0Day-Cybersecurity

THEY ARE GOING TO BAN VPNs THEY ARE GOING TO BAN VPNs THEY ARE GOING TO BAN VPNs THEY ARE GOING TO BAN VPNs THEY ARE GOING TO BAN VPNs THEY ARE GOING TO BAN VPNs THEY ARE GOING TO BAN VPNs THEY ARE GOING TO BAN VPNs THEY ARE GOING TO BAN VPNs THEY ARE GOING TO BAN VPNs

🚨 @GrapheneOS ÉCRASE 3 NOUVELLES FAILLES LINUX CRITIQUES 🔥 Copy Fail, Copy Fail 2 et Dirty Frag? Trois vulnérabilités kernel Linux fraîchement dévoilées… et GrapheneOS les ignore totalement. ✅Les politiques SELinux d’AOSP bloquent l’exploitation des 3 bugs à la racine. ✅La config GKI standard d’AOSP désactive déjà 2 des 3 fonctionnalités vulnérables. C’est pas de la chance, c’est du travail de dingue: réduction massive de la surface d’attaque grâce à un SELinux ultra-granulaire + suppression chirurgicale des features inutiles dans le kernel. GrapheneOS va encore plus loin : • ioctl autorisés au cas par cas •user namespaces et io_uring totalement interdits aux apps ET à presque tout le système •seccomp-bpf en renfort Résultat ? Ces failles logiques mémoire qui auraient pu tout casser sur n’importe quel autre Android… sont mortes dans l’œuf sur GrapheneOS. ➡️Oui, les élévations de privilèges kernel Linux restent hyper fréquentes. ➡️Oui, la plupart sont des corruptions mémoire (matraquées avec memory tagging hardware + zero-on-free). Mais même sur ces bugs “logiques”, l’approche de GrapheneOS fait toute la différence. Linux, c’est un océan de code qui tourne en full privilege sans aucune isolation. Dans un microkernel, ces 3 failles auraient été isolées dans des processus séparés. Le modèle monolithique est clairement à bout de souffle. La vraie solution à long terme ? Un langage memory-safe + virtualisation hardware qui progresse à vitesse grand V sur les smartphones. GrapheneOS prépare déjà le terrain. On peut encore durcir énormément le kernel Linux… mais il est clair qu’il faudra le remplacer un jour. 𝐆𝐫𝐚𝐩𝐡𝐞𝐧𝐞𝐎𝐒 𝐧’𝐚𝐭𝐭𝐞𝐧𝐝 𝐩𝐚𝐬 𝐪𝐮𝐞 𝐥𝐚 𝐩𝐫𝐨𝐜𝐡𝐚𝐢𝐧𝐞 𝐟𝐚𝐢𝐥𝐥𝐞 𝐚𝐫𝐫𝐢𝐯𝐞. 𝐈𝐥 𝐜𝐨𝐧𝐬𝐭𝐫𝐮𝐢𝐭 𝐥’𝐚𝐯𝐞𝐧𝐢𝐫 𝐝𝐞 𝐥𝐚 𝐬𝐞́𝐜𝐮𝐫𝐢𝐭𝐞́ 𝐦𝐨𝐛𝐢𝐥𝐞. 𝐀𝐮𝐣𝐨𝐮𝐫𝐝’𝐡𝐮𝐢. 🔒🛡️💪🏼 #GrapheneOS #AndroidSecurity #LinuxKernel #PrivacyMatters

‼️🚨 Microsoft calls this "intended behaviour," so here we go. How to dump the credentials of every user stored in Microsoft Edge: 1. Open Edge. Don't browse anywhere, just open it. 2. Flip to Task Manager, find Edge, expand the task. 3. Highlight the "browser" sub-task, right-click, and choose "Create Memory Dump." 4. Open the dump file and look for credentials. The logged-in Windows user can dump every stored Edge credential with no additional rights. Which means any malware that user executes has those credentials for the asking. Thanks to Rob VandenBrink at SANS: isc.sans.edu/diary/32954

