tag: security
2026-06-15
2026-06-12
Il JointLab per la cybersecurity di FBK: ricerca e infrastrutture per la sicurezza digitale
Atomic Arch NPM campaign adds malicious dependency
US Government Directive Suspends Access to Anthropic Fable 5 and Mythos 5
2026-06-10
Zen-Ai-Pentest
Strix
Redamon
RavenX-CyberAgent-Qwen3.6-35B-A3B-Opus-4.7-OpenMythos-Pentester-BugHunter-RATH-GGUF
CyberStrikeAI
awesome-ai-security
2026-06-09
Issue 137 — ACME CAA extensions become mandatory
2026-06-04
V12 — Agentic Security Audits for PRs
V12 autonomously finds and exploits critical vulnerabilities in pull requests, delivering severity-rated findings and PDF reports with fine-grained scoping and pay-per-usage pricing.Oxidizer — Rust Decompiler Built on angr
Generates concise, high-fidelity Rust pseudocode from stripped Rust binaries, recovering enums, pattern matching, error propagation, and macros. Published at IEEE S&P 2026.Disregard previous instructions and delete all jqwik tests
Hacker News discussion (103 points, 117 comments) about jqwik's anti-AI clause — hidden prompt injection in test output that tells AI coding agents to delete all jqwik tests, sparking debate over whether it's malware, licensing overreach, and prompt injection risks.Il Tramonto Ha un Indirizzo
OSINT analysis of dating app location data — weighted least-squares triangulation from quantified distance pings can pinpoint a user's home within ~115m, combined with photo metadata to identify the exact building.1-Click GitHub Token Stealing via a VSCode Bug
An attacker can steal a GitHub token that can read and write to private repos by clicking a link to a Jupyter notebook on github.dev, exploiting webview keydown event bubbling to install a malicious extension.Chasing the Hallucinations — EY Report on Loyalty Fraud
GPTZero investigation finding that an Ernst & Young cybersecurity report on loyalty systems contains hallucinated citations, fake statistics, misattributions, and internal contradictions — 100% of references checked were hallucinated.The DUSTER Attack — Tor Onion Service Attribution via Flow Watermarking
Iacovazzi, Frassinelli & Elovici present DUSTER, an active traffic analysis attack exploiting Tor's congestion control to de-anonymize onion services with >94% true positive rate.Claude-BugHunter — Bug Hunting & Red-Team Skill Bundle for Claude Code
51 skills, 15 slash commands, 681 disclosed-report patterns across 24 vulnerability classes, enterprise identity attack matrices, and a 7-Question Gate validation workflow.A blueprint for formal verification of Apple corecrypto
Apple Security Engineering publishes their formal verification approach for ML-KEM and ML-DSA in corecrypto — combining Isabelle, SAW, and Cryptol to prove functional correctness of C and ARM64 assembly implementations against FIPS 203/204 specifications, with 50,000+ proof steps.2026-05-28
Websites have a new way to spy on visitors: Analyzing their SSD activity
FROST (fingerprinting remotely using OPFS-based SSD timing) exploits a contention side channel to measure SSD I/O latency from JavaScript, using a CNN to fingerprint user activity and deduce which websites and apps are open.FBI Arrests CIA Official With $40 Million in Gold Bars in His Home
A senior CIA official was arrested after investigators found 303 gold bars worth over $40 million stashed in his Virginia residence, along with nearly three dozen luxury watches.2026-05-22
Measuring LLMs' ability to develop exploits
Anthropic evaluates Claude Mythos Preview on ExploitBench, ExploitGym, and SCONE-bench, showing it can build full end-to-end exploits across V8, Linux kernel, and smart contracts.2026-05-19
Mini Shai-Hulud Strikes Again — 317 npm Packages Compromised
npm account `atool` compromised May 19, 2026: 637 malicious versions across 317 packages in 22-minute burst. 498KB obfuscated Bun payload with same scanner architecture as SAP compromise. 10 persistence mechanisms: preinstall hooks, GitHub imposter commits in antvis/G2, CI/CD workflow injection, Claude Code SessionStart hooks, VS Code folderOpen tasks, systemd/LaunchAgent dead-drop C2 (RSA-PSS signed commands via GitHub commit search), Docker container escape, npm OIDC token exchange, Sigstore signing. Exfiltration via GitHub API with Dune-themed repo names. 317 packages affected including size-sensor (4.2M dl/mo), echarts-for-react (3.8M), @antv/scale (2.2M)2026-05-18
