🇲🇽 Cybersecurity professional | SOC Analyst | CTF player | DFIR, Threat Intelligence | I like to think like an attacker | Opinions are my own
127.0.0.1
Joined July 2012
- Tweets1.8K
- Following1.9K
- Followers394
- Likes24.5K
Pinned Tweet
APTNightmare-2 has been retired and I've been really excited to share the writeup I did back in march. This was a fun way to put my knowledge about LKM rootkits to practice. Very fun sherlock.
medium.com/@v4ltzz/hack-the-…
Jorge Gibbs retweeted
Hay un mexicano cuyo código probablemente has usado sin saberlo: Miguel de Icaza. 🇲🇽
Empezó con Midnight Commander, metió mano en el kernel de Linux y en 1997 fundó GNOME junto a Federico Mena, otro mexicano. Hoy GNOME es el escritorio por defecto de Ubuntu, Fedora, Debian y Red Hat.
Después creó Mono y Xamarin, que ayudaron a que .NET terminara siendo open source y multiplataforma.
Todo eso en los 90, colaborando por internet desde México.
Si quieren conocer más de la historia les dejo este post:
xataka.com.mx/aplicaciones/m…
Happy SOC Analyst Appreciation day to my fellow analysts and colleagues!
Happy SOC Analyst Appreciation Day! 💙
Today, we're recognizing some of cybersecurity's unsung heroes: the SOC analysts working behind the scenes to keep organizations safe.
From investigating suspicious activity and responding to incidents to sorting through countless alerts, SOC analysts are on the front lines of #cybersecurity defense every day.
It's demanding work that requires patience, persistence, technical expertise, and plenty of dedication. And while much of that work happens out of the spotlight, it doesn't go unnoticed.
To all the #SOC analysts out there: thank you for everything you do. Your work matters, and we appreciate you!
And for those interested in pursuing or advancing a SOC career, TCM Security offers two SOC-focused certifications, including the intermediate-level Practical SOC Analyst Professional (PSAP): hubs.la/Q04BCzbC0
La primera vez que di una charla dudé en hacerlo porque pensé que necesitaba ser un experto para compartir algo que para mí fue una experiencia de aprendizaje. Estaba equivocado.
Esta es una excelente iniciativa. Aprovechen este espacio para presentar esas ideas y experiencias.
En esta edición de #BugCON tendremos por primera vez la Villa Rookie: un espacio para estudiantes y personas que todavía no han tenido la oportunidad de presentar su trabajo frente a una comunidad: lnkd.in/eptg_NQb
Jorge Gibbs retweeted
GTIG has just released our latest quarterly AI threat tracker, a collection of case studies based on our unique visibility into this rapidly evolving threat. Criminals and state actors are making strong headway in speed, scale, and sophistication. 1/2 cloud.google.com/blog/topics…
Jorge Gibbs retweeted
@OpenAI just launched a new feature last night called Computer History. For DFIR analysts, this is a new artifact class worth knowing about. I turned it on on my MacBook, parsed the artifacts, and it produced about 3,616 timeline events from ~2 hours of normal work.
While Computer History is on, it logs input, app focus, and what was on screen, then stores it on the Mac. It keeps a timed record of what you clicked, typed, and opened, including chats in Slack, WhatsApp, Telegram, and other apps. That record stays on the Mac.
IRFlow-Timeline 1.0.10 now parses those Computer History artifacts and builds a timeline of the activity, so you can walk the investigation instead of grepping raw cache files. On a compromised Mac, this shows what was typed, clicked, and read. Not just that the app was installed.
#dfir #incidentresponse #openai #computerhistory
Jorge Gibbs retweeted
Shodan Membership sale is live until 2026-08-09 00:00 UTC (~48 hours from now): account.shodan.io/billing/me…
Jorge Gibbs retweeted
🚨 New entrant alert: Stark Industries Solutions debuts at #2 for newly observed botnet C&Cs between Jan and Jun 2026, with 931 detections in just six months. This 🇬🇧 UK-registered host is widely assessed to be 🇷🇺 Russian-operated bulletproof hosting, and it's now on Spamhaus's DROP and ASN-DROP lists.
Network operators: treat traffic to/from this ASN accordingly ⚠️
Read the full report👇
spamhaus.org/resource-hub/bo…
#BotnetCC #BulletproofHosting #ThreatIntel
Jorge Gibbs retweeted
Anyone who sees my talks on DEFCON, I'll bring these addons to give away... I'll see them there
My schedules
Friday
Payment village:
4pm
Saturday:
Red team village
4pm
Sunday:
Red team village
2pm
@defcon
#defcon #redteamvillage #paymentvillage #lavilla #blackhat #lasvegas
Jorge Gibbs retweeted
JUST IN: Growing number of job applicants are hiding prompt injections in their résumés — to trick AI screeners into ranking them as qualified candidates.
Was anyone able to take a look at what scam this was pushing?
My guess is probably stealer malware.
This quoted post is unavailable.
Jorge Gibbs retweeted
BREAKING: USERS ARE SHOWING THE SUPREME OMNIPOTENT POWER OF THE CLAUDE MYTHOS.
QUIT YOUR JOB IN CYBERSECURITY AND START PUTTING IN APPLICATIONS FOR MCDONALDS NOW
Jorge Gibbs retweeted
🎤 Step onto the stage at #FIRSTMX26
🔗go.first.org/jv1Xh
We’re looking for speakers to share practical insights, lessons learned, and emerging challenges in cybersecurity.
Be part of a truly global program.
Jorge Gibbs retweeted
🚨 A single stray "!" in the #Linux kernel's firewall code (nftables).
That one character let any normal logged-in user become root, and step out of the container.
The fix? One line.
And the exploit (CVE-2026-23111) to abuse it just went public.
Read: thehackernews.com/2026/06/on…
Jorge Gibbs retweeted
众多 MkDocs 笔记遭 polyfill[.]io 供应链投毒而弹窗
TL;DR: 如果你遇到了该弹窗，不要输入任何密码；如果你的 MkDocs / Material for MkDocs 站点或其他站点引用了 polyfill[.]io，请尽快删除这行配置。
More Details: github.com/inuEbisu/polyfill…
Ha sido de mis favoritas del año. Me da mucho gusto ver que le esté yendo tan bien, se lo merecen Curry Barker y todo su equipo :)
Jorge Gibbs retweeted
🚨The FBI has issued a Public Service Announcement warning about Kali365, an emerging Phishing-as-a-Service platform first observed in April 2026.
ic3.gov/PSA/2026/PSA260521
Distributed primarily through Telegram, Kali365 allows cyber threat actors to capture Microsoft 365 access tokens and bypass multi-factor authentication without needing to directly intercept a user’s password.