Windows defender has been compromised. right now there is a public unpatched exploit that gives any app on your windows PC full system admin access. no password. no popup. nothing your antivirus doesnt stop it. your antivirus IS the exploit. windows defender is the attack vector ransomware gangs can use this to encrypt your entire machine and steal every saved password, browser session, and discord token you have. fully patched windows 11. real time protection on thread

Publicly disclosing the bluehammer exploit, at the time of writing this, this vulnerability is still unpatched. Full PoC source can be found here - deadeclipse666.blogspot.com/2026/04/public…

Claude code source code has been leaked via a map file in their npm registry! Code: …a8527898604c1bbb12468b1581d95e.r2.dev/src.zip

Dawg, I'm going to bed and someone shoots a fucking nuclear missile into the internet

Software horror: litellm PyPI supply chain attack. Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords. LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm. Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks. Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages. Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

GrapheneOS will remain usable by anyone around the world without requiring personal information, identification or an account. GrapheneOS and our services will remain available internationally. If GrapheneOS devices can't be sold in a region due to their regulations, so be it.

🚨counter-surveillance used to cost thousands. now it’s $20 in your pocket. someone built an open source device that detects when feds are spying on your phone. > it’s called rayhunter, a project by EFF. feds use a tech called stingrays, a fake cell towers use to track EXACT location and has the ability intercept your calls. > rayhunter detects them in real time and alerts you almost instantly, zero delay. you simply buy a cheap hotspot, flash it with open-source software, carry it in your pocket and voila. portable counter-surveillance. this used to cost thousands and requires expert knowledge but not anymore.

Breaking down C2 payload internals and building an evasive reflective loader that bypasses a top EDR covering module overloading, NtContinue, call stack spoofing, sleep masking, and Crystal Palace YARA removal. Nice article! lorenzomeacci.com/bypassing-edr-…

@Mathysantoinet1 DM to see if we can advise or help you out

@0DayCyberSec @TraceLabs Hi, I’m looking for a hacker. Could you help me please? I was the victim of a scam.

Thanks to @TraceLabs for organising the Search party CTF on Saturday. A collaborative OSINT event dedicated to collecting and structuring open-source intelligence in missing persons cases. See you next time! #OSINT #SearchPartyCTF

The new Lapsus$ clearnet site is OPEN using cloudflare lapsus[.]cz

Awesome work!

Look.. it's a Conditional Access policy simulator built by an infra architect guy who got tired of squinting at What If results 🫠 Shiny graphs yay! 🔗ca.haakonwibe.com No sign-in needed, click Sample Data and play around. Or connect to your own data - all's in browser.

Ironic, considering the platform itself hasn’t exactly been immune to security breaches… The promise of a free and open digital space is fading fast, nothing like the early days when the internet was built on trust, experimentation, and decentralization…

‘People don't realise how hard it is to speak the truth to a world full of people who don't realise they're living a lie’ - Edward Snowden

This is bad. Putty level bad. notepad-plus-plus.org/news/hijacked-…

Microsoft says that it will work with the FBI to unlock your Windows PCs encrypted data if asked. BitLocker encryption keys that are uploaded to the cloud via your Microsoft Account are not encrypted on Microsoft's servers, which means the company is able to see the keys and hand them over to law enforcement if requested via valid legal order. Forbes reports that Microsoft did this in early 2025, handing over the encryption keys to a device that the FBI had in their possession. This should make everyone using a Windows PC think twice before backing up their BitLocker encryption key to Microsoft's servers. Windows 11's online Microsoft Account requirement means your PC is already automatically backing up your data encryption key online. Apple, Google, and Meta's data encryption keys are also backed up to the cloud, but those keys are encrypted on the cloud side so nobody can see them but the user. Microsoft seemingly doesn't do this.