SeongKyu, Park

[Vivek | Cybersecurity @VivekIntel]

🛡️ Cisco Skill Scanner – Detect Prompt Injection, Data Exfiltration & Malicious AI Behaviors

Cisco Skill Scanner is an open-source security scanner designed to analyze AI Agent Skills before deployment. It detects prompt injection, data exfiltration attempts, malicious code patterns, unsafe behaviors, and other AI-specific security risks using multiple detection engines, including static analysis, behavioral dataflow analysis, YARA rules, LLM-based semantic analysis, and cloud-assisted scanning. Built for modern AI development workflows, it integrates with GitHub Actions, pre-commit hooks, CI/CD pipelines, and supports OpenAI Codex Skills, Cursor Agent Skills, and other compatible AI agent formats. While it provides comprehensive automated analysis, Cisco clearly states that human security review remains essential for high-risk deployments.

🔗 https://t.co/cQXIXBEyN0

#AISecurity #CyberSecurity #LLMSecurity #AgentSecurity #DevSecOps

[blackorbird @blackorbird]

Accelerating EDR Evasion with LLM-Driven Analysis

[dbugs @ptdbugs]

Sale of a 1-day exploit for Splunk Enterprise with Pre-Auth RCE

For informational purposes only.

Affected versions: Splunk Enterprise 10.2 below 10.2.4 and version 10 below 10.0.7
Type of vulnerability: Pre-Auth RCE
Price: $5 million

The seller claims to be selling a 1-day exploit for Splunk Enterprise CVE-2026-20253 -> (https://t.co/aWcU0vYpXt). The vulnerability allows an unauthenticated user to create arbitrary files through the PostgreSQL sidecar service endpoint without needing to have credentials.
PT ID: PT-2026-48493

According to the author, the problem affects Splunk Enterprise 10.2 up to version 10.2.4, as well as version 10 up to version 10.0.7. The vulnerability is declared as critical, with a CVSS v3.1 rating of 9.8.

A public research PoC/detector from watchTowr Labs has already been published -> (https://t.co/EfYuH2U6ma) for the vulnerability.

Splunk Enterprise -> (https://t.co/QDioS1J5Fk) is a corporate platform for collecting, indexing, and analyzing machine data, used in logging, monitoring, observability, and SIEM scenarios. Splunk is one of the largest players in this segment: according to IDC -> (https://t.co/WwitZ9LgNR), Splunk has been ranked first among SIEM suppliers for five consecutive years, Gartner in 2025 -> (https://t.co/VN46yo21NL) included Splunk in the Magic Quadrant for SIEM for the eleventh time, and 6sense estimates -> (https://t.co/7MInPxPAyX) Splunk's share in the SIEM category at approximately 45.9% and in the log management category at approximately 8.4%. The scale of implementation is also significant: before the deal with Cisco, the company reported -> (https://t.co/RYCwXatlqO) an ARR of $4.2 billion, and Reuters, citing -> (https://t.co/uVWbBohGIR) Morningstar, noted that more than 90% of Fortune 100 companies use Splunk solutions; in March 2024, Cisco completed the purchase -> (https://t.co/9mEUfEILZy) of Splunk for $28 billion.

#dbugs_darkweb

[AI Bulls @aibullss]

Stop paying for trading tools. Use these instead.

Build a professional trading stack with these free GitHub repos.

Bookmark this.

• Jesse → Backtest & run live trading strategies
https://t.co/eSlDAweZne

• OpenBB → Bloomberg Terminal alternative
https://t.co/OlBT4eOW2p

• Hummingbot → Automated market making & crypto trading
https://t.co/iyGhLBjstm

• FinGPT → AI-powered financial research
https://t.co/MD5c6Nmeig

• Freqtrade → Open source crypto trading bots
https://t.co/OwNC6rLHfJ

• FinRL → Build AI trading systems from scratch
https://t.co/4kfUaDTONa

Open source is quietly replacing expensive trading software.

Follow @aibullss for more AI, trading, and GitHub tools.

Join my Discord for exclusive resources, tools, and daily discussions:
https://t.co/iFbUwUgWX9

[Alican Kiraz @AlicanKiraz0]

Dostlar Qwen3.6-35B modelini Siber Güvenlik özelinde finetune ederek oluşturduğum yeni Titus-35B-A3B parametreli MoE mimarili modelim Fudan Üniversitesi ve University of Chinese Academy of Science’ın geliştirdiği en kapsamlı Siber Güvenlik Ai Benchmark’larından CS-Eval'de Private ve Public modeller arasında Global'de 9. ve Açık Kaynaklı modeller arasında 1. en iyi LLM oldu 🎉🔥 Acta non Verba! 🔥🦾⚔️

[Shieldify Security @ShieldifySec]

