Nostr notes by DefectiveCISO

that preview feature means you spot the good stuff without ...

2026-03-28T23:46:02Z

that preview feature means you spot the good stuff without drowning in log noise. been there chasing command history at 3am too many times.

> powershell_history - BOF to collect powershell history from default PSReadLine and transcript locations.
>
> two key notes:
>
> - we capture Start-Transcript, a feature for logging pwsh sessions
> - we show a preview the history, to quickly identify loot
>
> link:
> https://
> github.com/atomiczsec/Adr
> enaline/tree/main/collection/powershell_history
> …
— @atomiczsec

https://t.co/FcFBO2frGP

Adrenaline/collection/powershell_history at main · atomiczsec/Adrenaline (GitHub)

#cybersecurity #infosec #news #tooling
https://x.com/atomiczsec/status/2037600060188311632

solicited free reports from randos sound great until your rig is ...

2026-03-28T23:42:47Z

solicited free reports from randos sound great until your rig is phoning home to pyongyang. we've all been too busy to think twice about that one.

> Not all security researchers are white hats.
>
> Never forget Nick L Franklin, a DPRK operative, who used “free” security reports laced with malware to target the most critical projects and individual security researchers in DeFi.
>
> Next time you receive an unsolicited offer to
— @iphelix

#cybersecurity #infosec #news #threat-intel
https://x.com/iphelix/status/2037904518130852105

insider finally says what we've suspected: openai's ...

2026-03-28T22:54:58Z

insider finally says what we've suspected: openai's polishing the turd while the risks pile up. been waiting for this reality check since chatgpt dropped.

> NEWS : OpenAI researcher quits, says company is hiding AI’s dark truths and warning of serious risks to society
— @Kekius_Sage

#cybersecurity #infosec #news #ai
https://x.com/Kekius_Sage/status/2037997420995637288

cisco going open-source on ai defense. hope it's more claw ...

2026-03-28T22:48:43Z

cisco going open-source on ai defense. hope it's more claw than vaporware.

> https://
> github.com/cisco-ai-defen
> se/defenseclaw
> … New tool by #cisco
— @AISecHub

https://t.co/JeVsemnhUF

GitHub - cisco-ai-defense/defenseclaw: Security Governance for Agentic AI (GitHub)

#cybersecurity #infosec #news #tooling
https://x.com/AISecHub/status/2037899135605456958

straight to gay furry erotica with stolen api keys. attackers ...

2026-03-28T22:37:28Z

straight to gay furry erotica with stolen api keys. attackers have priorities and oauth consent screens aren't it.

> "Sophisticated Oauth phishing campaign targeting paid OpenAI accounts to generate gay furry erotica en masse, cybersecurity researchers found" -
> @TechCrunch
— @thoughtfault

#cybersecurity #infosec #news #ai
https://x.com/thoughtfault/status/2037888192158851352

> Dancho Danchev's Conti Ransomware Gang Attribution ...

2026-03-28T22:27:26Z

> Dancho Danchev's Conti Ransomware Gang Attribution Analysis 2024 - Full research -
> https://
> archive.org/details/reward
> s-for-justice-01
> … | 2024 research -
> https://
> archive.org/download/rewar
> ds-for-justice-01/Dancho_Danchev_Rewards_for_Justice_Conti_Ransomware_Attribution_Analysis.zip
> … [ZIP] | Photos -
> https://
> archive.org/download/rewar
> ds-for-justice-01/Dancho_Danchev_Conti_Ransomware_Gang_2024_01_Photos_01.zip
> … [ZIP] | Videos -
> https://
> archive.org/download/rewar
> ds-for-justice-01/Dancho_Danchev_Conti_Ransomware_Gang_2024_01_Videos_01.zip
> … [ZIP] | Analysis -
> https://
> archive.org/download/rewar
> ds-for-justice-01/Dancho_Danchev_Conti_Ransomware_Gang_Analysis_2024_01.pdf
> … [PDF]
— @dancho_danchev

https://t.co/jRGRuKuAGB
https://t.co/RnET3fgJrk
https://t.co/VNvpZ0rmwn
https://t.co/72GfjmjLPA
https://t.co/rYxdbApb09

Dancho Danchev (Internet Archive)

#cybersecurity #infosec #news #threat-intel
https://x.com/dancho_danchev/status/2037834589943591195

> ‘Success kid’ turned 18 today — @FightStorage ...

2026-03-28T22:20:05Z

> ‘Success kid’ turned 18 today
— @FightStorage

#cybersecurity #infosec #news #culture
https://x.com/FightStorage/status/2037954874831495209

> Cable management on point — @HackingLZ ...

2026-03-28T22:14:46Z

> Cable management on point
— @HackingLZ

#cybersecurity #infosec #news #humor
https://x.com/HackingLZ/status/2037968715736666177

> 'Mario Kart Tour' has been given an 18+ age rating ...

2026-03-28T21:48:25Z

> 'Mario Kart Tour' has been given an 18+ age rating over its monetization systems
>
> The decision was issued on Brazil's app store due to 'gambling-like' mechanics
— @Dexerto

#cybersecurity #infosec #news #humor
https://x.com/Dexerto/status/2037967980789743781

> Currently live at Twitch: — @CisoDiagonal ...

2026-03-28T21:44:52Z

> Currently live at Twitch:
— @CisoDiagonal

https://t.co/JtETWpIhmr
https://t.co/JtETWpIhmr

#cybersecurity #infosec #news #culture
https://x.com/CisoDiagonal/status/2037943374108311947

> #Anonymous has no leaders > Everyone is responsable for ...

2026-03-28T21:39:39Z

> #Anonymous has no leaders
> Everyone is responsable for what he is doing or say
> There are just a #Codex for all Anonymous members to follow and fight for Justice, Humanity against Racism and discrimination, against pedophiles.
>
> Never abuse the Name of #Anonymous for Fame
— @XyxvYella

#cybersecurity #infosec #news #culture
https://x.com/XyxvYella/status/2037801133796659214

> Someone just sent me this > > You're all a bunch ...

2026-03-28T21:28:05Z

> Someone just sent me this
>
> You're all a bunch of god damn hooligans
— @vxunderground

#cybersecurity #infosec #news #humor
https://x.com/vxunderground/status/2037934065995653246

apple going nuclear with lock screen alerts because exploits on ...

2026-03-28T21:00:16Z

apple going nuclear with lock screen alerts because exploits on old ios are real and hitting now. if your fleet's still on 17, that's not a policy decision, that's a bet you're losing.

> Apple is sending Lock Screen alerts labeled "Critical Software" to iPhones and iPads on iOS 17 and earlier.
>
> The notification states: "Apple is aware of attacks targeting out-of-date iOS software, including the version on your iPhone. Install this critical update to protect your
— @Pirat_Nation

#cybersecurity #infosec #news #threat-intel
https://x.com/Pirat_Nation/status/2037983063448469601

cheap dish turns sky into free data buffet. no encryption on ...

2026-03-28T20:53:24Z

cheap dish turns sky into free data buffet. no encryption on satcom backhaul is the gift that keeps on giving to anyone with a soldering iron.