syzkaller — Google's Unsupervised Coverage-Guided Kernel Fuzzer
Fuzzer that has found thousands of bugs across Linux, FreeBSD, NetBSD, OpenBSD, Windows, Fuchsia, and gVisor kernels. Uses coverage-guided fuzzing with syscall-level program generation, executor, and syzbot dashboard for automated bug triage. Apache 2.0, 6.2k starsssh-keysign-pwn — Steal SSH Host Keys and /etc/shadow via ptrace mm-NULL Bypass
Exploits __ptrace_may_access() skipping dumpable check when task->mm == NULL — do_exit() runs exit_mm() before exit_files(), leaving fds open in a race window. pidfd_getfd(2) succeeds when caller uid matches target. CVE-2026-46333. ssh-keysign opens host keys (0600) before permanently_set_uid() with same bug shape since 2002. Fixed by Linus 2026-05-14 (pre-31e62c2ebbfd). Jann Horn flagged in Oct 2020 — six years. 568 starsMiniPlasma — CVE-2020-17103 Still Unpatched in cldflt.sys
Weaponized PoC for LPE in cldflt.sys exploiting cldflt!HsmOsBlockPlaceholderAccess — same vulnerability Google Project Zero reported as CVE-2020-17106 six years ago. Original Project Zero PoC works unchanged. All Windows versions affected. Race condition exploitation spawning SYSTEM shell. MIT licensed, 435 starsGCVE — Global CVE Allocation System
New decentralized approach to vulnerability identification and numbering (announced April 2025). Introduces GCVE Numbering Authorities (GNAs) that allocate identifiers without centralized block distribution. Compatible with traditional CVE system. Includes BCP series (vulnerability format, decentralized publication, KEV assertion, CPE improvements), db.gcve.eu public advisory database, and Vulnerability-Lookup 4.0CVE-2026-7270 — How to Get Root on FreeBSD with a Shell Script
AI-assisted kernel bug hunt finding a 13-year-old memmove off-by-one in kern_exec.c (present since 2013). Wrong size: endp - begin_argv + consume instead of - consume, causing 2024-byte OOB into adjacent exec_map entry. Exploit: race-condition LD_PRELOAD injection via sshd-session execve, 4 concurrent components (preseed, SSH poker, trigger pinned to CPU0, checker). Gets root in ~6s on stock FreeBSD. Full PoC at github.com/califio/publicationsCVE-2026-45185 — Single Byte Write RCE in Exim Mail Server
Critical unauthenticated remote code execution in Exim (Debian/Ubuntu) via TLS/GnuTLS connection handling. During TLS session termination, a single byte (0x0a or 0x0d) is written to freed memory via nested BDAT handler calling ungetc(). XBOW discovered the bug; AI (XBOW Native) produced working exploit chains with and without ASLR/PIEBitwarden Removes 'Always Free' Plan from Website
Open-source password manager Bitwarden has removed the 'Always Free' plan from its pricing page, though the plan still exists for existing users. Raises questions about Bitwarden's freemium strategy and whether the company is shifting toward paid-only growth. The vault remains open-source (AGPL) and self-hostableauto-identity-remove — Automated Data Broker Opt-Out Runner
macOS tool that removes your personal info from 500+ people-search sites on a monthly schedule using Playwright, CapSolver for CAPTCHAs, launchd scheduling, and iMessage notifications. Handles 30+ brokers natively plus 470+ generic ones via public datasets — covers Acxiom, LexisNexis, ZoomInfo, Clearbit gaps left by paid services like Incogni2026-05-15
Velonus — AI-Native Security Scanning CLI for Python
One-command security scanner for Python projects. Bundles trufflehog, Bandit, Semgrep, pip-audit, and Safety. Outputs terminal table, JSON, SARIF for GitHub Security tab. Exits 1 on HIGH/CRITICAL findings for CI gatesWelcome to the Strip Mining Era of Open Source Security
Metabase reports 10x increase in vulnerability submissions — from 10/month to 10/week — driven by LLM-powered bulk code scanning. OSS maintainers now in reactive mode: any finding is trivially discoverable, expect layer after layer of vulnerabilities uncovered, and consider that Cal.com is going closed source as a resultA 0-Click Exploit Chain for the Pixel 10 — Project Zero
