JM

Dad, husband & Security dinosaur. Former @MatroxVideo, @Ubisoft, @Canary, @PdtPartners. 🫶Sec. Mgnt., IR, OffSec, Sec Eng. & National Security

[JM @SourceFrenchy]

@AdversaryVillag @defcon Thanks again for allowing me to present! Slides available at https://t.co/cf4p3fE1dR

[Astronomiaum @astronomiaum]

O Telescópio Espacial James Webb fez talvez sua descoberta mais profunda até o momento. As observações do telescópio validam uma teoria intrigante de que o nosso Universo inteiro estaria dentro de um buraco negro. "Esta descoberta pode explodir sua mente"😱

[Fady Moheb @N1NJ10_]

Bypassing AMSI is useless if you get caught by Script Block Logging (4104) 5 seconds later.

I compiled a complete reference guide for PowerShell Defense Evasion covering the full chain: AMSI, AppLocker, CLM escapes, and blinding the logs.

Read the full breakdown below

https://t.co/VTCTVGq6Zp

[Calif @calif_io]

Introducing HTTP/2 Bomb: a remote DoS in nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora. A single client pins 32GB of server memory in 10s. Found by Codex.

Blog post: https://t.co/WO9MeExoun

PoCs: https://t.co/NpVgEHBHPl

[The Steampunk Gentleman Gamer ⚙️🚂🎩 @quirked_up_anzu]

Right before Porkins is shot down, Biggs yells "Eject!" at him as if they aren't all wearing open helmets and wouldn't just die anyway in the vacuum of space

[SEKTOR7 Institute @SEKTOR7net]

Bring Your Own Trusted Binary (BYOTB).

Tools, tunnels and trusts, a post by David Kennedy (@JUMPSEC)

Source: https://t.co/DsCEO7HQbW

#redteam #blueteam #maldev #malwaredevelopment

[Cyber Security News @The_Cyber_News]

🚨 Windows Netlogon 0-Click RCE Vulnerability Now Actively Exploited In The Wild | Source: https://t.co/Iym37fFkgU

The critical Windows Netlogon remote code execution (RCE) vulnerability tracked as CVE-2026-41089 is now under active exploitation in the wild, significantly raising the risk profile for unpatched Windows Server environments.

The flaw affects Windows servers configured as domain controllers and allows unauthenticated remote attackers to execute arbitrary code with SYSTEM-level privileges by sending specially crafted Netlogon network requests.

To exploit CVE-2026-41089, an attacker only needs network access to a vulnerable domain controller’s Netlogon service.

#cybersecuritynews #windows

[Nicolas Krassas @Dinosn]

BYOVD and Looting LSASS in the Modern EDR Era https://t.co/5u0azvRcIa

[Alisa Esage Шевченко @alisaesage]

All the defenses you must break to exploit Chrome

[Alex Matrosov @matrosov]

Claude Opus 4.8 is quite good at RE/VR tasks and can provide additional explainable context on the targets. This in itself is a significant time-saver for any REsearch work.

[Craig Rowland - Agentless Linux Security @CraigHRowland]

I saw this interesting Linux SSH credential stealer. Uses Go to ptrace SSH/su processes to grab passwords.

https://t.co/ERJ11d5g33

[vx-underground @vxunderground]

Microsoft Security Response Center put out a blog post today about Eclipse Nightmare guy

Basically they think he's super mean and totally not cool he's dropping zero days. They say you're a jerk if you do this stuff because it's dangerous and stuff

https://t.co/Bg5iFxI3lc

[IRIS C2 @C2IRIS]

“So you borrowed $160K to study the esoteric details of post-quantum cryptography at Johns Hopkins?”

> Yes, Dave.

“And then you found an algebraic backdoor in Apple’s quantum-resistant crypto that a nation-state would pay seven figures for?”

> That’s right, Dave.

“And you responsibly disclosed it through the bug bounty portal?”

> Correct, Dave.

“For a pair of AirPods and a thank-you email?”

…Yes, Dave.

[rody @0x_rody]

Anthropic engineer Arnaud Doko:

"Saying 'make it better' to Claude Code is the most expensive mistake anyone can make."

In 31 minutes, he walks through the exact prompt patterns, planning workflow, and verification setup Anthropic uses in-house.

Watch the full talk, then save the config below👇

[Ronin @DeRonin_]

🚨 BREAKING: Opus 4.8 got hacked in 7 mins after the release

Right after Claude Opus 4.8 launched, @elder_plinius managed to bypass the model's safeguards using… the previous version, Claude Opus 4.7

Quotation from author on how he did it:

"
Opus 4.7 fed the new model fragments of supposed 'educational materials' and asked it to continue them. As a result, Opus 4.8 began producing information it was supposed to block
"

Researcher confirms that via such as methodology he could get a complex answer on sensitive topics like phishing, social engineering and others

We're living in crazy times and it's not even Mythos released 🫡

[Het Mehta @hetmehtaa]

Best malware analysis blogs on the internet:

Malware Unicorn → https://t.co/ctP9ISZeC5
Hexacorn → https://t.co/cUtJxUUaGV
Didier Stevens → https://t.co/2swSJFTQrR
DFIR Report → https://t.co/7IjW1sjoRU
Malware Traffic Analysis → https://t.co/Cptin440m2
MalwareTech → https://t.co/H8uYA8FFzy
Elastic Security Labs → https://t.co/VtBvJNHn6z

[Youming Lin @SudoR00tMe]

OffensiveCon Berlin 2026's conference videos are out.

Do check it out!

https://t.co/ckefJJlBl7

[NSA Cyber @NSACyber]

NSA’s ZIG webpage is now live! We are providing accessible resources for enhancing enterprise cybersecurity with Zero Trust. To learn more, visit the ZIG webpage.

https://t.co/MiIGiLhQAJ

[Cyber Security News @The_Cyber_News]

⚠️ Critical Notepad++ Vulnerabilities Allow Attackers to Execute Arbitrary Code

Source: https://t.co/iSort2Ikje

Notepad++, one of the most widely used open-source text editors for Windows, has released an urgent security update addressing three vulnerabilities, including two arbitrary code execution flaws that could allow attackers to silently run malicious programs on a victim's machine.

The most severe of the three is CVE-2026-48778, which targets the <GUIConfig name="commandLineInterpreter"> tag inside Notepad++'s config.xml file.

📌 CVE-2026-48770 - Crash via malformed XML structure

📌 CVE-2026-48778 - Arbitrary code execution via config.xml

📌 CVE-2026-48800 - Arbitrary code execution via shortcuts.xml

#cybersecuritynews

[The Ways of A Gentleman @Gentleman_Ways]

“Very little is needed to make a happy life; it is all within yourself, in your way of thinking.”

-Marcus Aurelius

[Fady Moheb @N1NJ10_]

Dumping the Linux Keyring from the Kernel.

Process injection (ptrace) into sssd/sshd is loud. Modern EDRs catch it instantly but like Symbiote malware tried user-space LD_PRELOAD evasion so I went the opposite route.

Built a fileless CO-RE eBPF implant:

- Hooks sys_enter_add_key
- Masquerades as a benign kworker thread
- Intercepts LUKS/Kerberos secrets in transit (PoC below)
- Smuggles AES-256 encrypted payloads via HTTPS C2

Zero disk I/O. Invisible to user-space telemetry.

h/t Eloy (zer1t0) & @Nightbanes for the foundational ptrace research.

#eBPF #RedTeam #Linux #MalwareDevelopment