konik_polanowyFenomen

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2026.10.13.md

Introducing Aikido Altar: the model that makes sovereign security intelligence possible - https://www.aikido.dev/blog/aikido-altar-open-weight-ai-sovereign-security

Learning LLVM (Part-1) - Writing a simple LLVM pass - https://sh4dy.com/2024/06/29/learning_llvm_01/

Harnessing Harnesses - Climbing the LLM Hills - https://blog.zsec.uk/harnessing-harnesses/

A story of wifi secrets, UART lockdowns and a damaged flash memory chip - https://adepts.of0x.cc/eufy-homestation2-firmware/

Disposable Tooling - Building LLM-Generated Mythic Agents from Prompt to Deployment - https://blog.xpnsec.com/disposable-tooling/

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2026.10.11.md

MECCHA CHAMELEON can't hide from the RCE - https://www.aikido.dev/blog/meccha-chameleon-rce

Abusing Constrained Delegation without Protocol Transition against SPN-less accounts - https://hunio.org/security/abusing-constrained-delegation-without-protocol-transition-against-spn-less-accounts/

Serving a (g)zip bomb with Caddy - https://dustri.org/b/serving-a-gzip-bomb-with-caddy.html

Active Directory Attack Architecture Map v2.0 - https://kypvas.github.io/ad_attack_architecture/

CVE-2026-81578: PaperCut NG/MF CVE-2026-81578 + CVE-2026-82078 unauthenticated RCE chain - https://www.pruva.dev/reproductions/REPRO-2026-00340

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2026.10.09.md

We burned 11.7bn tokens to find the best cyber AI model - https://www.aikido.dev/blog/ai-model-benchmarks-aug-21-2026

Nuclei vulnerabilities: Information Disclosure, Denial of Service - https://labs.stoik.io/nuclei-vulnerabilities-information-disclosure-denial-of-service-2/

Vulnerability Research on Bitdefender's Antivirus Engine - https://stackbits.eu/blog/vulnerability_research_bitdefender_part_1.html

From Physical Memory Read/Write to SYSTEM - https://vojtechhron.dev/en/article/ktapi-lpe

You're Building Your MCP Wrong - https://mpgn.fr/youre-building-your-mcp-wrong/

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2026.10.07.md

Bypassing DEP: VirtualProtect - https://iss4cf0ng.github.io/2026/09/30/2026-9-30-DEP/

Learning LLVM (Part-1) - Writing a simple LLVM pass - https://sh4dy.com/2024/06/29/learning_llvm_01/

Microsoft Paint and Photos Embed Server-Issued GUIDs as Invisible Watermarks in Locally-Generated Images - https://xusheng.dev/posts/reversing/mspaint_invisible_watermark/main/

Module Stomping - The Standard Injection For Modern C2 Agents - https://combat.theater/blog/module-stomping/

Lunex Uses BYOVD to Disable Security Monitoring and Deploy Persistent Stealer - https://blog.polyswarm.io/lunex-uses-byovd-to-disable-security-monitoring-and-deploy-persistent-stealer

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2026.10.05.md

Backdoors in the Dungeon – TURN & MQTT Abused by DragonForce - https://lab52.io/blog/backdoors-in-the-dungeon-turn-mqtt-abused-by-dragonforce/

I accidentally logged hundreds of thousands of phone calls to military bases - https://lina.sh/blog/hijacking-e164-arpa

Inside the Sandbox: How pwn Escaped Google kvmCTF (Before the Watershed) - https://pwn.ai/blog/kvmescape

Frappe 16.18.3 / ERPNext 16.19.1 SSTI to OS RCE - https://thinkloveshare.com/offenskill/frappe-ssti-to-rce/

Hunting Abuse: Detecting Privilege Escalation Through the ADCS Database - https://www.guidepointsecurity.com/blog/detecting-privilege-escalaction-through-adcs/

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2026.10.03.md

Paint It Blue: Reversing Win32k's Callbacks - https://idov31.github.io/posts/paint-it-blue-reverse-win32k

Static Devirtualization of Tencent VM - https://aftermathlabs.net/blog/31/07/2026/