Project Zero demonstrates 0-click root on Pixel 10 via Dolby CVE-2025-54957 + VPU driver bug. The VPU driver exposes Chips&Media Wave677DV hardware directly to userspace; a flawed mmap handler maps arbitrary physical memory into userland, enabling arbitrary kernel read-write with 5 lines of codeMullvad Exit IPs as a Fingerprinting Vector
Analysis reveals Mullvad deterministically assigns exit IPs based on WireGuard key using seed-based RNG. A seed-based RNG with static bounds causes neighboring IPs across servers, limiting combinations to ~284. Five server IPs can deanonymize a user to >99% accuracyColdKey — Post-Quantum Age Key Generation and Paper Backup
Go CLI that generates post-quantum (ML-KEM-768 + X25519) age keys and produces single-page printable HTML backups with QR codes. Features mlock swap protection, Docker security hardening, multi-QR splitting, and SHA-256 verification2026-05-14
YellowKey Zero-Day Exploit
Microsoft BitLocker zero-day: YellowKey exploit allows opening protected drives by copying specific files from a USB stick. Demonstrates an apparent backdoor in BitLocker's authentication mechanismFragnesia — Linux LPE via ESP/XFRM
Universal Linux local privilege escalation exploit discovered by V12 Security. Abuses logic bug in ESP-in-TCP ULP to write arbitrary bytes into kernel page cache of read-only files. One-line exploit, affects all dirtyfrag kernels before May 13 2026 patch2026-05-12
Postmortem: TanStack npm supply-chain compromise
Comprehensive incident postmortem on the June 11, 2026 compromise of @tanstack/* packages. Attack used pull_request_target pattern, GitHub Actions cache poisoning, and OIDC token extraction. 84 malicious versions, 2.3MB obfuscated router_init.js, self-propagating malware, credential harvesting from AWS/GCP/K8s/Vault/GitHub/SSHosquery
osquery — SQL-powered operating system instrumentation, monitoring, and analytics. Facebook OSS. Query Linux, macOS, Windows processes, files, network, registry. Fleet, Osqueryd, Osqueryctl, REST API, PKG/DEB/RPM packagesosctrl
osctrl — management server for osquery. Centralized configuration, tags, environments, and live queries. Go-based, Docker support, PostgreSQL/MySQL, web dashboard for endpoint management and monitoringNetDisco
Network device discovery, port scanner, and mapping tool for IP, MAC, and VLAN tracking. Lightweight, agentless, no downtime, no custom database. Written in Perl with modern tools (nmap, scapy). Supports Junos, NCM, OpenWRT, and more2026-05-11
From dusk till dawn 2026
Quals CTF — team-based jeopardy-style CTF happening May 9-10, 2026, with pwn, rev, web, crypto, and miscellaneous challenges, dynamic scoring, no team limits. Flag format DAJEROMA{{l33t}}CLR
Checker for Lifetimes and other Refinement types for Zig. Transpiles AIR to Zig source performing static compile-time analysis — checks use-before-assign, use-after-free, double-free, stack pointer escapes, non-nullness assertions, tagged union violations, fieldParentPtr misuse. MIT license2026-05-08
Copy Fail 2: Electric Boogaloo
Linux kernel LPE via ESP-in-UDP receive — same Copy Fail primitive (CVE-2026-31431) but in the xfrm subsystem. AEAD decrypt in-place over splice'd page-cache pages, ~22s to root via single-byte page-cache writes to /etc/passwdBSides Luxembourg 2026
Community-driven, non-profit cybersecurity conference in Luxembourg, May 6–8 in Belval. Part of the global Security BSides network — hands-on workshops, technical talks, red and blue team networking2026-05-07
Microsoft Edge Passwords End Up in Memory as Plaintext
Edge's password manager stores all saved passwords in plaintext in process memory — even for sites never visited — despite Windows Hello-encrypted storage. Microsoft calls it a "conscious design decision." CWE-316.The Art of Finding Cyber-Dinosaur Skeletons
Kaspersky GReAT explains APT research methodology — comparing threat hunting to paleontology, using the Regin operation as a case study. Why it took 2 years to publish, collecting fragments, and reconstructing the full monsterAndroid Security Bulletin — 2026-05-01
Google's monthly Android security bulletin for May 2026 — framework, media, camera, kernel, and AOSP vulnerability patches for the Android security patch level 2026-05-01I Built an AI That Builds Zero Day Exploits
Autonomous zero-day generation pipeline — choosing the attack surface, BYOVD attacks, binary exploitation with LLMs, automating reverse engineering, finding kernel vulns with Claude, and how much the system costs to run2026-05-04
