ZeroBS_GmbH retweeted
Now that we can point machines at everything we’ve built over the last 40 years, I’m starting to think a lot of it was “security by obscurity” all along.
There just weren’t enough skilled people looking at how broken it actually was.
ZeroBS_GmbH retweeted
My quick write-up on NoName057(16) & Z-Pentest's claim that they are involved with Danfoss freezer cyber attacks
TL;DR: they did make this claim, the posts are still online, but I don't buy it & neither should you
fromcyberia.substack.com/p/d…
ZeroBS_GmbH retweeted
CyberSec Trends Q4/26 🔮
⬆️ AI-driven attacks (ARTEX, Cairn)
⬆️ 0day / critical RCE disclosures
⬆️ Software supply-chain attacks
⬆️ Token/OAuth app abuse & cloud persistence
↗️ EDR blinding / killing (vulnerable or malicious signed drivers)
↗️ Persistence on systems outside EDR coverage
↗️ Abuse of legit RMM / tunneling tools
ZeroBS_GmbH retweeted
Interesting finding from my colleagues for anyone following #PHP2SHELL activity
They found a Linux botnet sample that already has code targeting CVE-2026-109618 integrated into its existing exploit routines, alongside eight other CVEs
#PHP2SHELL is already making its way into active Linux botnet arsenals.
Spotted a THOR-detected sample with PHP2SHELL-VULN-CVE-2026-109618 integrated alongside 8 existing CVE exploit references.
Botnets are adapting fast.
Patch ASAP and assess your systems for signs of compromise. Don't assume you're safe just because you've patched.
virustotal.com/gui/file/a75f…
ZeroBS_GmbH retweeted
php2shell is one of the most impactful bugs in recent times, yet threat actors aren’t mass exploiting it
the bug is so complex that even porting the exploit between targets takes serious skill, human or ai
so i benchmarked how well open and frontier models can do it. 🧵
ZeroBS_GmbH retweeted
Sometimes it seems security is drifting back towards a "Prevent Breach" mindset.
Prevent breach was never enough. Patch faster, of course.
But offensive AI is about a lot more than finding bugs!
Invest in Assume Breach!
Grow an internal Red Team. Automate offensive AI. Learn with defenders what matters
Exploit yourself before someone else does it for you.
In the end, you will not patch your way out of this.
ZeroBS_GmbH retweeted
Clean lab environment for local testing. Lab and PoCs for the PHP session.upload_progress memory-corruption bugs, CVE-2026-109618 and CVE-2026-109619. Five exploitation chains from one root cause. Each phase has its own folder with a self-contained Docker lab and a PoC. github.com/TheCyberGeek/php2…
ZeroBS_GmbH retweeted
Just published our high fidelity scanner for php2shell: github.com/assetnote/php2she…
See our detection logic here: slcyber.io/research/high-fid…
We've taken care in our detection logic and hope it helps defenders. Congrats to @calif_io and @lcfr_hax for the discovery.
ZeroBS_GmbH retweeted
See how the exposure of Danfoss refrigerators has changed over time: trends.shodan.io/search?quer…
ZeroBS_GmbH retweeted
Ein DDoS-Angriff auf einen Kunden hat auch uns getroffen.
Wir betreiben seine Internetanbindung, deshalb sind die Angriffswellen vom 11. bis 13. August auch bei uns angekommen. In der Spitze waren es geschätzt 500 bis 600 Gbit/s, 260 Gbit/s davon haben uns zwei Upstream-Provider direkt bestätigt. Getroffen hat es Applikationen auf Deploio, unsere Website, das Cockpit und unser Ticketsystem. Einen unbefugten Zugriff auf Daten hat es nicht gegeben. 🔒
Im Postmortem legen wir offen, welche drei Lücken der Angriff in unserer Abwehr aufgedeckt hat und was wir seither an unserer Infrastruktur geändert haben. Dazu gibt es eine konkrete Empfehlung, falls du eigene Domains auf Deploio betreibst. 🔍
Eines haben wir bewusst nicht gemacht: unsere eigenen Dienste von Deploio abgezogen. Wir nutzen weiterhin dieselbe Plattform wie unsere Kundinnen und Kunden, machen sie aber robuster.