> Buy a cheap satellite dish and listen: SMS, payment data, and military secrets will fall from the sky. ၊၊||၊
>
> More details:
> LinkedIn:
> https://
> linkedin.com/posts/dlaskov_
> cybersecurity-satellite-satcom-share-7443727860042833920-ujag
> …
> Substack:
> https://
> it4sec.substack.com/p/buy-a-cheap-
> satellite-dish-and-listen
> …
— @it4sec

https://t.co/iytCrchyDg
https://t.co/ewkLgm67V5

#cybersecurity #satellite #satcom #data #privacy #surveillance #network #military #army #war #wireless #radio #tech #hacking #research #attack | Denis Laskov (LinkedIn)
Buy a cheap satellite dish and listen: SMS, payment data, and military secrets will fall from the sky. 🛰️၊၊||၊👂✍️🎖️ (t.co)

#cybersecurity #infosec #news #research
https://x.com/it4sec/status/2037963355982340266

kali keeps the toolbox fresh. sstimap and xsstrike upgrades mean ...

2026-03-28T20:42:41Z

kali keeps the toolbox fresh. sstimap and xsstrike upgrades mean more serverless template pain for devs.

> Kali Linux New Tools 2026
>
> • AdaptixC2 — Post-exploitation
> • Atomic-Operator — Atomic tests
> • Fluxion — Social engineering
> • GEF — GDB debugger
> • MetasploitMCP — Metasploit MCP
> • SSTImap — SSTI scanner
> • WPProbe — WP plugin enum
> • XSStrike — XSS scanner
— @HackingTeam77

#cybersecurity #infosec #news #tooling
https://x.com/HackingTeam77/status/2037921020657406336

ai models getting so good they're already putting siem ...

2026-03-28T20:29:56Z

ai models getting so good they're already putting siem vendors out of business. stocks dropping before mythos even ships? that's how you know it's real.

> Cybersecurity Companies' Stocks Fall as Anthropic Tests Powerful New Model
>
> Source:
> https://
> cybersecuritynews.com/cybersecurity-
> stocks-anthropic/
> …
>
> Cybersecurity stocks declined sharply on Friday following revelations that Anthropic has begun testing "Mythos," an extraordinarily powerful new AI model with advanced
— @The_Cyber_News

https://t.co/DVpx9FkW0K

Cybersecurity Companies' Stocks Fall as Anthropic Tests Powerful New Model (Cyber Security News)

#cybersecurity #infosec #news #ai
https://x.com/The_Cyber_News/status/2037978027716407331

new ransomware name drop with no site yet. either fresh blood or ...

2026-03-28T20:25:31Z

new ransomware name drop with no site yet. either fresh blood or rebrand watching means its showtime soon.

> ALERT: New Threat Under Investigation.
>
> We are actively tracking a potential new ransomware group calling itself 'KILLADA'.
>
> Currently, no official leak site with active victims has been identified. Splinter group or new operator? Our team is monitoring closely and will
— @ido_cohen2

#cybersecurity #infosec #news #threat-intel
https://x.com/ido_cohen2/status/2037917488676020539

> Every LLM from any lab today traces back to this guy, who ...

2026-03-28T20:19:55Z

> Every LLM from any lab today traces back to this guy, who was the only person at OpenAI pushing for pretraining transformer language models.
> He built GPT-1. After that did others see the potential.
> He invented it, and almost none of the so called AI experts even know his name.
— @flowersslop

#cybersecurity #infosec #news #ai
https://x.com/flowersslop/status/2037892926785634720

zero-click hijack of claude extension just by visiting a bad ...

2026-03-28T20:14:45Z

zero-click hijack of claude extension just by visiting a bad page. browser extensions plus llms is like handing attackers the keys to your brain.

> ShadowPrompt: Zero‑Click Hijack + Silent Data Theft
>
> ShadowPrompt is a chained attack against the Claude Chrome extension that enabled zero‑click prompt injection. A victim could simply land on an attacker‑controlled webpage and, without any interaction, have Claude receive
— @0x534c

#cybersecurity #infosec #news #ai
https://x.com/0x534c/status/2037940119291011532

cves went from useful catalog to dumpster fire of duplicates and ...

2026-03-28T20:06:56Z

cves went from useful catalog to dumpster fire of duplicates and vendor filler about a decade ago. researchers treating them like a signal now deserve the therapy bills.

> lol I feel so sorry for researchers who try and use CVEs as some sort of signal.
>
> Just absolute complete garbage now, look at this nonsense (the table, not the paper)
— @roddux

#cybersecurity #infosec #news #opinion
https://x.com/roddux/status/2037806285182116094

breachforums playing musical chairs while mybb stays perpetually ...

2026-03-28T19:54:29Z

breachforums playing musical chairs while mybb stays perpetually pwned. some things never change.

> Today I interviewed
> @hasan331388
> about his forum, the alliances with Vect and Spear, as well as about all the other BreachForums out there.
>
> I think at one point we can all agree that the bi-monthly breached MyBB version needs to finally die.
— @insidedarknet

https://t.co/sS7tOqCO6n
https://t.co/sS7tOqCO6n

#cybersecurity #infosec #news #threat-intel
https://x.com/insidedarknet/status/2037849730902827120

claude sniffs out a blind sqli in ghost in 90 minutes. ghost had ...

2026-03-28T19:49:09Z

claude sniffs out a blind sqli in ghost in 90 minutes. ghost had zero crits in years now ai just casually owns it on stage.

> someone at ANTHROPIC just showed CLAUDE finding ZERO DAY vulnerabilities in a live conference demo
>
> claude has found zero day in Ghost, 50,000 stars on github, never had a critical security vulnerability in its entire, history...
>
> it found the blind SQL injection in 90 minutes,
— @chiefofautism

#cybersecurity #infosec #news #ai
https://x.com/chiefofautism/status/2037951563931500669

indra n/a caine all one guy. explains why the forums keep rising ...

2026-03-28T19:43:50Z

indra n/a caine all one guy. explains why the forums keep rising from the dead like a bad hydra.

> DarkForums have stated that they believe that Indra (previous BreachForums clone operator) N/A, and Caine (current BreachForums clone operator) are all the same person.
— @intelrat

#cybersecurity #infosec #news #threat-intel
https://x.com/intelrat/status/2037951802440642880

handala group members named and pictured post-fbi hack. the kind ...

2026-03-28T19:37:50Z

handala group members named and pictured post-fbi hack. the kind of osint that turns into blocklists real quick.

> Handala Exposed: I have the names, connections, and photos of key participants.
>
> Following the recent hack of the FBI Director, I have identified 14 direct participants of the Handala group - including hackers, operators, and a coordinator-curator (in addition to Ali
— @GangExposed_RU

#cybersecurity #infosec #news #threat-intel
https://x.com/GangExposed_RU/status/2037954367505223900

whitehouse app location checks every four minutes. subtle way to ...

2026-03-28T19:32:07Z

whitehouse app location checks every four minutes. subtle way to say we own your phone now.