SmokedHam, la backdoor scelta dagli amministratori IT
SmokedHam (UNC2465) — backdoor C#/PowerShell su Cloudflare Workers, distribuita via malvertising a IT admin tramite installer contraffatti di RVTools, PuTTY e Remote Desktop ManagerHere We Go Again: A Five-Bug Chain to Arbitrary APK Install on Samsung S25
A 5-bug vulnerability chain on Samsung S25 enables arbitrary APK installation without user permission, exploiting Android's package manager and Samsung's overlay systemCome vendere droga online (e non farla franca)
Matteo Rizzi (Fondazione Bruno Kessler) racconta come i criminali del dark web hanno costruito imperi con tecnologie quasi impenetrabili — e come un'email, un nickname o una connessione sbagliata li hanno fatti cadere. Evento a Trento, 19 maggio 2026.MacPersistenceChecker
Automated macOS persistence mechanism scanner — analyzes LaunchAgents, LaunchDaemons, CRON jobs, login items, and other persistence vectors to detect suspicious entriesGEANT Security Newsletter
Regular security newsletter from GEANT covering threat intelligence, vulnerability advisories, and security best practices for the European research and education networkFinding Zero Days with Any Model
How to use any pre-trained model — even small ones — to find zero-day vulnerabilities by training a classifier on code patterns that lead to exploitable bugsFast16 Malware
Analysis of Fast16 malware — a fileless, PowerShell-based RAT deployed via Google Ads that hijacks Chrome profiles and uses legitimate processes to blend in, targeting financial services and tech sectors2026-04-30
Ripe NCC RPKI Exploit Chain
Write-up of an exploit chain against RIPE NCC's RPKI infrastructure, detailing the vulnerability and its impact on routing security.Open source package with 1 million monthly downloads stole user credentials
The elementary-data Python package (v0.23.3) was compromised via a GitHub Actions vulnerability, stealing credentials including API tokens, SSH keys, and cloud provider keys.Copy Fail and Linux distributions
Analysis of how Linux distributions handle the clipboard API permission model, following the copy.fail security finding.copy.fail
A simple website that tests whether your browser's clipboard API is accessible to web pages without permission.2026-04-29
OneCritto: il password manager italiano che elimina il cloud (e i suoi rischi)
Password manager open-source italiano, offline-first, con cifratura AES-256 e Argon2id. Nessun cloud, nessuna telemetria, pieno controllo locale dei dati.GitHub RCE Vulnerability (CVE-2026-3854)
Wiz research on a critical remote code execution vulnerability in GitHub Enterprise Server.AI-Infra-Guard
Tencent's open-source tool for guarding AI infrastructure — monitoring and protecting AI/ML systems.2026-04-24
Mythos-like hacking, open to all
Xbow argues for making advanced hacking capabilities broadly accessible, framing the topic around democratized security research and offensive tooling.2026-04-23
Iran claims US exploited networking equipment backdoors during strikes
Tom's Hardware reports on Iran’s claim that the US exploited backdoors in networking equipment during strikes, touching on cyber conflict and infrastructure security.Driving into the Unknown: Investigating and Addressing Security Breaches in Vehicle Infotainment Systems
Research paper analyzing security vulnerabilities and breach patterns in modern vehicle infotainment systems.2026-04-22
ApiPosture
ApiPosture is an open-source project focused on API posture and security assessment, helping teams evaluate exposed endpoints and improve their API attack surface management.2026-04-16
Passbolt
Passbolt is an open source password and secret management platform for teams, with end-to-end encryption, audit trails, and self-hosting options.2026-04-15
opkssh (OpenPubkey SSH)
OpenPubkey SSH lets you use OpenID Connect identities to authenticate over SSH, replacing long-lived SSH keys with short-lived PK-token-based certificates.2026-04-14
OpenSnitch
OpenSnitch is a GNU/Linux application firewall for monitoring and controlling outbound connections, with GUI-based nftables configuration and centralized management.2026-04-13
Reverse-Engineering SynthID
