Loading video...

Video Failed to Load

There was a problem loading this video. This could be due to a temporary network issue or the video might be unavailable.

🚨 Very concerning 0-click zero-day vulnerability for sale: allows unauthenticated attackers to execute arbitrary code with SYSTEM-level privileges on fully patched Windows 10/11 and Windows Server 2022 systems. The exploit is “reliable, low-resource, and bypasses the latest security mitigations.” Price: 25k POC:

International Cyber Digest

33,422 subscribers

77,014 views • 1 year ago •via X (Twitter)

Science & Technology News & Politics Education

Anya Rossi• Live Now

Private livecam show

0 Comments

No comments available

Comments from the original post will appear here

Related Videos

Microsoft denies rewriting Windows 11 using AI after an employee’s “one engineer, one month, one million lines of code” post on LinkedIn causes outrage. "Windows is *NOT* being rewritten in Rust with AI" -- Microsoft. Since this has Microsoft's attention, it's the right time to remind everyone about the lack of "native" code for UI-level features in Windows 11, as everything is moving to WebView2. For example, in recent Windows 11 builds, Notification Center's Agenda view is built using WebView2, and you'll notice spike in web resources (Edge-related processes) when you open Notification Center.

Microsoft denies rewriting Windows 11 using AI after an employee’s “one engineer, one month, one million lines of code” post on LinkedIn causes outrage. "Windows is NOT being rewritten in Rust with AI" -- Microsoft. Since this has Microsoft's attention, it's the right time to remind everyone about the lack of "native" code for UI-level features in Windows 11, as everything is moving to WebView2. For example, in recent Windows 11 builds, Notification Center's Agenda view is built using WebView2, and you'll notice spike in web resources (Edge-related processes) when you open Notification Center.

Windows Latest

564,454 views • 8 months ago

So here is new local privilege escalation zero-day I discovered, not patched yet too :). In simple terms, if you have a service like RDP that exposes an RPC server, there many system services running as SYSTEM connect to it as RPC clients. If that service is turned off (RDP is off by default), it seems that any other process in Windows can expose the same RPC server using the same endpoint. Now all the RPC calls from that SYSTEM processes will come to this fake server and If the process that deployed the server has SeImpersonatePrivilege, it can escalate to SYSTEM by impersonate the RPC client. In the white paper below, I describe five exploit paths you can abuse. However it's architecture problem and maybe there are more. It's Not A Potato

So here is new local privilege escalation zero-day I discovered, not patched yet too :). In simple terms, if you have a service like RDP that exposes an RPC server, there many system services running as SYSTEM connect to it as RPC clients. If that service is turned off (RDP is off by default), it seems that any other process in Windows can expose the same RPC server using the same endpoint. Now all the RPC calls from that SYSTEM processes will come to this fake server and If the process that deployed the server has SeImpersonatePrivilege, it can escalate to SYSTEM by impersonate the RPC client. In the white paper below, I describe five exploit paths you can abuse. However it's architecture problem and maybe there are more. It's Not A Potato

Haidar

51,483 views • 4 months ago

RedNova: From Arbitrary File Write to Command Execution Using COM in Windows Months ago, I wrote a post ( about the unique method used in the RedSun exploit to turn a file write into command execution by using a COM object that can be triggered by a low-privileged user and runs as SYSTEM. In that post, I mentioned that there are other COM objects that can be used in the same way. I presented one object called CoFilterPipeline and noted that it needs some tricks before it can be weaponized. Now I've written a full blog post on how you can find such objects and how you can weaponize them in exploits like RedSun. The video below shows another COM object with the same behavior (windows 11). It's called PerceptionSimulationCoClass. A low-privileged user can activate it, and it runs as SYSTEM. The video doesn't contain any exploit (it just replaces the COM server as administrator). The goal is only to demonstrate how a file write can be turned into command execution as SYSTEM while being triggered by a low-privileged user.

RedNova: From Arbitrary File Write to Command Execution Using COM in Windows Months ago, I wrote a post ( about the unique method used in the RedSun exploit to turn a file write into command execution by using a COM object that can be triggered by a low-privileged user and runs as SYSTEM. In that post, I mentioned that there are other COM objects that can be used in the same way. I presented one object called CoFilterPipeline and noted that it needs some tricks before it can be weaponized. Now I've written a full blog post on how you can find such objects and how you can weaponize them in exploits like RedSun. The video below shows another COM object with the same behavior (windows 11). It's called PerceptionSimulationCoClass. A low-privileged user can activate it, and it runs as SYSTEM. The video doesn't contain any exploit (it just replaces the COM server as administrator). The goal is only to demonstrate how a file write can be turned into command execution as SYSTEM while being triggered by a low-privileged user.

Haidar

13,511 views • 17 days ago

Exploit write-ups for our 🚨latest 0-day🚨and the tragedy that swept the red black tree family dropping soon 👀 Here is a tiktok style video for those of you with no attention span thanks to slop and social media. Turn on the audio!!!

Exploit write-ups for our 🚨latest 0-day🚨and the tragedy that swept the red black tree family dropping soon 👀 Here is a tiktok style video for those of you with no attention span thanks to slop and social media. Turn on the audio!!!

