Bun0xd retweeted
In mid 2025, I was told by Eastern European business people Donald Jr. went around telling them "Let's do deals fast, as we have time into November 2026".
In other words, the outcome was predictable to them when it wasn't to most. Makes you wonder why.
Bun0xd retweeted
Google Threat Intelligence Group and @Mandiant, working with @manageengine METAL, wrote up UNC7017. They tampered with AOMEI update config files (down_html.ini and Notifycfg.ini) for a few minutes at a time, then put them back. Ephemeral supply chain tampering. 🧵
Bun0xd retweeted
New on LOLDrivers: Realtek RtsUpx.sys 1.13.0.0, a signed USB camera/hub/audio utility driver.
An admin has to load it, but once it is running, a regular user can send it IOCTLs to read and write physical memory. That is a short path from user land to the kernel.
Bun0xd retweeted
AnyDesk on Linux just got a public pre-auth root PoC.
@v12sec / @rickdejager published AnyPwn against AnyDesk Linux 8.0.2: a heap overflow in the session protocol that can run a command as root before anyone approves the connection. Direct TCP on port 7070. Fixed in 8.0.3 (changelog called it a crash). No CVE yet.
thehackernews.com/2026/10/re…
Bun0xd retweeted
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-your-ba…
Bun0xd retweeted
Two more EDR killers just landed on LOLDrivers, both from Jehad Abudagga's (@j3h4ck) KillerLand research.
Same BYOVD play: load a signed driver, hand it a PID, and let the kernel terminate the security tools for you.
github.com/redteamfortress/K…
Bun0xd retweeted
Crazy cool blog I saw on linkedin about an SMB signing bypass technique
TLDR: SMB re-auth reuses the original signing key and never checks the new identity matches the old. So you sign a session as a low-priv account you control, re-auth it with a relayed privileged login, and get a privileged session still signed with your original low-priv key, which btw is accepted even where signing is required, with DCs included.
blackfield.ch/blog/defeating…
Bun0xd retweeted
Is tomorrow Node2Shell? To be fair I need to dig into this one as it looks to be configuration dependent.
⚠️ Node.js is vulnerable to remote code execution.
CVE-2026-111497 (high): A Node.js process that decompresses attacker-controlled Brotli data can be made to leak memory or run arbitrary code.
You’re exposed if your app or a library decompresses bad Brotli data (e.g. the built-in fetch(), body-parser)
Aikido detects this. Patches are available.
Bun0xd retweeted
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: teapawt.net/lcfr_hax/status/208503…
His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
Bun0xd retweeted
Since I heard about this #PHP #RCE last week, I've been preparing a tool for everyone who doesn't know what to do right now:
process-watcher shows you every program your PHP processes start, with full command lines, so you can spot suspicious activity
Until a patch is out, isolation (containers) and tight monitoring are your best bet to limit the damage. And I'm sure the LLMs already go "brrrr" and people are trying to reproduce the vulnerability.
From what I've heard, exploitation will probably show up as suspicious sub process spawns. That's exactly what this watches, using eBPF: one static binary for Linux (amd64, arm64), no dependencies, running in a few minutes. It can also kill the ones you name (dry run first), but it's a detection layer, not a patch, and it can't see anything that happens inside PHP without starting a process.
Quick start: github.com/Neo23x0/process-w…
Project: github.com/Neo23x0/process-w…
Bun0xd retweeted
arstechnica.com/security/202…
The private keys for these certs are literally the numbers 4, 56, 66, 115, 155, 156, 230, and 237 (life imitates XKCD, again).
Bun0xd retweeted
As I have said for close to 15 years now: online ads = malware.
All individuals and companies should block ads based on DNS lists at the gateway or within browser extensions. My guide from a decade ago on how to secure your web browsing is still highly relevant and prevents these types of attacks:
teapawt.net/attrc/status/713473614…
Bun0xd retweeted
Our services team found multiple Ivanti Connect Secure 0days being exploited in the wild and against one of our Network Security Monitoring customers. The blog has the full attack details and IOCs!
.@Volexity has discovered in-the-wild exploitation of a #zeroday exploit chain targeting Ivanti Connect Secure VPN appliances (CVE-2026-104935). Beginning October 3, a previously unknown threat actor, UTA0576, chained three vulnerabilities to gain unauthenticated root-level code execution on a fully patched device. Notably, UTA0576 deployed no malware or web shell. Instead, the threat actor re-exploited the device for every command it ran and tampered with logs to cover its tracks, evading Ivanti’s Integrity Checker Tool.
Using its #Volcano memory analysis platform, Volexity analyzed the compromised device’s memory to uncover the full exploit chain and the attacker’s post-exploitation activity, which focused on credential theft, Active Directory reconnaissance, and data exfiltration. Volexity reported these findings to Ivanti through coordinated disclosure.
Read the full analysis, including detection guidance and IOCs, in our blog post here: volexity.com/blog/2026/10/13…
#DFIR #threatintel #memoryforensics
Bun0xd retweeted
President Trump’s decision to lift sanctions on Russian fuel amidst Putin’s ongoing and brutal attacks on civilian targets in Ukraine makes no sense and is a betrayal of the legacy and leadership of the late Senator Lindsey Graham.