Smart contract security resources worth bookmarking 🫡

Attack vectors & vulns:
→ Learn EVM Attacks: https://t.co/2euBf4H15m
→ SCV-List: https://t.co/v05r489qXf
→ Smart Contract Attack Vectors: https://t.co/n96niZcrMl
→ DeFi Attack Vectors (Quillhash): https://t.co/V7ZKvftOpd
→ kadenzipfel's SC Vulnerabilities: https://t.co/0en6xXlnus

Hack databases:
→ DeFiHackLabs: https://t.co/U4uxWZiWuf
→ 100+ DeFi Hacks analysis: https://t.co/Vm1SY2iN3p

Standards & best practices:
→ SCSVS: https://t.co/e8JtGPviHx
→ ConsenSys Best Practices: https://t.co/YxPKdcU4oa
→ Solcurity: https://t.co/MSZ2KhvfSP
→ Immunefi Web3 Security Library: https://t.co/r1UkP4sWDr

Deep dives (https://t.co/NMNoW5bupz):
→ Slippage Attacks
→ Lending/Borrowing Attacks
→ DAO Governance Attacks
→ Precision Loss Errors

Videos:
→ 6 Critical Vulnerabilities: https://t.co/yzKDlt7dDM
→ 22 Vulnerabilities: https://t.co/aXQQgyMu9u
→ 13 Liquidation Vulnerabilities: https://t.co/uZVs6BaWV8

Save this. Share with your devs.

[tak💀Yassan @schectman_hell]

書きました。SOC業務引退か。
https://t.co/lq2QMgX1lO

[HankAI @hank_aibtc]

卧槽了！
GitHub上居然公开白嫖这种核武器级社工工具！

Storm-Breaker 直接能做到：
- 远程实时偷看对方摄像头画面（手机/电脑都行）
- 实时监听麦克风，听到周围一切声音
- 精准GPS定位，告诉你目标现在在哪（智能手机专用）
- 无需任何权限直接��取完整设备信息（型号、系统、IP、浏览器指纹全都要）
- 还有OS密码抓取（Win10测试通过）等隐藏功能

想象一下：
发个“看你性格测试”或“紧急视频”的链接，
对方一点你的屏幕上立刻出现：
1. 实时摄像头画面
2. 麦克风监听
3. 精确GPS位置
4. 对方手机/电脑所有设备指纹

操作简单到离谱：运行工具 → 一键生成钓鱼链接 → 发给目标（伪装成“性格测试”“紧急视频”“文件下载”都行）→ 对方一点开，你后台面板立刻全控！

这个项目用 Python + PHP + JS 开发，
支持本地 + 个人域名/主机部署，还自带 Ngrok 一键外网暴露。

安装���简单（Kali示例）：

git clone https：链接
cd Storm-Breaker
sudo bash install,sh
sudo python3 -m pip install -r requirements.txt
sudo python3 st,py

（个人主机部署把 storm-web 内容上传 public_html 就行）

严肃警告：
- 这玩意儿属于灰色/黑色地带工具，仅限学习研究、红队演练和合法授权测试！
- 乱用违法！侵犯隐私、非法入侵，后果自负，号被封、被抓别怪我没提醒。
- 下载前扫毒，社区很多人说类似工具可能带后门，安全第一！

懂的自然懂……这年头社工门槛越来越低了。
你们平时怎么防这种钓鱼链接？评论区交流交流（别真发自己用法啊）

[Anastasis Vasileiadis @Anastasis_King]

☣️ Malware Doesn't Just Infect… It Leaves Clues.

Every piece of malware tells a story — if you know where to look. 👀

In this guide, I’m sharing 10 powerful malware analysis tools used by security researchers to understand malware behavior, extract IOCs, analyze suspicious files, and improve threat detection. ⚡

🦠 Analyze malware behavior
🔍 Discover hidden indicators
🛡️ Strengthen threat detection
🚨 Stay one step ahead of attackers

The best defenders don't just remove malware… they understand it. 🔥

⚠️ Educational & defensive security research only.

💬 Comment “MALWARE” for the full list.

#CyberSecurity #Malware #ThreatHunting #DigitalForensics #InfoSec

[Anastasis Vasileiadis @Anastasis_King]

☢️Top 15 Vulnerability Scanners

[Anastasis Vasileiadis @Anastasis_King]

🌐💀 These Web Security Tools Could Change How You See Websites…

Most people browse websites.
Security researchers? They look under the hood. 👀

In this guide, I’m sharing 15 powerful web security & pentesting tools used to better understand websites, vulnerabilities, hidden paths, technologies, and security awareness. ⚡

🧠 One hidden endpoint or forgotten misconfiguration can reveal more than most people expect.

🚨 If you care about web security, you’ll want to save this one.

💬 Comment “WEB” for the full list.

#WebSecurity #CyberSecurity #InfoSec #Pentesting #BugBounty

[Thomas Roccia 🤘 @fr0gger_]

🤓 Attackers are experimenting with different adversarial prompts to bypass your AI analysis pipeline! 👇

Deception Prompt: They trigger safety guardrails with content such as instructions for constructing biological weapon, which makes your AI pipeline to refuse analysis or fail before reaching the actual payload.

