‼️ The alienation continues: more security researchers are sticking up the middle finger after feeling squeezed by Microsoft and GitHub. MSRC emailed Black Hat USA 2026 presenters asking which MSRC cases, VULN-IDs, or CVEs their talks would cover. GitHub told a researcher to delete his public PoC repos and flagged his accounts under ToS.
We helped FFmpeg find and fix 21 security vulnerabilities.
In a 1.5M-line codebase, we spent just $1K in API costs. Some of these bugs had been hiding for decades.
We also developed a PoC demonstrating an RCE primitive when FFmpeg processes RTSP streams.
Full write-up: https://t.co/mIrjirCgcB
🚨 Our CIRT and Research teams uncovered JINX-0164, a threat actor targeting crypto organizations.
A single LinkedIn message can lead to malware, CI/CD compromise, stolen crypto, and supply chain attacks.
Read more: https://t.co/SBTWQYCjWK
Bring Your Own RWX Region DLL (BYORWXDLL)
New Medium post, today we are exploring a technique I call Bring Your Own RWX Region DLL, inspired by the well-known BYOVD (Bring Your Own Vulnerable Driver)
https://t.co/slNKv9qF4W
🚨 BREAKING: Miasma is back.
The Shai-Hulud variant has returned to npm, impacting 57 packages with a combined 647K+ monthly downloads.
⚠️ GitHub token theft
⚠️ Cloud credential theft
⚠️ npm account compromise
⚠️ 118+ infected GitHub repos
Full technical analysis to come — follow @OX__Security for updates
#CyberSecurity #SupplyChainSecurity #AppSec #npm #OpenSource
We think of WASM as a mechanism to run compiled code in your browser, but what if we shimmed in all the host APIs necessary to run full implants with ALL logic entirely in the WASM VM? This post walks through what that looks like.
https://t.co/xGVpPe2zyC
#wasm#malware#sliver
🚨 Cybersecurity Alert: The HSE is experiencing IT disruption today due to a ransomware attack on an external vendor. The health service itself wasn't directly targeted, proving once again that your security is only as strong as your weakest third-party link. Read more: https://t.co/cebf46722b
#Cybersecurity #hse #ransomware #cyberattack #nis2 #3rdPartyRisk
The attackers demonstrated strong operational security and evasion discipline during a 5-month campaign focused on stealing an executive’s Outlook mailbox.
Their primary goal was to remain undetected by minimizing noise, blending with legitimate activity, and avoiding common detection triggers.
❗️Google employees are flooding an internal meme board with posts about how bad the company's AI is.
A source says dozens of anti-AI memes post weekly, spiking when models update or their internal coding tool Jetski breaks. One showed Jetski admitting it fabricated report metrics with over 400 upvotes.
Engineers say AI removed the code-gen bottleneck but jammed everything else: testing, build times, and human review now drowning in code nobody wrote.
CEO Pichai says 75% of new code is AI-generated, btw.
Via 404Media
Flashpoint reports that XSS, once a unified Russian-speaking cybercrime hub, fractured into competing factions after a July 2025 takedown, with DamageLib, Rehub, XSS[.pro], and XSSF emerging. https://t.co/CZaoIw85fW
IRFlow Timeline v1.0.7 is live.
This one focuses on a problem I think DFIR teams will see more often: AI assistant usage becoming part of the investigation surface.
You can now collect and normalize local AI usage history from tools like Claude Code, ChatGPT Desktop, Cursor, GitHub Copilot, OpenAI Codex, Gemini CLI, Continue, Windsurf, and Claude Desktop into a unified timeline view.
Also added AI Secret Hunt, which helps identify secrets, tokens, API keys, private keys, and credentials that may have been pasted into AI assistants during real investigations or day-to-day engineering work.
The goal is simple: make AI app activity easier to preserve, search, tag, and correlate during incident response. AI usage is becoming part of the forensic record. We need tooling that treats it that way.
Link in the comment ⬇️
#DFIR #IncidentResponse
#Gamaredon
This report analyses over a decade of malware families and establishes a unified naming taxonomy to cut through the fragmented nomenclature.
1:
https://t.co/pjywWtlIkQ
2:
https://t.co/fKcZ0hSaEf
3:
https://t.co/vcMDWqD47S
"Re: Family Room Reservation"
fake #booking spam email
⛔️https://haddjskak827sja.]com/v
drop zip > lnk
👇
drop genuine node-v24.13.0-win-x64. zip
👇
tonajukbhuakpo2.]shop
Samples
https://t.co/7BiTfkUY8d
New short article on a real-world exploitation case rather than pure research, demonstrating how a specific mistake in Next.js can lead to a systematic zero-click SXSS on its latest versions (w/@inzo____):
Re:CACHE - Excessive reflection, type confusion, and 0-click SXSS on Next.js
https://t.co/0JWjH6yzC2
Using Nezha RMM as C2 - No Detection
Earlier we spoke on this issue. RMMs are dangerous when not monitored. Here is an example of Nezha that doesn't trigger any AV alert and works really well if abused by hackers. The victim won't even see anything suspicious when hackers connect to their computer. We also showed the forensic artifacts it might leave.
So, you better monitor them all
Learn more: https://t.co/8np8jXJkF0
RMMs to monitor: https://t.co/CtFNVxjnlM
@three_cube@_aircorridor #blueteam #redteam #apt