Episode 20: War Stories with Julien Richard! @tib3rius.bsky.social & @swiftsecur.bsky.social chat with Julien Richard about his war stories! Thank you to @portswigger.net for sponsoring today's episode! Check out portswigger.net/burp/ai to learn more about AI in Burp Suite. Links below!

SAUSAGE.....those who know.....know. All will be revealed..

oh fuck off...while my heads been down making CTF's...I pop my head up for 5 seconds and NPM is on fire again...

I need sleep. Been building a CTF based around firmware reversing, crypto mishaps and a sprinkling of MQTT..because why not... for the last few days...its gunna be a wild ride in the morning when my teams gets let loose on it...good luck yawll..ill be sleeping in the corner.

Episode 19: DEF CON! @tib3rius.bsky.social & @swiftsecur.bsky.social chat about DEF CON, the world's biggest hacker convention, which Andy attended for the first time this year! Links below!

Someone asked me what I was eating for lunch, I said 'er poached eggs'....I couldn't tell them it was actually a dipping egg with soldiers.

eeeek

Now I'm awake and stuff.. I don't want to be dismissive of the NPM thing..sensationalist headlines help no one, some are def overhyped for clicks...but this had potential to hit different...and thats the kinda interesting bit... This is a cool link: www.securityalliance.org/news/2025-09...

Episode 18: UK Online Safety Act @tib3rius.bsky.social & @swiftsecur.bsky.social chat with Daniel Card about the controversial UK Online Safety Act. Links below!

cybersecuritynews.com/sshamble/ This is a coolio tool, github here: github.com/runZeroInc/s...

Episode 17: Common Vulnerability Scoring Sucks? @tib3rius.bsky.social & @swiftsecur.bsky.social chat about the problems with CVSS. Links below!

Episode 15: Why Can't Pentesters Scope? @tib3rius.bsky.social & @swiftsecur.bsky.social discuss why they (pentesters) can't scope very well. Links below!

So....I built a new scheduling/resourcing system for pentesters, its been a fun project...but now, the irony....it is being pentested....hold onto your hats people...this is going to be a bumpy ride 🤣 #pentesting

www.omgubuntu.co.uk/2025/07/ubun... This is kinda interesting, maybe helpful for forensics 😆

This has been my fav so far.... @davidkuszmar.com was awesome, we got to have him back. LIGHT THE RIVER ON FIRE!

Episode 14: Ignore Previous Instructions & Interview David Kuszmar @tib3rius.bsky.social & @swiftsecur.bsky.social interview AI security researcher @davidkuszmar.com about his incredible LLM jailbreaks and exploits! Links below!

I dont really ask people to be references, imo security and privacy are important in our work, yet.. most large bid contracts ask for them, whats funny is the ones asking often decline to be references themselves citing security policy as the reason...vicious cycle.

On me way to London guv :) at the Imperial War Museum today for a bit of a workshop with some clients, fun day ahead!

thehackernews.com/2025/06/citr... Uh oh....

www.darkreading.com/vulnerabilit... ahhh here we go again :) This is giving me serious PTSD, last time out the IR bat signal was on constantly for a good few weeks 😂 No evidence of wild exploitation yet apparently...but still.

thehackernews.com/2025/06/qili... lol wtf is this.... 🤣

I've always found it works best not to use non-existent settings..

Episode 13: US Tech Market Dominance @tib3rius.bsky.social & @swiftsecur.bsky.social chat about why the US tech and cybersecurity markets are so dominant in the world. Prepare for some hot takes. 🔥🥵 Links below!

cybersecuritynews.com/linux-privil... Few big ones for Linux...one is all Suse but the other is a lil more interesting LPE.

uh huh 👍

Ah ha! looks like these are doing the rounds again :D Careful pulling in packages..as more people are now coding via the vibes...I wonder if we will see more of this type of thing.. thehackernews.com/2025/06/mali...

Always check for DCs with the Pre-Windows 2000 Compatible Access group enabled. Just saw one where pre-2000 support was ticked at setup - null sessions wide open. If netexec screams null but other hardening is in place, this group might’ve added Everyone/Anonymous.. #pentesting #CyberSecurity

There are a lot of really crap posts/news articles about how CVE-2025-33053 works with a lot of confusion around the actual components affected....the og research explains it really well with some really clear examples, great read...pretty simple: research.checkpoint.com/2025/stealth...

