HARDY Chang

[connect24h @connect24h]

🚨 ペンテスト界に革命きた

「見つけた脆弱性、本当に悪用できるの？」って今まで全部LLMの妄想だったのに…

このツールはMachine Oracleで実際にPoC実行してVERIFIEDバッジ付けるんだよ

False Positive地獄から解放される日が来た

pip install ptai && ptai demo

→ https://t.co/frTyGqCdBT

#Pentest #BugBounty #AI #CyberSecurity #Red

[NetAskari @NetAskari]

A while ago we got our hands on documents from the Xinjiang Police College in Urumqi, concerning the requirements on their Cyberspace Security Laboratory to be build in 2025.

The document was quite detailed on what kind of training the authorities are planning to provide to the upcoming members of the "cyber police" and delivers some interesting insights into the capabilities of the security services.

It holds details on what kind of malware and viruses the training setup should include, remote intelligence gathering ( including OSINT and network traffic analysis of targets and suspects ), learning how to use "living off the land" tooling to conduct offensive as well as defensive tactics.

It also holds references to AI capabilities and the procurement of NVIDIA RTX 4090 ( which were on the entity list at the stage of the release of the document ).

[Clandestine @akaclandestine]

https://t.co/tpPZuIMV7q - Open Source Intelligence Training https://t.co/EP5Nb27Q0t

[obscaries ❘ AppSec @obscaries]

This article on JavaScript analysis for pentesters is a solid walkthrough of:
• endpoint extraction
• hidden routes
• dangerous DOM sinks
• framework-specific attack surfaces
• client-side recon methodology

Worth reading if you're into client-side bug bounty hunting:
https://t.co/4JBnnkbjf3

#bugbounty #websecurity #javascript #infosec #appsec #pentesting

[Tom Dörr @tom_doerr]

Automates dark web OSINT with LLMs

https://t.co/cJLgLWTmSx

[7h3h4ckv157 @7h3h4ckv157]

Open-source LLM red-team lab.
159 transforms, 25 tool surfaces, BYOK gateway. Runs in your browser.

Source: https://t.co/fXNldXdPQO

[Mathew @mittypk]

Old technique, new zero-day

CVE-2026-5426 in KnowledgeDeliver is related to hardcoded machine keys enabling ViewState deserialization attacks. If you're a defender in APJ, but especially Japan, this may be relevant to you:
EN:
https://t.co/DJLspWRWNP
JP:
https://t.co/o7r7WEVsrE

[Tom Dörr @tom_doerr]

Pentesting guide with tools, labs, and certifications

https://t.co/F0BW5YgmCt

[Orange Tsai 🍊 @orange_8361]

And this one is human insight w/ LLM-assisted research. Took about one week to finish everything. The AI really rescued me from a lot of tedious work

— excluding the part where it changed the Domain Admin password, locked me out, and claimed it got RCE 🤦

[Orange Tsai 🍊 @orange_8361]

That's my chain — a full chain w/ logic bugs only! No memory corruption, no AI, and of course no collisions at all 😉

[TrendAI Zero Day Initiative @thezdi]

Confirmed! Orange Tsai (@orange_8361) of DEVCORE Research Team (@d3vc0r3) chained 4 logic bugs to achieve a sandbox escape on Microsoft Edge, earning $175,000 and 17.5 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin

[The Hacker News @TheHackersNews]

🛑 3rd Linux kernel LPE in just ~2 weeks: Fragnesia (CVE-2026-46300) just dropped.

Attackers can now gain root by corrupting the kernel page cache through a flaw in XFRM ESP-in-TCP.

PoC is public. Major distros have already issued advisories.

Details: https://t.co/s8S9XA3sl1

[Raunak Yadush @raunak_yadush]

200+ Hacking / Infosec pdfs

https://t.co/dKGzFC4Bdk

[DeFi狙击手 | Ai🕊️ @bi_9527zx]

韩国网友“戒色”大行动：一次性拉黑1000多个网站，本想清空收藏夹...

结果GitHub上直接变全民宝藏！这波反向安利我服了😂

想研究的兄弟自己冲：

https://t.co/JxcF6Mbl4m

你们别外传自己研究吧！

[Vivek | Cybersecurity @VivekIntel]

🔥 SOC Analyst & Blue Team PDF Collection — From Networking to Threat Detection

(Splunk • Wazuh • MITRE ATT&CK • SIEM • SOC Tools • CCNA • Threat Hunting • Incident Response)

This collection covers practical Blue Team and SOC fundamentals:
• Splunk Queries & Commands
• SOC Analyst Notes & Interview Q/A
• Wazuh Log Analysis
• MITRE ATT&CK Framework
• Threat Intelligence Basics
• SIEM & EDR Concepts
• Ransomware Investigation
• Encryption & Hashing
• Cisco SD-WAN & CCNA Notes
• Open-Source SOC Setup
• Networking Essentials
• Incident Detection & Log Analysis

⚠️ PDFs alone won’t get you a SOC job.
You still need: • Hands-on labs
• Log analysis practice
• Splunk/Wazuh setup
• Windows & Linux fundamentals
• Networking clarity
• Consistent alert investigation practice

📥 Free PDF Collection:
https://t.co/x3PS8qT1NK

#SOCAnalyst #BlueTeam #CyberSecurity #MITREATTACK #SIEM #CCNA #IncidentResponse #threatintel

[Rishi @rxerium]

🚨 Palo Alto has disclosed a zero day: CVE-2026-0300 (CVSS 9.3) - a buffer overflow vulnerability in the Captive Portal service of PAN-OS.

Nuclei template for fingerprinting PAN-OS:
https://t.co/9h3Fihh3Y3

This issue is applicable only to PA-Series and VM-Series firewalls that are configured to use User-ID™ Authentication Portal - Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.

No patches are available yet, only workarounds. Full details and mitigations are in the official advisory.
https://t.co/gtNOVl24fg

[Steven Lim @0x534c]

CVE‑2026‑31431 — Copy‑Paste Root Detection 😂

Ever wondered which of your Linux users are achieving “instant root” status by simply copy‑pasting commands into the terminal and hitting execute?

#Cybersecurity #CopyFail #DumbUserDetection

[Nick G @kallsyms]

🚨 0-day alert! GPT 5.5 has found and exploited a network accessible RCE in Mac OS 9.2.1 🚨

[The Hacker News @TheHackersNews]

🔥 GitHub RCE via single git push!

CVE-2026-3854: Unsanitized push options let attackers run commands on backend servers, bypassing sandboxing (cross-tenant risk).

🔗 Learn how header injection led to full compromise → https://t.co/YzdRbikpau

Patched within hours.

[曾哥 @AabyssZG]

【情报】“Copy Fail”Linux内核提权漏洞🚨🚨🚨
Linux本地提权漏洞（CVE-2026-31431）被公开，通过页面缓存写入实现提权。仅需非特权本地用户账户，无需网络访问、无需内核调试🤠
Github地址：https://t.co/5y6u6V4frs
能在K8s/容器环境中提权：页缓存为宿主机共享，可突破容器边界，危及宿主节点😱