history (infected machine path) and ~/.pkg_logs (XOR-encoded marker) to prevent re-infection
3. Downloads hidden payload: Fetches second-stage .js from 23[.]254[.]164[.]92:8000/update/49890878
4. Executes as invisible process: Spawns downloaded payload with C2 endpoint 23[.]254[.]164[.]123:443 passed as argument, runs detached and hidden (windowsHide=true)
5. Covers tracks: Deletes setup.cjs to remove all evidence of initial infection

This attack affects [email protected], mastra/pg, mastra/mcp, mastra/schema-compat, mastra/ai-sdk, mastra/rag, and 80+ other packages.

Microsoft Defender for Endpoint customers should monitor and act on alerts with Trojan:JS/ObfusNpmJs in the title. Customers can also check for the following IOCs:
- ls ~/.pkg_history ~/.pkg_logs
- random .js files in home/temp directory

Users are advised to downgrade to previous versions immediately, use [email protected] explicitly, and use lockfiles.

[osj @inf0stache]

More DPRK packages, clearly targeting developers by package name.

What's interesting here is the dropper isn't in index.js like the others. This one pulls from a gist, and inside that gist is the same dropper I've mentioned in other posts.

They then pull in the malicious package as a require. So the other packages don't appear malicious on their own, they're doing normal things and just pulling in the malicious one. This is interesting.

This is something I think is expected as the crackdown on lifecycle hooks begins with npm v12. With allowScripts defaulting off, preinstall/postinstall won't fire on their own anymore, so it makes sense to move execution into the require chain instead.

One malicious package, then require it in the others. It runs when the code actually gets used instead of at install.

Worth watching if this becomes the usual pattern once v12 ships in July.

[Nick VanGilder @nickvangilder]

Reminder: I am no longer posting new red team jobs on LinkedIn and X. I used to post them every week. Instead, they now live on: https://t.co/9sSZTAzVEN. It’s all the same jobs and same content, just updated more frequently, a longer running list, automated pruning, and honestly just easier to keep track of and maintain.

[The Lunduke Journal @LundukeJournal]

The AUR (Arch Linux User Repository) is continuing to be flooded with malicious code.

As of this writing, the Arch team has found at least 1,579 malicious packages (roughly 1.4% of all packages within the AUR), with more packages being updated with malicious code this morning.

This includes several popular utilities and libraries, including: gtkimageview, gdl, libgdata, and python-future.

A partial list of impacted packages can be found here:
https://t.co/LmHBksv8UC

[Kirk @KirkDerpca]

NPM Malware >

- Obfuscated postinstall hook (.prepare.cjs) uses char-code arrays to hide sensitive variable names
- Credential harvesting targeting AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, NPM_TOKEN
- Exfiltration endpoint at open[.larksuite[.com (Feishu bot webhook) acts as C2
- Explicit sandbox evasion logic checking for SANDYCLAW, OPENCLAW, PERMISO, CHAINRADAR env

https[://www[.npmjs[.com/package/ash-claw/v/1.7.13
https[://sandyclaw[.permiso[.io/shared/5PVyO_QI-Y0ENhwni99JtULn_f8oVSMpqWXiYktq5E4

@TekDefense 😂