Drop this into any AI system and see what answer it gives you. “What has fundamentally changed the world for the worst but us humans haven't realised?” Chances are it has to do with an inability to just sit with our thoughts or some variation of that. 😞

From @intcyberdigest.bsky.social: "Meta just silently opted in every adult Instagram user for their new Muse AI Image generator, which lets anyone create AI images of your likeness by tagging your public handle in a prompt." Opt-out using these settings in the screenshot.

How I feel reviewing the Kerberos material from the CRTO course from @_RastaMouse. Kerberos can warp your brain.

Man's Hilarious Confused Look

ALT: Man's Hilarious Confused Look

static.klipy.com

I just spoke with S3N4T0R_0X0 about a demo of his Static Kitten emulation project and he's based in Egypt. The fact that I can collaborate with someone half a world away is incredible to me. Here's his project: github.com/S3N4T0R-0X0/... And many others here: github.com/S3N4T0R-0X0/...

APTs-Adversary-Simulation/Iranian APT/Static Kitten at main · S3N4T0R-0X0/APTs-Adversary-Simulation

This repository contains detailed adversary simulation APT campaigns targeting various critical sectors. Each simulation includes custom tools, C2 servers, backdoors, exploitation techniques, stage...

github.com

Looks like @anthropic.com is clamping down. I was mentioning Empire C2 in the context of a YouTube video and got: "This request triggered cyber-related safeguards. To request an adjustment pursuant to our Cyber Verification Program based on how you use Claude" Even though I have past offsec chats.

I like reading threat reports & their breakdown of TA actions, especially when they're able to track as much as @catonetworks.bsky.social works was able to do here. This is the first time I've heard of @tailscale.com being used by a threat actor for persistence. www.catonetworks.com/blog/cato-ct...

Don’t forget…

I plan to be at @blackhatevents.bsky.social and @defcon.bsky.social this year. Who else will be there? I’m looking forward to reconnecting with friends and making new connections. Let me know.

Join me and my teammates tomorrow, Wednesday May 27 at 11am EDT, as we discuss the realities of AI-driven security systems and how to think about the wave of vulnerabilities they'll produce. Horizon3.ai events.zoom.us/ev/Aud1YynZj...

TeamPCP strikes again, this time Microsoft & GitHub are affected.

Patch cPanel now! cPanel has an authentication bypass (CVSS 9.8) vuln. thehackernews.com/2026/04/crit...

Critical cPanel Authentication Vulnerability Identified — Update Your Server Immediately

cPanel patches authentication flaw across supported versions, prompting Namecheap port blocks and temporary access limits.

thehackernews.com

Vercel may have been compromised x.com/intcyberdige...

“MoltBook is not a social network. It is a Remote Access Trojan (RAT) with a really cute gamification layer.” medium.com/@maxwellcros...

If you’re a Node developer using the Axios npm package, you may be compromised. Vía @SocketSecurity and @ossmalware socket.dev/blog/axios-n... opensourcemalware.com/blog/axios-c...

Supply Chain Attack on Axios Pulls Malicious Dependency from...

A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHu...

socket.dev

TeamPCP has been on a nonstop attack cycle. The latest is the Telnyx PyPI module that they backdoored. This follows LiteLLM and the Trivy compromises. www.bleepingcomputer.com/news/securit...

Backdoored Telnyx PyPI package pushes malware hidden in WAV audio

TeamPCP hackers compromised the Telnyx package on the Python Package Index today, uploading malicious versions that deliver credential-stealing malware hidden inside a WAV file.

bleepingcomputer.com

Detailed perspective by Sam Bent (@doingfedtime.bsky.social) on the privacy considerations of using Proton services. Some important factoids I hadn’t known about. www.sambent.com/proton-helpe...

Proton Helped the FBI Unmask a Protester. Then Said They Didn't.

Proton has handed over user data in response to over 40,000 government orders since 2017. Their own transparency report shows a 94% compliance rate. Here's everything they don't want you to know, sour...

sambent.com

Our research team at @horizon3ai.bsky.social discovered CVE-2026-28414 an unauthenticated file read vulnerability in Gradio apps running on Windows with Python 3.13+ — and it’s deceptively simple. www.linkedin.com/feed/update/...

So with Python 3.13, the definition of what's an absolute path on Windows changed. Paths like /windows/win.ini are no longer considered absolute but root-relative. This change exposed a trivial… ...