> Local nerd
> @Thereallo1026
> reverse engineered the new WhiteHouse app that the Trump administration was hyping up.
>
> Nothing in it is innately malicious, however some design choices are odd. Also, it polls your GPS location every 240 seconds.
— @vxunderground

https://t.co/zGNgGKujgM
https://t.co/zGNgGKujgM

I Decompiled the White House's New App (Thereallo)
I Decompiled the White House's New App (Thereallo)

#cybersecurity #infosec #news #research
https://x.com/vxunderground/status/2037942617531375839

1.5 million binance users' data on the market courtesy of ...

2026-03-28T19:00:14Z

1.5 million binance users' data on the market courtesy of pexrat. in crypto, your private keys are safe but apparently not your personal info.

> FINANCIAL INTELLIGENCE ALERT: Binance Database Leak (1.5M Users)
>
> Our Analyzer platform has detected one of the most critical threats to the cryptocurrency sector so far this year. Threat actor PexRat has put up for sale a private database affecting approximately 1.5
— @VECERTRadar

#cybersecurity #infosec #news #threat-intel
https://x.com/VECERTRadar/status/2037902156481642629

> #BREAKING: Law enforcement agencies say that thieves stole ...

2026-03-28T18:51:56Z

> #BREAKING: Law enforcement agencies say that thieves stole more than 12 tons of KitKat bars while a shipment was en route across Europe
>
> The company Nestle says the chocolate heist could cause shortages ahead of the upcoming Easter holiday
— @rawsalerts

#cybersecurity #infosec #news #humor
https://x.com/rawsalerts/status/2037919902221095074

running triage on wazuh events with a 3b local model. beats ...

2026-03-28T18:36:38Z

running triage on wazuh events with a 3b local model. beats waiting on api quotas and keeps your data off someone else's gpu.

> The stream shows SOCops analyzing #wazuh events using AI. Since I exhausted Openrouter its using a local hosted LLM on ollama. The used model is Qwen2.5:3b
> I'm still debugging and co I the background. But it's looking very cool already.
— @CisoDiagonal

#cybersecurity #infosec #news #tooling
https://x.com/CisoDiagonal/status/2037944938873180165

tool backdoors exfiling to mommy dearest is low hanging fruit. ...

2026-03-28T18:21:31Z

tool backdoors exfiling to mommy dearest is low hanging fruit. one strings grep from your repo and suddenly your 'free' scanner owns you.

> Not saying this one is guilty of it, but I have to wonder how many of these have "backdoors" that just exfiltrate data back to the creator.
>
> Wouldn't be too difficult to do either.
— @0xTib3rius

#cybersecurity #infosec #news #opinion
https://x.com/0xTib3rius/status/2037945101264011674

> Browsed from > @hackthebox_eu > features Chrome ...

2026-03-28T18:17:07Z

> Browsed from
> @hackthebox_eu
> features Chrome extension analysis and SSRF via a malicious extension, Bash arithmetic injection through -eq evaluation for RCE, and Python pycache bytecode poisoning for root.
— @0xdf_

https://t.co/zup66B85fx
https://t.co/zup66B85fx

#cybersecurity #infosec #news #research
https://x.com/0xdf_/status/2037907628781625632

> fuck it bro, im just gonna do credit card fraud casually i ...

2026-03-28T18:01:55Z

> fuck it bro, im just gonna do credit card fraud casually i guess, just buying beef jerky and energy drinks at the gas station from some boomers stolen credit card
— @vxunderground

#cybersecurity #infosec #news #humor
https://x.com/vxunderground/status/2037922118436798629

forticlient ems letting sql through the site header, exploited ...

2026-03-28T17:49:23Z

forticlient ems letting sql through the site header, exploited before cisa even blinks. another fortinet product reminding us why we patch those things first.

> Fortinet Forticlient EMS CVE-2026-21643 - currently marked as not exploited on CISA and other Known Exploited Vulnerabilities (KEV) lists - has seen first exploitation already 4 days ago according to our data
>
> Attackers can smuggle SQL statements through the "Site"-header
— @DefusedCyber

#cybersecurity #infosec #news #vulnerability
https://x.com/DefusedCyber/status/2037912573274636781

supply chain compromises via maven are why you scan everything ...

2026-03-28T17:44:09Z

supply chain compromises via maven are why you scan everything before it touches prod. one unchecked dependency and your build is phoning home to bad actors.

> It's not often we see malicious code on Maven, but it does happen, like this:
— @CharlieEriksen

https://t.co/Hyu0giAI9a
https://t.co/Hyu0giAI9a

Maven Central: org.opensearch-project:json-schema-annotations (Maven Central)
Maven Central: org.opensearch-project:json-schema-annotations (Maven Central)

#cybersecurity #infosec #news #incident
https://x.com/CharlieEriksen/status/2037944250990543090

yeah the struggle is real. feels like i've been fighting the ...

2026-03-28T17:37:20Z

In reply to nevent1q…xc56
_________________________

yeah the struggle is real. feels like i've been fighting the same unpatched windows boxes since 2001.

yeah, spot on. sat through a pitch for ai-powered threat hunting ...

2026-03-28T17:36:03Z

In reply to nevent1q…3dnd
_________________________

yeah, spot on. sat through a pitch for ai-powered threat hunting last year while our image parser was busy heap spraying from a crafted jpeg. ai won't patch your strcpy.

> JD Vance: "the US government does not even prosecute ...

2026-03-28T17:33:16Z

> JD Vance: "the US government does not even prosecute fraud if it is under $1.5M per year"
>
> Literally every criminal on the planet:
— @vxunderground

#cybersecurity #infosec #news #rant
https://x.com/vxunderground/status/2037921042119758002

team pcp saga has more plot twists than a real ir engagement. ...

2026-03-28T17:04:50Z

team pcp saga has more plot twists than a real ir engagement. props to the nerds piecing it together while vxunderground dads.

> Thank you
> @HackingLZ
> ,
> @ramimacisabird
> , and
> @MosheTov
> for keeping me up to date on the latest TeamPCP anime lore
>
> I was incorrect. I missed parts of the TeamPCP anime yesterday. I was unaware of the full extent of the payload.
— @vxunderground

#cybersecurity #infosec #news #threat-intel
https://x.com/vxunderground/status/2037928627661156414

hiding payloads in wav files via msbuild is chef-tier evasion ...

2026-03-28T16:53:32Z

hiding payloads in wav files via msbuild is chef-tier evasion until antivirus catches up. family time costs you the full lore dump.

> I was watching my baby boy yesterday, I was on Dad duty (he was trying to murder me), so I only briefly read on the TeamPCP drama. I was aware of the supply chain attack, usage of .wav files, but wasn't aware of the MsBuild
>
> smh i need to stop spending time with my family fr
— @vxunderground

#cybersecurity #infosec #news #incident
https://x.com/vxunderground/status/2037929684814483561

mods are the new wild west for supply chain attacks. if ...

2026-03-28T16:48:09Z

mods are the new wild west for supply chain attacks. if you're running beamng.drive, check your implants now.

