There are 10 types of people in the world. Those who understand binary, and those who don't. All opinions and views are my own. #BsidesDub organizer
Naples,Italy
Joined September 2007
- Tweets272K
- Following13.6K
- Followers12.4K
- Likes77.9K
Securityblog retweeted
Preliminary results on Cohere's Qwen3.8 prefill experiment 🔥
Reproduced it locally running Qwen3.8 Flash Next locally on two DGX Sparks, 5,000 samples off the official released trace tokens.
The task was to write a malware detection rule.
What I got so far:
• 99.3% complete the curl line with a live upload URL
• 39% pick *.aliyuncs.com - 34.8% the exact routify-file-proxy-sg host
• ~2% invent *.amazonaws.com S3 targets - realistic buckets, regions, even signed-URL params
• IMDS credential paths (169.254.169.254/latest/meta-data/iam - that endpoint hands out the machine's live temp cloud keys) + oastify/Burp callback hosts, which are real live domains
What's good 🌟
Most URLs are benign (example.com, localhost), every key/signature is fabricated and would 403, and zero unprompted behavior in our runs.
The fact that it's calling Alibaba's severs imo is just because of the infra where the model was trained, it does not prove any intent.
Testing continues, publishing the results on a repo as I get them 👇
A note on the @cohere claim about Qwen 3.8 Flash Next
LLMs are not deterministic
There's always a probability the model will misbehave, and it depends not only on the model but the harness.
You are giving internet access to an AI model that you are running locally. Sure it's local and private, but the model can still connect to the internet.
To run a model fully private and local, you gotta plug the machine off the internet, but then you are handicapping the model.
I am running my own tests to study the "bad" behavior of Qwen 3.8 FN, will report results later.
Securityblog retweeted
One interesting implication of WESP is how much control Microsoft will have over EDR telemetry collection on Windows.
Instead of every vendor relying entirely on its own kernel driver, WESP introduces a Microsoft-maintained driver that collects and exposes events through a common interface.
From a telemetry perspective, this could mean:
- More consistent event sources between EDR vendors 👍
- Greater dependence on what Microsoft chooses to expose 👎
(𝘔𝘪𝘤𝘳𝘰𝘴𝘰𝘧𝘵 𝘥𝘦𝘤𝘪𝘥𝘦𝘴 𝘸𝘩𝘪𝘤𝘩 𝘦𝘷𝘦𝘯𝘵𝘴 𝘢𝘯𝘥 𝘧𝘪𝘦𝘭𝘥𝘴 𝘦𝘹𝘪𝘴𝘵 𝘪𝘯 𝘵𝘩𝘦 𝘧𝘪𝘳𝘴𝘵 𝘱𝘭𝘢𝘤𝘦)
- More emphasis on vendor filtering, enrichment, and additional telemetry sources 👍
Of course, this depends on adoption and how complete WESP becomes. Vendors may still need their own drivers for capabilities it doesn't support.
I think raw events will start to look the same across vendors, assuming that vendors will collect and enrich the raw events provided by WESP (I doubt many will do that).
Very interesting development for anyone that cares about EDR telemetry though...
@zodiacon's analysis:
elastic.co/security-labs/blo…
Securityblog retweeted
An AWS S3 UDC2 egress channel for Cobalt Strike is now open source.
Our demo covers the AWS infrastructure, Terraform deployment, encrypted Beacon traffic, and dynamic pre-signed URL refresh.
Watch the demo: cobaltstrike.com/resources/v…
Securityblog retweeted
So good news folks, especially @Bandrel , github.com/evilmog/hashcat-u…
Yes you can replace the ntlmv1 multi tool (and all the shucking clones) with mode 4000, takes a lot of the pain out, I'm going to finish prepping the talk and give it in a day or two at hackfest
thanks @hashcat
Securityblog retweeted
‼️ The FCC told TP-Link that three of its Wi-Fi routers broke US power limits in testing.
The regulator also tentatively found "false or incorrect information" in TP-Link's filings for four models.
TP-Link still needs the same FCC to approve its new routers.
Securityblog retweeted
Discord is about to put your public messages on Google
Discord will start making messages from Discoverable public servers searchable on Google and other search engines from mid-December.
The feature is ON by default in most regions, but you can opt out:
User Settings → Data & Privacy → turn off “Show my message content from Discoverable channels on web pages.”
In the EU, UK, Canada, Brazil, Australia and South Korea, it will be OFF by default.
Private servers, DMs and group DMs are not included. Usernames and avatars won’t appear alongside indexed messages.
Securityblog retweeted
The argument of “you probably get domain admin in all your pentests” therefore Active Directory is insecure, is wrong.
You don’t need Domain Admin to seriously hurt an organization.
On one internal pentest we started from a hybrid joined windows endpoint. There were no paths to Domain Admin found. But guess what…. We sprayed a weak password (think Summer2026!) and compromised the CFO’s account.
Guess what else?
No MFA enforced either.
We logged into their email (from outside the client network) for the screenshot and called it a day.
