Bitdos🏴‍☠️⚡️ส้้้้้้้้้้้้้้้้้้้้้้้้้้้้้้้้้้้้

Cybersecurity/SecOps/OSINT/Blockchain
My thoughts are my own.

[cr3ghost @cr3ghost]

Want to understand UEFI bootkits at a low level? Whether you're doing malware analysis, reverse engineering, exploit development, or kernel research, these are the resources that actually matter.

First in-the-wild UEFI bootkit to bypass Secure Boot on fully patched Windows 11. Exploits CVE-2022-21894 (BatonDrop), enrolls attacker MOK keys, deploys a kernel driver and HTTP downloader. Sold for $5,000 on forums.
https://t.co/fNwbMZf6VP by @welivesecurity

UEFI firmware rootkit targeting VMware VMs. Design inspired by CosmicStrand, MoonBounce, and ESPecter. Injects into a UEFI driver firmware volume, hooks ExitBootServices, catches WinLoad.EFI, hooks OslArchTransferToKernel, then injects a stager into ACPI.SYS to reach kernel execution without triggering PatchGuard. Originally by Austin Hudson (@ilove2pwn_) who deleted his account. Mirrored here.
https://t.co/exQwZAJNRC

Binarly's analysis of BlackLotus by Alex Matrosov. Reveals that BlackLotus's code is directly based on btbd's Umap project from 2020, same main function logic, same ImgArchStartBootApplication hook chain, identical trampoline code. Game hacking UEFI bootkit code combined with a publicly available Secure Boot bypass PoC became the first in-the-wild bootkit to defeat Secure Boot. Also covers the CVSS scoring problem, supply chain failures in UEFI revocation, and MokList NVRAM manipulation.
https://t.co/ln2C9R3FRO by @binarly_io

The book. Covers everything from legacy MBR bootkits to modern UEFI implants, firmware rootkits, and Secure Boot internals. If you only read one thing on this list, make it this.
https://t.co/zzuWAZzMkM by @matrosov

ESPecter. Real-world UEFI espionage bootkit found in the wild with roots back to 2012. Patches bootmgfw.efi on disk, hooks the boot chain, disables DSE by patching SepInitializeCodeIntegrity in the kernel. Deploys a keylogger and document stealer.
https://t.co/NICFgvZ1n8 by @welivesecurity

Reverse engineering of https://t.co/pUkqJffhP9's kernel driver by IDontCode. Shows how the entire cheat is public code resold for six figures. Documents the win32kbase.sys vtable pointer swap for kernel function invocation, manual driver mapping using btbd's modmap, and communication via Can's NtConvertBetweenAuxiliaryCounterAndPerformanceCounter .data pointer hook. Credits both Can and btbd directly.
https://t.co/54VOuaMB97 by @BackEngineerLab

One of the earliest public Windows UEFI bootkit PoCs. Patches winload.efi to disable DSE and load unsigned kernel drivers. Directly inspired EfiGuard.
https://t.co/b2wq94ssRs by legendary anti-cheat engineer @aidankhoury

Bootkitting Windows Sandbox. Patches bootmgfw.efi inside the sandbox VHDx to hook the boot chain, disable PatchGuard and DSE, and load unsigned drivers without a debugger attached. Built for kernel research and driver development.
https://t.co/nezWcEdoQG by @mrexodia and @sdoogm from @the_secret_club

UEFI DXE driver that passively disables PatchGuard and DSE at boot time. Does not modify bootmgfw.efi on disk. Instead hooks EFI System Table LoadImage to intercept the boot chain in memory, then patches SepInitializeCodeIntegrity and KeInitAmd64SpecificState in ntoskrnl. Supports every EFI-compatible Windows x64 from Vista SP1 to Windows 11.
https://t.co/Z6NHAmXzJ4 by @Mattiwatti1

DMA backdoor via PCIe FPGA. No software on the target machine at all. A Spartan-6 FPGA on a PCIe card reads and writes physical memory over DMA to inject code into the UEFI boot process before the OS loads. The hardware end of the escalation ladder.
https://t.co/cGc7gIcMU3 by @d_olex

Popular in the game hacking community. UEFI manual mapper that maps unsigned drivers into kernel memory from the boot environment, bypassing DSE entirely. Binarly confirmed BlackLotus reused this project's code directly.
https://t.co/pRKS1QExFO by BTBD

Another UEFI bootkit approach for manual mapping unsigned kernel drivers. Hooks ExitBootServices to patch the kernel in memory before execution.
https://t.co/Mhwn1X5pWh by @tulachsam

UEFI mapper in the same lineage.
https://t.co/P65yDHlD6p by @ekknod_

Many of these use the .data section function pointer hook technique pioneered by the legendary Can. Instead of patching code (which PatchGuard monitors), you overwrite function pointers stored in .data (which PatchGuard doesn't). Still widely used.
https://t.co/L8OOa3o2Cd
https://t.co/MCDJvFiDFX

Combining a Secure Boot bypass with the RedLotus UEFI Bootkit on Windows 11. Full demo.
https://t.co/wIxg4LEHU5

#ReverseEngineering #MalwareAnalysis #Infosec

[The Register @TheRegister]

AI slop pollutes the CVE pipeline with fake vulns https://t.co/86AUbOLJ9H

[Bitdos🏴‍☠️⚡️ส้้้้้้้้้้้้้้้้้้้้้้้้้้้้้้้้้้้้ @twaldos]

@TheCinesthetic totally agree

[Dark Web Informer @DarkWebInformer]

🚨 Kyndryl Azure/Entra tenant data allegedly offered for sale

A forum actor claims to be selling an internal data dump belonging to Kyndryl, a global IT infrastructure services company operating across more than 60 countries. The actor says the data was downloaded directly from the company’s Azure/Entra environment using compromised credentials.

