We talk in @VulnerabilityNw about CVEs, zero-days & what's exploited right now. Monero lovers · Builder of https://xitter.cf/t.co/E8G6RsKwiZ mining pool for $XMR
Joined August 2024
- Tweets819
- Following265
- Followers177
- Likes1.4K
Pinned Tweet
I've just created the Telegram and Discord chats for xmr.pw I'll leave the links below to join:
Discord: discord.gg/kJXKrJqUjr
Telegram: t.me/xmrpw
If you have questions or issues I'll try my best to help you 😅
Happy mining ⛏️
Don’t fall for useless FUD please go do 3 seconds of research and save yourself from having an heart attack magicgrants.org/2026/09/22/B…
Trade perps/spot from your own wallet on Hyperliquid using @arbiterapp made by @cake.
Use my link for a fee discount: arbiter.xyz/r/ELUSIVEXMR
@vikrantnyc you really cooked with @arbiterapp it’s really nice! Hope it leaves the beta soon!
New major update on xmr.pw mining pool check it out!
Changelog:
- new ui
- faster share confirmation
- leaderboard
- AI Chatbot to help users
- real time informations
- P2Pool instance switched to Main
- Solo mode now pays out directly from the block coinbase without touching our wallets.
- bonuses will also be randomly be given away to miners based on their contribution.
- and more…
Share your feedback!
Elusive retweeted
We ship an MCP server. 21 tools.
Point Claude, ChatGPT or your own bot at it: read the book, place orders, check the portfolio, withdraw each API key scoped to what you allow.
Public read tools need no key at all.
AryStinger a new botnet has turned 4,000+ end-of-life D-Link routers (DIR-850L, DIR-818LW) into distributed attack proxies.
Exploits: CVE-2013-3307, CVE-2016-5681, CVE-2025-11837.
Infected devices scan, proxy, tunnel, hijack DNS, and sniff all traffic. A second Go variant targets NAS, running Shell/Go/Java/Python payloads.
48% of infections sit in South Korea. No attribution to any known cluster.
The hardware is EoL no patch is coming. Replace it and kill remote management.
Source: @BleepinComputer
@VulnerabilityNw
Gravity SMTP CVE-2026-4020
100,000 WordPress sites can leak their own secrets to anyone who asks.
CVE-2026-4020 (CVSS 5.3) in the Gravity SMTP plugin lets unauthenticated attackers pull config data, API keys, secrets, and OAuth tokens. Already being exploited.
"Medium severity" undersells it handing out OAuth tokens with no auth is a full credential-leak primitive. Patch now, then rotate every key that plugin could see.
Source: @TheHackersNews
via @VulnerabilityNw
Macron / AI regulation
Macron is pitching democracies to jointly regulate advanced AI and asking the US to share its frontier tech.
"Cooperate on regulation" sounds clean. The detail that matters: who gets access to the models, and who decides the rules.
AI governance is becoming geopolitics. Watch what gets centralized in the name of safety.
Source: @SecurityWeek
via @VulnerabilityNw
Mastra AI supply chain -> North Korea
140+ npm packages compromised. Microsoft puts it on North Korea.
The Mastra AI supply chain attack is now attributed to Sapphire Sleet (aka BlueNoroff) the same DPRK crew known for chasing developers and crypto.
The npm registry is a nation-state delivery channel now. npm install pulls more than dependencies.
Pin versions. Audit transitive deps. Treat unexpected package updates as hostile until proven otherwise.
Source: @BleepinComputer
via @VulnerabilityNw
Prinz Eugen ransomware
New ransomware, new playbook: Prinz Eugen encrypts your most recently modified files first and drops no ransom note at all.
Going after recent files maximizes damage to active work before anyone notices. No note means no negotiation prompt, no clear attribution just data gone.
If your backups aren't versioned and offline,"recent files first" is exactly what hurts.
Source: @BleepinComputer
via @VulnerabilityNw
Elusive retweeted
$1,000 Monero by end of 2026.
No opinion from us. Just the odds.
So… YES or NO? 🐇link in bio $XMR
Elusive retweeted
5-minute markets are live. Up or down.
Real prices. Resolves in 5.
Fastest way to be right (or wrong) in crypto.
BTC next 5 min UP or DOWN?👇🐇 $XMR
Elusive retweeted
JUST IN: Dusty Johnson calls for crypto market structure bill to prevent another Gary Gensler
FortiSandbox: 3 CVEs exploited
Three FortiSandbox flaws under active exploitation, all already patched:
•CVE-2026-39813 (9.1) auth bypass
•CVE-2026-39808 (9.1) OS command injection
•CVE-2026-25089 (9.1) unauth command execution (Web UI)
It feeds verdicts to your whole Fortinet stack. Patch to 5.0.6 / 4.4.9+ and lock the Web UI to trusted IPs.
Source: @SecurityWeek
@VulnerabilityNews
RoguePlanet / Defender 0-day “ CVE assigned, still unpatched “
Microsoft’s “RoguePlanet” Defender 0-day finally has a CVE but no patch.
One week after Nightmare Eclipse dropped the PoC, Microsoft assigned CVE-2026-50656 (CVSS 7.8) and confirmed a fix is in progress.
Nothing has shipped yet.
It’s a TOCTOU race in Defender’s malware-remediation flow that spawns a SYSTEM shell on fully patched Win10/11 and works whether real-time protection is on or off.
Hit-or-miss per attempt, but a local attacker just loops until it lands.
No patch means detection is the control: alert on any SYSTEM-integrity shell whose parent process is MsMpEng.exe. Defender never legitimately does that.
Source: @BleepinComputer
@VulnerabilityNw
Insider threat: ex-IT staffer jailed
A former IT employee at an Iowa school district got 21 months in prison for a prolonged attack on his old employer deleting accounts, disrupting classes, and causing tens of thousands in damages.
The cheapest insider-threat control is still the boring one: revoke every credential, key, and VPN profile the day someone leaves.
Source: @BleepinComputer
@VulnerabilityNews