Efrain Torres

12.6K posts

Efrain Torres

Efrain Torres

@etlow

Certified Information Security Sleepless Parent

Houston Присоединился Şubat 2009
372 Подписки1.5K Подписчики
Efrain Torres ретвитнул
Jorian
Jorian@J0R1AN·
Cool exploit with @_0x999: He found that \x7F breaks Chrome's "Copy as cURL (cmd)" command parsing in Windows Console Host. In combination with a ", it allowed you to add any arguments to curl. With -o writing files is easy, but we need the username for the startup path... (1/2)
Jorian tweet media
English
1
39
216
17.2K
Efrain Torres ретвитнул
Luke Stephens (hakluke)
CVE -> exploitation in 2021 took 1 year. Now it takes 1 hour on average, it'll be 60 seconds by the end of the year. Big changes coming. If we ignore it, we're cooked. Check zerodayclock.com for the stats.
English
1
2
24
4.2K
Efrain Torres ретвитнул
pspaul
pspaul@pspaul95·
Pwning PostgreSQL was quite fun, excited to share our research at OffensiveCon! offensivecon.org/speakers/2026/…
pspaul tweet media
English
1
12
104
6.4K
Efrain Torres ретвитнул
Chris Laub
Chris Laub@ChrisLaubAI·
A Rust dev just killed Headless Chrome. It's called Obscura. The open-source headless browser purpose-built for AI agents and scrapers at scale. Chrome vs Obscura: - Memory: 200MB+ → 30MB - Binary: 300MB+ → 70MB - Page load: 500ms → 85ms - Startup: 2s → Instant - Anti-detect: None → Built-in Single binary. No Node, no Chrome, no dependencies. Stealth mode is brutal: → Per-session fingerprint randomization (GPU, canvas, audio, battery) → 3,520 tracker domains blocked by default → navigator.webdriver masked to match real Chrome → Native function masking so detectors can't sniff it out Drop-in replacement for Puppeteer and Playwright over CDP. Zero code changes. If you run agents or serious scraping at scale, this repo prints money. 100% Opensource.
Chris Laub tweet media
English
96
501
5K
318.6K
Efrain Torres ретвитнул
NullSecurityX
NullSecurityX@NullSecurityX·
A pre-auth attacker can open a single WebSocket connection and obtain a fully interactive root shell. Due to missing auth checks in the handler, marimo exposes RCE without tokens or user interaction, even when auth is enabled. CVE-2026-39987
NullSecurityX tweet media
English
2
25
225
13.7K
Efrain Torres
Efrain Torres@etlow·
@IvanCepedaCast Esa verdad que promete no se vio ni la dijo con los casos constantes, claros y cronicos de corrupcion del gobierno actual del que usted hace parte.
Español
0
0
1
383
Iván Cepeda Castro
Iván Cepeda Castro@IvanCepedaCast·
COMUNICADO Iván Cepeda responde con el poder de la verdad a la estrategia de la mentira El candidato presidencial del Pacto Histórico y la Alianza por la Vida, Iván Cepeda Castro, reafirmó desde el corazón del Eje Cafetero su compromiso con la verdad como principio de su campaña electoral. Además, hizo un llamado al diálogo a los directores de medios de comunicación. “Lo mío es decir la verdad, estar junto al pueblo, defender sus intereses y sus derechos”, señaló.
Iván Cepeda Castro tweet mediaIván Cepeda Castro tweet media
Español
317
1.6K
3.8K
49.3K
Efrain Torres ретвитнул
Mike Gannotti
Mike Gannotti@MichaelGannotti·
Running LLMs local vs Cloud services. Lot of hype and clickbait out there around both sides. They both have their use case but users setting up need to be realistic what they can actually host, what self hosted can do
English
14
16
291
18.1K
Efrain Torres ретвитнул
Vaishnavi
Vaishnavi@_vmlops·
MICROSOFT OPEN-SOURCED THEIR ENTIRE SENTINEL SECURITY TOOLKIT most teams building on azure figure out threat detection the hard way trial and error, custom KQL, dashboards built from nothing, playbooks written by hand nobody told them it was already done the sentinel github repo has: ▫️ 1000+ pre-built threat detection rules ▫️ hunting queries for active threat investigation ▫️ automated response playbooks ▫️ security workbooks + dashboards ▫️ data connectors for 100s of sources the hard part was already done github.com/Azure/Azure-Se…
English
15
135
729
