Pinned Tweet
Introducing: GhostKatz! 🐱
A Cobalt Strike BOF that lets you dump LSASS via exploitation of vulnerable drivers that offer physical memory read primitives.
Written by @EricEsquivel123 and I!! :)
github.com/RainbowDynamix/Gh…
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: xitter.cf/lcfr_hax/status/208503…
His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
Game changers right here!
The TTD tech tree has advanced a level!
- ttd-capa-cpp: reimplementation of ttd-capa that supports code scanning
- capa-cpp: C++ reimplementation of capa with added IDA Pro plugin
Shoutout to Xusheng (@CrackmesOne) for his help!
github.com/HullaBrian/ttd-ca…
github.com/HullaBrian/capa-c…
The report is a really good read. My belief is that not a lot of people are in university "to learn." At the end of the day, they want the degree which unlocks job potential. Of course, this is not the case for every degree program.
MIT published a brutally honest report on what AI is doing to students.
A committee of professors and students spent five months studying how AI changed learning on campus, and the findings read like a warning to every university on the planet.
Study groups are disappearing. Office hours are emptying out. Problem sets and take-home exams no longer prove anything, because AI can produce credible solutions to almost any written assignment in the undergraduate curriculum. Students who lean on chatbots lose mastery and confidence, and some slip into what the report calls cognitive surrender, reaching for AI at the first hint of struggle.
The numbers are rough. 46 percent of surveyed MIT undergrads use LLMs daily. 90 percent worry about their own overreliance. Undergrads who feel AI makes them replaceable now outnumber those who feel it makes them capable.
The committee's answer surprised me. They refused to fight AI with surveillance. The report calls AI detectors unreliable, says lockdown browsers feel like spying, and warns that policing students builds a classroom atmosphere of mutual distrust.
Instead, MIT wants to rebuild education around the things AI can't replace. That means oral exams, semester portfolios, in-person project work, and a required social component in every subject. The report even floats the idea of rethinking grades entirely, since without a GPA to optimize, much of the incentive to cheat with AI evaporates.
The committee warns professors against replacing undergrad research assistants with AI agents just because they're cheaper, because a university exists to grow people, not output.
The most famous tech school on earth admitted the machines broke its way of teaching. Its answer is more humans, not more software.
YES!!
Totally agree, that's why I am planning to do this year's #FlareOn without using AI (unless there is a task where it's specifically required). The competitive side of the challenge may be dead, but we still can choose to have fun. Just like existence of a mountain lift doesn't have to kill the pleasure of climbing.
Julian Peña retweeted
Join us next Friday, September 18th at 11AM PT for the next @offby1security stream with the great Pavel Yosifovich (@zodiacon) for a session on, "Breaking Windows: Exploring Security Through Kernel Drivers!"
youtube.com/watch?v=3tP1HVwA…
"Even if you removed the csagent.sys process callbacks, WESP blocks the malware afterwards."
Just remove the WESP callbacks?? 🤔
New blog post! In this one, I dive into an untrusted pointer dereference bug in FortiClient's FortiShield driver (CVE-2015-5736). This was a fun exercise! Enjoy!
julian-pena.com/2026-09-09-f…
Julian Peña retweeted
We identified a cluster of WHQL-signed Windows kernel drivers that all contain the same Authenticode metadata reference:
SpcSpOpusInfo=Autel Intelligent Technology Corp., Ltd.
Taken together, the drivers provide a surprisingly complete set of ring0 primitives: arbitrary process and kernel memory access, manual kernel PE loading, DKOM-based hiding, pointer hooks, keyboard and mouse injection, WFP/NDIS traffic interception, browser traffic manipulation and physical-memory access.
Some samples go further, with self-deletion, covert userland-to-kernel communication, embedded shellcode and explicit security-product targeting. Several appear purpose-built for privileged control and concealment.
We published the full sample list, SHA-256 hashes, family grouping and per-driver analysis notes in our IOC repository:
github.com/NextronSystems/io…
Julian Peña retweeted
Releasing PLATINUMPICK, a Windows kernel-mode shellcode development framework written in C++20.
github.com/winterknife/PLATI…
Julian Peña retweeted
Just released ttd-capa, a tool used with CAPA to extract capabilities from Time Travel Debugging (TTD) traces.
On top of that, you can create timelines of the extracted capabilities that you can navigate to in your traces!
github.com/HullaBrian/ttd-ca…
Julian Peña retweeted
I don’t know who needs to hear this but your research is your IP not the vendors IP. You can do whatever you want with that IP. Reporting it, publishing it, selling it to a third party or putting it in a box under your bed 🙄
This is *quite* a post.
I honestly don't know offhand: Has Microsoft as a company ever before suggested in any official statement that it might seek to have criminal charges brought against security researchers who drop 0days?
microsoft.com/en-us/msrc/blo…
Julian Peña retweeted
Striga: Lifting x86 to LLVM IR with Python by @mrexodia
secret.club/2026/05/21/strig…
