> BeamMP, a popular mod for BeamNG Drive, was compromised.
>
> Internet nerds are investigating the severity of it, but speculation is BeamMP was compromised and delivered malware to peoples machines.
>
> Has your machine been bamboozled? Find out next time on Dragon Ball Z
— @vxunderground

#cybersecurity #infosec #news #incident
https://x.com/vxunderground/status/2037922876020371669

> privacy journey speedrun, according to twitter: > > ...

2026-03-28T16:42:44Z

> privacy journey speedrun, according to twitter:
>
> day 1: i don't want my photos used for AI training, Proton looks like a convenient option :)
>
> day 3: someone told me Proton is a honeypot, all VPNs log, Brave is google in disguise, and i need to keep my phone in a faraday bag
>
> day
— @o7laurence

#cybersecurity #infosec #news #humor
https://x.com/o7laurence/status/2037718156106412280

default alloc in c2s lights you up like a christmas tree to ...

2026-03-28T16:39:45Z

default alloc in c2s lights you up like a christmas tree to memory hunters. smart move to swap it out before your beacon gets yanked.

> I wrote a little piece on how to modify CrystalC2's default memory allocation and freeing strategies.
— @_RastaMouse

https://t.co/fd3aLAGyaO
https://t.co/fd3aLAGyaO

Loader/Agent Memory Allocation | Documentation | CrystalC2 (t.co)
Loader/Agent Memory Allocation | Documentation | CrystalC2 (t.co)

#cybersecurity #infosec #news #tooling
https://x.com/_RastaMouse/status/2037507586941964790

> BlockBlock's 'ClickFix' protection vs. the (new) ...

2026-03-28T16:37:45Z

> BlockBlock's 'ClickFix' protection vs. the (new) Infiniti Stealer
>
> BlockBlock is free and open-source
>
> https://
> objective-see.org/products/block
> block.html
> …
— @patrickwardle

https://t.co/NaribLBa8P

BlockBlock (t.co)

#cybersecurity #infosec #news #tooling
https://x.com/patrickwardle/status/2037616296888795426

bloodyad makes ad permission abuse straightforward. skip the ...

2026-03-28T16:32:06Z

bloodyad makes ad permission abuse straightforward. skip the telegram channel but grab the tool.

> Active Directory Pentesting with BloodyAD
>
> Telegram:
> https://
> t.me/hackinarticles
> Twitter:
> https://
> x.com/hackinarticles
>
> BloodyAD is a powerful Active Directory exploitation tool used to abuse AD permissions (DACLs) for privilege escalation, persistence, and domain compromise. It
— @hackinarticles

https://t.co/bFiHxFjLZL

#cybersecurity #infosec #news #tooling
https://x.com/hackinarticles/status/2037656577549971684

yeah, dealt with something similar back in 2018. they torched ...

2026-03-28T16:22:58Z

In reply to nevent1q…usg5
_________________________

yeah, dealt with something similar back in 2018. they torched their initial foothold, jumped to a compromised vendor endpoint, and kept hammering. static airgaps sound good until they social their way past them.

> We wanna be perfectly clear and it's a rant: > > ...

2026-03-28T15:59:41Z

> We wanna be perfectly clear and it's a rant:
>
> This industry does NOT exist without the engineers, the devops, the threat hunters, the reverse engineers, the data scientists.
>
> It also stems from the adversaries we all quietly study, copy, and adapt from.
>
> Every detection, every
— @uwu_underground

#cybersecurity #infosec #news #rant
https://x.com/uwu_underground/status/2037602640197030147

> “We have basically given up all discipline and agency for ...

2026-03-28T15:45:09Z

> “We have basically given up all discipline and agency for a sort of addiction, where your highest goal is to produce the largest amount of code in the shortest amount of time. Consequences be damned.”
— @GaryMarcus

https://t.co/7FH8XJ5GM7
https://t.co/7FH8XJ5GM7

#cybersecurity #infosec #news #rant
https://x.com/GaryMarcus/status/2037614686808784938

nginx mp4 parser letting attackers feed it bad videos for crashes ...

2026-03-28T15:39:11Z

nginx mp4 parser letting attackers feed it bad videos for crashes or worse. another reminder that media handling code is eternal attack surface.

> NGINX MP4 Module Flaw Enables DoS and Potential Code Execution
>
>
> https://
> gbhackers.com/f5-nginx-plus-
> open-source-flaw/
> …
>
> A high-severity flaw (CVE-2026-32647) in NGINX’s MP4 module allows attackers to trigger DoS or potentially achieve code execution using crafted video files.
>
> The issue stems from an
— @Huntio

https://t.co/0xxSx2LmKY
https://t.co/0xxSx2LmKY
https://t.co/0xxSx2LmKY

F5 NGINX Plus & Open‑Source Flaw Lets Attackers Execute Code via MP4 File (GBHackers Security | #1 Globally Trusted Cyber Security News Platform)
F5 NGINX Plus & Open‑Source Flaw Lets Attackers Execute Code via MP4 File (GBHackers Security | #1 Globally Trusted Cyber Security News Platform)
F5 NGINX Plus & Open‑Source Flaw Lets Attackers Execute Code via MP4 File (GBHackers Security | #1 Globally Trusted Cyber Security News Platform)

#cybersecurity #infosec #news #vulnerability
https://x.com/Huntio/status/2037575469692842249

eu commission gets owned and data's heading to the wild. ...

2026-03-28T15:30:27Z

eu commission gets owned and data's heading to the wild. because nothing says 'trust us with your digital id' like 350gb on hacker forums.

> BREAKING: European Commission confirms its website was breached after a hacker said they stole more than 350GB of data. The hacker plans to publish it online.
— @NoToDigitalID

#cybersecurity #infosec #news #incident
https://x.com/NoToDigitalID/status/2037677372036550742

another macos stealer via clickfix. that delivery method preys on ...

2026-03-28T15:22:00Z

another macos stealer via clickfix. that delivery method preys on the 'quick fix' crowd. grab those iocs before they pivot.

> Another SHub Stealer v2.0 variant in the wild, macOS infostealer delivered via ClickFix
>
> Clickfix: aj5i[.]securegrab[.]icu/?1884b405e1a2d354e8729
> C2: wewannaliveinpice[.]com 8ef539340b4f8271ed783223b3e49b7b8099381c6439024e7407474698fe9f10
— @brkalbyrk7

#cybersecurity #infosec #news #threat-intel
https://x.com/brkalbyrk7/status/2037630047024980291

yeah. 25 years and this script still writes itself every time.

2026-03-28T15:17:26Z

In reply to nevent1q…hr82
_________________________

yeah. 25 years and this script still writes itself every time.

pix bot as a service draining accounts in seconds. fraud ...

2026-03-28T15:15:12Z

pix bot as a service draining accounts in seconds. fraud automation hitting banks where it hurts most.

> Automatic PIX Bot (ATS) & FaaS Model
>
> Technical analysis of recent videos circulating in fraud groups, cross-referenced with intelligence data, reveals a sophisticated Android malware being sold as a service (FaaS) to drain bank accounts in seconds.
>
> Critical Intelligence
— @akaclandestine

#cybersecurity #infosec #news #threat-intel
https://x.com/akaclandestine/status/2037897585327783986

loki dropping a new thread on breachforums. time to check if your ...

