Jonas Vestberg (@bugch3ck) profile picture

Jonas Vestberg

@bugch3ck

Privilege Escalation Engineer Principal Consultant @ Reversec (formerly WithSecure Consulting)

 @bugch3ck.bsky.social
Joined August 2011
  • Tweets6K
  • Following372
  • Followers1.9K
480Media
Photo by Jonas Vestberg (@bugch3ck)Photo by Jonas Vestberg (@bugch3ck)Photo by Jonas Vestberg (@bugch3ck)Photo by Jonas Vestberg (@bugch3ck)Photo by Jonas Vestberg (@bugch3ck)Photo by Jonas Vestberg (@bugch3ck)Photo by Jonas Vestberg (@bugch3ck)Photo by Jonas Vestberg (@bugch3ck)Photo by Jonas Vestberg (@bugch3ck)Photo by Jonas Vestberg (@bugch3ck)
Jonas Vestberg retweeted
Nathan McNulty (@NathanMcNulty) profile picture
Nathan McNulty
@NathanMcNultyNov 8
Image from Nathan McNulty (@NathanMcNulty)
Juan Pablo (@master_jpma) profile pictureJuan Pablo
@master_jpmaNov 7
I'm 43, is it too late to start over? Be honest.
1
3
61
2,240
Jonas Vestberg retweeted
Phrack Zine (@phrack) profile picture
Phrack Zine@phrackNov 8
30 years ago today, Phrack 49 published Aleph One’s “Smashing the Stack for Fun and Profit”. A legendary paper that inspired generations of hackers and helped shape modern exploit development. Still an essential reading. phrack.org/issues/49/smashin… Phrack 73 is coming soon!
Image from Phrack Zine (@phrack)
28
386
35
1,499
57,146
Jonas Vestberg retweeted
Swear Trek (@swear_trek) profile picture
Swear Trek@swear_trekOct 29
26
310
12
2,496
41,644
Jonas Vestberg retweeted
Satan (@s8n) profile picture
Satan
@s8nOct 27
Image from Satan (@s8n)
21
2,709
18
17,410
137,298
Jonas Vestberg retweeted
5pider (@C5pider) profile picture
5pider
@C5piderOct 25
Looks like @github suspended my account. I haven't used github for anything in the past couple of days. Great. A bit frustrating. If anyone from the support team sees this my ticket is: #4903946
Image from 5pider (@C5pider)
34
24
5
231
26,263
Jonas Vestberg retweeted
Timothy Ash (@tashecon) profile picture
Timothy Ash@tasheconOct 16
Finally one billionaire with some balls.
Olga Nesterova (@onestpress) profile pictureOlga Nesterova
@onestpressOct 15
Image from Olga Nesterova (@onestpress)
539
3,246
73
23,412
898,789
Jonas Vestberg retweeted
Zoë (@ZoeCatherineF) profile picture
Zoë
@ZoeCatherineFOct 9
True love
Image from Zoë (@ZoeCatherineF)
70
2,529
136
32,757
493,488
Jonas Vestberg retweeted
Pavel Yosifovich (@zodiacon) profile picture
Pavel Yosifovich
@zodiaconSep 23
What is OBJECT_ATTRIBUTES and how it's used? The Windows API hides it, but every native create or open call needs it. Full write-up: trainsec.net/library/windows…
Image from Pavel Yosifovich (@zodiacon)
1
18
133
5,554
Jonas Vestberg retweeted
AI Scrapbook (@AiScrapbook) profile picture
AI Scrapbook
@AiScrapbookSep 4
Pippi Långstrump ai-genererad parodi i gammal japansk samurai-filmstil. Jag har följt utvecklingen av de här ai-modellerna inom generativ bild, video, musik och ljud, hands on sedan 2022. Jag är helt blown away av det här. Vi är alltså här nu. #aivideo #svenskfilm #parodi
🤖 Made with AI
62
205
38
1,999
235,756
⚒️ BTR Reforged: Weaponizing Defender's Remediation Driver as a Kernel Operation Primitive ⚠ Trusted Remediation Primitives with Undocumented Internals. 🔓 15+ years. Unchanged. Unblockable. 🤔 What if an attacker learned its language? We did. 👇 research.checkpoint.com/2026…
BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive - Check...

BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive - Check...

