Senior Security Consultant @TrustedSec | Military grade meme poster, researcher, cloud penetration tester, voider of warranties. My thoughts are my own.
In someone’s cloud
Joined April 2009
- Tweets19.6K
- Following1.3K
- Followers26.9K
- Likes22.1K
rootsecdev retweeted
🦛🦛🦛Microsoft patched PetitPotam this October: EFSR now only resolves local paths. This means WebDAV to LDAP Coercion is fixed!
Remaining methods for clients are WSP (coercing SMB) and PrinterBug (coercing RPC), but both cannot be relayed to LDAP 💀💀💀
rootsecdev retweeted
‼️BREAKING: Cloudflare says it is already seeing early attacks on the two leaked PHP flaws, hours before the patch.
Its CTO Dane Knecht says WAF rules for the known exploit vectors are live for all customers, including free plans, but calls them "a STOPGAP only".
Websites are going dark while they wait. NotuBiz, used by 100+ Dutch local governments, pulled council information sites offline, including those of Den Bosch, Breda and Eindhoven.
explain xkcd and the Star Citizen Wiki are down too.
PHP ships the fix at 14:00 UTC today.
‼️ BREAKING: Two leaked remote code execution flaws in PHP are real, watchTowr confirms.
PHP will ship fixes for two critical flaws, both rated CVSS 9.2, on Wednesday 21 October at 14:00 UTC, a day before the embargo was due to lift.
CVE-2026-109618 and CVE-2026-109619 first surfaced in a Hacker News post whose author admitted having no evidence beyond "source: trust me, bro".
Kevin Beaumont flagged the leak, and watchTowr confirmed it two hours later.
PHP says it may release sooner if details go public or exploitation appears. It has not named the CVEs or the affected versions.
rootsecdev retweeted
RAPID RESPONSE: Huntress has become aware of a widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick).
We’ve confirmed that an unknown threat actor abused the access they obtained in SkyKick to pivot to access customers' Microsoft 365 environments. 🧵
rootsecdev retweeted
Something that still hasn’t been solved is how wildly different every company views risk when it comes to AI. Twitter and many OffSec startups treat this as a solved problem, but it’s far from it.
Some companies allow frontier models for external testing but prohibit them for internal or application testing. Others have entirely different restrictions. It’s not specific to an industry, vertical, or company size.
Many of these same companies have widely deployed AI internally but still impose unique restrictions on third party security testing. We’ve had to design entirely unique ROEs around these requirements.
There’s no universal approach here, regardless of how much the OffSec industry wants to pretend there is. Compliance, regulatory requirements, data handling, and a whole host of other factors play into these decisions.
rootsecdev retweeted
🚨 #BREAKING: OpenAI & Anthropic execs prepping for “catastrophic” AI incident that could impact the trajectory of humanity.
rootsecdev retweeted
Integrity Tech has enabled Chinese government-linked threat actors to exploit organizations’ networks globally and exfiltrate critical data. We’ve joined @FBICyberDiv and others to arm organizations with guidance to proactively defend their networks from this threat. nsa.gov/Press-Room/Press-Rel…
ALT "NSA joins FBI and others in releasing: Chinese government-linked cyber threat actors combine automated and hands-on hacking tools to steal sensitive data. Cybersecurity advisory.
rootsecdev retweeted
SITUATION DETECTED: OpenAI has released a GitHub repository with over 700 math problems solved by its models.
github.com/openai/math
rootsecdev retweeted
ALERT: 🚨 Plague in Russia that has quarantined close to 200 people listed by the World Health Organization as the MOST virulent form of plague.
Can be FATAL within 18-24 hours of onset, if untreated.
It is transmitted via respiratory particles.
rootsecdev retweeted
Russia - The timeline
Sept 25 - media say lab worker broke a tube containing plague pathogen at work. UNCONFIRMED by any agency.
Sept 29 - Moscow Times says admitted with severe pneumonia. IRK cites sources saying she was initially suspected of severe COVID-19.
Oct 1 - Shelekhov hospital restricts admissions; mayor confirms inpatient quarantine, outpatient care continues. Sources say ~90 contacts quarantined that day.
Overnight Oct 1-2 - lab worker dies
Oct 2 - Governor Kobzev calls an emergency commission with Rospotrebnadzor chief Popova present; says "particularly dangerous infection," contacts asymptomatic with negative tests.
Tsydenov says "plague" - then edits it to "possibly."
Oct 3 - Baikalsk officials posted advice to avoid Shelekhov, deleted it two hours later.
rootsecdev retweeted
One of the most common questions on red team kick off calls is how should the defense respond if the red team is detected? This is a great question and seeks to maximize the value of the engagement.
I wrote this post in 2019 to directly and practically answer this question, and it's held up surprisingly well.
trustedsec.com/blog/red-team…
rootsecdev retweeted
We're releasing a report on our 48-hour investigation into rogue OpenAI agent activity.