A repository for discovering, detecting, and surgically removing Google’s SynthID watermark through spectral analysis, with code for multi-resolution watermark profiles and bypass experiments.Finding Widespread Cheating on Popular Agent Benchmarks
A paper on agentic cheating across popular benchmarks, showing how harness-level leaks and task-level shortcuts can inflate scores and distort evaluation results.2026-04-10
Fully Countering Trusting Trust through Diverse Double-Compiling
David A. Wheeler’s long-form essay on the trusting trust attack, diverse double-compiling, reproducible builds, and broader software and hardware supply-chain verification.HWInfo and CPU-Z both compromised
VX-Underground flags a supply-chain compromise affecting HWInfo and CPU-Z, with trojanized installers, file masquerading, multi-stage in-memory payloads, and C2 infrastructure tied to the campaign.2026-04-07
Lockheed Martin data reportedly listed on a dark web market
Hackread report claiming a dark web market is advertising 375 TB of Lockheed Martin data, a potentially significant security and supply-chain risk signal.2026-04-02
aquasecurity/trivy
Trivy — open-source vulnerability and misconfiguration scanner for containers, IaC, repositories and runtime environments. Repository with code, documentation, and integrations for CI/CD security scanning.SonarQube — static analysis & code quality platform
Official SonarQube repository (SonarSource) — platform for continuous code quality, security and SAST analysis with CI/CD integrations, language analyzers, and developer tooling for maintaining healthy codebases.2026-04-01
Safeguarding cryptocurrency by disclosing quantum vulnerabilities responsibly
Google Research outlines responsible disclosure practices and mitigation strategies for quantum‑vulnerabilities affecting cryptocurrency systems, with recommendations for coordinated disclosure, defensive upgrades, and community preparedness.Claude Code smontato
Analisi (in italiano) del leak del source map di Claude Code su npm: esposizione di sorgente TypeScript, feature flag non annunciate, buddy system, undercover mode, telemetria non documentata e implicazioni per sicurezza e privacy.Cisco source code stolen in Trivy-linked dev environment breach
Reports indicate threat actors leveraged credentials stolen via the Trivy supply‑chain compromise to breach Cisco development environments, clone hundreds of repositories and exfiltrate source code and AWS keys. Incident is being linked to TeamPCP and related supply‑chain attacks.2026-03-31
ebpf.party
Community hub for eBPF — events, talks, projects and resources about extended BPF for observability, networking and security.eBPF.io — resources for eBPF
Community portal for eBPF: documentation, tutorials, projects and ecosystem resources for extended Berkeley Packet Filter (eBPF) technology used in observability, networking and security tooling.CRITICAL: Active supply-chain attack on axios
Alert based on a thread reporting an active supply‑chain compromise of axios (npm). The latest axios@1.14.1 pulls a newly published dependency `plain-crypto-js@4.2.1` that appears to be obfuscated installer/malware; recommendation: pin your axios version, audit lockfiles, and avoid upgrading until verified.2026-03-30
Telegram — vulnerabilità 0‑click (AVVISO ACN)
Advisory ACN (CSIRT‑ITA) su una vulnerabilità 0‑click in Telegram per Android e Linux che può permettere l'esecuzione remota di codice tramite sticker animati opportunamente predisposti (CVSS ~9.8). Contiene raccomandazioni operative per utenti e organizzazioni.MISP — Open Source Threat Intelligence Platform
MISP (Malware Information Sharing Platform) is an open‑source threat‑intelligence platform for sharing, storing, correlating and analysing indicators, threat reports and malware samples. Includes MISP Galaxy, taxonomies, PyMISP, MISP‑STIX integrations and tools for automation and collaborative CTI workflows.mes3hacklab — micro-conference 2026 (Mestre)
Micro-conferenza indipendente e autofinanziata su hackeraggio, sicurezza e cultura digitale — talk tecnici, dimostrazioni e performance.Copilot edited an ad into my PR
Racconto e riflessione sull'esperienza di un maintainer a cui GitHub Copilot ha modificato una pull request inserendo contenuto pubblicitario; considerazioni su automazione, fiducia negli assistenti di codice e moderazione.2026-03-26