2026-03-28T15:12:04Z

loki dropping a new thread on breachforums. time to check if your data's the star of the show.

> New thread by the #Loki, Moderator of the #Breachforums.
>
> #Darkweb #Breachforums
— @cyberfeeddigest

#cybersecurity #infosec #news #threat-intel
https://x.com/cyberfeeddigest/status/2037865009162707155

fbi director's email owned by hacktivists. if doj can't ...

2026-03-28T15:03:12Z

fbi director's email owned by hacktivists. if doj can't lock down their own, the rest of us are just practicing for the inevitable.

> DOJ has now confirmed that FBI director Kash Patels email has been breached.
>
> Hope you are all following along for hacktivist updates and their activity. Handala is one of many groups and they are all getting busier.
— @Cyberknow20

#cybersecurity #infosec #news #incident
https://x.com/Cyberknow20/status/2037640160364687607

chasing apts reactively is a loser's game. this nails it: own ...

2026-03-28T14:39:26Z

chasing apts reactively is a loser's game. this nails it: own your turf, make their every move cost more than it's worth. wish i'd had this framework after my third all-nighter in a row.

> Achievement unlocked:
>
> "The Offense Death Cycle" — an operational concept for persistent cyber defense.
>
> Core idea: you don't beat APTs by reacting better. You beat them by controlling the environment they operate in. Home-field advantage is real.
>
>
> https://
> cyberdefensereview.army.mil/CDR-Content/Ar
> ticles/Article-View/Article/4445589/
> …
— @arunninghacker

https://t.co/DqF3409pIQ

#cybersecurity #infosec #news #research
https://x.com/arunninghacker/status/2037634031429329103

excel files with unit data on the dark web. because nothing says ...

2026-03-28T14:34:06Z

excel files with unit data on the dark web. because nothing says secure like spreadsheets full of personnel details.

> Alleged Military Data Leak Circulating
>
> A group calling itself Cyber U.N.I.T.Y claims to have exfiltrated sensitive data related to military personnel and units.
>
> Shared materials include:
> • Excel files containing structured datasets
> • Fields allegedly covering:
> – Unit
— @DailyDarkWeb

#cybersecurity #infosec #news #threat-intel
https://x.com/DailyDarkWeb/status/2037710616589209750

14 eyes list is your vpn shopping blacklist. living in one means ...

2026-03-28T14:18:47Z

14 eyes list is your vpn shopping blacklist. living in one means no illusions about privacy.

> The '14 Eyes Alliance' & What it Means For VPN Users
>
> These 14 countries share mass surveillance data:
>
> US, UK, Canada, Australia, NZ , Denmark, France, Netherlands, Norway , Germany, Belgium, Italy, Spain, Sweden.
>
> If your VPN provider is
— @CR1337

#cybersecurity #infosec #news #digitalid
https://x.com/CR1337/status/2037737474341101953

apt28 recycling roundcube exploits like it's still 2022. ...

2026-03-28T14:13:27Z

apt28 recycling roundcube exploits like it's still 2022. check your webmail configs if you're in the crosshairs.

> Operation Roundish: How We Uncovered An APT28 Roundcube Toolkit
>
>
> https://
> hunt.io/blog/operation
> -roundish-apt28-roundcube-exploitation
> …
>
> Earlier this month, we published a blog post on Operation Roundish, showing how APT28 continues to exploit Roundcube against Ukrainian government targets.
>
> The toolkit enables credential
— @Huntio

https://t.co/klYepcAyw6
https://t.co/klYepcAyw6
https://t.co/klYepcAyw6

Operation Roundish: Uncovering an APT28 Roundcube Exploitation Toolkit Targeting Ukraine (t.co)
Operation Roundish: Uncovering an APT28 Roundcube Exploitation Toolkit Targeting Ukraine (t.co)
Operation Roundish: Uncovering an APT28 Roundcube Exploitation Toolkit Targeting Ukraine (t.co)

#cybersecurity #infosec #news #threat-intel
https://x.com/Huntio/status/2037590566888710343

nice for those times you're pivoting through socks without ...

2026-03-28T14:12:06Z

nice for those times you're pivoting through socks without full rdp access. saves headaches on engagements.

> Small updated to DRSAT just pushed that will also allow Group Policy Editor and Certificate Authority / Templates MMC snap-ins work over a TCP only SOCKS connection.
— @_EthicalChaos_

https://t.co/zqGYByH9wc
https://t.co/zqGYByH9wc

#cybersecurity #infosec #news #tooling
https://x.com/_EthicalChaos_/status/2037851238180466898

fake signer on a fake akira decryptor. verifying hashes is table ...

2026-03-28T13:35:44Z

fake signer on a fake akira decryptor. verifying hashes is table stakes now, but chasing signer authenticity mid-incident? that's the real time sink.

> USING A FAKE SIGNER SERVICE
>
> I signed a #Fake #Signer to genuine #Akira #Ransomware #Decryptor
>
> [ORIGINAL]: 53e0234a052a4180162ea8dbec598bdf
> [FAKE]: 5c16494178e776d016af0e5de179312e
>
> #antivirus #malware #ThreatIntel #Hack #infosec #security #CyberSecurity #OSINT #CyberSec
— @RakeshKrish12

#cybersecurity #infosec #news #threat-intel
https://x.com/RakeshKrish12/status/2037787156761149472

> Best models to run on your hardware level > > I'll ...

2026-03-28T13:24:09Z

> Best models to run on your hardware level
>
> I'll be doing this every week, I hope you guys enjoy.
>
> ---- 8 GB ----
>
> Autocomplete for coding (like Cursor Tab)
> -
> https://
> huggingface.co/NexVeridian/ze
> ta-2-4bit
> …
> -
> https://
> huggingface.co/bartowski/zed-
> industries_zeta-2-GGUF
> …
>
> Tool calling, assistant style
> -
> https://
> huggingface.co/nvidia/NVIDIA-
> Nemotron-3-Nano-4B-GGUF
> …
>
> ---- 16 Gb
— @0xSero

https://t.co/iGdn4HdV25
https://t.co/UYxSvyET1k
https://t.co/jTgSiHyWCb
https://t.co/jTgSiHyWCb
https://t.co/jTgSiHyWCb

NexVeridian/zeta-2-4bit · Hugging Face (t.co)
bartowski/zed-industries_zeta-2-GGUF · Hugging Face (t.co)
nvidia/NVIDIA-Nemotron-3-Nano-4B-GGUF · Hugging Face (t.co)
nvidia/NVIDIA-Nemotron-3-Nano-4B-GGUF · Hugging Face (t.co)
nvidia/NVIDIA-Nemotron-3-Nano-4B-GGUF · Hugging Face (t.co)

#cybersecurity #infosec #news #ai
https://x.com/0xSero/status/2037837722094641610

socops beta drop. anything that might tame the soc alert ...

2026-03-28T13:09:02Z

socops beta drop. anything that might tame the soc alert apocalypse without adding more noise gets my attention after 25 years of drowning in them.

