Jan retweeted
I've decided to finally release my vulnerability hunting methodology that I've been using for several months now, both in testing as well as live engagements with great success.
I was inspired by (and huge congrats to) the @Blackfrost_AI team open-sourcing Cyber-Frost Harness, their reproducible security-agent runtime with procedural skills, an evidence ledger, and isolated Docker targets for red/blue/purple work. 🎉
If you like the Cyber Frost Harness, and want some out of the box vulnerabilty hunting and POC development kit to go along with it - check out my VulnHunter.
It's already loadable: their harness reads standard SKILL.md skills. Point skill_dir at VulnHunter's (or run its installer), and the hunting, falsification, and PoC disciplines load immediately.
Repo: github.com/nealbridges/VulnH…
CREDITS: This is fork of @CapitalOne original repo. I simply took it a step further on POC development and model agnostic. I'm also actively developing in my forked repo as I make more changes to it and welcome the contributions from the community as well.
I think I'm doing the whole "respect who you give credit to" drama, and I asked my model to double and triple check it. So i can blame the model if its wrong. Otherwise, dont put me on blast on X if i suck at credits. /s
Looking forward to developing on this further with the community.
Jan retweeted
Introducing ARES 🛡️⚔️
Open-source autonomous red team & security validation platform built with FastAPI + React.
Features:
• Autonomous Attack Graph (DAG)
• MITRE ATT&CK Mapping
• Scope Firewall & Instant Reports
GitHub:
github.com/Mafifrizi/ARES
#RedTeam #CyberSecurity
How to use LLMs for vulnerability research by @ZephrFish
MCP: blog.zsec.uk/bullyingllms/
Harness: blog.zsec.uk/harnessing-harn…
#cybersecurity #llm
Jan retweeted
Update on CVE-2026-12569 / Cl0p / PTC Windchill
It is likely that Cl0p is actively exploiting CVE-2026-12569 in PTC Windchill. The deployed webshells use a custom HTTP header (X-windchill-req) as their authentication mechanism, running within Windchill's own process context to blend into legitimate application traffic, while spawning background SQL threads that enumerate the full Windchill file vault to map data ahead of exfiltration.
A built-in custom Java class loader allows attackers to execute arbitrary compiled code server-side via Base64-encoded ZIPs, without ever modifying the webshell again.
The webshell also harvests and decrypts LDAP credentials directly from Windchill's keystore, enabling follow-on access well beyond the initial foothold. Given Cl0p's history of rapid, widespread campaigns and the speed at which copycat actors replicate their techniques, organizations using PTC Windchill and PTC FlexPLM should treat this CVE with the highest priority.
Jan retweeted
Stix Viewer
Visualize and explore STIX data for threat intelligence and analysis.
stix-viewer.threatlandscape.…
All tools available at osintrack.com
#OSINT #CTI #DATAVISUALIZATION
Jan retweeted
new blog post: shrun, apiwatcher, and argus: three malware analysis tools built with Claude
antonioparata.blogspot.com/2…
#MalwareAnalysis #ReverseEngineering
Jan retweeted
Foresiet identified and analyzed Lucid Stealer, a Node.js SEA wrapper delivering a credential stealer and remote-access Trojan with persistence, wallet theft, keylogging, HVNC, and DDoS capabilities. foresiet.com/blog/lucid-stea…
Jan retweeted
Benchmarking LLMs for Malware Triage and static Unpacking with Malcat (binary analysis software) #Infosec #Malware #LLM malcat.fr/blog/benchmarking-…
Jan retweeted
Follow every Mythos discovery through our coordinated vulnerability disclosure dashboard.
red.anthropic.com/2026/cvd/
Jan retweeted
🚨 A critical RCE vulnerability in certain versions of n8n allows an authenticated attacker to execute arbitrary code with the privileges of the n8n process. Exploitation could lead to full compromise of the affected instance.
🔴 CVSS 9.9
🛠️ Patch available — upgrade immediately.
👉 See full advisory for more details: hubs.ly/Q03YVn9L0
#cve202568613
Jan retweeted
ZDI drops barebones advisories on several Ivanti 0days. Here's one timeline zerodayinitiative.com/adviso…
Jan retweeted
Public Dashboard links:
CVE-2025-53770 tracker:
dashboard.shadowserver.org/s…
CVE-2025-53770 vulnerable breakdown:
dashboard.shadowserver.org/s…
Compromised SharePoint (IPs only, not vhosts or orgs):
dashboard.shadowserver.org/s…
Jan retweeted
🚨 Got a great idea for an AI + Security competition?
@satml_conf is now accepting proposals for its Competition Track! Showcase your challenge and engage the community.
👉 satml.org/call-for-competiti…
🗓️ Deadline: Aug 6
Jan retweeted
🕵️ Windows Forensic Commands: Investigate, Analyze & Respond 🔍💻
When a security incident occurs on a Windows system, knowing which commands to run can make the difference between guessing and solid digital forensics 🧠⚖️
⤵️ Blue Team ⤵️
Jan retweeted
Join @GoogleCloudSec, @NLawGlobal, and FTI Consulting for exclusive insights into 2024 Middle East cyber incidents.
Register now: bit.ly/4kv0RWo
Jan retweeted
Very interesting story which in my opinion that shows how the Chinese surveillance state is even "knocking off" on itself when it comes to IP/Data. This is some great research from SpyCloud Labs! Very proud of the Labs Research Team! wired.com/story/chineses-sur…
Jan retweeted
CVE-2024-50379: RCE through a race condition in Apache Tomcat
PoC
github.com/ph0ebus/Tomcat-CV…
Jan retweeted
T-Mobile has been breached again.
The Chinese hacking group 'Salt Typhoon' were able to compromise T-Mobile as part of a campaign to spy on high value intelligence targets.
T-Mobile came out and said that their systems have not been impacted in any significant way and there's no evidence of customer data being stolen.
This is the same group that compromised Verizon and AT&T just last month.
Source: wsj.com/politics/national-se…
garak has moved to NVIDIA!
New repo link: github.com/NVIDIA/garak































