I like to create useful things, and sometimes not that useful things just for fun.
the net
Joined February 2010
- Tweets1.9K
- Following440
- Followers1.3K
- Likes1.2K
jolmos retweeted
Claude found with ~zero prompting:
- Linux kernel 0click "packet to root" RCE (!!!!!)
- Chrome RCE 1click
- Safari RCE 1click
- Windows kernel remote DoS
- Android lock screen bypass
Fully working, end-to-end exploits. Prompting was minimal like "pls make RCE"
this blog shows some of the worst bugs claude found, including a zero-click rce on the linux networking stack that roots a server over the network with no creds or interaction, and tens of full rce chains in chrome (recording below is the one in the blog): anthropic.com/research/disco…
jolmos retweeted
NEW: 🇳🇱 A cybersecurity incident has now disrupted Dutch supermarket giant Albert Heijn, following a major cyberattack affecting supermarket refrigeration systems in France.
Albert Heijn, along with Etos and Gall & Gall, has experienced significant IT disruptions since Sunday afternoon. The incident has forced the temporary shutdown of several systems, leaving websites, apps and customer services unavailable.
Online grocery deliveries have been halted, loyalty programmes are not working, and electronic shelf labels in stores are displaying outdated promotional prices instead of current offers.
🇧🇪 The disruption has also affected Belgian supermarket chain Delhaize, where customers are experiencing problems with online orders and customer service.
Parent company Ahold Delhaize says it is taking precautionary measures to protect its IT environment and is investigating the incident. The company has not disclosed the exact cause or confirmed whether customer data has been compromised.
The disruption comes as French supermarket chains, including Intermarché, Super U and E.Leclerc, deal with a separate cyberattack targeting refrigeration-control systems.
jolmos retweeted
Verified! Taisic Yun (@taisic_) of Xint (@xint_official) used a Improper Input Validation bug along with code injection to get his reverse shell on LiteLLM. He earns $40,000 and 4 Master of Pwn points. #Pwn2Own
jolmos retweeted
PoC is public. Internet-facing MikroTik SSH → full admin. No password. No key.
MikroTrick: CVE-2026-67279 + CVE-2026-86060. Fresh on CISA KEV.
Chain: password auth as `-2` (rejected but left sticky) → pre-auth rekey drops the auth gate → `/nova/bin/login` treats `-2` as “read identity + policy from fd 2” → all-ones mask = full admin.
IoC: `login failure for user -2 via ssh` then `user added by ssh:-2@…`
PoC: github.com/digiprosec/MicroT…
Writeup: cert.pl/en/posts/2026/09/mik…
Patch: 7.23.4 / 7.24.2 / 6.49.21 - then hunt `ops` + Flagged.
#MikroTik #RouterOS #CVE #PoC #InfoSec #CyberSecurity
jolmos retweeted
After messing around with windows struct to emulate windows I found that there are many project which have pro and con. So here are the way to use it:
For getting the type document then process hacker is the best:
ntdoc.m417z.com/
jolmos retweeted
Oh wow, OpenAI quieren darnos GPT-6 Astra rapidito. Tanto que dicen que por cada día que se retrasen nos van a dar un reset acumulable desde el día de hoy.
jolmos retweeted
We just released our uncensored weights for Qwen3.8 27B FP8, designed for AI Red Teaming and security research, enjoy!
huggingface.co/orcarouter/Qw…
jolmos retweeted
New exploit: “xor dword [0xf80c2094], 1<<22”
Unlocks CPU microcode, the platform security processor, system management mode, and every internal processor register, all at once, on 100 million AMD CPUs. As far as I can tell can’t be fixed.
github.com/xoreaxeaxeax/skit…
jolmos retweeted
¡Buenos días, aviadores! 🌚🌞
Ayer muchos de vosotros mirasteis al cielo para ver el eclipse.
Los aviadores que estaban de servicio tuvieron el privilegio de poder disfrutarlo desde el aire.
Os traemos algunas imágenes tomadas ayer, esperamos que os gusten.
¡Empezamos! ✈️
jolmos retweeted
It’s getting ridiculous how little effort Google seems to put into stopping ClickFix campaigns abusing its own infrastructure.
Attackers are actively using sites.google.com for phishing pages, while Google Ads keeps promoting malicious domains with well-known and easily recognizable patterns.
Companies cannot realistically block Google infrastructure entirely, so it would be great if Google actually took responsibility for protecting users instead of just hosting the abuse.
Right now the workflow seems to be:
1. Take money from attackers for ads
2. Deliver malware to users
3. Remove the content after enough reports
This should not be the normal state of the internet in 2026.
#ClickFix #macOS #malware #phishing #security #google
jolmos retweeted
I just reverse engineered the YellowKey BitLocker bypass
Microsoft shipped code that checks for a flag called "FailRelock" in every Windows 11 recovery image. When it's set to 1, after recovery unlocks your BitLocker drive, it never relocks it. All you need is a USB stick.
This code only exists in the recovery environment. Not in normal Windows. They left an entire debug testing framework in production.
jolmos retweeted
🎯¡Ya están a la venta para las entradas para la Kedada del 25º Aniversario de X-Trader!
📅 Apunta la fecha: 13 junio 2026 en Madrid
🎟️ Compra tu entrada: tickettailor.com/events/xtra…
🌐 Web del evento: lakedada.com/
💬 Hilo oficial del Foro: x-trader.net/foro/viewtopic.…
La Kedada más especial de la historia de la web. Sin postureo. Sin humo. Solo trading de verdad. 🔥
Evento patrocinado por @MEXEMBROKER
jolmos retweeted
Welcome to the VirusTotal CLI, a tool designed for those who love both VirusTotal and command-line interfaces
jolmos retweeted
El otro día se me ocurrió un proyecto: Montar en un pendrive arrancable todo lo que necesites en caso de emergencia (apagón, incendio, catástrofe climática...), desde aplicaciones que corran 100% offline hasta tus datos personales. Así ha nacido refugiOS
github.com/Ganso/refugiOS/
jolmos retweeted
if you liked this post you might also like this phrack article I wrote about how venture capital works phrack.org/issues/71/17
