And the winner of Startup Battlefield at Disrupt 2026 is: Intero Biosystems | TechCrunch techcrunch.com/2026/10/15/an…
Jan retweeted
I've decided to finally release my vulnerability hunting methodology that I've been using for several months now, both in testing as well as live engagements with great success.
I was inspired by (and huge congrats to) the @Blackfrost_AI team open-sourcing Cyber-Frost Harness, their reproducible security-agent runtime with procedural skills, an evidence ledger, and isolated Docker targets for red/blue/purple work. 🎉
If you like the Cyber Frost Harness, and want some out of the box vulnerabilty hunting and POC development kit to go along with it - check out my VulnHunter.
It's already loadable: their harness reads standard SKILL.md skills. Point skill_dir at VulnHunter's (or run its installer), and the hunting, falsification, and PoC disciplines load immediately.
Repo: github.com/nealbridges/VulnH…
CREDITS: This is fork of @CapitalOne original repo. I simply took it a step further on POC development and model agnostic. I'm also actively developing in my forked repo as I make more changes to it and welcome the contributions from the community as well.
I think I'm doing the whole "respect who you give credit to" drama, and I asked my model to double and triple check it. So i can blame the model if its wrong. Otherwise, dont put me on blast on X if i suck at credits. /s
Looking forward to developing on this further with the community.
Jan retweeted
Introducing ARES 🛡️⚔️
Open-source autonomous red team & security validation platform built with FastAPI + React.
Features:
• Autonomous Attack Graph (DAG)
• MITRE ATT&CK Mapping
• Scope Firewall & Instant Reports
GitHub:
github.com/Mafifrizi/ARES
#RedTeam #CyberSecurity
How to use LLMs for vulnerability research by @ZephrFish
MCP: blog.zsec.uk/bullyingllms/
Harness: blog.zsec.uk/harnessing-harn…
#cybersecurity #llm
Jan retweeted
Update on CVE-2026-12569 / Cl0p / PTC Windchill
It is likely that Cl0p is actively exploiting CVE-2026-12569 in PTC Windchill. The deployed webshells use a custom HTTP header (X-windchill-req) as their authentication mechanism, running within Windchill's own process context to blend into legitimate application traffic, while spawning background SQL threads that enumerate the full Windchill file vault to map data ahead of exfiltration.
A built-in custom Java class loader allows attackers to execute arbitrary compiled code server-side via Base64-encoded ZIPs, without ever modifying the webshell again.
The webshell also harvests and decrypts LDAP credentials directly from Windchill's keystore, enabling follow-on access well beyond the initial foothold. Given Cl0p's history of rapid, widespread campaigns and the speed at which copycat actors replicate their techniques, organizations using PTC Windchill and PTC FlexPLM should treat this CVE with the highest priority.
Jan retweeted
Stix Viewer
Visualize and explore STIX data for threat intelligence and analysis.
stix-viewer.threatlandscape.…
All tools available at osintrack.com
#OSINT #CTI #DATAVISUALIZATION
Jan retweeted
new blog post: shrun, apiwatcher, and argus: three malware analysis tools built with Claude
antonioparata.blogspot.com/2…
#MalwareAnalysis #ReverseEngineering
Jan retweeted
Foresiet identified and analyzed Lucid Stealer, a Node.js SEA wrapper delivering a credential stealer and remote-access Trojan with persistence, wallet theft, keylogging, HVNC, and DDoS capabilities. foresiet.com/blog/lucid-stea…
Jan retweeted
Benchmarking LLMs for Malware Triage and static Unpacking with Malcat (binary analysis software) #Infosec #Malware #LLM malcat.fr/blog/benchmarking-…
Jan retweeted
Follow every Mythos discovery through our coordinated vulnerability disclosure dashboard.
red.anthropic.com/2026/cvd/




















