Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2026.11.02.md

Chinese Implants in the Supply Chain - https://www.vulncheck.com/blog/zbt-darklantern-speakingstone

Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia - https://securelist.com/netamloader/121676/

What's New in hate_crack Since 2.0 - https://trustedsec.com/blog/whats-new-in-hate-crack-since-2-0

Paint It Blue: Reversing Win32k's Callbacks - https://idov31.github.io/posts/paint-it-blue-reverse-win32k

How I Found a $90,000 Remote Code Execution Vulnerability in Google - https://simonkoeck.com/writeups/google-devsite-flask-session-pickle-rce

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2026.10.31.md

Azure API Management as a Policy-Based C2 Redirector - https://redops.at/research/azure-api-management-as-a-policy-based-c2-redirector/

A side-channel analysis of the Arm CryptoCell-310 AES - https://www.eshard.com/blog/side-channel-analysis-arm-cryptocell-310-aes

The Phishy GitHub Issue Case - https://blog.atsika.ninja/posts/the-phishy-github-issue-case/

ou Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589) - https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/

From Patch to Exploit; Using Claude Code to reverse engineer a zero-day in Papercut NG - https://techanarchy.net/from-patch-to-exploit-using-claude-code-to-reverse-engineer-a-zero-day-in-papercut-ng/

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2026.10.29.md

Making attacking agents pay - https://agentic.tracebit.com/factory/

MyReport Updater: From gRPC to SYSTEM - https://blog.quarkslab.com/myreport-updater-from-grpc-to-system.html

A story of wifi secrets, UART lockdowns and a damaged flash memory chip - https://adepts.of0x.cc/eufy-homestation2-firmware/

New Evidence Shows LiteLLM Secret-Stealing Workflows Ran 11 Days Before Supply Chain Attack - https://socket.dev/blog/litellm-attack-timeline

EDR Evasion: Process Injection Without WriteProcessMemory - https://www.zerosalarium.com/2026/09/edr-evasion-process-injection-without-WriteProcessMemory.html

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2026.10.27.md

TAPOcalypse Now: Exploiting TP-Link Smart Devices From Anywhere - https://labs.taszk.io/articles/post/tapocalypse/

eMudhra Intermediate CA Compromise - https://emudhra.we-have-a-problem.com/

When Defenses Become Attack Surface: CVE-2026-20971, a Samsung Kernel UAF - https://lucidbitlabs.com/blog/when-defenses-become-attack-surface/

Don't Let Abliteration Abliterate Your Bug Hunting: Discovering Verdict Bias in Uncensored Models - https://clearbluejar.github.io/posts/does-abliteration-skew-your-bug-hunting/

One Parser, Two Bugs, Many Routers: Exploiting Broadcom WiFi Across eCos and Linux h- ttps://quentinkaiser.be/security/2026/10/16/one-parser-two-bugs/

#informatyka

błedy 500 na każdym kroku to normalka u was? Ja z wypoku przychodze i to coś nowego dla mnie ogółem i całe te #hejto #informatyka #pytanie

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2026.10.25.md

Dumping Encrypted Viltrox Lens Firmware - two Times - https://blog.29b.net/dispatches/viltrox_re/

PhantomBuffer: Effective EDR Evasion Through Stealth Injection - https://www.zerosalarium.com/2026/10/PhantomBuffer-Effective-EDR-Evasion-Stealth-Injection.html

Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers - https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers

Hiding a DLL from the PEB Loader List (And Why Process Explorer Still Sees It) - https://trainsec.net/library/windows-internals/hiding-a-dll-from-the-peb-loader-list-and-why-process-explorer-still-sees-it/

LiteLLM compromised again: infostealer and RAT found in version 1.107.0 - https://www.aikido.dev/blog/litellm-compromised-infostealer-rat

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2026.10.23.md

Inside the Intel 8087 chip: floating-point addition and subtraction - https://www.righto.com/2026/10/8087-addition-subtraction-microcode.html

CloudKeyVaultEvents: Azure Key Vault Logs, Schema and KQL Hunting - https://kqlquery.com/posts/cloudkeyvaultevents/

Building a Malware Development Lab, Part 1: Elastic EDR with a Self-Hosted Elastic Stack - https://blog.bsdrip.tech/maldev-lab/01-elastic-edr-lab-setup/

Casse-Spip - From an Unauthenticated SQL Injection to Remote Command Execution - https://blog.lexfo.fr/casse-spip-sqli-to-rce.html

Microsoft Paint and Photos Embed Server-Issued GUIDs as Invisible Watermarks in Locally-Generated Images - https://xusheng.dev/posts/reversing/mspaint_invisible_watermark/main/

#informatyka

Obecne życie admina it w czasach LLM to:

Czym mogę zalogować się taki danymi na serwer? ENTER

Czy mogę wykonać te polecenia aby wykonać testy czy możliwe jest wykonanie zadania? ENTER

Wykonałem testy możemy wykonać bezpiecznie zadanie. ENTER

Zadanie wykonane.