Dirty Cert: Cisco Smart Software Manager's Silently Patched RCE - https://starlabs.sg/blog/2026/09-dirty-cert-cisco-smart-software-managers-silently-patched-rce/

Two DGX Sparks, 33 Local Models, One Question: Can Local AI Actually Red Team? - https://betheadversary.com/posts/dgx_spark_red_team_bench/

Is sandboxing sufficient to contain rogue agents? - https://blog.cryptographyengineering.com/2026/09/30/is-sandboxing-sufficient-to-contain-rogue-agents/

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2026.10.01.md

Exploiting Azure IMDS - https://cyberdom.blog/exploiting-azure-imds/

Windows Internals: Secure Calls - The Bridge Between The NT Kernel and Secure Kernel - https://connormcgarr.github.io/secure-calls-and-skbridge/

GDID: The Windows Global Device Identifier - https://zerotracelab.com/blog/gdid-windows-tracking

CVE-2026-20182: Critical authentication bypass in Cisco Catalyst SD-WAN Controller (FIXED) - https://www.rapid7.com/blog/post/ve-cve-2026-20182-critical-authentication-bypass-cisco-catalyst-sd-wan-controller-fixed/

WINDOWS PRIVILEGE ESCALATION USING NCSI ACTIVE PROBES - https://labs.itresit.es/2026/09/28/windows-privilege-escalation-using-ncsi-active-probes/

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2026.09.29.md

Discovering and exploiting a remote code execution vulnerability in OpenCode (GHSA-632h-h47v-g4x4) - https://securitylabs.datadoghq.com/articles/opencode-upgrade-remote-code-execution/

How I Could've Accessed 17 Trillion Microsoft Records - https://blog.faav.net/how-i-couldve-accessed-17-trillion-microsoft-records

A prompt that finds deep logic bugs, and the pipeline we built around it - https://workos.com/blog/vulnerability-analysis-pipeline

Even more privileged ADCS ESC_CES - https://adhdmurky.github.io/posts/post4/

I spent 3 years of my life building this tool- DIYFPV DRONE BUILDER - https://www.youtube.com/watch?v=uzM72CcgL0c

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2026.09.27.md

One Tap Too Far: Using Shortcuts to Bypass Chrome for iOS Call Prompts - https://blog.doyensec.com/2026/09/24/chrome-ios-policy-bypass.html

Containers Are No Longer a Security Boundary - https://depthfirst.com/research/containers-are-no-longer-safe

ceasta a disassembler, decompiler and debugger in one — for windows and linux - https://github.com/ngwg/ceasta

How One Twitch Chat Message Became Code Execution on a Streamer’s PC - https://blog.scrt.ch/2026/09/22/how-one-twitch-chat-message-became-code-execution-on-a-streamers-pc/

Llama.cpp, an Ice Cold CORS Light, and Command Execution - Put it on my Tab! - https://g3tsyst3m.com/cors/Llama.cpp,-an-Ice-Cold-CORS-Light,-and-Command-Execution-Put-it-on-my-Tab!/

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2026.09.25.md

Testing race conditions with memory access tracing and stack-based delay injection - https://projectzero.google/2026/09/maccconc-race-condition.html

Photon-Emission-Guided Laser Fault Injection Enables RP2350 Secure Debug - https://donjon.ledger.com/blog/rp2350-secure-debug-laser-fault-injection/

When Defenses Become Attack Surface: CVE-2026-20971, a Samsung Kernel UAF - https://lucidbitlabs.com/blog/when-defenses-become-attack-surface/

CVE-2026-7162 Root Cause Analysis - https://blog.uhg.sg/cve/cve-2026-7162

LogonTracer v2 is a tool to investigate malicious logon by visualizing and analyzing Windows Active Directory event - https://github.com/JPCERTCC/LogonTracer

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2026.09.23.md

Evading Machine Learning Based Detections - https://msecops.de/blog/posts/ml-evasion/

