Today I made my first portrait of the sun 🌞 You can even see the sunspots! The focal length of my telescope makes it impossible to take the picture of the whole sun, but I'll get to it soon.

Quick lunch time side quest building a simple lab to play with the inetutils-telnetd authentication bypass as disclosed on oss-sec ₁. github.com/leonjza/inet... ₁ seclists.org/oss-sec/2026...

Yesterday I was able to catch, with my phone, Jupiter transitioning through the lens. A lot of margin for improvement (e.g. motor for the RA axis), but happy with the progress I'm making 🔭

A few photos I took this weekend 🐶🐦

The number of times people have tried to kill Net-NTLMv1 eh? youtu.be/lm7Cuktpnb4?...

Uh, really excited to give my new toy a try tonight 📹🔭

I'm getting more and more disappointed with the Internet nowadays, so I made one for myself yesterday.

A source shares some screenshots of the Lapsus ransomware gang celebrating the government shutdown as a disruption to the FBI investigations tracking them. They also refer to Trump as "my king."

Maybe it's my fault, but I'm really missing non-US related content in Bluesky. Can we talk about other countries, please? I don't want to go back to X 😢 🙏🏼

If you're at RomHack at the end of the month, come tell me your @github.com username and I'll give you early access to the @sensepost.com tool repo for PipeTap at the con! 🙃 Below is a demo of the proxy in action. www.youtube.com/watch?v=or8Y...

I've been hacking on a new Windows Named Pipe tool called PipeTap which helps analyse named pipe communications. Born out of necessity while doing some vulnerability research on a target, its been super useful in reversing it's fairly complex protocol. :)

One of the pools in the Alhambra Palace complex in Granada.... had to be this one for #PalacesandGardens #Water #photography #dailyphoto #travel #Spain

Reverse engineering Microsoft’s SQLCMD.exe to implement Channel Binding support for MSSQL into Impacket’s mssqlclient.py. Storytime from Aurelien (@Defte_ on the bird site), including instructions for reproducing the test environment yourself. sensepost.com/blog/2025/a-...

From June 2025 through July 2025, the Cloudflare Email Security team has been tracking a cluster of cybercriminal threat activity leveraging Proofpoint and Intermedia link wrapping to mask phishing payloads. Read more: cfl.re/4lUXBEE

There's an ongoing npm supply chain attack taking place: socket.dev/blog/npm-phi... x.com/AikidoSecuri...

I've created a pull request to detect CitrixBleed 2 into Burp's Bcheck repository: github.com/PortSwigger/...

I wrote a tool to detect orphan scripts at a scale using Scrapy as its foundation: JsJack. Finding vulnerabilities in high-volume traffic sites was more challenging than I initially expected, but I learned many other things from this experience: blog.felipemolina.com/posts/jsjack/

Oh neato, a 13 year-old vuln in (checks notes) all US trains that allowed anyone to control the brakes? Cool cool cool.

Well, a single week was enough to provide a convincing case that a Wikipedia equivalent for LLMs is necessary i.e. decentralized LLM training and serving

Y luego tenemos a unos cuantos gurús educativos proponiendo que el alumnado "le pregunte las dudas" a ChatGPT...

These arrests are the definition of "don't shit where you eat"

The finding was for "JWT weak HMAC secret" and it said the secret was literal "secret" A range of emotions pushed me in various directions at once. What? no.!? yes!!!!!!! let's verify...

All hail the stupid king! Me! 🤴 In 2024 forgot that I was running a Mongo Express in a docker container without authentication (AS IT WAS ONLY INTERNALLY EXPOSED). Later, I randomly did some tests with Nginx to expose port 8081 and forgot about it... Fast forward to June 2025:

If this is true, this is the best news I've read this week! Excited to activate my nostalgia mode with Spaceballs 2! www.ign.com/articles/spa...

