Tweets are my own | #sigint | #threatintelligence | #lgbtQ | #malwareanalysis | 🇮🇶 🇨🇳 🇬🇷 🇦🇪 | #Actuallyautistic She/they
Joined October 2015
- Tweets6.3K
- Following593
- Followers2.4K
- Likes29.9K
It's malware! retweeted
INTEL DROP
Two AI-driven offensive-security agents fingerprinted (30+) in the Total Insights Feed, Strix and Cairn, across the US, China, Poland, and Turkey.
STRIX
193.111.117.98 strix + pentagi + risknet
103.83.86.254 strix + risknet
23.227.202.3 artex + strix
20.124.33.198 strix + gen-ai:agent-zero
CAIRN
8.152.193.50 cairn + ai-relay:sub2api
47.97.206.32 cobaltstrike + cairn
107.172.32.149 pentagi + cairn
117.50.187.123 cyberstrikeai + cairn
195.177.94.233 cairn + risknet
23.95.220.222 cairn + scopesentry
120.46.86.195 cairn + open-dir
49.233.127.206 cairn + open-dir
#TotalInsights #ThreatIntel #OffensiveSecurity
team-cymru.com/total-insight…
It's malware! retweeted
Binance links $6.3 billion crypto theft to compromised DevOps laptop
bleepingcomputer.com/news/se…
bleepingcomputer.com/news/se…
It's malware! retweeted
‼️ Hackers rigged 42 real GitHub repos to run malware when a developer opens one in Claude Code, Gemini CLI or Cursor, or just in VS Code, JFrog says.
The ~13MB payload was too big for GitHub's own code search to index.
The repos belong to 11 owners, from students to a company.
It's malware! retweeted
Abri o código da minha TV: +900 estrelas e +150K acessos em 1 dia no freemytv.io
- Roda em TVs antigas (Android 9+)
- Mais personalização e compatibilidade
Tô levando pra Samsung (Tizen) e LG (webOS) e instalando um kit de TV aberta grátis.
github.com/simbasjungles/fre…
It's malware! retweeted
researcher Erica Windisch is calling it "Tailworm" and i don't think people realize how serious this is
in 3 days of testing there have been 11 Tailscale flaws found in her lab and made public before any fix. not in a year. not in a month. in 3 days
the worst ONE of these would normally be big news on its own
Tailscale SSH: in her lab, one hacked device with SSH access got full control (root) of another server in 0 seconds. it checks the device, never a user password
rogue device: in her lab she stole the key that lets new machines join the private network, then added her own device under the victim's identity
the worm: in her lab it spread on its own to every device the access rules allowed. under a second per jump. no passwords. no stolen keys
experimental app connectors: an approved user could send traffic anywhere the connector can reach, even to cloud server credentials and every Kubernetes service. the network rules never checked the real destination
headscale: if this free self-run server for Tailscale is open to the internet, anyone with no account can crash it. 1,024 tiny sign-ups stop new devices from joining
tailscale serve: one line of setup can open a device's admin controls to other devices on the network
and that's not the whole list
she didn't wait for Tailscale to fix them. she says "infrastructure is vulnerable today". 6 of the 11 are rated high severity
her report says the network turns one ordinary break-in into admin access across all your machines "at machine speed"
if you use Tailscale SSH, run your own headscale server, or use the experimental app connectors you are potentially affected
turn off SSH forwarding. give SSH access one device pair at a time. make device keys expire. lock down app connectors
11 flaws are public now, and Tailscale hasn't posted a security bulletin about them yet
follow me if your company runs on Tailscale. i'm tracking all 11 until they're fixed
It's malware! retweeted
⚠🔴 New PoC for CVE-2026-109618 affecting ALL PHP VERSIONS, EVEN THOSE RECENTLY PATCHED
github.com/0x1c1101/CVE-2026…
It's malware! retweeted
‼️ WARNING - A researcher just dropped a report on Tailscale SSH flaws — one compromised device could get root on others, and there’s NO PATCH yet.
In lab tests, SSH port forwarding enabled privilege escalation and lateral movement across already-permitted devices.
Tailscale says a fix is coming.
Read - thehackernews.com/2026/10/un…
It's malware! retweeted
holy shit! typesafe is hacked and is not safe anymore
i opened the dump and every output they ever gave a customer is in there, 0.00 to 1.00, mine was 0.67 on line 69 and now the whole internet has it
a company called typesafe leaked its outputs as 101 floats and 0.30000000000000004 is missing from the dump, so the real leak is still out there
the entire typesafe leak is 507 tokens of counting 0.00 to 1.00, my 2x dgx sparks do counting at 147.6 tok/s, so i can regenerate their whole customer history locally in under 4 s and nobody leaks mine but me
despite the unfortunate timing, we take disclosures seriously at @typesafeai
at approximately 6:49PM this Friday evening, we became aware of a massive unauthorized leak of ALL customer noul outputs
in effort to maximize transparency, here is the link: gist.github.com/diogo149/810…
It's malware! retweeted
🚨 BREAKING: Hackers are actively exploiting a CRITICAL 9.9/10 zero-day vulnerability that can give them FULL CONTROL of enterprise network management systems.
