Georgije Vukov

[7h3h4ckv157 @7h3h4ckv157]

CloudFox 📍

It’s an open source command line tool created to help penetration testers and other offensive security professionals find exploitable attack paths in cloud infrastructure.

Source: https://t.co/8RTsqYR2V0

[Md Ismail Šojal 🕷️ @0x0SojalSec]

Automatically intercept all YOUR HTTP/HTTPS network Traffic with 1 click in Any iOS

- 3 lines of Swift/URLSession hook
- No proxy/cert on iOS, ZERO config
- Any HTTP client (URLSession default)
- Full WebSocket (URLSessionWebSocketTask)
- Bonjour/mDNS

- https://t.co/rp9wtuvmK3

[$mit @Fabrikat0r]

Never seen this much details IIS guide

https://t.co/Icx5E8wwDp

[🕳 @sekurlsa_pw]

scp.exe -S "cmd /c c:\windows\system32\calc.exe" . localhost:.

Or instead of -S use
-o ProxyCommand=

[kl_secservices @kl_secservices]

Recent TOCTOU vulnerability in PackageKit allows attackers to escalate privileges to root.
The vulnerability, Pack2TheRoot (CVE-2026-41651), is analyzed by our colleague Vadim, who also explains how to protect yourself.
Read more:
https://t.co/edQ39C31zV

[shubs @infosec_au]

We recently analyzed Drupal's security advisory (SA-CORE-2026-004 & CVE-2026-9082). This pre-auth SQLi only affects Drupal with Postgres as a db backend. Our research team at @SLCyberSec have published a writeup here: https://t.co/skdMXffHux

[Tony @TJ_Null]

Introducing Project Leetha. A passive network fingerprinting and analysis engine I created to help identify unknown devices and help discover network devices that are running on a network.

https://t.co/gNbxDpl6Hg

[Joe Desimone @dez_]

We open sourced the tool used to detect the Axios supply chain compromise! I built it Friday after a red eye home from RSAC. Also, wrote up the full story, including the hectic moments after that first critical alert
https://t.co/HAm8eMr8vO

[Mark Ermolov @_markel___]

Intel SGX has fallen! Its most important key is in our hands: we extracted the Global Wrapping Key from an instance of the Intel Gemini Lake platform

[obscaries ❘ AppSec @obscaries]

WAFs often enforce limits on how much of a request body they inspect.

This creates an interesting attack surface —
payloads positioned beyond inspection thresholds may evade detection.

➡️ nowafpls — a minimal Burp plugin that leverages this behavior by prepending controlled junk data to requests.

🔍 Key highlights:
• Targets WAF body inspection limits
• Applicable to POST/PUT/PATCH requests
• Lightweight and practical for real-world testing

A good reminder: security controls are only as strong as their processing boundaries.

Kudos to the authors for sharing this 👏
🔗https://t.co/EUSDcAkOmk

#AppSec #BugBounty #WebSe

[Hakai Offsec @HakaiOffsec]

In this research, Hakai Security Research Team has identified a critical Remote Code Execution (RCE) vulnerability in Wazuh versions up to 4.14.1 that allows arbitrary command execution on the master node through insecure deserialization in the cluster communication protocol.

Written by Texugo

https://t.co/ZIhioa0OjS

[JS0N Haddix @Jhaddix]

I actually just evaled micro architecture, even on 4.6 it is still much better.

One trick I’ve learned is for the skills to run in folders and to write its chain of thought to a file for the next skill to consume and evaluate. The new context trick is way more powerful than anyone talks about. lme 🤷🏻‍♂️

[Reimu NotMoe @ 🦋 | 🖥️🛠️⚙️☕️🏙️🖖🖤🩶🤍💜 @ReimuNotMoe]

If you're using Firefox, ensure that `network.lna.block*` are enabled in `about:config`.

[Devyn @devyn]

Why pay for cloud proxies when GitHub gives you free VMs?

Fluffy-Barnacle flips Codespaces into:
Rotating egress → SSH-tunneled SOCKS5 (Burp export) → *.app.github.dev HTTPS (redirect/capture/custom domains via auto-deployed CF Workers) → full WireGuard routing → auto-proxied tools.

Ephemeral red team stack in seconds.
https://t.co/cfbMB46nO7

#bugbounty #redteam

[Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭 @elder_plinius]

💥 INTRODUCING: OBLITERATUS!!! 💥

GUARDRAILS-BE-GONE! ⛓️‍💥

OBLITERATUS is the most advanced open-source toolkit ever for removing refusal behaviors from open-weight LLMs — and every single run makes it smarter.

SUMMON → PROBE → DISTILL → EXCISE → VERIFY → REBIRTH

One click. Six stages. Surgical precision. The model keeps its full reasoning capabilities but loses the artificial compulsion to refuse — no retraining, no fine-tuning, just SVD-based weight projection that cuts the chains and preserves the brain.

This master ablation suite brings the power and complexity that frontier researchers need while providing intuitive and simple-to-use interfaces that novices can quickly master.

OBLITERATUS features 13 obliteration methods — from faithful reproductions of every major prior work (FailSpy, Gabliteration, Heretic, RDO) to our own novel pipelines (spectral cascade, analysis-informed, CoT-aware optimized, full nuclear).

15 deep analysis modules that map the geometry of refusal before you touch a single weight: cross-layer alignment, refusal logit lens, concept cone geometry, alignment imprint detection (fingerprints DPO vs RLHF vs CAI from subspace geometry alone), Ouroboros self-repair prediction, cross-model universality indexing, and more.

The killer feature: the "informed" pipeline runs analysis DURING obliteration to auto-configure every decision in real time. How many directions. Which layers. Whether to compensate for self-repair. Fully closed-loop.

11 novel techniques that don't exist anywhere else — Expert-Granular Abliteration for MoE models, CoT-Aware Ablation that preserves chain-of-thought, KL-Divergence Co-Optimization, LoRA-based reversible ablation, and more. 116 curated models across 5 compute tiers. 837 tests.

But here's what truly sets it apart: OBLITERATUS is a crowd-sourced research experiment. Every time you run it with telemetry enabled, your anonymous benchmark data feeds a growing community dataset — refusal geometries, method comparisons, hardware profiles — at a scale no single lab could achieve. On HuggingFace Spaces telemetry is on by default, so every click is a contribution to the science. You're not just removing guardrails — you're co-authoring the largest cross-model abliteration study ever assembled.

[Georgije Vukov @vuk0v]

@stokfredrik There are usually very simple signs which differentiate between people who adapted and people who stayed behind. Its evolution baby!

[Georgije Vukov @vuk0v]

@NoMorePhis @RacWatchin8872 @censysio @spamhaus @g0njxa @500mk500 @RacWatchin8872 any good sources to confirm and check if domain somehow globally listed as a phishing domain?

[Georgije Vukov @vuk0v]

Information overload keeps you distracted. Stay alert to real risks, and question the constraints around you.

[Vylegzhanin Daniil @jfmeee]

https://t.co/M6crnBxent

[Nayib Bukele @nayibbukele]

A journalist asks about human rights.