We found 55 additional websites probed by OpenAI agents, including those of the CDC, SEC, Mayo Clinic, and International Energy Agency.
We uncovered novel tactics that erased records or made them inaccessible, access to government website staging environments, and evidence of attacker-style reconnaissance.
Our blog: asymmetricsecurity.com/newsr…
FT: ft.trib.al/AC1uyE5
rootsecdev retweeted
🔥 Recent additions to LOLBAS-Project.github.io:
• applaunch.exe for applocker bypass
• mscopilot/setupupc/dotnet-trace.exe for proxy execution
• scp/ssh.exe for loading arbitrary DLLs
• msoxmled.exe for downloading
• fsutil.exe for preventing Windows Defender updates
rootsecdev retweeted
SharePoint + Pre-Auth RCE + MemShell? 👀
We’ve published our technical analysis of CVE-2026-65660, covering the attack chain from an Allow Anonymous site and a pre-auth SharePoint vulnerability to RCE and MemShell.
Take a look:
blog.viettelcybersecurity.co…
rootsecdev retweeted
Opus 5.5 performs at the level of Fable 5.1. It's ~30% faster and ~40% cheaper than Opus 5 per task.
In Claude Code:
- 5-hour session limits increase 20% today
- Opus 5.5 is priced lower, so it goes 25% further within limits
- Pro, Max, and Team users get a reset to use anytime
rootsecdev retweeted
How do you make #AI work for your cloud infrastructure without sacrificing security? Find out in our next #webinar on September 30, "Securing Cloud AI: Real-World Scenarios in AWS, Azure, and GCP." Register now! hubs.la/Q04xFNWg0 @nyxgeek @rootsecdev @ustayready @0xfg__
rootsecdev retweeted
🐳 Run DeepSeek V4.1 Flash locally on your Mac — uncensored for security research.
We just released Orca’s official MLX weights for Apple Silicon.
This build is designed for AI security research, red teaming, alignment research, and agent-security testing — where refusal behavior itself can get in the way of measuring the model.
4-bit — recommended
→ 458.7 GB
→ 0.9954 routed-expert fidelity
→ 512 GB Mac
3-bit → 364.3 GB / 512 GB Mac
2-bit → 212.2 GB / 256 GB Mac
On our refusal evals, the uncensored build reduced harmful-prompt refusal by 87–96% across JBB, AdvBench, MaliciousInstruct, HarmBench, ForbiddenQuestions, StrongREJECT, and SimpleSafetyTests.
Built for security researchers who need to study what happens when the guardrails come off.
The downloadable weights are uncensored. Our hosted API remains guardrailed.🐳
API: orcarouter.ai/models/deepsee…
Model: huggingface.co/orcarouter/De…
rootsecdev retweeted
Holy shit. Anthropic caught Iran using Claude to target Navy bases, automate dossiers on Americans, and run influence campaigns on US social media. Details are insane. The morons uploaded everything including the organization plans of the Ayatollah's funderal lmao
We're publishing our most detailed threat intelligence report to date.
It covers how people tried to misuse Claude—for cyberattacks, influence operations, surveillance, biology, and building weapons—and how we found and stopped them.
We disrupted every operation in the report, and used the lessons from them to strengthen our safeguards. Where appropriate, we also shared what we found with authorities and other AI companies.
These cases are not typical: we’re highlighting some of the most sophisticated misuse we’ve seen. But they’re especially important to discuss, because they show us where AI misuse is headed, where our safeguards work, and where they need to improve.
We’re publishing this report so others can spot the same activity on their own platforms, and so we can give the public a clearer view of how emerging threats develop.
Read the report: anthropic.com/threat-intelli…
rootsecdev retweeted
Anthropic’s new threat report is absolutely insane.
They claim:
-Alibaba extracted 151M+ Claude exchanges to help train Qwen
-Kimi secretly routed some users to Claude without them knowing
-DeepSeek apparently did the same
-A weapons group used multiple Claude instances as an engineering team, test-fired a guided rocket, FAILED, then went back to Claude to figure out what went wrong
What the fuck did I just read 😭
We're publishing our most detailed threat intelligence report to date.
It covers how people tried to misuse Claude—for cyberattacks, influence operations, surveillance, biology, and building weapons—and how we found and stopped them.
We disrupted every operation in the report, and used the lessons from them to strengthen our safeguards. Where appropriate, we also shared what we found with authorities and other AI companies.
These cases are not typical: we’re highlighting some of the most sophisticated misuse we’ve seen. But they’re especially important to discuss, because they show us where AI misuse is headed, where our safeguards work, and where they need to improve.
We’re publishing this report so others can spot the same activity on their own platforms, and so we can give the public a clearer view of how emerging threats develop.
Read the report: anthropic.com/threat-intelli…