Crusaders of Rust

56,239 views • 1 year ago

$TESTED: Windows 11's upcoming "Low Latency Profile" mode brings genuine performance improvements to the OS, speeding up flyout and app launches significantly. We've benchmarked opening some apps on video with the Low Latency Profile enabled and disabled, and you can see differences in how quickly things appear. For some things, it's a fraction of a second faster, for others, it's a significant increase in speed. In our testing, this new Low Latency Profile is a major improvement in overall responsiveness when it comes to opening apps and flyouts. Our tests were conducted on a clean install of the latest Windows 11 preview build on the same hardware.$

TESTED: Windows 11's upcoming "Low Latency Profile" mode brings genuine performance improvements to the OS, speeding up flyout and app launches significantly. We've benchmarked opening some apps on video with the Low Latency Profile enabled and disabled, and you can see differences in how quickly things appear. For some things, it's a fraction of a second faster, for others, it's a significant increase in speed. In our testing, this new Low Latency Profile is a major improvement in overall responsiveness when it comes to opening apps and flyouts. Our tests were conducted on a clean install of the latest Windows 11 preview build on the same hardware.

Windows Central

1,162,358 views • 4 months ago

Windows 11’s hidden CPU boost is now available in the May optional update! I installed KB5089573 (Build 26200.8524) and tested the Low Latency Profile again. For now, this feature does not make your apps launch faster, as that particular change is not included in today's update. However, the Low Latency Profile currently makes OS flyouts load faster. This means the Start menu opens with less lag, and Action Center feels smoother. Plus, right-click menus show less of that annoying rendering delay. On slower PCs, this should matter even more because Windows briefly pushes the CPU harder during shell interactions, then lets it drop back to idle. Some people call this a lazy band-aid, but that misses the point. macOS and Linux already have similar tricks. This is how modern systems make interactions feel instant. The real win comes when Microsoft combines this with native WinUI 3 work and less WebView2 bloat. Windows 11 finally feels like it’s being tuned for responsiveness again.

Windows Latest

220,035 views • 3 months ago

This is big... Anthropic just announced a model so powerful they won't release it to the public out of fear over the damage it will cause 😨 Claude Mythos Preview found thousands of zero-day exploits in every major operating system and web browser... The numbers are hard to believe: > $50 to find a 27-year-old bug in OpenBSD, one of the most security-hardened operating systems ever built > Under $1,000 to find AND build a fully working remote code execution exploit on FreeBSD that grants unauthenticated root access from anywhere on the internet > Under $2,000 to chain together multiple Linux kernel vulnerabilities into a complete privilege escalation exploit For context: these are the kinds of findings that previously required elite security researchers working for weeks. Anthropic engineers with no formal security training asked Mythos to find exploits overnight. They woke up to working code the next morning. The results were so impressive Anthropic assembled Apple, Google, Microsoft, Amazon, NVIDIA, and seven other organizations into Project Glasswing: A $100M defensive coalition. They're not releasing this model publicly. Instead, they're racing to patch the world's infrastructure before models like this proliferate.

This is big... Anthropic just announced a model so powerful they won't release it to the public out of fear over the damage it will cause 😨 Claude Mythos Preview found thousands of zero-day exploits in every major operating system and web browser... The numbers are hard to believe: > $50 to find a 27-year-old bug in OpenBSD, one of the most security-hardened operating systems ever built > Under $1,000 to find AND build a fully working remote code execution exploit on FreeBSD that grants unauthenticated root access from anywhere on the internet > Under $2,000 to chain together multiple Linux kernel vulnerabilities into a complete privilege escalation exploit For context: these are the kinds of findings that previously required elite security researchers working for weeks. Anthropic engineers with no formal security training asked Mythos to find exploits overnight. They woke up to working code the next morning. The results were so impressive Anthropic assembled Apple, Google, Microsoft, Amazon, NVIDIA, and seven other organizations into Project Glasswing: A $100M defensive coalition. They're not releasing this model publicly. Instead, they're racing to patch the world's infrastructure before models like this proliferate.

Josh Kale

4,066,145 views • 5 months ago

someone built an AI RED TEAM that maps your entire attack surface as a knowledge graph, finds every vulnerability, then EXPLOITS them to root access AUTONOMOUSLY its called RedAmon, 9,000 templates. 17 node types, actual Metasploit shells, not reports, no pentesters needed 6 phases of autonomous recon: subdomain discovery, port scanning, http probing, resource enumeration, vulnerability scanning, MITRE mapping every finding stored in a Neo4j graph with 17 node types and 20+ relationship types. the AI reasons about the graph, finds attack paths, and runs actual Metasploit exploits, actual shells stress-tested with zero vulnerability data, zero exploit modules, one instruction find a CVE and exploit it, it went from empty database to root-level RCE in 20 steps, researched the exploit on the web, crafted a custom deserialization payload, debugged itself when the first attempt failed next try, the server responded with root access, the highest privilege level on any Linux system. full control over everything the target was running node-serialize 0.0.4, a package with a critical deserialization flaw (CVE-2017-5941, CVSS 9.8), the server takes your cookie, decodes it, and passes it straight into unserialize() which executes any code inside it, the AI figured this out on its own with no hints built on LangGraph + MCP tool servers for naabu, nuclei, curl, metasploit. hunts leaked secrets across GitHub repos, 40+ regex patterns for AWS keys, Stripe tokens, database creds