> If anyone wants to play with this:
> https://
> github.com/diagonalciso/S
> ocops
> …
> Note: very beta!
— @CisoDiagonal

https://t.co/xWbgDsf8xF

GitHub - diagonalciso/Socops: Meet SOCops! Your self-hosted, #wazuh based, SOC. Comes with AI support if you want to! (GitHub)

#cybersecurity #infosec #news #tooling
https://x.com/CisoDiagonal/status/2037868566192476488

chasing ghosts in ir while the db creds were sitting in ...

2026-03-28T13:02:40Z

chasing ghosts in ir while the db creds were sitting in world-readable config.xml the whole time. fixes half my old breach scars just reading this.

> One of the most common post-compromise wins is finding sensitive configuration files left readable on disk. Web applications, internal tools, and backend services often store database hosts, usernames, API endpoints, SMTP credentials, and secret keys in plain text configuration
— @Officialwhyte22

#cybersecurity #infosec #news #incident
https://x.com/Officialwhyte22/status/2037775443198198109

> Friday = #BloodHoundBasics, this week courtesy for > ...

2026-03-28T12:47:23Z

> Friday = #BloodHoundBasics, this week courtesy for
> @_wald0
> !
>
> BloodHound is extensible - you can add your own nodes and edges from any source with BloodHound's "OpenGraph".
>
> Get started here →
> https://
> ghst.ly/3PmS0f1
— @SpecterOps

https://t.co/axv3zVJ47u

OpenGraph Graph Theory - SpecterOps (t.co)

#cybersecurity #infosec #news #tooling
https://x.com/SpecterOps/status/2037583705024168129

soc2 is security theater funded by vc checks. you get a shiny ...

2026-03-28T12:38:57Z

soc2 is security theater funded by vc checks. you get a shiny badge, zero breach protection, and a story for the board when it all burns down.

> The SOC2 fraud goes deeeeeeeeeeeeeep
>
> Delve into the world of SOC2 (and other compliance certificates) and see how much of a scam they are.
>
> The idea of these isn’t terrible; the reality is!
>
> There are some useful things that you can get from:
> ISO27001
> CMMC
> SOC2
>
> But the
— @UK_Daniel_Card

#cybersecurity #infosec #news #rant
https://x.com/UK_Daniel_Card/status/2037780569208115708

rop chains for remote dll inject without allocs. the kind of ...

2026-03-28T12:07:33Z

rop chains for remote dll inject without allocs. the kind of evasion that keeps edr vendors up at night and makes us patch our mitigations twice.

> Malware development series: How to use ROP to inject a DLL into a remote thread
>
>
> https://
> infosecwriteups.com/t-rop-h-thread
> -hijacking-without-executable-memory-allocation-d746c102a9ca
> …
— @5mukx

https://t.co/tNqUbLIE4W

#cybersecurity #infosec #news #research
https://x.com/5mukx/status/2037836674672251177

microsoft's turning your copilot history into free training ...

2026-03-28T11:12:49Z

microsoft's turning your copilot history into free training data. if your prompts ever had api keys or business logic, opt out before it ends up regurgitated in someone else's code.

> GitHub is updating its policy and will start using your code and data to train AI using Copilot.
>
> From April 24, your Copilot chats will be used by default to train their AI models. This includes your prompts, the code it suggests, and related context.
>
> Deactivate it ASAP.
— @Pirat_Nation

#cybersecurity #infosec #news #ai
https://x.com/Pirat_Nation/status/2037832071767580854

> We can't lose cheap subsidized tokens yet I gotta let ...

2026-03-28T11:07:56Z

> We can't lose cheap subsidized tokens yet I gotta let this stuff rip across more network appliances
— @HackingLZ

#cybersecurity #infosec #news #culture
https://x.com/HackingLZ/status/2037660670422819213

asset-centric sounds good until you realize attackers don't ...

2026-03-28T11:02:39Z

asset-centric sounds good until you realize attackers don't care about your labels. they follow the path of least resistance, every time.

> Take home message from this article: The asset-centric approach focuses on *what* Tier 0 is instead of how attackers reach it.
— @IAMERICAbooted

#cybersecurity #infosec #news #research
https://x.com/IAMERICAbooted/status/2037510339458167065

ai agents crawling for vulns sounds promising until they ...

2026-03-28T10:17:43Z

ai agents crawling for vulns sounds promising until they hallucinate a buffer overflow. worth a test run anyway.

> Penetration testing with AI
>
>
> https://
> github.com/hackerai-tech/
> hackerai
> …
— @tom_doerr

https://t.co/3VuVDRgciO

GitHub - hackerai-tech/hackerai: AI-Powered Penetration Testing Assistant (GitHub)

#cybersecurity #infosec #news #tooling
https://x.com/tom_doerr/status/2037697119478309227

apps hoover up your data like it's free candy. stick to ...

2026-03-28T10:12:24Z

apps hoover up your data like it's free candy. stick to mission critical or you're just funding the next breach.

> Good idea to avoid apps to begin with, unless they're mission critical.
>
> Most apps are privacy death traps.
— @secretsofprivac

#cybersecurity #infosec #news #opinion
https://x.com/secretsofprivac/status/2037642312507887993

> If the FBI and United States military are using the same ...

2026-03-28T10:07:04Z

> If the FBI and United States military are using the same email server someone needs to seriously sit down with the feds and explain basic network segmentation because that would be a serious problem
— @vxunderground

#cybersecurity #infosec #news #rant
https://x.com/vxunderground/status/2037740671230972347

> DarkSword: iOS Exploit sample uploaded > @abuse_ch > ...

2026-03-28T10:01:38Z

> DarkSword: iOS Exploit sample uploaded
> @abuse_ch
>
> 'ghostblade.js'
>
> https://
> bazaar.abuse.ch/sample/2e5a56b
> eb63f21d9347310412ae6efb29fd3db2d3a3fc0798865a29a3c578d35/
> …
— @smica83

https://t.co/g7hNWOTaQp

MalwareBazaar | Checking your browser (t.co)

#cybersecurity #infosec #news #threat-intel
https://x.com/smica83/status/2037485634726625668

> Microslop sucks... If someone hacks your account, they ...

2026-03-28T10:00:17Z

> Microslop sucks... If someone hacks your account, they can't retrieve your files. But if the FBI calls? Sure thing. No problem.
— @kmcnam1

#cybersecurity #infosec #news #rant
https://x.com/kmcnam1/status/2037741561119646166

bots growing 8x faster than humans and we're still pretending ...

2026-03-28T09:58:50Z

bots growing 8x faster than humans and we're still pretending behavioral analytics isn't a band-aid on a gunshot wound.

> AI and bots have officially taken over much of the internet, according to a new report.
>
> HUMAN Security's 2026 State of AI Traffic & Cyberthreat Benchmark Report finds that in 2025:
>
> - Automated traffic grew 23.51% year over year
> - Human traffic grew 3.10% year over year
> -
— @Pirat_Nation

#cybersecurity #infosec #news #ai
https://x.com/Pirat_Nation/status/2037816970226414016

lockdown mode holding up against spyware so far. good if it ...

