Don’t forget…

I plan to be at @blackhatevents.bsky.social and @defcon.bsky.social this year. Who else will be there? I’m looking forward to reconnecting with friends and making new connections. Let me know.

Join me and my teammates tomorrow, Wednesday May 27 at 11am EDT, as we discuss the realities of AI-driven security systems and how to think about the wave of vulnerabilities they'll produce. Horizon3.ai events.zoom.us/ev/Aud1YynZj...

TeamPCP strikes again, this time Microsoft & GitHub are affected.

Patch cPanel now! cPanel has an authentication bypass (CVSS 9.8) vuln. thehackernews.com/2026/04/crit...

Vercel may have been compromised x.com/intcyberdige...

“MoltBook is not a social network. It is a Remote Access Trojan (RAT) with a really cute gamification layer.” medium.com/@maxwellcros...

If you’re a Node developer using the Axios npm package, you may be compromised. Vía @SocketSecurity and @ossmalware socket.dev/blog/axios-n... opensourcemalware.com/blog/axios-c...

TeamPCP has been on a nonstop attack cycle. The latest is the Telnyx PyPI module that they backdoored. This follows LiteLLM and the Trivy compromises. www.bleepingcomputer.com/news/securit...

Detailed perspective by Sam Bent (@doingfedtime.bsky.social) on the privacy considerations of using Proton services. Some important factoids I hadn’t known about. www.sambent.com/proton-helpe...

Our research team at @horizon3ai.bsky.social discovered CVE-2026-28414 an unauthenticated file read vulnerability in Gradio apps running on Windows with Python 3.13+ — and it’s deceptively simple. www.linkedin.com/feed/update/...

This was inevitable: Anthropic Launches Claude Code Security for AI-Powered Vulnerability Scanning I remember using Claude Code to scan some source code and it found stuff that other mature, established SAST platforms failed to find. thehackernews.com/2026/02/anth...

AI coding assistant Cline compromised to create more OpenClaw chaos www.theregister.com/2026/02/20/o...

Mac users, be careful when you install HomeBrew. "The attack starts with typosquatted domains that closely mimic the official Homebrew site, including homabrews[.]org and other lookalike hostnames served from shared infrastructure at 5.255.123[.]244. ​" gbhackers.com/clickfix-exp...

Vulnerabilities with high to critical severity ratings affecting popular Visual Studio Code (VSCode) extensions collectively downloaded more than 128 million times could be exploited to steal local files and execute code remotely. www.bleepingcomputer.com/news/securit...

I've been looking forward to @zephrfish.yxz.red's new course, Malwareless Adversarial Emulation. Just by looking at the course syllabus, I'm confident I'm going to learn a ton and become a better operator. And the price to value is more than reasonable. The course is at lms.zsec.red

I've been looking forward to @zephrfish.yxz.red's new course, Malwareless Adversarial Emulation. Just by looking at the course syllabus, I'm confident I'm going to learn a ton and become a better operator. And the price to value is more than reasonable. The course is at lms.zsec.red

I feel like @benjedwards.com has written one of the best explanations of how AI coding agents work. The article breaks it down into easy to understand terms that developers new to agents can really grok. arstechnica.com/information-...

ALWAYS validate proof-of-concept exploit code before you use it. "The WebRAT malware is now being distributed through GitHub repositories that claim to host proof-of-concept exploits for recently disclosed vulnerabilities." www.bleepingcomputer.com/news/securit...

I hate scammers.

What do I do on the weekend? I install Game of Active Directory Ninja Hacker Academy on AWS of course! 😂 I'm running through the install so I can learn more about the range deployment on cloud services. Always be learning something new. @orangecyberdefense.bsky.social github.com/Orange-Cyber...

Black Friday and Cyber Monday deals are out! I review some of them and link to a community GitHub page for you all to get discounts on courses, tools and services! Deals from @rastamouse.me, OffSec, EvilGinx, @antisyphontraining.bsky.social and a whole lot more. youtu.be/hkJfhM1T5bI

Seeking video camera advice for content creation. I've gotten back to creating tutorial & teaching videos on YouTube. Currently using a Brio MX but interested in the @elgato Facecam 4K. It looks to offer a lot more software features. Has anyone used it & can give their thoughts?