someone built an AI RED TEAM that maps your entire attack surface as a knowledge graph, finds every vulnerability, then EXPLOITS them to root access AUTONOMOUSLY its called RedAmon, 9,000 templates. 17 node types, actual Metasploit shells, not reports, no pentesters needed 6 phases of autonomous recon: subdomain discovery, port scanning, http probing, resource enumeration, vulnerability scanning, MITRE mapping every finding stored in a Neo4j graph with 17 node types and 20+ relationship types. the AI reasons about the graph, finds attack paths, and runs actual Metasploit exploits, actual shells stress-tested with zero vulnerability data, zero exploit modules, one instruction find a CVE and exploit it, it went from empty database to root-level RCE in 20 steps, researched the exploit on the web, crafted a custom deserialization payload, debugged itself when the first attempt failed next try, the server responded with root access, the highest privilege level on any Linux system. full control over everything the target was running node-serialize 0.0.4, a package with a critical deserialization flaw (CVE-2017-5941, CVSS 9.8), the server takes your cookie, decodes it, and passes it straight into unserialize() which executes any code inside it, the AI figured this out on its own with no hints built on LangGraph + MCP tool servers for naabu, nuclei, curl, metasploit. hunts leaked secrets across GitHub repos, 40+ regex patterns for AWS keys, Stripe tokens, database creds

chiefofautism

70,129 views • 6 months ago

MUST WATCH:🚨 Watch this crucial 20-minute video featuring prominent Democrats, computer science professors, and election security experts discussing the vulnerabilities in America's election system. They warn that the system is online, easily hackable, and often operates on outdated Windows 7 or older systems. Key Points: Easily Hackable Voting Equipment: All electronic voting equipment can be hacked as they must receive programming before each election from memory cards prepared on election management systems. These systems are often connected to the internet and run outdated Windows versions. Spread of Malware: If a county election management system is infected with malware, it can spread to USB drives, which then transfer it to voting machines, scanners, and ballot-marking devices throughout the county. Programming Practices: Most U.S. election systems are programmed by local county officials or third-party vendors. They use previously used USB drives on internet-connected computers before plugging them into scanners, tabulators, and voting machines. Outdated Systems: In 2019, the Associated Press reported that most of the 10,000 election jurisdictions, including swing states, were still using Windows 7 or older systems for ballot production, vote programming, counting, and reporting. End of Windows 7 Support: Windows 7 reached its end of life on January 14, 2020, with Microsoft stopping technical support and security updates. Remote Access and Modems: Voting machine manufacturers have installed remote-access software and wireless modems, connecting voting machines directly to the internet. NBC News reported in 2020 that ES&S, the largest U.S. election machine vendor, had installed at least 14,000 modems. Dominion Voting Systems: The second-largest vendor, Dominion, has publicly acknowledged using modems in their machines and running remote-access software during the 2020 election. For example, in Georgia, election worker Susan Voyles testified that Dominion employees operated remotely on ballot-marking devices and poll pads. Findings from Wisconsin and Michigan: Investigations found Dominion and ES&S machines online and connected to the internet. In Michigan, a modem chip was discovered in an ES&S voting machine, potentially allowing hackers to intercept and manipulate election results. Conclusion: Hackers can potentially infiltrate elections through vulnerable USB cards, election management systems, and voting machines themselves. This underscores the urgent need for securing America's election infrastructure.

MUST WATCH:🚨 Watch this crucial 20-minute video featuring prominent Democrats, computer science professors, and election security experts discussing the vulnerabilities in America's election system. They warn that the system is online, easily hackable, and often operates on outdated Windows 7 or older systems. Key Points: Easily Hackable Voting Equipment: All electronic voting equipment can be hacked as they must receive programming before each election from memory cards prepared on election management systems. These systems are often connected to the internet and run outdated Windows versions. Spread of Malware: If a county election management system is infected with malware, it can spread to USB drives, which then transfer it to voting machines, scanners, and ballot-marking devices throughout the county. Programming Practices: Most U.S. election systems are programmed by local county officials or third-party vendors. They use previously used USB drives on internet-connected computers before plugging them into scanners, tabulators, and voting machines. Outdated Systems: In 2019, the Associated Press reported that most of the 10,000 election jurisdictions, including swing states, were still using Windows 7 or older systems for ballot production, vote programming, counting, and reporting. End of Windows 7 Support: Windows 7 reached its end of life on January 14, 2020, with Microsoft stopping technical support and security updates. Remote Access and Modems: Voting machine manufacturers have installed remote-access software and wireless modems, connecting voting machines directly to the internet. NBC News reported in 2020 that ES&S, the largest U.S. election machine vendor, had installed at least 14,000 modems. Dominion Voting Systems: The second-largest vendor, Dominion, has publicly acknowledged using modems in their machines and running remote-access software during the 2020 election. For example, in Georgia, election worker Susan Voyles testified that Dominion employees operated remotely on ballot-marking devices and poll pads. Findings from Wisconsin and Michigan: Investigations found Dominion and ES&S machines online and connected to the internet. In Michigan, a modem chip was discovered in an ES&S voting machine, potentially allowing hackers to intercept and manipulate election results. Conclusion: Hackers can potentially infiltrate elections through vulnerable USB cards, election management systems, and voting machines themselves. This underscores the urgent need for securing America's election infrastructure.