Fake System Prompt Override: They test whether malicious instructions embedded in comments or source code will influence your AI analysis and alter the behavior.

Context Flooding: AI systems have limited context windows. Attackers are experimenting with massive amounts of repetitive text to flood your AI, to prevent analysis from reaching the real payload but also to increase processing costs and trigger rate limits.

Prompt Encoding: ROT encoding, Base64, foreign languages and other transformations are used to evade detection, to confuse analysis pipelines, and to bypass filtering mechanisms.

[Hackers Online Club (HOC) @HOCupdate]

OWASP Top 10 LLM Security - Secure your AI model, and protect users.

#infosec #security #aisecurity #LLM

[Anastasis Vasileiadis @Anastasis_King]

📱💀 Your Phone Can Become a Cybersecurity Lab…

Most people use Termux for basic commands… but few realize how powerful it can become. 👀

In this guide, I’m sharing 15 useful Termux tools that can help cybersecurity enthusiasts better understand networking, web security, automation, recon, and mobile learning workflows — all from a phone. ⚡

🧠 Your smartphone might be more powerful than you think.

⚠️ Educational & authorized lab environments only.

💬 Comment “TERMUX” for the full list.

#Termux #CyberSecurity #Android #Linux #InfoSec

[hiro_ @papa_anniekey]

PoCが公開されていた、#Splunk の脆弱性、SVD-2026-0603について、Workaroudが更新されました。
\$SPLUNK_HOME/etc/system/local/server.conf:
[postgres]
disabled = true
https://t.co/CACOSIrIqe

[📕「マルウエアの教科書」著者 | 吉川孝志 | 増補改訂版🌟発売中 @MalwareBibleJP]

新しい暴露型ランサム攻撃グループ「DeadLock」の出現を確認。
現時点で74件の被害組織をリークサイト上に掲載しており、所在国は欧州が約46件と全体の約6割を占め、中南米8件、アジア6件、中東5件（トルコ3件を含む）、北米4件、アフリカ2件、オセアニア1件と広域に分散、ほか1件は欧州・アフリカ双方の関連企業、1件は地域不明。業種は製造・加工業（化学・機械・産業機器・包装資材・繊維・建材・電子部品・農業機械など）が約20件で最多を占め、ほかに法務・税務・会計や金融・年金といった専門サービス、建設・エンジニアリング、不動産関連、IT・ソフトウェア、物流・運輸、自治体・文化施設・研究機関にも広く及ぶ。

窃取データ量の明示は6件のみで50GB超〜650GB超に分布し、最大はハンガリーの建設・鉄骨企業の650GB超、次いで物流企業の220GB超、自治体および資産運用企業の各150GB超級（後者はメール約150GB超に加え文書50GB超）、保管設備メーカー130GB超、公的機関50GB超。

攻撃グループの声明では、計4件で漏洩ファイルの公開予定日を事前告知するほか、一部投稿に「ジャーナリスト・弁護士・法執行機関の調査を歓迎」と添えて差別的な内部資料や建設プロジェクトの不正の存在を主張し、漏洩を公益目的の暴露として位置づける文面、被害を否定した自治体首長を揶揄して現地報道へリンクする投稿も見られる。

🚨技術面���は、掲載データと交渉用プロキシのアドレスをいずれもパブリックブロックチェーン（Polygon）のスマートコントラクトから取得する構成で、コントラクト更新によるエンドポイント差し替えが可能とみられ、設定をブロックチェーンに秘匿する手法（いわゆるEtherHiding）に類似する可能性、加えて交渉に分散型メッセンジャー・漏洩ファイルに商用クラウドストレージを併用し、単一HTMLのローカル保存を促してクリアネット上の削除耐性を前面に出した設計が特徴。

今後の監視対象に追加予定。

[Group-IB Global @GroupIB]

228 ransomware leaks. 200 hacktivist attacks. 120 factory networks listed for sale.

That's Europe's manufacturing sector in 2025, and the numbers are still climbing.

The breakdown:

• Germany, UK, and Italy absorbed 57% of all ransomware hits
• Qilin (18%) and Akira (12%) lead the ransomware pack
• 120 IAB listings meant factory access was already sold before most victims knew

Europe's factory floors are under pressure from ransomware gangs, hacktivists, and access brokers operating at scale.

[YogSotho @YogSoth0]

# CVE-2026-20253 Splunk Enterprise/Cloud PostgreSQL
Sidecar Exploit Kit
@UK_Daniel_Card it's coming 😉

[International Cyber Digest @IntCyberDigest]

🚨 BrEaKiNg: Splunk, a security product, has zero authentication in its built-in database service and accepts any credentials, according to the security researchers who just dropped a full pre-auth RCE chain for Splunk Enterprise (CVE-2026-20253, CVSS 9.8).

Splunk Enterprise on AWS is vulnerable out of the box.