Stop Using OpenCode - https://wren.wtf/shower-thoughts/stop-using-opencode/

AI studio Auth bypass - https://ndevtk.github.io/writeups/2026/07/28/ais-bypass/

Fileless ELF Execution via O_TMPFILE - https://matheuzsecurity.github.io/hacking/fileless-loader-bypassing-elastic-memfd/

Introducing Pretender - Your New Sidekick for Relaying Attacks - https://blog.redteam-pentesting.de/2022/introducing-pretender/

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2026.09.21.md

A Brilliantly Simple Bug In V8 - https://qedaudit.io/blog/brilliantly-simple/

The QNAP Pattern - https://runiclabs.io/research/qnap-architecture/

How to Run a Windows Service Inside Svchost.exe - https://trainsec.net/library/malware-analysis/how-to-run-a-windows-service-inside-svchostexe-service-dll-walkthrough/

SQL Injection - Bypassing Baffin Bay WAF to Exploit PostgreSQL ORDER BY Injection - https://p3n7a90n.github.io/blogs/sql-injection-waf-bypass-postgresql-order-by/

Writing Beacon Object Files In Mythic Using Dark Agent For MacOS - https://umsundu.co.uk/posts/Writing-Beacon-Object-Files-In-Mythic-Using-Dark-Agent-For-Mac/

#informatyka

1257 + 1 = 1258

Tytuł: Zaprzyjaźnij się z algorytmami. Przewodnik dla początkujących i średniozaawansowanych

Autor: Jacek Tomasiewicz

Kategoria: informatyka, matematyka

Format: ebook

Ocena: 7/10

Książka bardziej do przerobienia niż do czytania. Zbiór zadań z poprzednich lat olimpiad matematycznych dla licealistów z dość dużymi zadatkami na studia matematyczne lub techniczne.

Wygenerowano za pomocą https://bookmeter.xyz

#bookmeter

1256 + 1 = 1257

Tytuł: Zostań inżynierem sieci. 100 pytań do przyszłego sieciowca

Autor: Adam Józefiok

Kategoria: informatyka, matematyka

Format: ebook

Ocena: 7/10

Autor jest dobrze znany z licznych publikacji dotyczących czy stricte certyfikatowi CCNA. Książka jest takim przypomnieniem, co według tytułu, może cię spotkać na rozmowie kwalifikacyjnej. W sumie można też ją traktować jako szybkie przypomnienie przed egzaminem lub zdawaniem jakiegoś certyfikatu.

Wygenerowano za pomocą https://bookmeter.xyz

#bookmeter

1255 + 1 = 1256

Tytuł: O stawaniu się stoikiem. Czy jesteście gotowi na sukces?

Autor: Tomasz Mazur

Kategoria: filozofia, etyka

Format: ebook

Ocena: 8/10

Parę książek o stoikach już przeczytałem. Skupiają się głównie na opowiedzeniu o stoicyzmie z czysto akademickiego punktu widzenia. Definicje, okraszone cytatami, które samemu sobie trzeba jakoś do życiowych sytuacji pododawać. Sprawia, że teoria to jedno a codzienne sytuacje to drugie. Tu jest zupełnie inaczej. Jest Eryk, żona Natalia i dwoje dzieci. Są też przyjaciele i dalsza rodzina. Eryk trafił na stoicyzm z racji szukania problemów życia codziennego, np. problemy finansowe, wychowawcze, etc. Dalej przez rozdziały przechodźmy przez jego przeistoczenie w stoika, jak i całą gamę problemów, jak rozwód, komornik, śmierć ojca, nowa miłość, samobójstwo przyjaciela. Całość pomagają zrozumieć wytłumaczenia technik, które Eryk dostaje od innych członków Klubu Stoika. Książka jest opowiada z perspektywy narratora, który "wchodzi" w umysły i dialogi innych. Szybko się czyta i czeka na kolejny rozwój wydarzeń.