The car was so fast in this section, could brake super late and carry a bucket of speed, lush.

Today was an extremely cool day for me, professionally. @zigula.bsky.social and I released our latest bit of security research (hacking Fortnite's Gemini LLM) and I had an absolutely fantastic time speaking with @tib3rius.bsky.social and @swiftsecur.bsky.social on @acrosspondpod.bsky.social!

Are you a fan of #Fortnite? How about #StarWars? Do you like #AI stuff? For immediate release to the public: Kyber Jailbreak Executed on Fortnite Gemini LLM as Darth Vader NPC. Pub Disclosure: www.davidkuszmar.com/public-notic... Video Evidence: youtu.be/tOTF7tqRNNs?...

Got a good half day of testing the new engine and diff out on track yesterday, heavy rain in the second half so called it there...but, man the car shifts now, if not a bit twitchy mid corner so, some setup work to do and we are there :)

Raw footage of my actual scoping process when the client writes 'don't know' in every field of the scoping questionnaire... #pentesting

yea that sums up my coding pretty well....

A friend sent this over to me the other day...looks kinda interesting... exegol.readthedocs.io

Episode 11: Certified Rant @tib3rius.bsky.social & @swiftsecur.bsky.social rant about the chaos that is cybersecurity certs. Spotify: open.spotify.com/sho... Apple Podcasts: podcasts.apple.com/u... Amazon Music: music.amazon.com/pod... YouTube: www.youtube.com/chan...

If Fireman Sam taught me anything....its not to keep helping Norman Price.

Had a good chat with my mate @swiftsecur.bsky.social about the problem with app demo scoping calls. Don't get me wrong, demos are GREAT for learning how to use the app (100% required for a pentest). However they only show the surface and 95% of the pentest deals with the stuff under the water. 🧵👇

Recently seen quite a few orgs not ready for an incident..from lengthy procurement processes, lack of environment ownership.. to wanting to test all IR tooling before deployment; tldr - preparation is everything.. and it is NOT just technical..practice, rehearse. #Forensics #CyberSecurity

his was a fun snippet from the Lockbit dump, reminded me of an IR a year or so ago now where we saw evidence of the attackers checking out things like the targets cyber insurance...fun times. Reading through I don't think they ended up getting much of a discount..

10 Burp extensions I actually use... BUT none of them are in the top 30 most popular in the BApp Store! I get tired of seeing the same extensions come up in "top 10" lists. Here are some hidden gems you might not have tried... yet. In no particular order. 🧵👇

In the LockBit Affiliates Panel dump...the Unix timestamp for last online shows it being pretty active, but I also wonder if ransomware groups have issues with password reuse as well 😅 #cybersecurity #ransomware

Episode 10: Adventures in Social Engineering @tib3rius.bsky.social & @swiftsecur.bsky.social reminisce about their past social engineering engagements. Spotify: open.spotify.com/sho... Apple Podcasts: podcasts.apple.com/u... Amazon Music: music.amazon.com/pod... YouTube: www.youtube.com/chan...

Lockbit getting exposed the other day was interesting, lots of snippets of insightful conversations...and...wtf is this....a user table with plain text passwords!?

github.com/pop3ret/AWSo... Handy lil reference for AWS misconfigurations #pentesting #cyber

Doing some training with our team and @claranetcybersec.bsky.social this week on their Hacking Cloud Infrastructure course, nice to get some time out and recap a few things.

CobaltStrike licence...another one that has shot up by 1k a year since our last renewal. I love that tool, but its getting harder to justify with opensource alternatives offering more and more...

When you just don't want to trace cables... #datacentre

Found these bad boys as well in the junk room, 7600 series, they would have been worth a pretty penny back in the day. They are now retired and the traffic these can push pales compared to modern alternatives, but still...cool :) #Network #vintage 😂

I keep coming across people thinking of EDR/Monitoring tools as 'preventative' when just configuring stuff properly from the get go would actually benefit them more.. Not saying such tools are not valuable, but they are part of a security approach, not the entirety of it... #CyberSecurity