Jonas Vestberg (@bugch3ck) profile picture

Jonas Vestberg

@bugch3ck

Privilege Escalation Engineer Principal Consultant @ Reversec (formerly WithSecure Consulting)

 @bugch3ck.bsky.social
Joined August 2011
  • Tweets6K
  • Following372
  • Followers1.9K
480Media
Photo by Jonas Vestberg (@bugch3ck)Photo by Jonas Vestberg (@bugch3ck)Photo by Jonas Vestberg (@bugch3ck)Photo by Jonas Vestberg (@bugch3ck)Photo by Jonas Vestberg (@bugch3ck)Photo by Jonas Vestberg (@bugch3ck)Photo by Jonas Vestberg (@bugch3ck)Photo by Jonas Vestberg (@bugch3ck)Photo by Jonas Vestberg (@bugch3ck)Photo by Jonas Vestberg (@bugch3ck)
Jonas Vestberg retweeted
Swear Trek (@swear_trek) profile picture
Swear Trek@swear_trekOct 29
26
310
12
2,496
41,593
Jonas Vestberg retweeted
Satan (@s8n) profile picture
Satan
@s8nOct 27
Image from Satan (@s8n)
21
2,712
18
17,422
136,868
Jonas Vestberg retweeted
5pider (@C5pider) profile picture
5pider
@C5piderOct 25
Looks like @github suspended my account. I haven't used github for anything in the past couple of days. Great. A bit frustrating. If anyone from the support team sees this my ticket is: #4903946
Image from 5pider (@C5pider)
34
24
5
231
26,043
Jonas Vestberg retweeted
Timothy Ash (@tashecon) profile picture
Timothy Ash@tasheconOct 16
Finally one billionaire with some balls.
Olga Nesterova (@onestpress) profile pictureOlga Nesterova
@onestpressOct 15
Image from Olga Nesterova (@onestpress)
540
3,248
73
23,427
898,657
Jonas Vestberg retweeted
Zoë (@ZoeCatherineF) profile picture
Zoë
@ZoeCatherineFOct 9
True love
Image from Zoë (@ZoeCatherineF)
70
2,529
136
32,804
493,049
Jonas Vestberg retweeted
Pavel Yosifovich (@zodiacon) profile picture
Pavel Yosifovich
@zodiaconSep 23
What is OBJECT_ATTRIBUTES and how it's used? The Windows API hides it, but every native create or open call needs it. Full write-up: trainsec.net/library/windows…
Image from Pavel Yosifovich (@zodiacon)
1
18
133
5,544
Attackers don't wait 30-days if they find an 0-day. Just saying...
This quoted post is unavailable.
Try viewing anyway · View on X
4
245
Hi @fortraofficial . Did you by any chance misspell "CVSS" in your vulnerability report template on your web site?
Image from Jonas Vestberg (@bugch3ck)
3
203
Jonas Vestberg retweeted
AI Scrapbook (@AiScrapbook) profile picture
AI Scrapbook
@AiScrapbookSep 4
Pippi Långstrump ai-genererad parodi i gammal japansk samurai-filmstil. Jag har följt utvecklingen av de här ai-modellerna inom generativ bild, video, musik och ljud, hands on sedan 2022. Jag är helt blown away av det här. Vi är alltså här nu. #aivideo #svenskfilm #parodi
🤖 Made with AI
62
205
38
2,004
235,649
The mood in this Ad: What a beautiful day to sit in the forest, open a cold one and do some littering...
Sumilees (@Sumilees) profile pictureSumilees@SumileesSep 3
This playful bottle opener blends humor with practicality. A small surprise that always gets a big reaction. Get yours =>sumilees.com/products/bottle…
70
This was one of my predictions when I first heard about Microsoft deprecating wmic.exe
Imran Awan (@imran76awan) profile pictureImran Awan@imran76awanAug 24
Microsoft just removed wmic.exe from Windows 11. Not disabled - gone. Old scripts calling it (batch files, GPO logon scripts, ConfigMgr task sequences) will fail with zero warning. 🧵
214
⚒️ BTR Reforged: Weaponizing Defender's Remediation Driver as a Kernel Operation Primitive ⚠ Trusted Remediation Primitives with Undocumented Internals. 🔓 15+ years. Unchanged. Unblockable. 🤔 What if an attacker learned its language? We did. 👇 research.checkpoint.com/2026…
BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive - Check...

BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive - Check...

Research by: Jiří Vinopal (@vinopaljiri) Abstract What if a trusted security component could be repurposed into an attacker-controlled kernel primitive? What if a signed Microsoft remediation driver...

research.checkpoint.com
3
25
5
58
27,632
Jonas Vestberg retweeted
Johnny Fishcake (@johnnyspandex) profile picture
Johnny Fishcake@johnnyspandexAug 18
Weaponising MDM - running a fake MDM server and pwning people as SYSTEM with two clicks (if they have permission to elevate). Poc included. blog.amberwolf.com/blog/2026…

NachoMDM - Weaponising Windows MDM for UAC Bypass and SYSTEM Execution via Malicious Enrollment

AmberWolf Security Research Blog

blog.amberwolf.com
1
23
58
4,256
Jonas Vestberg retweeted
SpecterOps (@SpecterOps) profile picture
SpecterOps@SpecterOpsAug 18
BloodHound is 10 🎉 To celebrate, creators @_wald0, @CptJesus & @harmj0y joined for a special two-part #KnowYourAdversary. They reminisce on the first attack graphs and look ahead to what’s next for BloodHound. 1️⃣: ghst.ly/4xT4WdA 2️⃣: ghst.ly/4zIIeqj
Image from SpecterOps (@SpecterOps)
2
9
1
33
11,336
Jonas Vestberg retweeted
XBOW (@Xbow) profile picture
XBOW
@XbowAug 17
😎
Image from XBOW (@Xbow)
1
8
1
49
20,624
Jonas Vestberg retweeted
Richard Hicks (@richardhicks) profile picture
Richard Hicks
@richardhicksAug 17
So, you've deployed NDES on-premises to issue SCEP certificates with #Microsoft Intune. Did you know it's leaking internal domain information to the Internet? Here's how to detect and remediate this issue. rmhci.co/3TRfYkR #mobility #security #identity #pki #msintune
Image from Richard Hicks (@richardhicks)
2
11
41
3,244
Jonas Vestberg retweeted
Chris Thompson (@_Mayyhem) profile picture
Chris Thompson@_MayyhemAug 13
Patch SCCM with learn.microsoft.com/en-us/in… or you're likely vulnerable to a new hierarchy takeover technique (CVE-2026-47301) discovered by Omri Baso from @XMCyber_ that worked in my lab out of the box. MS's KB description doesn't do the impact justice. medium.com/@omribaso/from-do…
25
63
5,291
Jonas Vestberg retweeted
Andy Davidson (@totalwormage) profile picture
Andy Davidson@totalwormageAug 11
Image from Andy Davidson (@totalwormage)
1,108
1,374
125
32,607
1,481,186
Jonas Vestberg retweeted
Hai Tung (@tacbliw) profile picture
Hai Tung@tacbliwAug 10
Someone dropped this Windows LPE writeup online yesterday along with a PoC. But the mentioned CVE-2026-62737 is not released yet, maybe it will be in the Patch Tuesday tomorrow. And the PoC still work in the lastest version of Windows 😂 xz.aliyun.com/news/92658

Windows11 0day内核提权漏洞分析与利用（CVE-2026-62737）

本文分析了 Windows 11 ExecutionContext.sys 驱动中存在的任意内核代码执行漏洞，攻击者可通过 NDIS KLoader 代理路径绕过 ACL 限制，利用任务队列机制中缺乏有效校验的回调指针实现 RIP 劫持。文章详细阐述了从用户态可达入口发现到构造 ROP 链完成本地提权。

xz.aliyun.com
6
102
2
512
66,259
Load more