Wygenerowano za pomocą https://bookmeter.xyz

#bookmeter

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2026.09.19.md

When AI Makes 0-Days Feel Like N-Days - https://starlabs.sg/blog/2026/07-when-ai-makes-0-days-feel-like-n-days/

LazyDLLSideload - https://crates.io/crates/LazyDLLSideload

Inverse-square law - https://blog.coredump.cx/p/inverse-square-law

Going depthfirst: Achieving GitLab RCE via Two Ruby Memory Corruption Vulnerabilities - https://depthfirst.com/research/going-depthfirst-achieving-gitlab-rce-via-two-ruby-memory-corruption-vulnerabilities

Behind the GitLab RCE: A depthfirst Journey into the Ruby Ecosystem - https://depthfirst.com/research/behind-the-gitlab-rce-a-depthfirst-journey-into-the-ruby-ecosystem

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2026.09.17.md

Exploiting AD ResetNightmare (CVE-2026-27912) and KerberLoss (CVE-2026-25177) from Linux - https://cravaterouge.com/articles/resetnightmare/

Exploit brokers pay $500,000 for a WordPress RCE. I found one with GPT5.6 Sol Ultra and $25 - https://www.slcyber.io/research/exploit-brokers-pay-500000-for-a-wordpress-rce-i-found-one-with-gpt5-6

Microcode in Intel's 8087 floating-point chip: the scale instruction - https://www.righto.com/2026/09/8087-microcode-reverse-engineering-fscale.html

$15k - CSPT to full account takeover, then 2FA bypass via the prototype chain - https://whoareme.com/blog/cspt-account-takeover-2fa-bypass/

Read the Bits, Not the Integer: msPKI-Certificate-Name-Flag and the ESC4⤍ESC1 Chain - https://secretmyth.blog/adcs/demystifying-mspki-certificate-name-flag/

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2026.09.15.md

Chinese Implants in the Supply Chain - https://www.vulncheck.com/blog/zbt-darklantern-speakingstone

Process Parameter Poisoning - https://sensepost.com/blog/2026/process-parameter-poisoning/

AI Assisted Vulnerability Research on Embedded Targets - https://quentinkaiser.be/security/2026/07/18/ia-assisted-vuln-research/

Bluetooth Low Energy Security Testing, Consolidated: Introducing Caeruleus - https://www.praetorian.com/blog/ble-testing-caeruleus/

Fileless ELF Execution via Kernel Keyring - https://matheuzsecurity.github.io/hacking/linux-kernel-keyring-fileless-exec/

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2026.09.13.md

Beyond Lazarus: Organization of DPRK cyber capabilities - https://www.sekoia.com/blog/beyond-lazarus-organization-of-dprk-cyber-capabilities

Dell BIOS Passwords: Weak XOR Encryption Allows Recovery from SPI Flash (CVE-2026-40639) - https://blog.amberwolf.com/blog/2026/july/dell-bios-passwords-weak-xor-encryption-allows-recovery-from-spi-flash-cve-2026-40639/

Testing race conditions with memory access tracing and stack-based delay injection - https://projectzero.google/2026/09/maccconc-race-condition.html

From P-Code to GNN: extract binary code semantics - https://blog.quarkslab.com/from-p-code-to-gnn-extract-binary-code-semantics.html

NetNTLMv1 Is Dead. Long Live NetNTLMv1 - https://www.outflank.nl/blog/2026/09/08/netntlmv1-is-dead-long-live-netntlmv1/

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2026.09.11.md

Anatomy of SystemOptimizer - A BYOVD EDR Killer with a UAC Bypass - https://cham1ndux.github.io/posts/BYOVD-EDR-killer-with-a-UAC-bypass-and-a-lying-comment-block/

Privilege escalation from IIS AppPool to NT Authority/SYSTEM via AD CS RPC endpoint - https://www.mannulinux.org/2026/08/Privilege-escalation-from-IIS-AppPool-to-NT-AuthoritySYSTEM-via-AD-CS-RPC-endpoint.html

Dissecting a PHP web server rootkit - https://www.sophos.com/en-us/blog/dissecting-a-php-web-server-rootkit

Trust no one: are one-way trusts really one way? - https://offsec.almond.consulting/trust-no-one_are-one-way-trusts-really-one-way.html

AdaptixC2: Fingerprinting an Open-Source C2 Framework at Scale - https://censys.com/blog/adaptixc2-open-source-c2-framework

#informatyka