./retweet.sh

It's all about security!! Channel is handled by HUMAN not by BOT #threatIntel

[Nitin Gavhane @NitinGavhane_]

https://t.co/exPDzS2mPK

[skull @brutecat]

Hacking Google with A.I. for $500,000

https://t.co/S8NbDU9ZaN

[BlackRoomSec @blackroomsec]

NIST AI Incident Management ($46 fee for virtual) https://t.co/gGlhuYhgYv

Get on this.

[Thomas Roccia 🤘 @fr0gger_]

https://t.co/DDrdRSaLzn

[sebsrt @s3bsrt]

I’ve been digging into HTTP Trailers and found some new smuggling techniques:
https://t.co/gpaIiYkSHs

[0xdfir-jutsu-mal @Jutsu0xdfir_mal]

🚨 WARNING: Fake CVE-2025-55182 (React2Shell) scanner contains MALWARE
https://t.co/Q65dFepsOl
Hidden payload in code: → mshta.exe https://py-installer[.]cc
Targets security researchers hunting this vuln.
Always read source before running any "security tool"!
#React2Shell

[Tech Fusionist | Kushal Gangil @techyoutbe]

Are You Making These 11 Kubernetes Mistakes?

Misconfigurations can lead to outages, security risks, and performance issues. Learn how to prevent the most dangerous Kubernetes pitfalls before they sink your deployment!

✍️✍️

[./retweet.sh @retweetslash]

The widely used GitHub Action “tj-actions/changed-files” has been compromised

[./retweet.sh @retweetslash]

Gitlab critical bypass flaws

CVE-2025-25291 and CVE-2025-25292

[Cytex @cytexsmb]

A new ransomware strain, dubbed NailaoLocker, has been discovered targeting healthcare organizations across Europe. This malicious payload is being deployed in attacks that exploit CVE-2024-24919 (CVSS: 7.5), a vulnerability in Check Point Security Gateways. The attackers are leveraging this exploit to gain initial access to targeted networks and subsequently deploy two malware families strongly linked to Chinese state-sponsored threat groups: ShadowPad and PlugX.

While NailaoLocker itself is considered a relatively basic ransomware variant – lacking features like process termination, advanced anti-debugging, sandbox evasion, and network share scanning – its presence alongside sophisticated malware like ShadowPad and PlugX paints a more complex picture. Researchers have observed NailaoLocker employing obfuscation and anti-debug techniques, as well as establishing communication with a remote server for persistent access. Evidence also suggests attempts at data exfiltration, including accessing the file system and creating ZIP archives.

The contrast in sophistication between NailaoLocker and the accompanying malware is notable. NailaoLocker sometimes even appears to mimic ShadowPad's loading techniques. This suggests a potential division of labor among the threat actors, with some focusing on the more complex intrusion and exfiltration while others deploy the simpler ransomware payload.

Although the exact motives behind this campaign remain unclear, the combination of espionage-focused malware and ransomware suggests a blended approach. While quick financial gain through ransomware payments may be a secondary objective, the primary goal could be long-term access to compromised systems for intelligence gathering or future disruptive operations. The campaign, even if opportunistic in some aspects, allows the threat actors to establish a foothold within targeted healthcare networks, potentially paving the way for further malicious activities.

The targeting of the healthcare sector is particularly concerning, given the sensitive nature of patient data and the critical importance of uninterrupted healthcare services. This incident highlights the ongoing threat of cyberattacks targeting critical infrastructure and the need for robust cybersecurity defenses within the healthcare industry.

[sysxplore @sysxplore]

Kubernetes Scaling Strategies

[Tech Fusionist | Kushal Gangil @techyoutbe]

Git - Cheat Sheet 🔥🔥

[Alex Xu @alexxubyte]

Big Data Pipeline Cheatsheet for AWS, Azure, and Google Cloud

[Harshleen @0xharshleen]

Search Engine For Cybersecurity

[Tech Fusionist | Kushal Gangil @techyoutbe]

REST API (Simplified) 🔥🔥

[Harshleen @0xharshleen]

Defensive and Offensive Linux Security Tools💻⚙️

[Tech Fusionist | Kushal Gangil @techyoutbe]

Automation Tools 🔥🔥

[sysxplore @sysxplore]

How Dynamic Host Configuration (DHCP) Works

[Tech Fusionist | Kushal Gangil @techyoutbe]

Quick Cheat Sheet : Git 🔥🔥

[Dr Milan Milanović @milan_milanovic]

𝗔𝗣𝗜 𝗟𝗲𝗮𝗿𝗻𝗶𝗻𝗴 𝗥𝗼𝗮𝗱𝗺𝗮𝗽

Whether you're a beginner or an experienced developer looking to learn about API, this comprehensive API learning roadmap will guide you through the key concepts and technologies you need to master.