While Ukraine fights for its survival, Putin’s war machine continues to prosecute his terrorist war on civilian populations and innocent Ukrainians are dying every day.
Now, Instead of implementing the tough sanctions Lindsey Graham fought to his last breath to enact, President Trump has announced the United States is lifting sanctions on Russian energy, fueling the Putin’s war machine.
As I saw firsthand in Ukraine last month, Putin is losing this war. Ukraine has fought the Russian military to a standstill and reinvented warfare with drones taking the fight into the heart of Russia.
America should not be throwing a lifeline to Putin’s war machine. Now is the time to stand strong against Russian aggression as we did during the first Trump administration.
Putin doesn’t want peace. Putin wants Ukraine. I have no doubt that if Putin overruns Ukraine, it will only be a matter of time until Russia’s military crosses a border that our troops will have to deal with him.
America is the Leader of the Free World. For our National Security, for the security of our Allies in Europe including Ukraine, President Trump should rescind this deal immediately and return to the strong policies of our four years in the White House; impose harsh sanctions on any nation purchasing Russian energy and work with our allies to ensure Ukraine has the military support it needs to repel and defeat this Russian invasion once and for all. Slava Ukraini🇺🇸🇺🇦
Bun0xd retweeted
Entropia - a compiled language for Windows shellcode.
It collapses the usual chain of compiler, linker and position-independence transform into one compiler that emits PIC x86-64 shellcode or Cobalt Strike BOFs directly.
OPSEC tricks like polymorphism, direct syscalls and ETW/AMSI patching ship as plain compiler flags.
A tool by @EntropyKit
Source: github.com/entropykit/entrop…
#redteam #blueteam
Bun0xd retweeted
This week let’s look at Active Directory domain permissions which are configured on the domain root and apply to the domain. There are many different type of concerning permissions, but let’s look at the most egregious.
Directory Changes & Directory Changes All – provides the ability to pull password hashes for users and computers (aka DCsync permissions).
Change Owner – provides the ability to set the owner on the domain root and the owner has the ability to set permissions.
Change Permission – provides the ability to set permissions on the domain root.
Full Control – provides the ability to control any type of object in the domain.
Full Control on Users and/or Computers – provides the ability to control the object type.
I wrote a PowerShell script leveraging the Active Directory PowerShell module that can help identify these permissions on the domain root: github.com/PyroTek3/ActiveDi…
For more on Active Directory permissions:
hub.trimarcsecurity.com/post…
specterops.io/wp-content/upl…
For more on DCSync: adsecurity.org/?p=1729
Reference Article:
adsecurity.org/?p=4941#more-…
Bun0xd retweeted
Just for your information:
We (offensive or defensive cybersec people) and threat actors don't have the same capabilities as the frontier labs do.
The API cost of testing ExploitBench like they did would be a whopping ~$59.3M (Astra).
Oh, and you cant do it like they do, they remove all guardrails and classifiers.
What about renting AI hardware in the cloud?
DeepSeek v4? $3.4M
Kimi K3? $16.9M
GLM 5.3? $9.3M
Not to mention the engineering cost to make a harness operate 10,000 agents.
(Napkin-Math based on the Huggingface reports. Exploit bench eval consisted of 10,000 concurrent agents, 8day non-stop run, no limiters)
Bun0xd retweeted
Want to stop npm supply chain issues?
Make three changes.
1. Use pnmp
2. Disable script execution
3. Use renovatebot but when a pin happens, delay it 3 days.
Most are detected pretty quickly and within hours, the delay 3 days for updates gives a nice buffer on if a compromised package is there.
Script execution should eliminate anything I've seen on compromised npm packages period.
Bun0xd retweeted
Alex's company is shipping secure-by-default hardened WiFi routers that support real enterprise, IOT, and ICS networks. The devices have been secured against AirSnitch attacks (public release at NDSS 2026) since 2022 as well as pre-secured against every other recent Wifi-based vulnerability.
It's BlackHat/DEF CON week so I'd like to interrupt your regularly scheduled chest drumming feed! Let's talk about a critical WiFi 7 memory corruption bug. The flaw was in Hostapd, the userland daemon which powers the world's WiFi on the majority of access points. I reported this in June and it's now patched upstream.
My proof of concept shows that authenticated clients can bypass ASLR to leak pointers OTA and inject code execution. 802.1X Enterprise WiFi 7 is basically exploitable pre-auth because of the "outer tunnel".
This bug was missed by LLM scans as well as human auditors, but found in the wifi gauntlet.
If you're at BH/DC this week and interested in the memory safe wifi stack we're building please reach out
Bun0xd retweeted
We (@Neuvik ) will be releasing Quantum Mechanic during this session. If you want an offensive Multi-Cloud attack tool, this may be one to watch.
Identity is the perimeter now, and every cloud handles it differently. @mosesrenegade breaks down a collision-course methodology for attacking interconnected, multi-cloud environments where misconfigs hide everywhere.