KanekoaTheGreat

1,388,889 views • 2 years ago

A Threat Actor has announced, through text and video in a Telegram group, the launch of BLACKNET-00 — the world’s most advanced and accessible ransomware builder platform. Featuring a professional dark-themed graphical interface, intuitive tabs, and real-time configuration preview, anyone — even with ZERO programming knowledge — can generate fully functional ransomware with just one click. High-risk features of the BLACKNET-00 tool include: • AES-256, RSA, and ChaCha20 encryption • Complete disablement of Windows Defender, Task Manager, and critical system controls • Advanced persistence + network/USB self-propagation • C2 server with Tor + DGA support • Anti-detection (VM, sandbox, delayed execution) • Exfiltration of passwords, crypto wallets, screenshots, and webcam footage Announced price: US$ 500. This platform democratizes ransomware, completely eliminating the technical barrier and dramatically increasing the risk of mass attacks by low-level actors. Cybersecurity professionals and organizations: immediately raise your alert level and reinforce defenses. Share to spread awareness. #CyberSecurity #Ransomware #BLACKNET00 #ThreatIntelligence #InfoSec #Malware #RansomwareAsAService #CyberThreat #ThreatActor

A Threat Actor has announced, through text and video in a Telegram group, the launch of BLACKNET-00 — the world’s most advanced and accessible ransomware builder platform. Featuring a professional dark-themed graphical interface, intuitive tabs, and real-time configuration preview, anyone — even with ZERO programming knowledge — can generate fully functional ransomware with just one click. High-risk features of the BLACKNET-00 tool include: • AES-256, RSA, and ChaCha20 encryption • Complete disablement of Windows Defender, Task Manager, and critical system controls • Advanced persistence + network/USB self-propagation • C2 server with Tor + DGA support • Anti-detection (VM, sandbox, delayed execution) • Exfiltration of passwords, crypto wallets, screenshots, and webcam footage Announced price: US$ 500. This platform democratizes ransomware, completely eliminating the technical barrier and dramatically increasing the risk of mass attacks by low-level actors. Cybersecurity professionals and organizations: immediately raise your alert level and reinforce defenses. Share to spread awareness. #CyberSecurity #Ransomware #BLACKNET00 #ThreatIntelligence #InfoSec #Malware #RansomwareAsAService #CyberThreat #ThreatActor

Clandestine

88,491 views • 5 months ago

XBOX Gen-10 details: • Microsoft's next-generation Xbox (Gen-10) is the company's most ambitious and risky gaming platform, built as a Windows 11 gaming PC with a TV-optimized, console-like interface. • It supports full backward compatibility for all Xbox One, Series X|S, and legacy games, plus any Windows 11 PC titles. • Users can exit the Xbox interface to full Windows for tasks like streaming, coding, or music production, akin to Steam Deck's Linux mode. • Core hardware features an AMD semi-custom SoC codenamed “Magnus.” • AMD CEO Lisa Su: “Development of Microsoft's next-gen Xbox featuring an AMD semi-custom SoC is progressing well to support a launch in 2027.” • 2027 launch is a "best-case scenario"; Microsoft insiders are surprised by Su's timeline, pending Windows 11 polish. • Xbox President Sarah Bond confirmed a multi-year Xbox-AMD partnership for hardware and backward compatibility. • Xbox and Windows teams collaborate for a seamless, console-like OS experience atop Windows 11. • Supports multiple storefronts: Xbox Store, Steam, and Epic Games Store, with ports to PS and Switch 2. • The "Xbox Everywhere" strategy offers hardware choices via OEM partners like ASUS (Xbox Ally preview). • OEMs (ASUS, Lenovo, and Razer) to offer a range of Xbox-branded devices at different price/performance points. • Microsoft plans its own first-party Xbox handheld in the future. • NPU-powered features like auto-generated gameplay highlight clips, testing on Xbox Ally X, and rollout in March 2026. • Emphasizes cross-play, cross-saves, and cross-purchasing via Xbox Play Anywhere to grow the industry. • First-party games ported to Steam, PlayStation, and Nintendo Switch 2. • Easier developer publishing tools; major updates at GDC 2026. • Polished software experience is critical; current Ally handhelds highlight Windows issues to fix. • Epic Games Store and Steam are expected to be part of the next Xbox’s multi-store openness, alongside Xbox’s own store. • Price is uncertain (due to tariffs and costs; OEMs for affordability), but the next Xbox may skew more premium (~$1,000)—while lower-end options may persist via partners. Also, Series S support will be extended. • Echoes the original Xbox vision of Windows in the living room; Surface-like premium ecosystem strategy. via: Windows Central Jez