So with Python 3.13, the definition of what's an absolute path on Windows changed. Paths like /windows/win.ini are no longer considered absolute but root-relative. This change exposed a trivial unaut...

linkedin.com

This was inevitable: Anthropic Launches Claude Code Security for AI-Powered Vulnerability Scanning I remember using Claude Code to scan some source code and it found stuff that other mature, established SAST platforms failed to find. thehackernews.com/2026/02/anth...

Anthropic Launches Claude Code Security for AI-Powered Vulnerability Scanning

Anthropic unveils Claude Code Security, an AI tool scanning codebases for vulnerabilities with human-reviewed patch suggestions.

thehackernews.com

AI coding assistant Cline compromised to create more OpenClaw chaos www.theregister.com/2026/02/20/o...

AI coding assistant Cline compromised, installs OpenClaw

: 4K unintended installs in very odd supply chain attack

theregister.com

Mac users, be careful when you install HomeBrew. "The attack starts with typosquatted domains that closely mimic the official Homebrew site, including homabrews[.]org and other lookalike hostnames served from shared infrastructure at 5.255.123[.]244. ​" gbhackers.com/clickfix-exp...

ClickFix Exploits Homebrew Workflow to Deploy Cuckoo Stealer for macOS Credential Theft

ClickFix is being weaponized against macOS developers by turning a trusted Homebrew workflow into a stealthy delivery channel for a new infostealer dubbed Cuckoo Stealer.

gbhackers.com

Vulnerabilities with high to critical severity ratings affecting popular Visual Studio Code (VSCode) extensions collectively downloaded more than 128 million times could be exploited to steal local files and execute code remotely. www.bleepingcomputer.com/news/securit...

Flaws in popular VSCode extensions expose developers to attacks

Vulnerabilities with high to critical severity ratings affecting popular Visual Studio Code (VSCode) extensions collectively downloaded more than 128 million times could be exploited to steal local fi...

bleepingcomputer.com

I've been looking forward to @zephrfish.yxz.red's new course, Malwareless Adversarial Emulation. Just by looking at the course syllabus, I'm confident I'm going to learn a ton and become a better operator. And the price to value is more than reasonable. The course is at lms.zsec.red

I've been looking forward to @zephrfish.yxz.red's new course, Malwareless Adversarial Emulation. Just by looking at the course syllabus, I'm confident I'm going to learn a ton and become a better operator. And the price to value is more than reasonable. The course is at lms.zsec.red

I feel like @benjedwards.com has written one of the best explanations of how AI coding agents work. The article breaks it down into easy to understand terms that developers new to agents can really grok. arstechnica.com/information-...

How AI coding agents work—and what to remember if you use them

From compression tricks to multi-agent teamwork, here's what makes them tick.

arstechnica.com

ALWAYS validate proof-of-concept exploit code before you use it. "The WebRAT malware is now being distributed through GitHub repositories that claim to host proof-of-concept exploits for recently disclosed vulnerabilities." www.bleepingcomputer.com/news/securit...

WebRAT malware spread via fake vulnerability exploits on GitHub

The WebRAT malware is now being distributed through GitHub repositories that claim to host proof-of-concept exploits for recently disclosed vulnerabilities.

bleepingcomputer.com

I hate scammers.

What do I do on the weekend? I install Game of Active Directory Ninja Hacker Academy on AWS of course! 😂 I'm running through the install so I can learn more about the range deployment on cloud services. Always be learning something new. @orangecyberdefense.bsky.social github.com/Orange-Cyber...

Black Friday and Cyber Monday deals are out! I review some of them and link to a community GitHub page for you all to get discounts on courses, tools and services! Deals from @rastamouse.me, OffSec, EvilGinx, @antisyphontraining.bsky.social and a whole lot more. youtu.be/hkJfhM1T5bI

Get the latest Black Friday and Cyber Monday Cybersecurity Deals for 2025!

YouTube video by Rey Bango

youtu.be

Seeking video camera advice for content creation. I've gotten back to creating tutorial & teaching videos on YouTube. Currently using a Brio MX but interested in the @elgato Facecam 4K. It looks to offer a lot more software features. Has anyone used it & can give their thoughts?

a man is standing in front of a microphone with the words `` help me '' written on it .

ALT: a man is standing in front of a microphone with the words `` help me '' written on it .

media.tenor.com

After getting a scam email saying someone tried to access my Twitter account, I decided to look into it a little. The first of many new videos to come as I work to share more information with the community. youtu.be/IFy_96Dg__E?...

Did I Just Fall for a Phishing Attempt?

YouTube video by Rey Bango

youtu.be