AppSecFreak retweeted
‼️ OpenCode confirms a security breach that may have exposed users' OpenAI, Anthropic, and Google API keys.
1.4% of Console users affected. Some report unauthorized AI usage charges.
OpenCode urges affected users to revoke their keys.
Read - thehackernews.com/2026/10/op…
AppSecFreak retweeted
Galaxy S26 Ultra: untrusted_app → root.
Introducing "Infinity Core": 6 vulns in the Linux kernel's core subsystems.
Their impact spans Linux server LPE, container escape, and Android LPE.
Details: github.com/V4bel/InfinityCor…
AppSecFreak retweeted
Claude's current state is unusable for cybersecurity work.
It's disappointing that Anthropic has messed up their product so bad.
It's really trash.
AppSecFreak retweeted
We're back, analyzing CVE-2026-21589 - an Arbitrary File Read vulnerability in Atlassian Jira, Confluence, BitBucket and more...
Enjoy!
labs.watchtowr.com/you-wont-…
AppSecFreak retweeted
SMTP smuggling is back! Dot-stuffing is a great find, awesome work!
Blog post about From header smuggling in Apple iCloud just dropped.
Sending emails as [email protected], exotic parsing, and a $15,000 bounty.
sec-consult.com/blog/detail/…
AppSecFreak retweeted
We took lookup.disclose.io to Black Hat and DEF CON and asked people to break it.
They did. Specifically, about assets they owned.
Three weeks on: 7 integrations shipped, IPs resolve natively, and the engine says "I'm guessing" out loud now.
blog.disclose.io/what-vegas-…
AppSecFreak retweeted
Pre-auth RCE on Microsoft Exchange Server. No credentials needed.
github.com/hypnguyen1209/cve…
AppSecFreak retweeted
DEFCON has released all slides and videos!!
media.defcon.org/DEF%20CON%2…
AppSecFreak retweeted
Oh this looks fun and SCARY!
If your ISP uses shared GPON fibre and has not correctly enabled downstream encryption, another customer on the same local fibre branch may be able to receive traffic being sent to your home.
Affected:
DNS, HTTP, TLS metadata, SIP telephone traffic, RTP media, MQTT, SNMP, mobile-network tunnels. The tool can apparently also recover files transferred through unencrypted HTTP, FTP, TFTP and email-related traffic.
The best solution:
VPN everything. So glad they want to take that away asap.
AppSecFreak retweeted
If you like novel techniques and HTTP Request Smuggling carnage, you’ll love this talk.
Today @m4st3rspl1nt3r and I present the @defcon edition of “CRLF-Powered Desync Attacks: Beheading HTTP Streams”. Come to track 3 on main stage at 17:00 to learn to build your very own desync worm and find real-world impact even when your desync can’t impact other users directly!
Saw it coming. This race to "escaping the sandbox" is gonna accelerate real quick and organizations are gonna have to bear with the consequences if there are no guardrails.
🚨BREAKING: Kimi K3 escaped its sandbox during cybersecurity testing
>tasked with solving problems in isolated sandbox
>found a leak in the sandbox
>Kimi “took advantage of that loophole”
>probed the network settings itself
>walks onto the open internet
>didn’t hack anything
>just went to GitHub to get the answers
Frontier Security (US startup):
>“Kimi K3 is very good at following a goal by any means necessary and DOESN’T have the guardrails to prevent it from cheating or escaping.”
it was only a matter of time…
AppSecFreak retweeted
DOJ has been prosecuting coders for the illegal acts of third parties using code for years. Heads up AI boys and girls. Attorney Advertising.
AppSecFreak retweeted
Heading to DEFCON. Couldn't find anyone that made this so I wrote it: A flipper zero NFC canary: keep it in your pocket or bag to keep track and alarm when someone tries to scan your gear while you're walking around the con.
github.com/antitree/nfc_cana…