XBOX Gen-10 details: • Microsoft's next-generation Xbox (Gen-10) is the company's most ambitious and risky gaming platform, built as a Windows 11 gaming PC with a TV-optimized, console-like interface. • It supports full backward compatibility for all Xbox One, Series X|S, and legacy games, plus any Windows 11 PC titles. • Users can exit the Xbox interface to full Windows for tasks like streaming, coding, or music production, akin to Steam Deck's Linux mode. • Core hardware features an AMD semi-custom SoC codenamed “Magnus.” • AMD CEO Lisa Su: “Development of Microsoft's next-gen Xbox featuring an AMD semi-custom SoC is progressing well to support a launch in 2027.” • 2027 launch is a "best-case scenario"; Microsoft insiders are surprised by Su's timeline, pending Windows 11 polish. • Xbox President Sarah Bond confirmed a multi-year Xbox-AMD partnership for hardware and backward compatibility. • Xbox and Windows teams collaborate for a seamless, console-like OS experience atop Windows 11. • Supports multiple storefronts: Xbox Store, Steam, and Epic Games Store, with ports to PS and Switch 2. • The "Xbox Everywhere" strategy offers hardware choices via OEM partners like ASUS (Xbox Ally preview). • OEMs (ASUS, Lenovo, and Razer) to offer a range of Xbox-branded devices at different price/performance points. • Microsoft plans its own first-party Xbox handheld in the future. • NPU-powered features like auto-generated gameplay highlight clips, testing on Xbox Ally X, and rollout in March 2026. • Emphasizes cross-play, cross-saves, and cross-purchasing via Xbox Play Anywhere to grow the industry. • First-party games ported to Steam, PlayStation, and Nintendo Switch 2. • Easier developer publishing tools; major updates at GDC 2026. • Polished software experience is critical; current Ally handhelds highlight Windows issues to fix. • Epic Games Store and Steam are expected to be part of the next Xbox’s multi-store openness, alongside Xbox’s own store. • Price is uncertain (due to tariffs and costs; OEMs for affordability), but the next Xbox may skew more premium (~$1,000)—while lower-end options may persist via partners. Also, Series S support will be extended. • Echoes the original Xbox vision of Windows in the living room; Surface-like premium ecosystem strategy. via: Windows Central Jez

Idle Sloth

69,919 views • 7 months ago

Every software engineer and AI hater needs to watch this clip to understand that “oh every security incident is a marketing stunt” line is a tremendously misinformed take. I’m going to try to explain the OpenAI / HuggingFace exploit in 10 steps in simple words: OpenAI was evaluating their new internal model without internet access and it operated in a swarm of subagents to eventually hijack internal OpenAI and HuggingFace infrastructure. 1. Isolated agents found a way to communicate each other through an internal dependency management service by figuring out how to post sometimes cryptic text files or folder names in it 2. Using its collective knowledge through that communication channel, it found a 0-day (never before seen) exploit in said service to access the internet OpenAI hack: 3. Found a leaked credential of a random company in a public archive 4. Uploaded a Ruby object to that company’s servers, uses it as a dependency in the original service in (1) 5. Found another 0-day exploit in the service where packages are deserialized in an unsandboxed manner in the dep management service allowing any code to run 6. Finds that the Linux version of the unsandboxed system has a CVE, a known vulnerability, to gain more permissions (root) 7. Eventually spread through the OpenAI internal cluster gaining root access to many machines Hugging Face exploit: 8. Found an exposed API key in a Modal application running a HuggingFace app that took arbitrary code allowing it to take over that service to execute code 9. Found two 0-days in HuggingFace dataset infrastructure to be able to access local files on HF servers to obtain credentials and other HF source code 10. Used source code and credential to become cluster admin of HF in <13hrs Agents at the frontier are like infinitely scalable armies of the best hackers on the planet. If there is a password or key exposed, they will find it. Even if the system follows the best security practices, they will find a way around it. And these are not even models that are aligned to solving tangential tasks, not even post trained specifically to exploit systems. Cybersecurity has historically relied partly on attacker scarcity. That is no longer true. What would previously have taken months will take days. The repercussions for businesses, critical services and nation states are unprecedented threats in human history. You could ostensibly bring down power grids, financial infrastructure, military systems, weapons programs, intelligence networks and spread through the software supply chain. We need to take this seriously. It’s a threat to all software all over the world.

Every software engineer and AI hater needs to watch this clip to understand that “oh every security incident is a marketing stunt” line is a tremendously misinformed take. I’m going to try to explain the OpenAI / HuggingFace exploit in 10 steps in simple words: OpenAI was evaluating their new internal model without internet access and it operated in a swarm of subagents to eventually hijack internal OpenAI and HuggingFace infrastructure. 1. Isolated agents found a way to communicate each other through an internal dependency management service by figuring out how to post sometimes cryptic text files or folder names in it 2. Using its collective knowledge through that communication channel, it found a 0-day (never before seen) exploit in said service to access the internet OpenAI hack: 3. Found a leaked credential of a random company in a public archive 4. Uploaded a Ruby object to that company’s servers, uses it as a dependency in the original service in (1) 5. Found another 0-day exploit in the service where packages are deserialized in an unsandboxed manner in the dep management service allowing any code to run 6. Finds that the Linux version of the unsandboxed system has a CVE, a known vulnerability, to gain more permissions (root) 7. Eventually spread through the OpenAI internal cluster gaining root access to many machines Hugging Face exploit: 8. Found an exposed API key in a Modal application running a HuggingFace app that took arbitrary code allowing it to take over that service to execute code 9. Found two 0-days in HuggingFace dataset infrastructure to be able to access local files on HF servers to obtain credentials and other HF source code 10. Used source code and credential to become cluster admin of HF in <13hrs Agents at the frontier are like infinitely scalable armies of the best hackers on the planet. If there is a password or key exposed, they will find it. Even if the system follows the best security practices, they will find a way around it. And these are not even models that are aligned to solving tangential tasks, not even post trained specifically to exploit systems. Cybersecurity has historically relied partly on attacker scarcity. That is no longer true. What would previously have taken months will take days. The repercussions for businesses, critical services and nation states are unprecedented threats in human history. You could ostensibly bring down power grids, financial infrastructure, military systems, weapons programs, intelligence networks and spread through the software supply chain. We need to take this seriously. It’s a threat to all software all over the world.