Das ganze Postmortem: nine.ch/de/blog/ddos-angriff… 👈
#ddos #postmortem #incidentresponse #deploio #cloud #nineinternetsolutions #cloudnavigators #nine
ZeroBS_GmbH retweeted
easily the best video on the Hugging Face incident I've seen. By @NielsProvos
youtu.be/B7SGWOtt9rA
ZeroBS_GmbH retweeted
By the time Anthropic and OpenAi roll out a working CVP/TAC for verified cybersecurity professionals, most will have already migrated to local models and will never come back.
ZeroBS_GmbH retweeted
The FBI and DOJ are announcing the seizure of internet domains associated with NightmareStresser, one of the world’s longest running Distributed Denial of Service (DDoS) for-hire services. Since 2022, the NightmareStresser Booter service was used to launch hundreds of thousands of actual or attempted DDoS attacks targeting victims worldwide. These actions were taken in conjunction with Operation PowerOFF, an ongoing effort among international law enforcement agencies aimed at dismantling criminal DDoS-for-hire infrastructure worldwide.
The seizures announced today were performed by @FBIAnchorage in coordination with the Royal Canadian Mounted Police.
🔗justice.gov/usao-ak/pr/fbi-s…
ALT Seized website notice displaying seals of the Department of Justice, FBI, and Royal Canadian Mounted Police with a warning about illegal DDoS-for-hire services.
ZeroBS_GmbH retweeted
We recently sinkholed a DDoS #botnet of 200,000 compromised Android TV boxes infected with #CECbot malware 🕵️♀️. Shortly after, the threat actor responded by registering a rather specific botnet C2 domain 👇
📡 spamhaushackers .at
Nice try, but their new C2 domain is already flagged🛑. Its authoritative DNS runs on DNSPod (*.dnspod.com), which has carried a poor reputation for years! 💡
⤵️⤵️⤵️⤵️
hunting.abuse.ch/hunt/6aa7e8…
ALT abuse.ch Hunting
ZeroBS_GmbH retweeted
After at least a month of inactivity, Handala, the Pro-Iran hacktivist group has claimed an internet outage in the US state of Winsconsin.
The group remains intent on causing disruption to US citizens as they seek to have both cyber and information effects on the landscape
ZeroBS_GmbH retweeted
Fascinating to see more pro-Russian hacktivist arrests...
Funny to think most folks still disregard hacktivists as a nothing threat in the landscape
Spain collars alleged pro-Russia hacktivist after FBI tip-off theregister.com/security/202…
ZeroBS_GmbH retweeted
Our platforms were recently targeted by a large-scale web scraping operation originating from devices that are apparently participating in residential proxy networks 🏘️ 🖥️ . The vast majority of these requests were successfully blocked by our existing mitigations 🛑 . However, the sheer volume of traffic caused temporary disruptions to both the MalwareBazaar and URLhaus platforms ⚠️
To put the scale into perspective, our web platforms typically handle approximately 1,500 requests per second (excluding traffic to our community API and commercial APIs). During this incident, the scraping operation leveraged more than 135,000 unique IP addresses, most of which could be identified as nodes in residential proxy networks 🔍
The offender attempted to remain undetected by sending very few requests (less than 5) per IP address to the platforms 🕵
Below are the top networks sourcing this traffic (by unique IPs):
2,961 AS25019 SAUDINETSTC 🇸🇦
1,995 AS206206 KNET 🇮🇶
1,984 AS9121 TTNet 🇹🇷
1,954 AS3215 Orange 🇫🇷
1,871 AS12322 PROXAD 🇫🇷
1,550 AS5410 BOUYGTEL-ISP 🇫🇷
1,531 AS37705 TOPNET 🇹🇳
1,413 AS8193 BRM-AS 🇺🇿
We are sharing details of the involved IPs, along with the relevant timestamps, here for your awareness ⤵️
raw.githubusercontent.com/ab…
ALT Top countries sourcing residential proxy IPs targeting abuse.ch platforms