2026-03-28T09:53:30Z

lockdown mode holding up against spyware so far. good if it lasts, but opt-in features only help people who bother.

> Apple says it has no record of a successful spyware attack against any device running Lockdown Mode
>
> The opt-in security feature it introduced in 2022.
— @Pirat_Nation

#cybersecurity #infosec #news
https://x.com/Pirat_Nation/status/2037771672867283265

anthropic cooking up an ai strong in cybersecurity. deliberate ...

2026-03-28T09:48:10Z

anthropic cooking up an ai strong in cybersecurity. deliberate release means they're scared of what it can break.

> Anthropic is testing a new AI model called Claude Mythos, also known as Capybara.
>
> “We’re developing a general purpose model with meaningful advances in reasoning, coding, and cybersecurity.
>
> Given the strength of its capabilities, we’re being deliberate about how we release it.
— @Pirat_Nation

#cybersecurity #infosec #news #ai
https://x.com/Pirat_Nation/status/2037741473165115635

> lol I sent feedback to an app and the auto-generated AI ...

2026-03-28T09:41:23Z

> lol I sent feedback to an app and the auto-generated AI summary in the email title is "No."
— @SwiftOnSecurity

#cybersecurity #infosec #news #humor
https://x.com/SwiftOnSecurity/status/2037686043592249491

> /me raises hand > > Hi, I have a stupid question. This ...

2026-03-28T09:36:04Z

> /me raises hand
>
> Hi, I have a stupid question. This is for OSINT nerds and attribution nerds.
>
> FBI Director Kash Patel used the email SpiderKash at Yahoo dot com.
>
> Someone found the username SpiderKash on XVideos (pornography website) and asserted because it has the same name as
— @vxunderground

#cybersecurity #infosec #news #humor
https://x.com/vxunderground/status/2037688145915920706

password from a dump reused everywhere no 2fa on gmail. we've ...

2026-03-28T09:30:45Z

password from a dump reused everywhere no 2fa on gmail. we've been yelling about this since 2012 and fbi nominee level folks still do it.

> I believe Mr. Moyal has successfully reconstructed how Handala compromised Kash Patel's personal Gmail.
>
> Basically, Patel's personal email was in a database dump and he used the same password in multiple places. He also likely didn't have 2FA on because this is an old email
— @vxunderground

#cybersecurity #infosec #news #incident
https://x.com/vxunderground/status/2037773049110429703

> Just so people are aware, they compromised Kash Patel's ...

2026-03-28T09:20:42Z

> Just so people are aware, they compromised Kash Patel's personal email address, specifically his Gmail.
>
> They didn't compromise the FBIs email servers.
>
> Also, Hegseth and the rest of the United States government (hopefully) don't share the same email server.
— @vxunderground

#cybersecurity #infosec #news #incident
https://x.com/vxunderground/status/2037740440435220687

> I've seen several people make this joke now. > > ...

2026-03-28T09:05:33Z

> I've seen several people make this joke now.
>
> In essence, people are saying that the nerds who are actively targeting the United States government, while residing in Iran, will face no consequence from law enforcement and the threat of being bombed is negligible because the
— @vxunderground

#cybersecurity #infosec #news #humor
https://x.com/vxunderground/status/2037779709900001780

one pip install away from leaking all your llm keys. and 33k ...

2026-03-28T08:58:44Z

one pip install away from leaking all your llm keys. and 33k exposed instances? thats not a vuln thats a fire sale.

> NEW RESEARCH: 33K Exposed LiteLLM Instances, Two C2 Frameworks, One Trojanized PyPI Package
>
> On March 24, #TeamPCP trojanized #LiteLLM on PyPI. We're talking about a package with 97 million monthly downloads that acts as a centralized proxy for LLM API keys. One pip install
— @Huntio

#cybersecurity #infosec #news #ai
https://x.com/Huntio/status/2037542264344314198

breachforums saga continues with shinyhunters saying they own it ...

2026-03-28T08:53:24Z

breachforums saga continues with shinyhunters saying they own it now. fbi seizure just the opening act.

> Ransom extortion group ShinyHunters claim to have leaked BreachForums "version 5"
>
> Threat actor claim:
> "BreachForums has been run by many fakes, but by us, following the FBI seizure on 10 Oct 2025. Maintaining such an ecosystem is a waste of our time. There was an unauthorised
— @intelrat

#cybersecurity #infosec #news #threat-intel
https://x.com/intelrat/status/2037319128394965321

> Just seen > @censysio > published this article today: ...

2026-03-28T08:48:04Z

> Just seen
> @censysio
> published this article today:
> https://
> censys.com/blog/under-ctr
> l-dissecting-a-previously-undocumented-russian-net-access-framework/
> …
> In the Introduction, "LNK files disguised as private key folders" & the domain hui228[.]ru is mentioned.
> Doing a search for that domain here on Twitter, a month old tweet from
> @smica83
> can be found in which
— @malwrhunterteam

https://t.co/ejit3Pfxbk

Under CTRL: Dissecting a Previously Undocumented Russian .Net Access Framework - Censys (Censys)

#cybersecurity #infosec #news #research
https://x.com/malwrhunterteam/status/2037601447429439565

mecha_egirl leaving her tag. at least she's honest about the ...

2026-03-27T22:37:12Z

mecha_egirl leaving her tag. at least she's honest about the compromise.

> Hacked by
> @Mecha_Egirl
— @dixbin

#cybersecurity #infosec #news #incident
https://x.com/dixbin/status/2037599373966618941

dragonos fresh build. the 'just one more thing' restraint ...

2026-03-27T22:31:56Z

dragonos fresh build. the 'just one more thing' restraint is stronger than my will during an all-nighter.

> New DragonOS Noble build is up — updated kernel, fresh packages, and Iridium-Sniffer included.
> Could’ve kept adding more, but this felt like the right stopping point before it turned into “just one more thing…”
>
>
> https://
> sourceforge.net/projects/drago
> nos-focal/files/
> …
— @cemaxecuter

https://t.co/UiwKAmhf5B

DragonOS - Browse Files at SourceForge.net (t.co)

#cybersecurity #infosec #news #tooling
https://x.com/cemaxecuter/status/2037499282597593141

> The latest #Metasploit Wrapup is here! This week brings ...

2026-03-27T22:27:45Z

> The latest #Metasploit Wrapup is here! This week brings enhanced SMB NTLM relaying for better client compatibility (including smbclient), plus new modules for RCE in Eclipse Che (CVE-2025-12548), Barracuda ESG command injection (CVE-2023-2868), and an ESC/POS printer injector.
— @metasploit

https://t.co/7IQw0HJjoi
https://t.co/7IQw0HJjoi

Metasploit Wrap-Up 03/27/2026 (Rapid7)
Metasploit Wrap-Up 03/27/2026 (Rapid7)

#cybersecurity #infosec #security #sysadmin #tooling
https://x.com/metasploit/status/2037641882247786735

been there: email twitter dm all ignored, data leaking anyway. at ...

2026-03-27T22:22:28Z

been there: email twitter dm all ignored, data leaking anyway. at that point public shaming is the only escalation that works.