55.5K
Efrain Torres ретвитнул
NeilXbt
NeilXbt@neil_xbt·
Andrej Karpathy could have charged $10,000 for this course. He put it on YouTube. The man who built Tesla Autopilot from scratch. Co-founded OpenAI. Understands AI at a level most engineers at Google and Meta never reach. Sat down. Recorded 2 hours. No frameworks. No libraries. No shortcuts. Then dropped it for free. The gap between people who watch it this week and those who save it for later is not 2 hours. It is everything those 2 hours quietly unlock for the rest of your career.
English
65
519
4.4K
385.3K
Efrain Torres ретвитнул
Haidar
Haidar@haider_kabibo·
So here is new local privilege escalation zero-day I discovered, not patched yet too :). In simple terms, if you have a service like RDP that exposes an RPC server, there many system services running as SYSTEM connect to it as RPC clients. If that service is turned off (RDP is off by default), it seems that any other process in Windows can expose the same RPC server using the same endpoint. Now all the RPC calls from that SYSTEM processes will come to this fake server and If the process that deployed the server has SeImpersonatePrivilege, it can escalate to SYSTEM by impersonate the RPC client. In the white paper below, I describe five exploit paths you can abuse. However it's architecture problem and maybe there are more. It's Not A Potato securelist.com/phantomrpc-rpc…
English
9
134
660
38.5K
Efrain Torres ретвитнул
blackorbird
blackorbird@blackorbird·
The name ‘fast16’ is referenced in the infamous ShadowBrokers’ leak of NSA’s ‘Territorial Dispute’ components. fast16.sys selectively targets high-precision calculation software, patching code in memory to tamper with results. By combining this payload with self-propagation mechanisms, the attackers aim to produce equivalent inaccurate calculations across an entire facility. sentinelone.com/labs/fast16-my… wired.com/story/fast16-m…
blackorbird tweet mediablackorbird tweet mediablackorbird tweet media
English
5
27
111
8.8K
Efrain Torres ретвитнул
Co11ateral
Co11ateral@co11ateral·
Researchers from the University of California San Diego and the University of Maryland spent three years scanning traffic from 39 GEO satellites visible from California. Their analysis showed that roughly half of the observed signals carried cleartext IP traffic. The recovered traffic covered an extraordinary range of sectors. They observed voice calls, SMS messages, in-flight passenger Wi-Fi traffic, utility infrastructure communications, oil and gas platform data, corporate internal messages, retail inventory records, ATM networking data and even military and law-enforcement communications. In our article we covered their research, showing you the hardware and software they used. hackers-arise.com/satellite-hack…
Co11ateral tweet media
English
1
32
171
9.7K
Efrain Torres ретвитнул
xarkes
xarkes@xarkes_·
Mozilla says Mythos helped identify 271 vulnerabilities in Firefox 150. I went through the commits, CVEs, and bug links to see what that number really means. My takeaway: relax folks. xark.es/b/mythos-firef…
English
11
114
734
112.4K
Irene Vélez-Torres
Irene Vélez-Torres@IreneVelezT·
Se llama descarbonización, la lideró el Gobierno del Presidente @petrogustavo y sí se puede. Negar la urgencia de la transición energética es volver al pasado.
Forbes Colombia@forbescolombia

Ladrillera Santafé puso en operación uno de los parques solares de autogeneración industrial más grandes de Cundinamarca, con el que busca reducir costos energéticos y avanzar en su estrategia de sostenibilidad. ➡️f.mtr.cool/hsthtjzuoh

Español
273
685
1.3K
37.1K
Efrain Torres ретвитнул
Aircorridor
Aircorridor@_aircorridor·
Attacks on the LLM Supply Chain, Part 1 Many people depend on tools like OpenRouter or LiteLLM. However, keep in mind that before your prompt reaches its intended recipient, it may be intercepted or altered by third parties. hackers-arise.com/artificial-int…
Aircorridor tweet media
English
0
5
21
1.1K