Siddharth

Head of Security | Bug Hunter | F1 Enthusiast | Web3 | Gamer | My opinions are my own

[Siddharth @parad0xr]

So true. Intend to do the same soon.

[solst/ICE of Astarte @IceSolst]

When joining a new security team, the highest ROI action you can take is terminate Snyk as a vendor

[Moritz @m_r_tz]

The FLARE team now freely distributes its quality reverse engineering and malware analysis educational content at https://t.co/bGCIjBfD3C. Launched with:
- Malware Analysis Crash Course
- Go Reversing Reference
- Intro to TTD

[Batuhan Katırcı @batuhan_katirci]

vphone-cli + rpc-project + rpc-client-mcp (wip right now, i will publish soon).

simulate real iphone device (not simulator, it's an emulator) and do whatever you want on the device :D

[Patrik Grobshäuser @ITSecurityguard]

New series on using Claude for bug bounty 👀.

sync your hackerone reports, cross-referencing past findings against new targets etc.

The actual workflow, not the LinkedIn fantasy.

Feedback from AI-maxers always welcome ❤️

https://t.co/Y14VwMc30u

[NetAskari @NetAskari]

We got our hand on a Chinese DLP program the government and national security agencies use to monitor state employees computers for leakage and usage of confidential documents. Meet 保密管理系统. 1/9

[Hunt.io @Huntio]

🚩 7-Zip RCE Vulnerability Exploited in the Wild

https://t.co/8TfeI24cF1

Security researchers are warning that a remote-code-execution flaw (CVE-2025-11001) in 7-Zip is now being actively exploited.

The bug stems from incorrect processing of symbolic links inside ZIP archives, a malicious archive can traverse directory paths and write files outside the intended extraction folder, potentially delivering malware or achieving full code execution under the user or service account.

If you use 7-Zip on any Windows system, update to version 25.00 (or later) immediately to mitigate the threat.

#CyberSecurity #RCE #Vulnerability #Malware

[Amitai Cohen @AmitaiCo]

Here's our initial analysis of CVE-2025-55182 and CVE-2025-66478, critical RCE vulnerabilities in React and Next.js - these bugs allow for unauthenticated RCE on default configurations - patch ASAP:
https://t.co/EQaPopth22

[Mandiant (part of Google Cloud) @Mandiant]

📣 Everything defenders need to know about UNC1549: a deep dive analysis of suspected Iran-nexus espionage targeting the aerospace, aviation, and defense industries in the Middle East.

Dive into the details: https://t.co/N2KBeHdJ7z

[Siddharth @parad0xr]

@overflow_kaizen @akshay_pachaar lol, I see what you did there😂

[Branko @brankopetric00]

Cut our AWS bill from $52K to $18K per month. Took 3 weeks of detective work.

The audit:
- Started with AWS Cost Explorer
- Noticed NAT Gateway was $8K/month
- Data transfer was $12K/month
- RDS storage was $6K/month

What we found:
- Logs were being sent to S3 via NAT Gateway
- Should have used VPC Endpoint (free)
- RDS had 14TB of automated backups
- Retention was set to 90 days
- Old snapshots from deleted databases

The fixes:
- VPC Endpoints for S3 and DynamoDB
- Backup retention to 7 days
- Deleted 200+ orphaned snapshots
- Moved development to Spot instances

[Dirk-jan @_dirkjan]

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: https://t.co/jD6EaGtsn3

[gfw.report @gfw_report]

The Great Firewall of China (GFW) today experienced the largest internal document leak in its history. More than 500GB of source code, work logs, and internal communications have been exposed, revealing details about the development and operation of the GFW.

The leak originated from a core technical force — Geedge Networks (with chief scientist Fang Binxing) and the MESA Lab in the Institute of Information Engineering, Chinese Academy of Sciences.

The company not only provides services to local governments in Xinjiang, Jiangsu, and Fujian, but also exports censorship and surveillance technology to countries such as Myanmar, Pakistan, Ethiopia, and Kazakhstan under the “Belt and Road” framework.

Due to the massive volume of material, GFW Report will continue analyzing and updating on this page:
https://t.co/HgzRJbcTls

[Aditi Singh @aditi_singghh]

When we decompile an APK and see an unreadable https://t.co/BbQf3H943H.bundle, it could be Hermes bytecode. Using https://t.co/DBonMwpUBM we can make it readable and look for interesting endpoints, keys, or app flows.

#bugbounty

[LuemmelSec @theluemmel]

That is actually the real exploit.
I went through all the decoding and stuff.
It finally is the payload that creates spinstall0.aspx which then gets you the machine keys that allow you to craft your own Viewstates.

[spencer @techspence]

Super easy win for defenders… block everything from LoLRMM

https://t.co/hgbCMLgAgF

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft has discovered worldwide cloud abuse activity by new Russia-affiliated threat actor Void Blizzard (LAUNDRY BEAR), whose cyberespionage activity targets gov't, defense, transportation, media, NGO, and healthcare in Europe and North America. https://t.co/yVbdaFuqMf

[Florian Roth ⚡️ @cyb3rops]

Reading Microsoft’s new Void Blizzard report, one thing stands out (again): Everything is about credential theft, phishing, and tokens. Initial access comes from buying or stealing creds - often through low-effort phishing. All the real action happens in the cloud, not on endpoints.

Gone are the days of multi-stage attacks where you’d see lateral movement, privilege escalation, or fancy malware on file servers. Now it’s just: steal creds, log in to cloud, exfiltrate data, repeat. Detection? Only possible if you have access to expensive cloud logs. No logs, no chance.

The perimeter has shifted from endpoints to identity. The detection surface shrank from your whole network down to some logs you might get from your cloud provider if you pay extra. Honestly, not sure if that’s “progress” or just shifting the visibility problem somewhere else.

[Thorsten E. @endi24]

This vulnerability not only affects users of PuTTY but also extends to several other tools...

Affected Products
- PuTTY 0.68 - 0.80
- FileZilla 3.24.1 - 3.66.5
- WinSCP 5.9.5 - 6.3.2
- TortoiseGit 2.4.0.2 - 2.15.0
- TortoiseSVN 1.10.0 - 1.14.6

[Siddharth @parad0xr]

@MrKryp70n @offsectraining You're gonna crush it