𝟭. 𝗜𝗻𝘁𝗿𝗼𝗱𝘂𝗰𝘁𝗶𝗼𝗻 𝘁𝗼 𝗔𝗣𝗜𝘀

🔹 API Definition: An API is a set of protocols, routines, and tools for building software applications. It specifies how software components should interact.

🔹 API Types:
🔸 Public APIs: Open for use by external developers (e.g., Twitter API)
🔸 Private APIs: Used internally within an organization
🔸 Partner APIs: Shared with specific business partners
🔸 Composite APIs: Combine multiple data or service APIs

𝟮. 𝗔𝗣𝗜 𝗔𝗿𝗰𝗵𝗶𝘁𝗲𝗰𝘁𝘂𝗿𝗲𝘀

🔹 REST (Representational State Transfer): A widely used architectural style for web APIs
🔹 GraphQL: A query language for APIs that allows clients to request specific data
🔹 SOAP (Simple Object Access Protocol): A protocol for exchanging structured data
🔹 gRPC: A high-performance, open-source framework developed by Google
🔹 WebSockets: Enables full-duplex, real-time communication between client and server
🔹 Webhook: Allows real-time notifications and event-driven architecture

𝟯. 𝗔𝗣𝗜 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆

🔹 Authentication: Basic, OAuth 2.0, JSON Web Tokens (JWT)
🔹 Authorization: Controlling access rights to resources
🔹 Rate Limiting: Preventing abuse by limiting the number of requests
🔹 Encryption: Protecting data in transit using HTTPS

𝟰. 𝗔𝗣𝗜 𝗗𝗲𝘀𝗶𝗴𝗻 𝗕𝗲𝘀𝘁 𝗣𝗿𝗮𝗰𝘁𝗶𝗰𝗲𝘀

🔹 RESTful conventions: Using HTTP methods correctly, proper resource naming
🔹 Versioning: URI versioning (e.g., /v1/users), Query parameter versioning (e.g., /users?version=1), Header versioning (e.g., Accept: application/vnd. company. v1+json).
🔹 Pagination: Efficiently handling large datasets
🔹 Error Handling: Proper use of HTTP status codes and informative error messages

𝟱. 𝗔𝗣𝗜 𝗗𝗼𝗰𝘂𝗺𝗲𝗻𝘁𝗮𝘁𝗶𝗼𝗻

🔹 Swagger/OpenAPI Specification: A standard for describing RESTful APIs
🔹 Postman: A popular tool for API development and documentation
🔹 ReDoc: A tool for generating beautiful API documentation

𝟲. 𝗔𝗣𝗜 𝗧𝗲𝘀𝘁𝗶𝗻𝗴

🔹 Postman: Allows creating and running API tests
🔹 SoapUI: A tool for testing SOAP and REST APIs
🔹 JMeter: Used for performance and load testing
🔹 API Mocking: Tools like Mockoon or Postman's mock servers for simulating API responses

𝟳. 𝗔𝗣𝗜 𝗠𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁

🔹 API Gateways: Azure API Management, AWS API Gateway, Kongk, Apigee.
🔹 Lifecycle Management: Postman Collections, RapidAPI, Akan.
🔹 API Analytics and Monitoring: Moesif. Datadog, ELK Stack (Elasticsearch, Logstash, Kibana)

𝟴. 𝗜𝗺𝗽𝗹𝗲𝗺𝗲𝗻𝘁𝗮𝘁𝗶𝗼𝗻 𝗙𝗿𝗮𝗺𝗲𝘄𝗼𝗿𝗸𝘀

🔹 Python: Flask, Django REST framework, FastAPI
🔹 JavaScript​: Express.js
🔹 Java: Spring Boot

#softwareengineering #programming #api