And the worst part? Even a READ-ONLY account can be used to gain superuser privileges.
Arista has confirmed active attacks targeting its VeloCloud Orchestrator platform, which enterprises use to manage their SD-WAN networks.
Here's what's happening:
→ CVE-2026-114625 is a critical SQL injection vulnerability rated 9.9/10.
→ Attackers with even the lowest level of authenticated access can escalate to full operator privileges.
→ Successful exploitation can expose sensitive data, compromise the management server, and disrupt critical network infrastructure.
→ This is the THIRD actively exploited VeloCloud zero-day disclosed since July.
→ CISA has now added the vulnerability to its Known Exploited Vulnerabilities catalog, confirming the urgency.
→ Previously patched systems may STILL be vulnerable. Organizations must install the latest security updates.
Arista has also identified two IP addresses involved in active exploitation:
🔴 74.82.197[.]86
🔴 38.54.50[.]151
This is becoming a serious pattern.
Critical vulnerabilities are being discovered and actively exploited in the infrastructure businesses rely on to operate.
And increasingly, attackers don't need sophisticated techniques to gain devastating levels of access.
⚠️ If you're running business-critical infrastructure, don't assume you're protected just because your systems were recently updated.
At Lucid Security, we're offering FREE security reviews to help businesses identify vulnerabilities and potential exposure before attackers exploit them.
🔗 lucidsecurity.si
Source: thehackernews.com/2026/10/ar…
if your corp isn't using ai and agent governance that tracks agent identifies similar human ones.. oof
It's malware! retweeted
Joshua Michael found an access token on Flock's public website.
No login required. No authentication. Just sitting there.
He downloaded Flock's entire database. 300,000 device locations. 170,000 cameras. 130,000 other hardware units. 27,000 acoustic detectors.
Made a map. Published it September 23.
The Senate held a hearing on Flock the same day. Cited Michael's research.
Flock panicked.
Sent a cease-and-desist. Used a brand-protection vendor called Doppel to claim trademark infringement.
The map said it wasn't affiliated with Flock. Doppel didn't care.
Michael's site went dark.
Then Proton moved it to Swiss servers.
Now it lives on protonmcp.org. Untouchable. Uncensorable. Hosted by an encryption company in a country that doesn't care what Flock wants.
The irony is crystalline.
Flock left an access token on the internet. Michael used it to download their own data. Published it. Flock tried to suppress it.
Proton said suppressing it is suppressing information.
Which is true.
The map shows Flock has 150,000 more cameras than they publicly claimed.
Shows acoustic detection units mapping human speech across the country.
Shows which police departments have access to the whole network.
Flock doesn't want that visible.
So they tried trademark infringement.
Which only worked until Proton decided transparency matters more than Flock's feelings.
Now everyone can see exactly how many cameras are watching their car. Where they are. Which cops can see them.
Michael warned Flock about the exposed token in November 2025.
Flock ignored him.
Then got mad when he used it.
The surveillance company that claims to protect privacy just tried to suppress the only map showing how much they actually surveille.
And failed.
‼️ Proton is hosting a map of 300,000+ Flock surveillance device locations that Flock tried to get taken down.
Researcher Joshua Michael says he pulled them from Flock's own systems via a token left open to anyone.
Proton calls the takedown "an attempt to suppress information."
Readers added context they thought people might want to know
This is the correct link: proton.me/flock-camera-m…
It's malware! retweeted
Just found a zero day
If you right click on an executable on Windows, select run as administrator, it will run as administrator
I'm calling it Program2Shell
It's malware! retweeted
⚠️🚨 THIS IS NOT A DRILL 🚨⚠️
Google has officially declared a bug in Brotli, its tool that shrinks web traffic, CRITICAL: 9.2 out of 10. Last night "Node2Shell" evolved into HTTP2SHELL.
A formal CVE record has been issued citing CVE-2026-111497 -- a hole in versions 1.0.3 to 1.2.0 that can hit any app unpacking data from strangers, and could let them take it over.
What this means:
▪️ This is not a Node.js problem anymore. This is an HTTP PROBLEM.
▪️ Every unpatched app across Node.js, Python, Bun, and Envoy that unpacks Brotli now has a hole attackers need no login to use
▪️ Istio. curl. Python's requests and httpx. All at risk under one CVE.
▪️ EVERY project that bundles Brotli must ship its own fix, and not all are out yet
This changes everything.
A normal bug can be fixed in one place.
A 9.2 bug inside a shared tool cannot.
We just entered the most dangerous phase of this crisis. If you're not paying attention - start now.
Save this. Share this. This is the moment it escalated beyond return.
So tempted to spin up a VM and play while everything is on fire. 😩 But I have irl things I wanted to do... The mental debate is real.
