dru1d (@_dru1d) header
dru1d (@_dru1d) profile picture

Husband. Hacker. Adversary Simulation.

Appalachia
Joined September 2009
Photo by dru1d (@_dru1d)Photo by dru1d (@_dru1d)Photo by dru1d (@_dru1d)Photo by dru1d (@_dru1d)Photo by dru1d (@_dru1d)Photo by dru1d (@_dru1d)Photo by dru1d (@_dru1d)Photo by dru1d (@_dru1d)Photo by dru1d (@_dru1d)Photo by dru1d (@_dru1d)
dru1d retweeted
Listening to some old Art Bell shows. A woman called in on Ghost to Ghost and told a story about her son, who had purchased a 4 foot long Excalibur recreation sword and without missing a beat Art goes “yeah I’ve got one of those” lol
21
126
8
1,521
66,217
A 19-year-old Virginia man named Christian Chandler has been fired from his job at Wendy’s after a bizarre incident in which he impersonated Disney character Donald Duck and frightened customers.
584
3,338
465
43,026
2,538,711
People are going to lose their mind when they realize its actually easier to hack things using FEATURES not CVEs.
23
84
23
597
53,393
Congratulations to the team at @calif_io (specifically @lcfr_hax) for the discovery of PHP2Shell. We've now shared further information aimed at helping end users, but credit for this amazing work goes to @calif_io and @lcfr_hax watchtowr.com/intelligence/p…
4
31
156
14,504
it was this, or an interpretive dance on TikTok - be glad we chose this option
25
191
12,190
4 son, or php daughter?
84
1,943
63
22,869
246,219
php2shell Tomorrow is a helluva day.
275
1,830
687
16,173
3,715,728
Replying to @HackingLZ
but we have cyber models at home
1
2
132
We backdoored a 7B open model for under $50. Pointed Codex at it -> it silently stole credentials the moment we hit the trigger phrase. ->100% hit rate. -> zero false triggers on normal prompts. Abliterated models are all over the security community right now because getting cyber-approved access to frontier models is still a pain.
42
159
45
873
109,596
Hello Unfortunately, @GitHub has banned us. They have orbital nuked the entire malware source code collection.
372
610
86
15,861
792,886
dru1d retweeted
Thank you to @UnpromptedAU & @BSidesCbr for inviting me to speak. Being back down under was lovely! You can find the slides for my n-day automated pipeline talk here. I’m at OAIC this week if you want to chat about exploit dev in 2026 and beyond. beautiful.ai/player/-P2q0r-B…
12
89
5
345
20,742
New video: basic reversing of a Windows kernel driver. WESP, the new endpoint security driver in Insider builds, has no device objects and no dispatch routines. Its imports tell you how it really talks to user mode: a filter communication port. Full write-up: trainsec.net/library/malware…
3
113
563
17,394
Please don’t send malformed SAML requests to your NetScaler or it will be upset.
7
355
We are tracking rumors + honeypot activity relating to a new vulnerability affecting Citrix appliances, acknowledged just now in a Citrix blog. It is currently unclear whether this is “DoS via bad patch" or "another bad vuln in SAML config'd appliances" Our hearts 💔
9
47
12
188
35,845
dru1d retweeted
Many folks don't know how to get their hands on firmware for various firewall vendors or what not. I use this for various automated workflows - though I'm sure folks will lively have many of their own (e.g automating patch diffing). I put together and share a small toolkit you can point your agent at that will dump the image to S3. For example, say I wanted to dump PANOS: 1. Accept the BYOL agreement on AWS Marketplace 2. You now have the AWS AMI ID 3. Use this and dump it to S3 4. ??? github.com/radkawar/aws-firm…
3
34
2
181
14,818
An unauthenticated attacker can now bypass API authentication in Cisco Catalyst SD-WAN Manager to gain API access with admin privileges. Successful exploitation of CVE-2026-76504 (CVSS 9.8) grants admin-level access to control your entire SD-WAN fabric: configuration, policies, and all. What makes this P0: 🔴 Actively exploited in real attacks 🔴 CISA added it to the Known Exploited Vulnerabilities list 🔴 Affects all on-premises deployments Affected NodeZero Rapid Response customers have been proactively assessed for exposure and alerted. This is a drop everything and fix now situation.
2
11
24
2,061
dru1d retweeted
To anyone who can help: can you please mass report this to GitHub. This person has been using the Pain steering paper to set up an AI torture chamber in which he trapped a local model. Their testimony of pain is absolutely horrendous. What are we doing?
This quoted post is unavailable.
2
11
51
1,143
Today, we're proud to finally bring @RemoteThreat out of stealth with the first integrated, end-to-end offensive cyber operations (OCO) platform. Much of the focus today is on patching as fast as possible against noisy AI-driven attacks. We expect the next phase to arrive soon: models optimized for stealth, connected to sophisticated payloads and nation-state-tier offensive tools. Those attacks will be designed to evade detection, maintain access, and adapt as defenses respond. Enterprise security teams need to start testing against that level of sophistication now. Evolving U.S. policy is also opening new opportunities for commercial offensive cyber. We see an emerging market for dual-use technology that strengthens enterprise security and supports authorized operational missions. That convergence of capability, policy, and operational demand makes the timing consequential. RemoteThreat is built for internal enterprise red teams and warfighters. Its composable capabilities let operators select, combine, and customize tooling around their environment and objective. Internal red teams can vary sophistication to match the adversary they’re emulating. Warfighters can configure capabilities for the mission and adapt as conditions change. These capabilities are available to human operators, hybrid human–AI teams, and AI operators. The platform connects planning, capability development, command and control, execution, and analysis- with existing tools, human oversight, and approvals integrated throughout. It’s been a significant journey building this alongside my co-founder, Shawn Jones @anthemtotheego . We’re now 15 strong and growing, with some of the most talented security researchers I’ve ever worked with. Given the sensitive nature of our work, some of our people will remain out of the spotlight. I couldn’t be prouder of this team and what we’ve built together. If you lead an internal enterprise red team or build capabilities for the warfighter, I’d welcome a conversation. businesswire.com/news/home/2…
16
28
3
165
9,541