security researcher good guy hacker AI tinkerer OSCP certificate owner ADHD Brain owner https://xitter.cf/t.co/6AvGIhVjFJ
Joined July 2015
- Tweets65.3K
- Following831
- Followers3.6K
- Likes2.4K
Pinned Tweet
Other places to get RedPacket Security updates:
Telegram:
t.me/RedPacketSecurity
Discord:
discord.gg/xZY94PXXs4
Reddit:
reddit.com/r/RedPacketSecuri…
LinkedIn:
linkedin.com/company/redpack…
Mastodon:
mastodon.social/@RedPacketSe…
RedPacket Security retweeted
Damn, this is really bad.
Mainstream browsers will probably be fine, but there is a long tail of other stuff that will be affected by this:
scotthelme.co.uk/eight-bits-…
RedPacket Security retweeted
Ofcom Concedes Defeat in the 4chan Case
prestonbyrne.com/2026/10/20/…
RedPacket Security retweeted
⚠️ 𝗜𝗻𝘁𝗲𝗿𝗲𝘀𝘁𝗶𝗻𝗴 𝗼𝗻𝗲 𝗳𝗼𝗿 𝗳𝗲𝗹𝗹𝗼𝘄 𝗱𝗲𝗳𝗲𝗻𝗱𝗲𝗿𝘀.
A domain registered just 𝟭𝟯 𝗱𝗮𝘆𝘀 𝗮𝗴𝗼, closely resembling a Microsoft Copilot FQDN. VirusTotal at capture time: 𝟬/𝟵𝟮 𝗱𝗲𝘁𝗲𝗰𝘁𝗶𝗼𝗻𝘀.
Sharing for awareness. 🛡️
#ThreatHunting
RedPacket Security retweeted
Some sample: https://updatestates.blob.core\.windows.net/files/WindowsDefender.msi
A file named "WindowsDefender.msi" coming from Microsoft's network, with no AV vendor detecting it on VT and was signed using an SSL Corp given cert with name "SOPHISTICATED SOFTWARES (PTY) LTD" must be legit, right?
😂
🤷♂️
RedPacket Security retweeted
‼️ UPDATE: Calif showed one-tap attacks on Signal and iMessage on iOS, which make it possible to run code on an iPhone with a booby-trapped PDF.
On iOS 26.5, opening one in iMessage sent the phone's messages to a server.
Calif says everything will be released "in due time."
RedPacket Security retweeted
‼️ BREAKING: Security firm Calif unveiled an untethered iPhone 18 Pro jailbreak on stage in Paris.
Its Hexacon demo shows the phone on iOS 27.0.1, Apple's latest, giving up a root shell within 2 minutes of boot.
RedPacket Security retweeted
It's time. It's fucking time!
Flux.3 Image Klein is out and we bring you full support for it in Diffusers.
Catch all the details in our post:
huggingface.co/blog/flux-3
RedPacket Security retweeted
The OpenAI employee who allegedly stole over a hundred confidential documents without OpenAI noticing for months sent the documents to his number *in mainland China*...
RedPacket Security retweeted
If you're into adversary simulation, identity security or red/blue tradecraft, bookmark this.
The team at @SpecterOps has built one of the best FREE security research archives online.
The rabbit hole covers:
- Active Directory + Kerberos
- Entra ID + Azure
- Okta + identity providers
- BloodHound + attack paths
- SCCM / Configuration Manager
- Red team tradecraft
- Detection engineering
- Lateral movement
- Credential access
- OAuth + token security
- Browser persistence
- AWS + cloud attack paths
- Kubernetes security
- Software supply chain attacks
- Adversary simulation
- Purple teaming
- Threat hunting
- AI-assisted offensive security
There is a ridiculous amount of deep technical material here, including research developed from real offensive and defensive operations.
They also now have FREE on-demand Tradecraft Academy courses covering BloodHound, Kubernetes for Red Teamers and software supply chain security.
Blog:
specterops.io/blog/
Free Tradecraft Academy:
academy.specterops.io/
Huge credit to the @SpecterOps team for publishing so much of this openly.
#RedTeam #ActiveDirectory #Infosec
RedPacket Security retweeted
We discovered a sophisticated recording device that was hidden inside one of our offices. We used our models to understand the device and where it had come from, identifying that a specific employee had planted it a few days earlier. We referred the matter to the FBI, and we’re grateful to the agents and prosecutors who moved quickly to make an arrest. The FBI’s investigation is ongoing and we will continue to support their work.
At this time, we have no indications of this individual inappropriately accessing or exfiltrating model weights, source code, or customer data. The employee was terminated.
We take protecting our technology, data, and people seriously, and as a matter of national importance. Our security program is designed to protect against a wide range of threat actors, from insider risks to cybercriminals to nation states, and this case is an example of how AI can help address these sophisticated security threats.
RedPacket Security retweeted
⚠️ No login required. CVSS 10.0. Active exploitation.
Attackers are exploiting a Bricksforge WordPress flaw (CVE-2026-85097) that enables arbitrary PHP code execution through crafted file-upload metadata.
Patchstack observed attack activity from 63 IPs. Update to version 4.0.1.
Read - thehackernews.com/2026/10/at…
RedPacket Security retweeted
‼️🇬🇧 Deloitte has been named by The Gentlemen ransomware.
🇬🇧 Deloitte - A global professional services organization providing audit and assurance, consulting, financial advisory, risk advisory, tax, legal, technology, and cybersecurity services.
RedPacket Security retweeted
Prompt injection is often only the start of an AI security finding.
If an attacker can influence the model, can they use that to access customer data, retrieve internal documents or trigger actions in production systems?
Our Cory Stone looks at how the risks in the 2026 OWASP LLM Top 10 overlap, and how the impact depends on what the model can read, what it can reach and how the application handles its output.
Your AI can access it. Can an attacker?
📌 pentestpartners.com/security…
#AISecurity #LLMSecurity #PromptInjection #CyberSecurity
RedPacket Security retweeted
$300 for a bug that gives free access to OpenAI’s paid models with no API key or account.
Zero reason to report anything else I find to them.