I programmed some time ago a crawler with Scrapy to detect orphan JavaScript scripts in target domains. I think I'll release that tool soon ☺️

🆕 New blog post! "Checking for Symantec Account Connectivity Credentials (ACCs) with PrivescCheck" This blog post is not so much about PrivescCheck, but rather brings additional insight to the original article published by MDSec on the subject. 👉 itm4n.github.io/checking-sym... #redteam

I was talking with someone about dependency confusion and suply chain attacks and I was confused myself with the feasibility of doing this in 2025, so I decided to take a practical aproach and create my own tool 🔨 to detect Orphan and Mispelled packages 📦: sensepost.com/blog/2025/de...

sombrero galaxy - hubble vs webb:

i still think about the jwst saturn picture a lot

Wifi hacking can be a useful tool, but people are out here grinding on WPA2 handshake cracking tutorials & menu driven attack tooling. When we built the 3rd and latest iteration of the wifi hacking course for BlackHat - we did it to show what really works and how it really works. 1/7

I finished watching the last chapter of The Leftovers yesterday. Oh, man! Not many series got me so hooked up to the TV and sitting at the edge of my seat as this one has. ❤️

I’m seeing a large disconnect between “thought leader” takes about AI aiding attackers versus hands-on practical use - but I’d love a wider view. If we look at deepfakes, malware & phishing as the most common places people believe attackers are advantaged by AI one by one 1/5

Wow, a comment on HN I actually agree with!

🆕 New blog post! It's a rather short one, nothing crazy. Just wanted to share a random finding I made recently. 🤷‍♂️ 'Hijacking the Windows "MareBackup" Scheduled Task for Privilege Escalation' 👉 blog.scrt.ch/2025/05/20/h... #pentest #pentesting #redteam #windows #privilegeescalation

Bad news for many of us. I have been a Pocket user since its name was "Read it Later" 😞

Politicians really need to stop using X to assess public opinion on any given subject, at this point they might as well be relying on 4chan.

I'm so confused. Searching for "conclave" in Google and it looks like they have elected this guy as the new pope?

New Microsoft accounts will now be passwordless by default 👀👀👀 www.microsoft.com/en-us/securi...

Lectura más que recomendada para hoy: La operación del sistema eléctrico para dummies, una publicación de @redelectricare.bsky.social sobre el complejo sistema que se esconde detrás de los enchufes e interruptores que utilizamos a diario. www.ree.es/sites/defaul...

📺 Sánchez pide seguir tres recomendaciones a la ciudadanía: 1. Reducir al mínimo los desplazamientos 2. Seguir solo información oficial 3. Uso responsable del móvil: solo llamadas breves y el 112 solo cuando sea realmente necesario buff.ly/DKydEkF

After the national power blackout in Spain, we are slowly recovering, at 2AM or earlier is likely the demand of electricity will be fully met. CCN-CERT and @incibe.bsky.social have not declared this to be a cyberattack. Do not spread rumors and fake news about this, let's be professional, peeps.

Working with s/mime on macOS has first class support with the "security cms" command and keychain. Here's how to replace openssl with it, with the mutt mail client being the specific use case github.com/singe/smutt

PhD Timeline xkcd.com/3081

LLMs hallucinating nonexistent software packages with plausible names leads to a new malware vulnerability: "slopsquatting."

This is the album I've been listening in loop for 48 hours straight. JD McPherson, it's my new Dan Auerbach ❤️ Mesmerizing and beautiful guitar rifs here open.spotify.com/album/1ZyW0o...

Ok, so I'm not the only one who woke up with the forced password reset mail from Bugcrowd, no?

This is the kind of encouragement from my colleagues I like to gather ideas 💡 for the SenseCon 2025 hackaton

🦋 ¡Hola! Encantados de verte por aquí. 📌 Te dejamos en este post la lista de periodistas que hacemos EL PAÍS y las firmas habituales del periódico por si te apetece seguirnos. 👋 Muchas gracias y un saludo