Deedy

104,678 views • 1 month ago

OKKKK Ive fully automated Codex + Claude Code it take any app idea and runs a fleet of parallel agents in iterative loops nonstop for 24hr+ it can research, design, plan and execute for DAYS zero back and forth it also costs $0 because it’s powered by AI subs we all already pay for so I could have 100s of complex, polished iOS apps built in 30 days if i really wanted to - for the SAME price as anyone else on the same subscription this is CLONK

OKKKK Ive fully automated Codex + Claude Code it take any app idea and runs a fleet of parallel agents in iterative loops nonstop for 24hr+ it can research, design, plan and execute for DAYS zero back and forth it also costs $0 because it’s powered by AI subs we all already pay for so I could have 100s of complex, polished iOS apps built in 30 days if i really wanted to - for the SAME price as anyone else on the same subscription this is CLONK

Paulius 🏴‍☠️

44,882 views • 2 months ago

⚠️ A defense evasion tool called ExEngine is being sold as a service, marketed as an AV/EDR killer that disables mainstream consumer security software including Windows Defender, Malwarebytes, Bitdefender, and Avast. The tool combines AV termination with a Ring-3 rootkit, UAC bypass, and decoy payload delivery to support stealthy initial access operations. ⠀ ‣ Threat Actor: ryewx1 ‣ Category: Defense Evasion Tool / Killer ‣ Offering: ExEngine AV/EDR Killer ‣ Industry: Malware Tooling ⠀ The seller claims ExEngine actively terminates security software rather than only obfuscating payloads, granting attackers a longer window of undetected operation. The tool supports Windows 10 and 11 builds and is sold per-build at $150 to $250. ⠀ Advertised capabilities: ⠀ ▪️ AV/EDR termination with primary and fallback techniques ▪️ UAC bypass with automatic privilege escalation ▪️ Ring-3 rootkit functionality to hide files, processes, registry keys, and network connections ▪️ Discord webhook logging for victim machine info and execution status ▪️ Secondary decoy payload (game/document/installer) to keep targets unaware ▪️ Persistence across reboots and logouts ▪️ Anti-VM and anti-debug detection with fake error message exit ▪️ Universal Windows 10/11 support, all payload types ⠀ Risk to defenders: ⠀ ▪️ Active termination of consumer AV products including Windows Defender means traditional endpoint protections cannot be relied on once ExEngine executes successfully ▪️ Decoy payload pattern is designed to delay user-driven incident reporting, lengthening attacker dwell time ▪️ Ring-3 rootkit hiding of files, processes, and network connections complicates incident response triage on compromised hosts ▪️ Discord webhook telemetry indicates the operator is targeting consumer and SMB victims at scale rather than running individual targeted campaigns ▪️ Sold per-build at low cost ($150 to $250), making it accessible to low-skill operators who can pair it with commodity stealers, RATs, or loaders

⚠️ A defense evasion tool called ExEngine is being sold as a service, marketed as an AV/EDR killer that disables mainstream consumer security software including Windows Defender, Malwarebytes, Bitdefender, and Avast. The tool combines AV termination with a Ring-3 rootkit, UAC bypass, and decoy payload delivery to support stealthy initial access operations. ⠀ ‣ Threat Actor: ryewx1 ‣ Category: Defense Evasion Tool / Killer ‣ Offering: ExEngine AV/EDR Killer ‣ Industry: Malware Tooling ⠀ The seller claims ExEngine actively terminates security software rather than only obfuscating payloads, granting attackers a longer window of undetected operation. The tool supports Windows 10 and 11 builds and is sold per-build at $150 to $250. ⠀ Advertised capabilities: ⠀ ▪️ AV/EDR termination with primary and fallback techniques ▪️ UAC bypass with automatic privilege escalation ▪️ Ring-3 rootkit functionality to hide files, processes, registry keys, and network connections ▪️ Discord webhook logging for victim machine info and execution status ▪️ Secondary decoy payload (game/document/installer) to keep targets unaware ▪️ Persistence across reboots and logouts ▪️ Anti-VM and anti-debug detection with fake error message exit ▪️ Universal Windows 10/11 support, all payload types ⠀ Risk to defenders: ⠀ ▪️ Active termination of consumer AV products including Windows Defender means traditional endpoint protections cannot be relied on once ExEngine executes successfully ▪️ Decoy payload pattern is designed to delay user-driven incident reporting, lengthening attacker dwell time ▪️ Ring-3 rootkit hiding of files, processes, and network connections complicates incident response triage on compromised hosts ▪️ Discord webhook telemetry indicates the operator is targeting consumer and SMB victims at scale rather than running individual targeted campaigns ▪️ Sold per-build at low cost ($150 to $250), making it accessible to low-skill operators who can pair it with commodity stealers, RATs, or loaders

Dark Web Informer

23,567 views • 4 months ago

Write 100x better code using AI (for free!) Install the Codacy extension (VSCode, Cursor, WindSurf). This will install an MCP Server locally on your computer. Your coding copilot will use this server with the Codacy CLI to check every line of code it generates. The way this works is pretty awesome (assuming you are using Cursor): 1. You ask Cursor to generate some code 2. Cursor writes the code 3. Cursor then calls Codacy's MCP Server to check it 4. The MCP Server will use the Codacy CLI to find any issues 5. Cursor will fix the issues and call the MCP server again 6. When the code passes all checks, you are done Level of effort on your side: literally zero! Code quality and security because of this: 100x better! Codacy has been doing this for a long, long time, and their Guardrails MCP Server checks for a lot of potential issues: • Security issues • Quality standards • Pattern violations • Linting issues You can see more information about the extension here: I recorded a quick video to show you how it works. Thanks to the Codacy team for helping me set up everything, answering my 1,000 questions, and collaborating with me on this post.