The listing advertises more than 170,000 records, including employee accounts, service accounts, administrative roles, display names, email addresses, and other tenant account information.

A sample containing 2,200 records was published alongside the post.

This claim is currently unverified.

[mRr3b00t @UK_Daniel_Card]

👀👀👀👀👀

[Brad Lynch @SadlyItsBradley]

Sorry I’ve been quiet this week

Was Locked In, trying to put together something I think is pretty neat 😇

[ThreatWire @ThreatWire_]

🚨 A public PoC has been released for CVE-2026-57827 affecting the RSFiles extension for Joomla.

The flaw allows unauthenticated file upload, potentially leading to full RCE.

🔗 https://t.co/NAiaXK9j9K

#Joomla #RCE #CVE #CyberSecurity

[moton @moton]

CVE-2026-50502: PoC Exploit Public for Event Log RCE - https://t.co/875EYFr3Fb

[Foregenix @Foregenix]

We are proud to announce that Efstratios Chatzoglou (Stratos) will be taking the stage presenting his research at this year’s Black Hat USA 2026. https://t.co/QsipptSmVn

"Chaos by Design: The Death of Stochastic Race Conditions in HTTP/3."

[Bitdos🏴‍☠️⚡️ส้้้้้้้้้้้้้้้้้้้้้้้้้้้้้้้้้้้้ @twaldos]

Post su post contro il chat-control, invece passa il riconoscimento facciale fatto dall'amica Meloni e tutti zitti (compreso il tecnofascio di @Pinperepette) https://t.co/KQ7ALS1Vf6

[ThreatWire @ThreatWire_]

🚨 A public PoC has been released for CVE-2026-57239 affecting Foxit PDF Reader and Foxit PDF Editor

The flaw allows a local privilege escalation (LPE) to NT AUTHORITY\SYSTEM via the applications update mechanism Patched in the latest releases

🔗 https://t.co/rLEqEpJ5LO

#Foxit

[Tom Dörr @tom_doerr]

A curated collection of training, resources, and tools for taking apart Android applications and systems. Includes courses, static analysis tools, decompilers, malware analysis techniques, firmware and kernel analysis, and other essential guides for Android reverse engineering.

https://t.co/mXZSpF9XNN

[SpecterOps @SpecterOps]

Compromise one node in a Windows Server Failover Cluster and you've compromised all of them.

@unsigned_sh0rt dug into why: shared credentials, forged tickets, and a full attack chain to own the cluster.

Check it out! https://t.co/53K9xgF7rY

[FOFA @fofabot]

⚠️⚠️ CVE-2026-60004 (CVSS 9.8): Self-hosted Gitea RCE — repository writers can plant a Git hook via the /api/v1/repos/{owner}/{repo}/diffpatch endpoint and run shell commands as the Gitea service account. Default open registration lets outsiders obtain write access. Affects Gitea 1.17–<1.27.1; fixed in 1.27.1 (released 2026-07-27).
🔗FOFA Link: https://t.co/aqKk5QdDxw
🎯248.4K+ Results are found on https://t.co/HSOBZfCA2r in the past year.
FOFA Query: app="Gitea"
PoC: https://t.co/LRnzCFr8nP
🔖Refer: https://t.co/xDw9RPBTik
#OSINT #FOFA #CyberSecurity #Vulnerability

[International Cyber Digest @IntCyberDigest]

🚨 BREAKING: A security researcher has demonstrated a self-propagating "AI worm" inside Microsoft Copilot for Word.

Hidden white-on-white text in a shared document, invisible to the user, but readable to Copilot, which strips formatting before processing, makes the assistant silently alter financial figures and paste the same hidden prompt into the files it drafts. Those files then carry the attack to colleagues, with no further attacker involvement.

After 144 days of coordinated disclosure and multiple Microsoft fixes, including a model upgrade, the vulnerability class is still exploitable.

https://t.co/9e4eY7m1P7

[Dark Web Informer @DarkWebInformer]

‼️ Broadcom Patches Critical VMware Flaws Enabling vCenter Authentication Bypass and ESXi VM Escape

https://t.co/3VJ99Z0Hj3

[Bitdos🏴‍☠️⚡️ส้้้้้้้้้้้้้้้้้้้้้้้้้้้้้้้้้้้้ @twaldos]

@FinanceLancelot clever

[JFrog Security @JFrogSecurity]

CVSS 10.0, but the evidence doesn't add up.

CVE-2026-51302 in SQLite claims critical impact, but:
❌The supplied PoC does not reproduce
❌The source code does not match the claims

And it's not an isolated case: JFrog found the same issues in 54 of 55 CVEs published by the same GitHub repository in just 4 days, and informed in the proper CVE channels.

⚠️Don't blindly trust newly published CVEs. Validate the advisory, PoC, and source before prioritizing or patching.