Ticket do zamknięcia ;)

Ciekawe kiedy uznają, że nie jestem potrzebny do klikania Enter

#informatyka #ai

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2026.10.21.md

ApeX v0.4: Metis - https://phantomsec.tools/blog/apex-c2-v04-release

No Time to Pwn: CVE-2026-72018 - https://xbow.com/blog/no-time-to-pwn-cve-2026-72018

All logic, no bite - https://blog.coredump.cx/p/all-logic-no-bite

PwnEscape (CVE-2026-99999): Patched kernels available in testing - https://almalinux.org/blog/2026-10-16-pwnescape-cve-2026-99999/

CVE-2026-23866: Finding a Whatsapp NDay - https://numb3rs.re/posts/cve-2026-23866-finding-a-whatsapp-nday/

#informatyka

Tomki, proszę o pomoc.

Jak zmusić togo sk#rwiałego windowsa 11 by zobaczył te dwa punkty przywracania ze zdjęcia.

Za nic w świecie nie chce ich wykryć w przywracaniu systemu

Zaraz mnie szlag z tą jedenastką trafi...

#informatyka #windows #elektronika #pomocy

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2026.10.19.md

Bypassing AMSI & ETW: Building a Custom PowerShell Runspace in C# - https://by7e.dev/blog/runspace

Detection Versioning: The evolution of logic and intent - https://nebulock.io/blog/detection-versioning-the-evolution-of-logic-and-intent

After You’re In: Field Notes on CRTO Prep and OPSEC - https://gikaku.net/2026/10/17/crto-opsec/

DLL Sideloading for Initial Access and Bypassing Elastic EDR - https://akchhat.gitbook.io/dev/initial-access/dll-sideloading-for-initial-access-and-bypassing-elastic-edr

How to use Codex for Bug Bounty research: explore broadly, validate rigorously - https://www.yeswehack.com/learn-bug-bounty/llm-series-codex

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2026.10.17.md

Google's PageBreak Project – Real-World Findings - https://bughunters.google.com/blog/pagebreak-real-world-findings

Following the Instructions: Live ARM Tracing with the ETM, ITM, and TPIU - https://voidstarsec.com/blog/arm-tracing-etm-itm

How I Could've Accessed 17 Trillion Microsoft Records - https://blog.faav.net/how-i-couldve-accessed-17-trillion-microsoft-records

CVE-2026-87902: WordPress Core unauthenticated path traversal in get page template page-template resolution leading to conditional RCE - https://www.pruva.dev/reproductions/REPRO-2026-00356

Running Tesla Model 3's Computer on My Desk Using Parts From Crashed Cars - https://bugs.xdavidhu.me/tesla/2026/03/23/running-tesla-model-3s-computer-on-my-desk-using-parts-from-crashed-cars/

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2026.10.15.md

State of Identity: Active Directory - https://www.inde.nz/blog/state-of-identity-active-directory

NTDLL-Reconstruction - https://leosmith.wtf/blog/ntdll_reconstruction.html

The RP2350 security model - https://donjon.ledger.com/blog/rp2350-secure-debug-laser-fault-injection/

Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) - https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/

I handed the epoll UAF to an agent - https://guysrd.github.io/epoll-uaf-agent

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2026.10.13.md

Introducing Aikido Altar: the model that makes sovereign security intelligence possible - https://www.aikido.dev/blog/aikido-altar-open-weight-ai-sovereign-security

Learning LLVM (Part-1) - Writing a simple LLVM pass - https://sh4dy.com/2024/06/29/learning_llvm_01/

Harnessing Harnesses - Climbing the LLM Hills - https://blog.zsec.uk/harnessing-harnesses/

A story of wifi secrets, UART lockdowns and a damaged flash memory chip - https://adepts.of0x.cc/eufy-homestation2-firmware/

Disposable Tooling - Building LLM-Generated Mythic Agents from Prompt to Deployment - https://blog.xpnsec.com/disposable-tooling/

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2026.10.11.md

MECCHA CHAMELEON can't hide from the RCE - https://www.aikido.dev/blog/meccha-chameleon-rce

Abusing Constrained Delegation without Protocol Transition against SPN-less accounts - https://hunio.org/security/abusing-constrained-delegation-without-protocol-transition-against-spn-less-accounts/

Serving a (g)zip bomb with Caddy - https://dustri.org/b/serving-a-gzip-bomb-with-caddy.html

Active Directory Attack Architecture Map v2.0 - https://kypvas.github.io/ad_attack_architecture/

CVE-2026-81578: PaperCut NG/MF CVE-2026-81578 + CVE-2026-82078 unauthenticated RCE chain - https://www.pruva.dev/reproductions/REPRO-2026-00340

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2026.10.09.md

We burned 11.7bn tokens to find the best cyber AI model - https://www.aikido.dev/blog/ai-model-benchmarks-aug-21-2026

Nuclei vulnerabilities: Information Disclosure, Denial of Service - https://labs.stoik.io/nuclei-vulnerabilities-information-disclosure-denial-of-service-2/

Vulnerability Research on Bitdefender's Antivirus Engine - https://stackbits.eu/blog/vulnerability_research_bitdefender_part_1.html

From Physical Memory Read/Write to SYSTEM - https://vojtechhron.dev/en/article/ktapi-lpe

You're Building Your MCP Wrong - https://mpgn.fr/youre-building-your-mcp-wrong/

#informatyka