Casey

Decided to put my money where my mouth is. We built a thing. Give it a go. github.com/AlloySecureGro…

@TheWMIGuy And you can do it for free. No purchase necessary. Just time and focus.

A proper Allowlisting implementation (analyzing exe, dll and scripts) stops pretty much every threat on Windows endpoints that uses code execution on the device and that is gold to your security posture. Every DfE threat report stopped.

The Hardest Security Challenges Live in the Seams Why is securing AI so difficult right now? Because you can't properly secure what hasn't settled. True security only comes when system design patterns crystallize. Think back to the early Internet: we had firewalls, routers, and web servers, but systems-level security only clicked when architectural patterns like the DMZ finally emerged. Today, AI is experiencing a myriad of shifting design patterns every single week, and the locus of control is entirely up for grabs. philvenables.com/post/technolog…

I never good the chance to upload this video of analyzing a MEMORY.dmp generated by nanokrnl.ai in WinDbg.

a single word in a prompt can poison the well of possibilities

Entra ID User App Config Abuse cyberdom.blog/entra-id-user-…

@0x4D31 This is great! 💪

🐝 stinger is live!

open sourcing Stinger 🪤 — an endpoint deception experiment for macOS/Linux. uses FIFO baits and other local traps to catch secret collection as it happens. github.com/0x4D31/stinger

Vulnerability in Realtek driver allows DMA controller abuse from user mode with no additional hardware or driver zwclose.github.io/2026/07/08/rts…

@simplylurking2 It’s all open source if you know how to reverse engineer

now that LLMs make reverse engineering trivial, maybe it's time to make all software open source to simplify the process of coverage, triage, community suggestions, and transparency. absurd as it sounds... sooner software companies just accept the inevitable the better.

Lazarus used this as a zero-day. No BYOVD needed. The vulnerable driver is already on every Windows machine. CVE-2024-21338 exploits appid.sys (AppLocker's driver) to call a user-controlled function pointer in kernel mode. The exploit uses ExpProfileDelete as a valid kCFG target to decrement PreviousMode from 1 to 0. Once PreviousMode is flipped, NtWriteVirtualMemory and NtReadVirtualMemory skip all security checks. Full admin-to-kernel LPE with token manipulation. Works on Windows 10 and 11 with HVCI enabled. Full PoC included. If you just read the PreviousMode mitigation post by @yarden_shafir, this is the CVE that forced Microsoft to add it. hakaisecurity.io/cve-2024-21338… github.com/hakaioffsec/CV… Author: @HakaiOffsec #WindowsInternals #ExploitDevelopment #InfoSec

This is an interesting change (and a nice bug!):

When you compute the factorial of 3233! HUGE number.. See gist below. But some interesting patterns 53^62 and 61^53 Show up? But how could you efficiently compute the exponent for a prime in a factorial? Legendre’s Formula

Some fun Science Sunday Math experiments with LLMs and Mathematical reasoning. 🧵 So there’s a a neat observation in say a composite. Take 3233 You can start here as to why I choose that N cryer.co.uk/glossary/r/rsa…

FBI and Google Dismantle 'Outsider', the $88-a-Week Phishing Service Behind $1.9 Billion in Losses ministryofcyberaffairs.com/news/fbi-and-g…

In my annual #touchgrass recommendations, #denver has a lot of great things that are free to everyone. My favorites are #levittpavillion and #jazz in #citypark. Be sure to get outside and take in the blue sky. Sure it can be hot, but that is what trees are made for! Links below

Pew pew

Cc @d0tslash ❤️

@_subTee I can get around that