Research by: Jiří Vinopal (@vinopaljiri) Abstract What if a trusted security component could be repurposed into an attacker-controlled kernel primitive? What if a signed Microsoft remediation driver...

research.checkpoint.com
3
25
5
58
27,681
Jonas Vestberg retweeted
Johnny Fishcake (@johnnyspandex) profile picture
Johnny Fishcake@johnnyspandexAug 18
Weaponising MDM - running a fake MDM server and pwning people as SYSTEM with two clicks (if they have permission to elevate). Poc included. blog.amberwolf.com/blog/2026…

NachoMDM - Weaponising Windows MDM for UAC Bypass and SYSTEM Execution via Malicious Enrollment

AmberWolf Security Research Blog

blog.amberwolf.com
1
23
58
4,256
Jonas Vestberg retweeted
SpecterOps (@SpecterOps) profile picture
SpecterOps@SpecterOpsAug 18
BloodHound is 10 🎉 To celebrate, creators @_wald0, @CptJesus & @harmj0y joined for a special two-part #KnowYourAdversary. They reminisce on the first attack graphs and look ahead to what’s next for BloodHound. 1️⃣: ghst.ly/4xT4WdA 2️⃣: ghst.ly/4zIIeqj
Image from SpecterOps (@SpecterOps)
2
9
1
33
11,373
Jonas Vestberg retweeted
XBOW (@Xbow) profile picture
XBOW
@XbowAug 17
😎
Image from XBOW (@Xbow)
1
8
1
49
20,626
Jonas Vestberg retweeted
Richard Hicks (@richardhicks) profile picture
Richard Hicks
@richardhicksAug 17
So, you've deployed NDES on-premises to issue SCEP certificates with #Microsoft Intune. Did you know it's leaking internal domain information to the Internet? Here's how to detect and remediate this issue. rmhci.co/3TRfYkR #mobility #security #identity #pki #msintune
Image from Richard Hicks (@richardhicks)
2
11
41
3,245
Jonas Vestberg retweeted
Chris Thompson (@_Mayyhem) profile picture
Chris Thompson@_MayyhemAug 13
Patch SCCM with learn.microsoft.com/en-us/in… or you're likely vulnerable to a new hierarchy takeover technique (CVE-2026-47301) discovered by Omri Baso from @XMCyber_ that worked in my lab out of the box. MS's KB description doesn't do the impact justice. medium.com/@omribaso/from-do…
25
63
5,294
Jonas Vestberg retweeted
Andy Davidson (@totalwormage) profile picture
Andy Davidson@totalwormageAug 11
Image from Andy Davidson (@totalwormage)
1,107
1,373
125
32,589
1,481,324
Jonas Vestberg retweeted
Hai Tung (@tacbliw) profile picture
Hai Tung@tacbliwAug 10
Someone dropped this Windows LPE writeup online yesterday along with a PoC. But the mentioned CVE-2026-62737 is not released yet, maybe it will be in the Patch Tuesday tomorrow. And the PoC still work in the lastest version of Windows 😂 xz.aliyun.com/news/92658

Windows11 0day内核提权漏洞分析与利用（CVE-2026-62737）

本文分析了 Windows 11 ExecutionContext.sys 驱动中存在的任意内核代码执行漏洞，攻击者可通过 NDIS KLoader 代理路径绕过 ACL 限制，利用任务队列机制中缺乏有效校验的回调指针实现 RIP 劫持。文章详细阐述了从用户态可达入口发现到构造 ROP 链完成本地提权。

xz.aliyun.com
6
102
2
513
66,290
Jonas Vestberg retweeted
DANΞ (@cryps1s) profile picture
DANΞ
@cryps1sAug 6
Our Black Hat talk on the OpenAI-Hugging Face incident is now live on youtube. This is a watershed moment for the industry. I encourage all defenders to watch, consider how attack dynamics will imminently change, and plan for accelerating defense. youtube.com/watch?v=87DyyMV0…
69
251
72
1,232
481,552
Jonas Vestberg retweeted
Internet of Shit (@internetofshit) profile picture
Internet of Shit
@internetofshitAug 6
use this one WEIRD trick to make your customers never purchase your car again
James Walker (@jwalkermobile) profile pictureJames Walker
@jwalkermobileJul 30
Check this out, today when you start your BMW, you see an advert for #spiderman #brandnewday
6
29
2
186
14,213
Not sure about posting here again but I want to go back to doing what I love: making cool art for hackers and it seems like most of you stayed here. So, I still hate the guy in charge but I might post some stuff here.
1
1
1
17
879
Load more