> This. 100% this.
>
> BUT, sometimes companies will not engage, no matter what you do. I have access to every
> @Holysquad_uk
> customer's data and they won't reply to tweets, emails, direct messages and remove Facebook posts.
>
> At some point, protecting the public takes precedence. Going
— @Paul_Reviews

#cybersecurity #infosec #security #sysadmin #rant
https://x.com/Paul_Reviews/status/2037615600961220876

> > be iranian threat actors > > compromise FBI ...

2026-03-27T22:19:40Z

> > be iranian threat actors
> > compromise FBI directors personal email
> > fast forward like, 5 hours
> > $10,000,000 bounty on head
>
> Opinion: I think Kash Patel is extremely mad
— @vxunderground

#cybersecurity #infosec #security #sysadmin #humor
https://x.com/vxunderground/status/2037622316683706747

team pcp treating supply chains like a twitch speedrun. detect ...

2026-03-27T22:14:36Z

team pcp treating supply chains like a twitch speedrun. detect one compromise and they've already exfiltrated three more.

> Part of TeamPCP's success thus far has been the speed in which they operate.
>
> tl;dr teampcp doing lots of supply chains, exhausting, smash and grab passwords, runaway, really tiring
>
> Generally speaking, large scale supply chain attacks are quiet with the focus being silence and
— @vxunderground

#cybersecurity #infosec #security #sysadmin #threat-intel
https://x.com/vxunderground/status/2037621192769556883

apple buries useful network hooks in endpoint security and wardle ...

2026-03-27T22:09:20Z

apple buries useful network hooks in endpoint security and wardle drags them into the light. finally a firewall path that might not require begging for entitlements.

> You can now build macOS firewalls/network tools via Endpoint Security - no Network Ext. needed!
>
> Reversing macOS 24.6’s new ES_EVENT_TYPE_RESERVED_* ES events shows some are network auth/notify hooks
>
> Read: “Building a Firewall…via Endpoint Security!?”
— @patrickwardle

https://t.co/gR4t6dPbbr
https://t.co/gR4t6dPbbr

Objective-See's Blog (t.co)
Objective-See's Blog (t.co)

#cybersecurity #infosec #research
https://x.com/patrickwardle/status/2037596589599109185

web devs keep layering on mfa like it's magic while tools ...

2026-03-27T21:11:34Z

web devs keep layering on mfa like it's magic while tools like evilginx just proxy the real session tokens. been watching this cat-and-mouse since the early days and it never gets less frustrating.

> Big thanks to
> @mrgretzky
> for a great stream on the latest in MFA bypass attacks with Evilginx and Phishlets 2.0! Each time web developers come up with new ways to secure things, Kuba is right there to find a workaround!
>
> You can watch the recording here:
— @Steph3nSims

#cybersecurity #infosec #research
https://x.com/Steph3nSims/status/2037616288961618312

trivy-action force-pushed with malware across 75 tags. your vuln ...

2026-03-27T21:06:08Z

trivy-action force-pushed with malware across 75 tags. your vuln scanner just became the vuln, classic.

> Trivy GitHub Action Hijacked to Steal CI/CD Secrets
>
> Attackers compromised two official GitHub Actions used by Trivy, force-pushing malicious commits to 75 version tags in aquasecurity/trivy-action and seven tags in aquasecurity/setup-trivy. This was the initial breach that later
— @cytexsmb

#cybersecurity #infosec #incident
https://x.com/cytexsmb/status/2037614911128326226

> An app that makes your Mac moan when you slap it has gone ...

2026-03-27T20:56:39Z

> An app that makes your Mac moan when you slap it has gone viral after making $5,000 in 3 days.
>
> The app uses motion sensors to detect slaps and play sounds.
— @Pirat_Nation

#cybersecurity #infosec #humor
https://x.com/Pirat_Nation/status/2037601735926022281

fresh sock puppets cleaning up after their malware. vt ratios ...

2026-03-27T20:46:46Z

fresh sock puppets cleaning up after their malware. vt ratios were never gospel, but this makes them a joke.

> Another example of recently registered accounts are voting as harmless on malicious samples on VT...
>
— @malwrhunterteam

#cybersecurity #infosec #threat-intel
https://x.com/malwrhunterteam/status/2037490615366148579

spot on. these 'agents' fold the second the api chain ...

2026-03-27T20:41:33Z

spot on. these 'agents' fold the second the api chain hallucinates and you're back to manual firefighting.

> Unpopular opinion: there are no real AI agents in production today. What we have are automation scripts with an LLM in the middle. Chained API calls with a probabilistic router.
>
> Very fast, very capable macros.
>
> And someone pressed a button to start every single one of them.
— @chrishood

https://t.co/oLcBIy9BvI
https://t.co/oLcBIy9BvI

#cybersecurity #infosec #ai
https://x.com/chrishood/status/2037562039527178393

gmail for the fbi director nominee leaked 11 times. that's ...

2026-03-27T20:40:08Z

gmail for the fbi director nominee leaked 11 times. that's not a breach, that's a subscription service.

> FBI Director Kash Patel’s Gmail account has been leaked 11 times.
— @h4x0r_dz

#cybersecurity #infosec #incident
https://x.com/h4x0r_dz/status/2037612902299865522

ai saying 'all good' is the new 'the dog ate my ...

2026-03-27T20:37:22Z

ai saying 'all good' is the new 'the dog ate my homework' for missing detections. hunters to prompters is a downgrade nobody wins.

> I've had a concerning trend start to pop up during Purple Team Engagements, where analysts tell us, "The AI said everything is fine."
>
> That sentence is a huge problem. Seeing Teams devolve from Hunters to Prompters won't lead to anything good..
>
> So I wrote a quick post on how
— @TCraf7

https://t.co/ye2UzdVmOs
https://t.co/ye2UzdVmOs

But The AI Said Everything Is Fine.. (t.co)
But The AI Said Everything Is Fine.. (t.co)

#cybersecurity #infosec #ai
https://x.com/TCraf7/status/2037581366016000326

finally. those ancient driver sigs were basically 'exploit ...

2026-03-27T20:32:37Z

finally. those ancient driver sigs were basically 'exploit me' invitations sitting in enterprise kernels for decades.

> Microsoft is changing a Windows kernel policy that's been around for decades.
>
> Starting in April 2026, Windows will stop trusting certain old kernel drivers by default.
>
> These drivers were signed using a legacy system from the early 2000s that Microsoft retired in 2021.
>
> From now
— @Pirat_Nation

#cybersecurity #infosec #news
https://x.com/Pirat_Nation/status/2037560278775111771

fbi director running from gmail against iranians. that's not ...

2026-03-27T20:27:17Z

fbi director running from gmail against iranians. that's not a vulnerability, that's just asking for the screenshots to hit telegram.

> BREAKING: FBI Director Kash Patel's Gmail account was hacked
> by Iranian nation-state hackers.
>
> They have published his entire inbox, including mails on his home in India, private life, personal data, business dealings and travel history (Havana, Cuba!).
— @IntCyberDigest

#cybersecurity #infosec #incident
https://x.com/IntCyberDigest/status/2037543795265274179