Rey Bango

AI & Security | I hack into things sometimes. Opinions are mine. Fortis fortuna adiuvat. Nostalgia is not a strategy. It's a good time to cause a little chaos.

[Rey Bango @reybango]

The final part of using the open-source Empire C2 on Hack Smarter Labs' DarkHaven range is now out.

Once again I partner with @_Hubbl3 on how he would approach this Active Directory cyber range from Hack Smarter Labs as a red team operator using the @EmpireC2Project .

Go check out the vide here:

https://t.co/hiwNfAucxv

[Rey Bango @reybango]

Residential proxies apparently are popular at the Whitehouse.

"Several staffers at the White House are using computers or mobile devices equipped with residential proxy services that render their internet address available for others to rent, security experts warned today. One of the proxy services is a Russian company whose founder’s web hosting business was ground zero for cyberattacks against election systems in Arizona and Illinois in 2016."

https://t.co/DkNKMeeR02

[Rey Bango @reybango]

@konsolitus Oh no! Your router too?

[Rey Bango @reybango]

We’re all cooked

[MJ @mjackson]

This is the worst one I’ve seen 😞

https://t.co/51zXFrA8zs

[Just Hacking Training (JHT) @JustHackingHQ]

Biggest Sale of the Year Starts... NOW! 🦃 25% Off EVERYTHING w/ code BFF25. Even already discounted Bundles! Forget the Noise, Get to https://t.co/fGg3t299qk

Missed our 2 BIG announcements? Here ya go:

- New site including JHT for Teams and a Champion Reward: https://t.co/CgJxj4T2rl
- 🎉 Just Hacking Services! The experts behind our training are now available to advise, build and pentest all aspects of your cybersecurity program. Everyone earns commissions! Know someone needing our services? Make the intro, and we’ll take it from there. https://t.co/E7AgjjxJnw

#blackfriday #blackfriday26 #cybersecurity #training #career

[Dave Kennedy @HackingDave]

Insane. We so back from the 80s

[International Cyber Digest @IntCyberDigest]

The bug is like a joke.

On Alpine Linux, type 257 to 1024 characters of anything and you get root. 💀

[NIK @ns123abc]

> Railway gets caught hacking competitor's infra
> “sorry, my agents accidentally did it”

This is insane

[mRr3b00t @UK_Daniel_Card]

this is WILD!

[Derek Ross @derekmross]

🚨 PSA for anyone running a Linux server, node, or relay

CVE-2026-98432 is a critical Linux kernel bug (CVSS 9.8). Someone on the internet can send crafted TCP packets and take over your machine. No login needed.

Ubuntu and Red Hat haven't shipped a fixed kernel yet. Debian, SUSE, Oracle and Amazon have.

What to do today:

1. Check your kernel: uname -r
Fixed versions: 6.1.190+, 6.6.159+, 6.12.113+, 6.18.56+, 7.2.10+ or 7.3+. Below that, you're exposed.

2. If your distro has a fix, update and reboot.

3. If not, block the attack. It needs TCP packets with "IP options," which normal traffic never uses. One nftables rule drops them. Log what gets dropped so you can see if someone's probing you.

4. Turn off MPTCP unless you need it:
sysctl -w net.mptcp.enabled=0
Programs built with Go 1.24+ use MPTCP automatically, and that's how the known exploit gets in.

5. Make it survive a reboot, and check it still works after one.

If you run a Bitcoin node, a Lightning node or a Nostr relay, your machine is on the internet by design. Do this today.

Self-hosting is freedom. Patching is part of the job. 🛡️

[Rey Bango @reybango]

@PhillipWylie @DHAhole @Bandrel @misstennisha @TCraf7 @intigriti @zbraiterman @thejonmccoy @BentleyAudrey @Jhaddix @jeff_foley @bishopfox @C0d3Cr4zy @caseyjohnellis @MrJeffMan @SW_Samii @0xTib3rius @OliviaGalluccii @rana__khalil @Infosecpat @J3ssa @luizfernandorg @ethicalhacker @irawinkler @CyberWarriorSt1 @ebelardo73 @NahamSec @CSKIP71 @soundslikerhea @Whimmery @Neogenxz @Maekshyft @BrendonKelleyBK @_JohnHammond @JohnnyCiocca @IOCsAreEasy1 @MikeOcha2 @Dave_Maynor @EnglishRyno @LawyerLiz @C_C_Krebs @bsdbandit @marigalloway @DanRaywood @corg_e @hakluke @gregxsunday @RayRedacted @Rhynorater @GyledC Thank you Phil. Have a great weekend.

[Rey Bango @reybango]

Was reading a threat analysis report by @K7CyberSecurity and it motivated me to create a video about building an ISO to deliver a payload. Fun exercise leveraging techniques I learned from @_RastaMouse

https://t.co/1PbbusIZWk

[Ryan Shea @ryaneshea]

PSA for macOS users:

1. Apple’s supplied SSL certificate bundle at /etc/ssl/cert.pem still trusts certificates attackers can forge using compromised eMudhra keys.

2. I confirmed this on macOS 26.7.1 and 27.0.1 using Apple’s built-in curl and Git.

3. An attacker intercepting connections from tools using this bundle could replace downloads with malware. With commands like curl … | sh, that malware would execute immediately.

4. Removing the roots that authorize those certificates blocks the tested chains. Both OS updates restored roots I’d previously removed, requiring me to remove them again.

4. I’ve submitted the findings to Apple’s security team and am awaiting their response. In the meantime, you can apply a temporary fix as outlined below.

5. To check and fix your machine, give an agent like ChatGPT/Codex or Claude Code the following prompt:

“Independently verify whether Apple’s /etc/ssl/cert.pem still permits trust in certificates signed with compromised eMudhra keys. If so, back it up and remove the roots enabling that trust, identified by verified SPKI fingerprints. Confirm Apple’s built-in curl and Git reject those chains while ordinary HTTPS still works. Preserve rollback and never disable TLS verification.”

Note that removing these roots can also block legitimate sites. This is a temporary mitigation, not a substitute for a fix from Apple.

I’ll share the script I used in a follow-up post if you’d prefer to use that directly.

[Rey Bango @reybango]

@naterkane 😂

[Rey Bango @reybango]

OH: “There’s no patch for human stupidity.” 😂

[Chris O'Rourke @RsThrive]

@AletheDenis The best slides come from procrastination :)

[Rey Bango @reybango]

@JustPablosSF @AletheDenis I mean you’re not wrong about the 2 days thing. Been there.

[Rey Bango @reybango]

@AletheDenis Yeah…might be time 😂

[Empire @EmpireC2Project]

See Empire C2 in action in Part 3 of the DarkHaven Range walkthrough with @reybango and Jake Krasnov 🎉

Watch how Empire is run through a live target environment:
https://t.co/aTdDhadT9m

#EmpireC2 #RedTeam #CyberSecurity