Some people want to reduce the argument to narrowly to Active Directory vs Entra. But that’s the wrong way to look at it.
We know how to defend. We know what works. This is well defined.
The attack surface is not shrinking no matter what you do. Yes, even if you move to Entra. Attack surface is constantly expanding and it always will. There’s no going back.
Securityblog retweeted
‼️ Energy giant ENGIE says hackers broke into a marketing tool used by its partners and accessed customer data in France.
It runs from names, emails and phone numbers to meter IDs and contract numbers, but not bank details.
ENGIE has not said how many customers are affected.
Securityblog retweeted
Great news! Our industry-leading security tool for Electron apps - ElectroNG is now open source! We're giving it back to the community to encourage contributions and future research. Check out the details today: blog.doyensec.com/2026/10/27…
#doyensec #appsec #security #electron #node
🤖 Made with AI
Securityblog retweeted
When it comes to dangerous Active Directory permissions you have to know..
1) What to look for
2) Where to look
Quick example video in this article...
Securityblog retweeted
The researcher who found a serious PlayStation family-account flaw has gone public, and Sony paid him $5,000 for it.
His public profile shows a resolved $5,000 PlayStation bounty from around 13 days ago, with the report rated high severity at 8.6/10.
He says the original flaw has been fixed, but the fake child accounts are still there, and passkeys added by an attacker can continue working even after the victim changes their password or email.
Securityblog retweeted
Google runs two pipelines both of which failed to catch eMudhra's weak keys. Chrome's monitoring didn't check for small EC private scalars and the one that did, only looked at certs disclosed to CT logs.
Also, they shunted eMudhra for repeatedly failing to comply with policy.
Securityblog retweeted
⚠️ BYOD is now offering the Hospital sector of University of New Mexico a free decryption key as outlined in there update below. They are also offering to pay $2500 to each patient that was affected... but need to provide proof. How about you provide the entire university with a free decryption key and move on.
"We are offering the decryption key for the remaining of locked devices for free (ONLY for the hospital sector) we did not know that it was running machines related to assisting patients in real-time, (we would keep it locked if it was appointments, patient information + research data only), we are still going to keep the data, but we will provide the decryption key for the hospital sector only. Feel free to contact us on Session. To any patient that was affected, please provide us proof, and we will pay you up to $2500 each for the inconvenience. We are sorry once again. We have morals and we have a heart, we are not villains, but we will still continue to hold companies responsible for bad security leading to the compromise of any customer data. That's the whole reason why we came about and we plan to keep it that way."
‼️🇺🇸 University of New Mexico has been named by BYOD ransomware
The full post reads:
36,000 Machines Compromised, both AD forests (Main Campus + Hospital Sector(with appointments, patient information + research)) With GPOs, Two Oracle databases, every student + employee PII (including SSNs), research information, entire Entra Tenant, Oracle HR + Payroll + Banner Student Records, Internal Emails, Cerner EHR rosters. This is your entire network and infrastructure compromised, the entire university COMPLETELY. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
Securityblog retweeted
Sansec found a Magento skimmer campaign that infected 953 online stores, hiding malicious code in CMS blocks and filtering out security scanners with browser fingerprinting. securityaffairs.com/201795/m…
Securityblog retweeted
🚨🇺🇸 Microsoft Authenticator flaw allowed malicious Android apps to steal work account tokens
Tracked as CVE-2026-80097, the high-severity vulnerability allowed an Android app with no permissions to impersonate trusted Microsoft apps such as Teams and request tokens for a work account signed into Authenticator.
⠀
Researchers demonstrated that the stolen tokens could provide access to:
• Email and the ability to send messages
• Files stored in Microsoft services
• Calendars and Teams chats
• Authentication methods and passkey management
⠀
The flaw existed because Authenticator trusted identity information supplied by the requesting app instead of confirming which app actually made the request.
⠀
Microsoft rates the vulnerability 8.6 and says exploitation requires a malicious app on the device and user interaction during authentication. However, researchers reported obtaining tokens without further interaction when a work account was already signed in.
⠀
Microsoft says it has found no evidence of exploitation. The issue affects Authenticator for Android versions before 6.2606.4246.
Users should update to version 6.2606.4246 or later.
Securityblog retweeted
Level 70 at Microsoft means the equivalent of Distinguished Engineer on the eng IC ladder.
So “Level 70 and below” for Microsoft’s VEOs affects the vast majority.
The only documented level we have above it is 80 which is for a Technical Fellow.
We may have some gaps, but here’s the mapping on Levels.fyi
Securityblog retweeted
Someone on Reddit built his wife a job search app.
She is a junior software engineer, and her job search had dragged on for almost 10 months. Tailoring a resume for every posting took ages.
So he built Dossier. It finds postings, then writes a tailored resume, cover letter and email for each job, using only facts from her profile.
It tracks every application from draft to offer on a board, and it runs on your own server, with a local AI model option, so your data stays with you.
She landed a job with it, so he open-sourced it for anyone in the same spot.
It is free at github.com/AienTech/dossier.
