VulnerabilitiesrUs

Likes to learn how things tick. I am a security researcher protecting everyone. PC, Console, Android, iOS vulnerability researcher; Professional music producer.

[VulnerabilitiesrUs @TempAccountNull]

Welp, I found out that, this is a HVCI Compatible BYOVD. That's even scarier. This means it will work even on Windows 11. Proof below @0XDbgMan @weezerOSINT @horsicq @thezdi Expect a well throughout POC. CVE Incoming!
https://t.co/gi3Vivt2aB

[VulnerabilitiesrUs @TempAccountNull]

After emulating and finding it with my BYOVD Identifier ToolKit, now I can say It's 100% confirmed! even with a LIVE POC.
- 100% Privilege Escalation / Token Theft
- Port R/W
- Phys R/W
Submitting to ZDI now expect a CVE
@horsicq @0XDbgMan @weezerOSINT

https://t.co/HL9eEBWkyZ

[vx-underground @vxunderground]

Hi

People asked me if I'd setup a Git thingy for researchers because Microsoft keeps banning researchers from GitHub

I do have the infrastructure for it, yes. I'd have to consult with my stinky nerds though because I'm a malware guy, not a give people hosting guy

[VulnerabilitiesrUs @TempAccountNull]

Officially disclosed to the vendor
Timeline
02 June 2026 — Vulnerability first observed during testing 03 June 2026 — Initial validation and report preparation 03 June 2026 — Initial submission to vendor
04 June 2026 — Vendor Starts Triage Awaiting Reply
https://t.co/WnzdMoYGNq

[VulnerabilitiesrUs @TempAccountNull]

Update to my disclosure the vendor replied!

CVE INBOUND! Still have more to report and disclose!

LETS GOOOOOOOOOOOOO

@weezerOSINT @horsicq @0XDbgMan @kernullist

https://t.co/TWfG7uGDUd

[VulnerabilitiesrUs @TempAccountNull]

Update to my disclosure the vendor replied!

CVE INBOUND! Still have more to report and disclose!

LETS GOOOOOOOOOOOOO

@weezerOSINT @horsicq @0XDbgMan @kernullist

https://t.co/TWfG7uGDUd

[VulnerabilitiesrUs @TempAccountNull]

Officially disclosed to the vendor
Timeline
02 June 2026 — Vulnerability first observed during testing
03 June 2026 — Initial validation and report preparation
03 June 2026 — Initial submission to vendor
https://t.co/SKMLWCLPNS
@kernullist @horsicq @0XDbgMan @weezerOSINT @horsicq

[VulnerabilitiesrUs @TempAccountNull]

@CaptainInsightX The data is always still there, it's in a "deleted sector" on the disk, until those sectors are overwritten not before, so you can restore them later with recovery and can really only ever be fully wiped by zeroing the entirety of the disk the slow way or destroying the HDD.

[Caner @xzemit42]

My biggest single-shot bug bounty so far.

It feels great.

[vx-underground @vxunderground]

Oh, and only 32 supply chain attacks

[vx-underground @vxunderground]

Pretty slow couple of days in cybersecurity, only 15 companies hit by ransomware, only 18,000,000 malwares noted in the wild, only three or four North Korean and Russian cyber operations discussed, and only two new Microsoft 0days

[VulnerabilitiesrUs @TempAccountNull]

Because @5mukx had his project ripped from the web, I have made a theme based on RustyPacker just to commemorate his work. Keep fighting man, you didn't deserve your work being shut down due to miscommunication. You've taught me a lot. Shout 🤙
@0XDbgMan @weezerOSINT @horsicq

[tuckner @tuckner]

You might not believe me if I tell you this steals tokens

[VulnerabilitiesrUs @TempAccountNull]

Still working on some cool features for the tool.
- Now you can filter the type you're looking for including if you want unsigned apps/communicators :)

This keeps results consistant on hunches, and an override to find other types.

@0XDbgMan @weezerOSINT @horsicq @kernullist

[impulsive @weezerOSINT]

Gained two CVEs this week.
National Instruments ships on every defense contractor, chip fab, NASA test stand, and national lab in the country. their core kernel driver nipalk.sys is EV signed and valid through 2027. arbitrary physical memory read/write with zero authentication.