Write 100x better code using AI (for free!) Install the Codacy extension (VSCode, Cursor, WindSurf). This will install an MCP Server locally on your computer. Your coding copilot will use this server with the Codacy CLI to check every line of code it generates. The way this works is pretty awesome (assuming you are using Cursor): 1. You ask Cursor to generate some code 2. Cursor writes the code 3. Cursor then calls Codacy's MCP Server to check it 4. The MCP Server will use the Codacy CLI to find any issues 5. Cursor will fix the issues and call the MCP server again 6. When the code passes all checks, you are done Level of effort on your side: literally zero! Code quality and security because of this: 100x better! Codacy has been doing this for a long, long time, and their Guardrails MCP Server checks for a lot of potential issues: • Security issues • Quality standards • Pattern violations • Linting issues You can see more information about the extension here: I recorded a quick video to show you how it works. Thanks to the Codacy team for helping me set up everything, answering my 1,000 questions, and collaborating with me on this post.

Santiago

63,316 views • 1 year ago

🚨 FLOCK 2.0 IS HERE — THEY'RE PUTTING AI CAMERAS ON GARBAGE TRUCKS TO SPY ON EVERY HOME They're taking surveillance to the next level. They're now deploying AI cameras on garbage trucks that will drive through every street, scanning homes, roofs, windows, and more. No more fixed poles you can tear down. These cameras move with the trucks with eyes on every block, every house, every day. They’re already testing software that can detect “bad roofs,” broken windows, construction materials, and more… all while claiming it’s for “public safety.” And when people push back against mass surveillance systems like Flock? Flock sends cease and desist letters threatening legal action. How much more of our privacy are we going to surrender before we finally push back against this surveillance grid?

🚨 FLOCK 2.0 IS HERE — THEY'RE PUTTING AI CAMERAS ON GARBAGE TRUCKS TO SPY ON EVERY HOME They're taking surveillance to the next level. They're now deploying AI cameras on garbage trucks that will drive through every street, scanning homes, roofs, windows, and more. No more fixed poles you can tear down. These cameras move with the trucks with eyes on every block, every house, every day. They’re already testing software that can detect “bad roofs,” broken windows, construction materials, and more… all while claiming it’s for “public safety.” And when people push back against mass surveillance systems like Flock? Flock sends cease and desist letters threatening legal action. How much more of our privacy are we going to surrender before we finally push back against this surveillance grid?

HustleBitch

26,759 views • 1 month ago

‼️A malware binder tool branded "Universal File Binder 2026" is being sold on a popular cybercrime forum, advertised as fully undetectable and designed to disguise executable payloads as common file types including documents, images, and videos. ⠀ ‣ Threat Actor: Davina Keenan ‣ Category: Malware Tool Sale / Payload Binder ‣ Product: Universal File Binder 2026 ‣ Industry Impact: Phishing, Social Engineering, Initial Access ⠀ The tool is marketed as a payload binder, a category of malware used to attach executable code to a legitimate looking file so that opening the file triggers both the decoy document and the hidden payload. A video demo is attached to the listing and this post. ⠀ Advertised features: ⠀ ▪️ Claimed "100% FUD" (Fully Undetectable) against major antivirus engines including Windows Defender, Avast, and Kaspersky, at both scantime and runtime ▪️ Bind payloads to .jpg, .png, .pdf, .docx, .pptx, .mp4, and .mp3 files ▪️ Icon and extension spoofing, including double extension tricks ▪️ Lightweight stub with small footprint ▪️ Stated compatibility with Windows 10 and Windows 11 ⠀ Pricing: ⠀ ▪️ Single build: $100 ▪️ Lifetime access with updates: $1,000 ⠀ Binders of this type are a common component of commodity phishing kits, used primarily to deliver RATs, stealers, and ransomware via email attachments or messaging platforms. "FUD" claims on public forums are typically short lived and degrade within days or weeks of release as antivirus vendors collect samples.

‼️A malware binder tool branded "Universal File Binder 2026" is being sold on a popular cybercrime forum, advertised as fully undetectable and designed to disguise executable payloads as common file types including documents, images, and videos. ⠀ ‣ Threat Actor: Davina Keenan ‣ Category: Malware Tool Sale / Payload Binder ‣ Product: Universal File Binder 2026 ‣ Industry Impact: Phishing, Social Engineering, Initial Access ⠀ The tool is marketed as a payload binder, a category of malware used to attach executable code to a legitimate looking file so that opening the file triggers both the decoy document and the hidden payload. A video demo is attached to the listing and this post. ⠀ Advertised features: ⠀ ▪️ Claimed "100% FUD" (Fully Undetectable) against major antivirus engines including Windows Defender, Avast, and Kaspersky, at both scantime and runtime ▪️ Bind payloads to .jpg, .png, .pdf, .docx, .pptx, .mp4, and .mp3 files ▪️ Icon and extension spoofing, including double extension tricks ▪️ Lightweight stub with small footprint ▪️ Stated compatibility with Windows 10 and Windows 11 ⠀ Pricing: ⠀ ▪️ Single build: $100 ▪️ Lifetime access with updates: $1,000 ⠀ Binders of this type are a common component of commodity phishing kits, used primarily to deliver RATs, stealers, and ransomware via email attachments or messaging platforms. "FUD" claims on public forums are typically short lived and degrade within days or weeks of release as antivirus vendors collect samples.