After getting a scam email saying someone tried to access my Twitter account, I decided to look into it a little. The first of many new videos to come as I work to share more information with the community. youtu.be/IFy_96Dg__E?...

The end of an era. For so many people, AOL was the internet. arstechnica.com/gadgets/2025...

RubyGems & PyPI under attack: 🔸 60 fake RubyGems stole social media logins (275K+ downloads) 🔸 PyPI fakes hijacked crypto staking wallets Both hide credential-stealing code in legit-looking packages. #CyberAlerts thehackernews.com/2025/08/ruby...

Hi @defcon.bsky.social

Picked up this very cool @crowdstrike.com t-shirt for my son and the action figure that goes with it. He’s going to love it.

@crowdstrike.com says they’re seeing threat actors are targeting GenAI workloads to try poison the models. The inherent trust being built as we continue to use AI systems will lead to threat actors becoming an insider threat.

Walking back to my room I passed the Google Cloud Security party at Blackhat and it looked jumping. Almost considered social engineering my way in. 😈😈

Great analysis by @SentinelOne on a threat actor working out of Vietnam to target users in 62 countries. Starts with a phishing campaign that leads to DLL sideloading of legitimate and signed software, including Office 2013, for persistence. www.sentinelone.com/labs/ghost-i...

😂😂kerberoasting 4eva amirite @timmedin.bsky.social

Hashcat v7.0.0 released with speed and GPU support improvements hashcat.net/forum/thread...

theonion.com/trump-still-... The Onion just straight-up reporting real news, again.

Unfortunately @broadcom.bsky.social still hasn't fixed the VMWare Workstation update server link so be sure to upgrade to 17.6.4 to fix a security issue found at Berlin Pwn2own www.bleepingcomputer.com/news/securit...

"Wo unto you rich men, that will not give your substance to the poor, for your riches will canker your souls; and this shall be your lamentation in the day of visitation, and of judgment, and of indignation: The harvest is past, the summer is ended, and my soul is not saved!"

“This isn’t 'The Hunger Games’ for immigrants,” Worsoff told the newspaper This absolutely disgusting and a pathetic way of taking advantage of immigrants by this producer. www.nytimes.com/2025/05/16/u...

When you play an internal CTF against 10 other teams and win! Booyah! 😈

"Malicious VSCode extensions infect Windows with cryptominers" A set of ten VSCode extensions on Microsoft's Visual Studio Code Marketplace pose as legitimate development tools while infecting users with the XMRig cryptominer for Monero. www.bleepingcomputer.com/news/securit...

"Google and Mozilla on Tuesday announced the release of Chrome 135 and Firefox 137 to the stable channel with patches for nearly two dozen vulnerabilities, including high-severity memory safety bugs." Time to update! www.securityweek.com/chrome-135-f...

"New Phishing Attack Combines Vishing and DLL Sideloading Techniques" Initial access thru vishing on Teams, drop a signed TeamViewer binary and then DLL sideload that for persistent C2 access. I haven't seen JavaScript-based C2s. @hoodoer.bsky.social www.infosecurity-magazine.com/news/phishin...

“Oracle attempt to hide serious cybersecurity incident from customers in Oracle SaaS service” by @GossiTheDog.cyberplace.social.ap.brid.gy doublepulsar.com/oracle-attem...

Nice find by @reversinglabs.com "Malware found on npm infecting local package with reverse shell" 2 interesting packages were published on npm: ethers-provider2 & ethers-providerz. These were simple downloaders whose malicious payload was cleverly hidden www.reversinglabs.com/blog/malicio...

Cobalt Strike Abuse Dropped 80% in Two Years www.securityweek.com/cobalt-strik...

VMWare guest to host escape. Time to update several Broadcom packages. www.theregister.com/2025/03/04/v...

More research emerging about VS Code extensions as an attack vector, this time by Cas van Cooten. casvancooten.com/posts/2025/0...

Microsoft has removed two popular VSCode extensions, 'Material Theme – Free' and 'Material Theme Icons – Free,' with 9 million installs from the Visual Studio Marketplace for allegedly containing malicious code. www.bleepingcomputer.com/news/securit...