Cl0uddStrife 🛰️👾 retweeted
hey PSA, @HuntressLabs has been chasing a pretty gnarly new incident of a ScreenConnect worm, hitting hundreds of hosts downstream during the holiday today -- genuinely please do read up on this one if you've got ye' ol RMM running ↙️
huntress.com/blog/sckit-worm…
Attackers are using cloud-hosted ScreenConnect panels to install rogue clients on managed endpoints.
Don’t triage infected hosts with ScreenConnect. Connecting can spread the malware to your workstation and other panels you can access.
Details and IOCs: okt.to/XnlhWg
Cl0uddStrife 🛰️👾 retweeted
You can just do things
youtube.com/@PrivSecPodcast
@PrivSecPodcast
First live stream/episode/chat tomorrow!
Tomorrow i am chatting privacy and security with @usetraceix.
He's got whisky, i've got Baileys.
Might even link it so you can watch live and unedited
Cl0uddStrife 🛰️👾 retweeted
Every time someone tells me they work in "offense" I have to ask -- do you mean defense-offense (offense done only for defensive purposes) or do you mean actual offensive operations?
Cl0uddStrife 🛰️👾 retweeted
My moat is putting a moat around people who talk about moats so I dont have to talk to them
We managed to find a way to backdoor the next release of OpenAI Codex 🔥
This is the best exploit chain I’ve ever witnessed
depi.security/blog/20261111-…
Cl0uddStrife 🛰️👾 retweeted
LIMITED TIME: Grab the Caido for Hackers Course and get the Hacking APIs Course absolutely FREE!
Just want the API course? Snag it for $9.99 (50% off the usual $19.99).
Grab it before it's gone!
Links in the first reply. 🤓
Cl0uddStrife 🛰️👾 retweeted
Tomorrow I'll be walking through the Kubernetes nodes/proxy permission attack path on stage at @KubeCon_ .
Here is the tool I created during the disclosure process as my POC || GTFO.
It allows you to spread through an entire cluster using the techniques I'm discussing.
Cl0uddStrife 🛰️👾 retweeted
A friend and ex coworker @martin_vigo 's DEFCON talk on hacking Amazon lockers is finally on YouTube. It's such a fun, excellent, pure hacker ethos talk... I highly recommend it, and definitely watch to the end... youtu.be/ZVmRe8OVZtE?is=D4Li…
Cl0uddStrife 🛰️👾 retweeted
Replying to @techspence
@techspence posted something on another platform that hit home:
For every unimportant thing that is fixed or made a priority, something truly critical gets moved down the list.
Sometimes people have asked me “what’s the harm when media frenzy, marketing buzz, or knee-jerk reactions cause a topic that is not really a thing to take center stage (think agent swarms in toasters).
The harm is that all of those conversations, thoughts, and actions were about something unimportant, and were not about Winter2026! as a password, unmanaged devices, misconfigurations, users running as local admin, password stored in the clear, and so on…
Every time we make something unimportant take center stage, what should be center stage does not, and the attacker gains an advantage. It is like skipping a turn in a card game. Make a habit of skipping turns, and you will lose.
This has also been pointed out repeatedly by @ZackKorman, @UK_Daniel_Card, @Shammahwoods, @IceSolst, @christian_tail, and so many others here.
Cl0uddStrife 🛰️👾 retweeted
SSHOLE (CVE-2026-123158) live tracking. sshole.events.greynoise.io/
Cl0uddStrife 🛰️👾 retweeted
When AI is used correctly and with a highly specialized trained team backing it, this is the result.
NightBeacon CMD automatically pulls new CVE's for remotely exploitable vulnerabilities. Can ingest CMDB data, vuln management, as well as any log source - automatically researches the CVE and risk and proactively kicks off continual threat hunts through customers automatically looking for compromises or exposed systems and escalating to the team.
#BinaryDefense
Let’s step it up.
Persistent Root Kit in Grok Bot that you can’t remove without deleting your entire account.
You can use vulns reported to @elonmusk’s @bot team back in August that still aren’t fixed. Including a password of “local” protecting the service that executes agents commands.
Example vectors:
- prompt injection
- poisoned package/dependency the bot installs/updates
- malicious repo the bot clones/runs
Now, does this change much for all the Grok Bot users who didn’t read the product manual to understand that things like browser sessions & env vars are shared across all bots and you need to isolate all public inputs to a separate account?
Not really… it’s a bit like telling them the locks on their doors have weaknesses when they never even close their doors. But when they finally decide to close the door after a baddie walks in, they are gonna be shocked that they can’t close the door without deleting the whole house.
Cl0uddStrife 🛰️👾 retweeted
30 years ago today, Phrack 49 published Aleph One’s “Smashing the Stack for Fun and Profit”.
A legendary paper that inspired generations of hackers and helped shape modern exploit development.
Still an essential reading.
phrack.org/issues/49/smashin…
Phrack 73 is coming soon!




