Dark Web Informer

25,017 views • 4 months ago

Hot topic in vogue is what happens to systems of record in an era of 1000x more agents than humans. Aaron Levie has been the CEO of Box for 20 years and believes that systems of record become more important, not less, with agents: “Systems of record were built for a TAM of human employees. And that was sort of where the value maxed out at. And now maybe we'll have a hundred times more agents than people or a thousand times more agents than people. So I think on a relative basis, the agent layer will seize growth from zero to a trillion. But the system of record layer now has a thousand times more users on it that need to access data and need to execute a workflow and need to move things through various events. And importantly, you need as an enterprise to care about data integrity and security and the controls in your workflow and traffic copying the agents. So basically, this is where I am very diametrically opposed to the view that the system of record gets is squeezed into a database interaction layer because you actually need all of the core system of record properties for the agents to operate on.”

Hot topic in vogue is what happens to systems of record in an era of 1000x more agents than humans. Aaron Levie has been the CEO of Box for 20 years and believes that systems of record become more important, not less, with agents: “Systems of record were built for a TAM of human employees. And that was sort of where the value maxed out at. And now maybe we'll have a hundred times more agents than people or a thousand times more agents than people. So I think on a relative basis, the agent layer will seize growth from zero to a trillion. But the system of record layer now has a thousand times more users on it that need to access data and need to execute a workflow and need to move things through various events. And importantly, you need as an enterprise to care about data integrity and security and the controls in your workflow and traffic copying the agents. So basically, this is where I am very diametrically opposed to the view that the system of record gets is squeezed into a database interaction layer because you actually need all of the core system of record properties for the agents to operate on.”

Corinne Marie Riley

119,410 views • 8 months ago

Holy CRAP! jnmartin gave me access to his private Sonic R decompilation repo, which will serve as the basis for the Sega Dreamcast port. I was able to build Sonic R NATIVELY for my x86_64 desktop, running Ubuntu 24.04, and immediately begin playing after just typing "make" and then passing the binary the location of my ripped (yet legally purchased) PC assets. ...but while he's at it, jnmartin has decided to make the base decompilation codebase platform-independent, so this should theoretically work on any platform that supports SDL2 and very basic OpenGL--no shaders required--with very low system requirements. jnmartin already has it running fine on the latest MacOS version on Apple silicon, and now we can confirm it works fine on Debian Linux distros, no problem. Next up we'll test for Windows. Oh, and by the way, to everyone freaking out over the fact that the decomp is starting from the PC version and not the Saturn version, lamenting the less vibrant coloring... Your voices have been heard! CHECK IT OUT NOW!!! ...just imagine 4p netplay between Windows, Mac, Linux, and the Sega Dreamcast! 🤯

Holy CRAP! jnmartin gave me access to his private Sonic R decompilation repo, which will serve as the basis for the Sega Dreamcast port. I was able to build Sonic R NATIVELY for my x86_64 desktop, running Ubuntu 24.04, and immediately begin playing after just typing "make" and then passing the binary the location of my ripped (yet legally purchased) PC assets. ...but while he's at it, jnmartin has decided to make the base decompilation codebase platform-independent, so this should theoretically work on any platform that supports SDL2 and very basic OpenGL--no shaders required--with very low system requirements. jnmartin already has it running fine on the latest MacOS version on Apple silicon, and now we can confirm it works fine on Debian Linux distros, no problem. Next up we'll test for Windows. Oh, and by the way, to everyone freaking out over the fact that the decomp is starting from the PC version and not the Saturn version, lamenting the less vibrant coloring... Your voices have been heard! CHECK IT OUT NOW!!! ...just imagine 4p netplay between Windows, Mac, Linux, and the Sega Dreamcast! 🤯

Falco Girgis

71,883 views • 4 months ago

OpenClaw just leveled up from a cool demo to a powerhouse agent platform. The newest releases give you: - Multi-agent capabilities by default - Fresh channels like Telegram, Android, and Windows - Advanced routing - External secrets support - Massive under-the-hood hardening 🚀 Ready to deploy? Set up your OpenClaw in one click on is exactly how you bring this tech into real life. It gives you fully managed, 24/7 cloud hosting for the latest OpenClaw version—completely streamlined with one-click config backups. 💡

OpenClaw just leveled up from a cool demo to a powerhouse agent platform. The newest releases give you: - Multi-agent capabilities by default - Fresh channels like Telegram, Android, and Windows - Advanced routing - External secrets support - Massive under-the-hood hardening 🚀 Ready to deploy? Set up your OpenClaw in one click on is exactly how you bring this tech into real life. It gives you fully managed, 24/7 cloud hosting for the latest OpenClaw version—completely streamlined with one-click config backups. 💡

Md. Robius Sany

18,309 views • 5 months ago