CVE-2026-8035. CVE-2026-8036.

[Kevtech IT Support @KevTechSupport]

Always lol 😆

#itsupportspecialist #desktopsupport #desktopsupporttechnician #desktopengineer #servicedesk #servicedeskanalyst #cybersecurity

[iShowCybersecurity @ishowcybersec]

Real question: Where does VLC even get that extra volume from?

[Co11ateral @co11ateral]

Attacking Networks with a BadUSB

Second part of our series on BadUSB-ETH. Here you get to see all the attacks that can take place if somebody plugs in a Raspberry Pi Zero over USB (even if the computer is locked). It acts as a network interface and when removed leaves no traces.

Below you can see the ntlmrelay attack with domain admin creds being used to dump SAM hashes.

This BadUSB has a Wi-Fi module which means you can connect to it remotely from your phone. It also start a web page where you can view information about discovered vulnerabilities by checking logs in real time during the attack.

USB ports are often overlooked even when it comes to critical infra whithin companies. Best thing you can do is using software that will only allow trusted USB devices. Otherwise it can cause a lot of damage.

https://t.co/1gXdU5i8J9

@three_cube @_aircorridor #redteam #blueteam

[Nate @nnwakelam]

waiting for bounty payouts

[cr3ghost @cr3ghost]

This is the type of malware game hackers build to bypass kernel anti-cheat. The same techniques can be used by malware authors to evade EDRs.

A UEFI bootkit that injects into Microsoft's own Hyper-V at ring -1 before the OS even loads (easier than building a custom hypervisor from scratch).

Four phase bootloader. Hypervisor VM-exit interception. EPT page shadowing. MSR virtualization. EFI memory map ghosting. TPM measurement spoofing.

Reads like malware. Because it is. Videos and full technical breakdown in the link.

Author: https://t.co/iHtxyJSbwy

#ReverseEngineering #Malware #AntiCheat

[Alok @analogalok]

i just ran Google's brand new Unsloth Gemma4 12B dense GGUF on my RTX 4060 using llama.cpp + CUDA 13.2

21 tokens per second. on a budget consumer GPU. locally.

no API. no cloud. no subscription.

and the benchmarks are absolutely cooked

# first let's talk architecture because this is genuinely different

every multimodal model you've used has a frozen vision encoder + frozen audio encoder + LLM backbone glued together

Gemma 4 12B is different

it's a single decoder only transformer. that's it. vision? raw 48×48 pixel patches → one matmul → projected directly into the LLM

audio? raw 16kHz signal sliced into 40ms frames → linear projection → same LLM input space

no encoder tax. no latency penalty. no fragmented memory

to put the encoder savings in perspective:

old Gemma 4 26B approach:

- 550M param vision encoder (frozen)
- 300M param audio encoder (frozen)
- LLM backbone

Gemma 4 12B:

- 35M param vision embedder (a single matmul)
- no audio encoder at all
- LLM backbone handles EVERYTHING 550M → 35M for vision alone. that's a 15x reduction

this is why the gemma-4-12b-it-Q4_K_M.gguf is just 6.6 GBs!!!

and it has 256K native context context

# Benchmarks:

AIME 2026 (math olympiad): 77.5%
GPQA Diamond (expert science): 78.8% LiveCodeBench v6 (real code): 72%
Codeforces ELO: 1659
MMLU Pro: 77.2%
MATH-Vision: 79.7%
BigBench Extra Hard: 53%

inference → llama.cpp, LM Studio, vLLM, SGLang

llamacpp flags:

-m "gemma-4-12b-it-Q4_K_M.gguf" -ngl 99 -c 8000 -v --port 8080

Available on huggingface now! Link below

[Unsloth AI @UnslothAI]

@googlegemma Thank you Google Deepmind for constantly releasing open models! 🌟

We made Dynamic GGUFs so you can run Gemma 4 12B more efficiently: https://t.co/8cL321pVDh