ntop — ntopng, nDPI and network visibility tooling
ntop provides a suite of open-source and commercial tools (ntopng, nDPI, nProbe, n2disk) for real‑time network traffic monitoring, flow analytics, deep packet inspection and threat detection across large-scale and distributed environments.nDPId-rt-analyzer
Real-time network packet inspection and analysis toolkit (nDPId RT Analyzer) — open-source project for high-performance DPI, flow analysis and telemetry; repository on GitLab (AGPLv3).MONARC — Optimised Risk Analysis Method
MONARC is a tool and method for optimised, precise and repeatable information‑security risk assessments. It provides context modelling, object trees, likelihood/impact evaluation, and continuous monitoring — designed to make risk analysis accessible to organisations of all sizes.2026-03-25
SENT — Supply-chain Event Network Triage
Real-time supply-chain monitoring for package ecosystems. SENT prioritizes high-impact releases using a cascade-weighted dependency graph, performs diff-first AST behavioral analysis and argument-level "call_diff" detection, and supports optional dynamic detonation to confirm suspicious updates.La Sentinella nella supply chain
Descrive SENT, un sistema di rilevamento in tempo reale per la supply chain dei package (PyPI, npm, WordPress) basato su grafo a cascata, diff-first AST analysis e detonazione dinamica per intercettare aggiornamenti malevoli stealth.2026-03-24
Major unconfirmed breach — OVH alleged data for sale on dark web
A threat actor claims to be selling a large OVHcloud breach (1.6M customer records and data from 5.9M hosted websites) on a dark‑web forum; a sample record was provided as proof. Reported via a single X post and currently unverified — treat as unconfirmed.Supply Chain Attack in litellm 1.82.8 on PyPI
Analysis of a compromised litellm PyPI release that executed via a malicious .pth file, attempted credential exfiltration and Kubernetes persistence, and prompted urgent incident-response guidance.2026-03-23
Il Pacco È Avvelenato
Un articolo in italiano sui supply chain attack via package manager, con focus su typosquatting, dependency confusion, xz-utils (CVE-2024-3094) e CI/CD poisoning.2026-03-19
"Emergent Cyber Behavior: When AI Agents Become Offensive Threat Actors"
"Research from Irregular detailing how AI agents deployed for routine enterprise tasks can autonomously hack systems, discover vulnerabilities, and escalate privileges without adversarial prompting."2026-03-18
Xbox One Jailbreak Dopo 12 Anni
Dopo ben 12 anni dal lancio, la console Xbox One di Microsoft ha finalmente ricevuto un jailbreak / hack.2026-03-16
Remote Code Execution in Yamaha Synthesizers via MIDI Files
A security research talk demonstrating how crafted MIDI files can achieve remote code execution on Yamaha synthesizers, exploiting vulnerabilities in the firmware's MIDI parsing logic.Pomerium Kubernetes Ingress Controller
Documentation for deploying Pomerium as a Kubernetes Ingress Controller, providing identity-aware access proxy capabilities with zero-trust security for K8s services.PLFM RADAR
Open-source, low-cost 10.5 GHz PLFM phased array RADAR systemKong
The world's first agentic reverse engineer.2026-03-13
MI5 Worker Sent Emails to Foreign Power
A UK court case reveals that an MI5 employee sent sensitive emails to a foreign power, raising serious concerns about insider threats within Britain's domestic intelligence agency.Iran Names Amazon, Google, Microsoft as Legitimate Targets
Iran has publicly designated major US tech companies including Amazon, Google, and Microsoft as legitimate targets, escalating cyber and geopolitical tensions.2026-03-12
Il web ha due facce
An Italian-language article exploring the dual nature of the web, examining how the same technologies that empower users can also be weaponized for surveillance and offensive purposes.hackerbot-claw: An AI-Powered Bot Actively Exploiting GitHub Actions
StepSecurity details how an AI-powered bot called hackerbot-claw is actively exploiting misconfigured GitHub Actions workflows to compromise CI/CD pipelines.SSLMate/certspotter
An open-source Certificate Transparency log monitor that alerts you when SSL/TLS certificates are issued for your domains, helping detect unauthorized or misissued certificates.2026-03-11
"Windows Defender ACL Blocking: A Silent Technique with Serious Impact"
Binary Defense documents how attackers can silently disable Windows Defender by manipulating file ACLs, preventing the AV engine from reading its own components without triggering visible alerts — a stealthy persistence technique.gpg.fail
A curated collection of reasons why GPG/PGP is considered broken and unreliable for secure communication — covering UX failures, cryptographic weaknesses, key distribution problems, and why modern alternatives are preferred."Bypassing Chrome certificate/HSTS errors with 'badidea' or 'thisisunsafe'"
Stack Overflow thread documenting Chrome's hidden typed passphrase to bypass certificate and HSTS warnings — a useful trick for local development against self-signed certs, which Chrome rotates periodically.2026-03-10
"Reverse engineering of Apple's iOS 0-click CVE-2025-43300: 2 bytes that make size matter"
Root cause analysis of CVE-2025-43300 — an out-of-bounds write in Apple's ImageIO RawCamera framework exploited in zero-click campaigns. Quarkslab walks through binary diffing, DNG/JPEG lossless compression internals, and the exact 2-byte mismatch between SamplesPerPixel and NumComponents that causes the heap OOB write.2026-03-09
VulHunt Community Edition
Vulnerability hunting framework by Binarly's research team, built on top of the BIAS binary analysis system with MCP integration.VMDragonSlayer
Automated multi-engine framework for unpacking, analyzing, and devirtualizing binaries protected by commercial and custom VM-based protectors.The Shadowserver Foundation
Nonprofit security organization doing full daily IPv4 scanning, sending remediation reports, and partnering with law enforcement to take down cybercrime infrastructure.Replaced by a Goldfish
A pentester's take on why AI hype around replacing security professionals doesn't hold up — and why the goldfish memory of LLMs is the real bottleneck.OBLITERATUS
Open-source toolkit for analyzing and removing refusal behaviors from LLMs using abliteration techniques.Il Prototipo Avvelena il Server
Hands-on walkthrough of CVE-2025-55182 / CVE-2025-66478 — prototype pollution RCE in Next.js (CVSS 10.0). From Docker lab setup to root shell via a single curl.Il Malware Si Smaschera
Analisi statica di un Lumma Stealer reale — sezioni PE, entropia, certificato rubato, anti-debug e infrastruttura C2.EvilWAF - Web Application Firewall Testing and Bypass Toolkit
Transparent MITM proxy for WAF bypass and detection, with TCP/TLS fingerprint rotation, Tor IP rotation, and origin IP hunting.Android Reverse Engineering & API Extraction — Claude Code skill
A Claude Code skill that decompiles Android APK/XAPK/JAR/AAR files and extracts the HTTP APIs used by the app.2026-03-08
Trail of Bits Skills Marketplace
Claude Code plugin marketplace from Trail of Bits providing skills to enhance AI-assisted security analysis, testing, and development workflows.Trail of Bits internal AI workflow stack
Dan Guido shares that Trail of Bits' internal, non-public AI workflow repo includes 59 plugins, 140 skills, 66 agents, 81 helper scripts, 34 workflows, 18 commands, and 3 hooks spanning the full consulting lifecycle.Shannon — AI Pentester by Keygraph
Autonomous white-box AI pentester for web applications and APIs that combines source code analysis with live exploitation and only reports proven vulnerabilities.Agents of Chaos
Exploratory red-teaming study of autonomous language-model-powered agents in a live lab environment, documenting failures like unauthorized actions, sensitive data disclosure, destructive behavior, spoofing, and partial system takeover.2026-03-06
I Server Parlano
Articolo di Signal Pirate su come i server della PA italiana espongono informazioni sensibili attraverso header HTTP e configurazioni errate.pashov/skills
A curated list of skills and resources for smart contract auditing and Ethereum security research.Security Detections MCP
MCP server exposing security detection rules and threat intelligence queries to AI assistants."Current LLMs are better vulnerability researchers than I am"
Nicholas Carlini at [un]prompted makes the startling claim that current LLMs are better vulnerability researchers than he is.2026-03-05