LightNews LightNews
droner.bsky.social
@droner.bsky.social
120 followers 190 following 23 posts
researcher. exploit dev. pdx. hacking @ atredis
https://dronesec.net/
Posts Replies Media Videos
Reposted
atredispartners.bsky.social
Let's Hack Something Cute! A Reverse Engineering Journey into the Drawbot with Jessie www.atredis.com/blog/2025/9/...
Drawbot: Let’s Hack Something Cute! — Atredis Partners
The Target A few months ago I realized I was overdue for a fun, quirky hardware project. Every so often I like to see what new and interesting electronic children's toys are out there. When looking,…
www.atredis.com
November 13, 2025 at 8:40 PM
Reposted
jstnkndy.bsky.social
I've been following the @xbow.com stuff for a while now and have been really impressed by their blog posts and findings, so I'm extremely surprised/disappointed by the poor quality of their sample report on their new on-demand pentest offering at xbow.com/pentest for a lot of reasons.
Web Application Penetration Testing at AI Speed | XBOW
XBOW delivers web application penetration testing at AI speed; autonomous and validated with real exploit evidence in days.
xbow.com
November 13, 2025 at 6:25 PM
Reposted
aflplusplus.bsky.social
LibAFL 0.15.4 has just been released 🎉

Of the 30 Contributers for this release, almost half are new faces <3

github.com/AFLplusplus/...

#Fuzzing #LibAFL #AFLplusplus
Release 0.15.4 · AFLplusplus/LibAFL
Highlights DumpTargetBytesToDiskStage can to dump complex inputs to disk as bytes CmpLog implementation is now consistent with AFL++ to share targets back and forth Updated and fixed ForkserverByt...
github.com
November 12, 2025 at 3:31 PM
Reposted
campuscodi.risky.biz
Microsoft has discovered a side-channel attack (Whisper Leak) on the network communications between AI chatbots and their backend LLMs

www.microsoft.com/en-us/securi...
November 9, 2025 at 2:38 PM
Reposted
gloriouscow.bsky.social
I've officially released my real-mode emulator CPU test suite for the Intel 80386.

github.com/singlestepte...

#retrocomputing #emulation
Moorty the MOO mascot holding a 386 CPU
November 4, 2025 at 8:16 PM
Reposted
natashenka.bsky.social
New Blog Post: Seth Jenkins broke kASLR by doing … nothing 😩

googleprojectzero.blogspot.com/2025/11/defe...
Defeating KASLR by Doing Nothing at All
Posted by Seth Jenkins, Project Zero Introduction I've recently been researching Pixel kernel exploitation and as part of this research I ...
googleprojectzero.blogspot.com
November 3, 2025 at 6:17 PM
Reposted
buherator.bsky.social
[RSS] Drawn to Danger: Windows Graphics Vulnerabilities Lead to Remote Code Execution and Memory Exposure


research.checkpoint.com ->


Original->
November 3, 2025 at 1:53 PM
Reposted
districtcon.bsky.social
Interested in Jump The Wall? Applications close Nov 7 🔥
www.districtcon.org/jtw
October 31, 2025 at 7:52 PM
Reposted
campuscodi.risky.biz
Zimperium has discovered more than 760 Android apps that steal and relay NFC data to a remote attacker

zimperium.com/blog/tap-and...
Tap-and-Steal: The Rise of NFC Relay Malware on Mobile Devices
NFC relay malware on Android devices is exploiting Tap-to-Pay systems, targeting financial institutions globally with sophisticated attacks and minimal user interaction.
zimperium.com
October 30, 2025 at 3:29 PM
Reposted
campuscodi.risky.biz
Sophos has linked the recent Lanscope zero-day to Bronze Butler (Tick)

news.sophos.com/en-us/2025/1...
BRONZE BUTLER exploits Japanese asset management software vulnerability
The threat group targeted a LANSCOPE zero-day vulnerability (CVE-2025-61932)
news.sophos.com
October 30, 2025 at 8:25 PM
Reposted
buherator.bsky.social
[RSS] [Blog] A Retrospective Analysis of CVE-2025-59287 in Microsoft WSUS


code-white.com ->


Original->
October 30, 2025 at 1:39 PM
Reposted
decoder-it.bsky.social
Blog post about my recent CVE-2025-58726, aka “The Ghost Reflection” is out, read it here:
semperis.com/blog/exploit...
🙃
Exploiting Ghost SPNs and Kerberos Reflection for SMB Privilege Elevation
Understanding how attackers use Ghost Service Principal Names to initiate authentication reflection can help you avoid similar vulnerabilities.
semperis.com
October 29, 2025 at 5:19 PM
Reposted
blowdart.me
Tickets for BSides Seattle 2026 are open

www.bsidesseattle.com
Bsides Seattle
Bsides Seattle Security Conference
www.bsidesseattle.com
October 28, 2025 at 6:17 PM
Reposted
districtcon.bsky.social
We're officially announcing our speakers DistrictCon Year 1! Check out our incredible lineup: www.districtcon.org/speakers

This also includes our Day 1 & Day 2 Keynotes from Ian Levy and Dan Ridge.

And don't forget, GA tickets go on sale November 16! See you in January! 🪩
October 27, 2025 at 4:41 PM
Reposted
cve.skyfleet.blue
CVE-2025-12220 - Busybox 1.31.1 - Multiple Known Vulnerabilities
CVE ID : CVE-2025-12220

Published : Oct. 25, 2025, 4:15 p.m. | 45 minutes ago

Description : Busybox 1.31.1 - Multiple Known Vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19....
CVE-2025-12220 - Busybox 1.31.1 - Multiple Known Vulnerabilities
Busybox 1.31.1 - Multiple Known Vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
cvefeed.io
October 25, 2025 at 5:51 PM
Reposted
districtcon.bsky.social
Junkyard closes TODAY!!!!
www.districtcon.org/junkyard
The Junkyard — DistrictCon
www.districtcon.org
October 24, 2025 at 6:00 PM
Reposted
thezdi.bsky.social
October 23, 2025 at 5:57 PM
Reposted
re-verse.io
The CFP for RE//verse 2026 is open, but not for long! Submissions close November 14th. Share your best RE and security research with us here: sessionize.com/reverse-2026
October 21, 2025 at 7:20 PM
Reposted
campuscodi.risky.biz
The Linux kernel has patched a bug in the RDSEED entropy generator that caused AMD Zen5 chips to fail to produce random numbers.

The patch disables RDSEED and forces all AMD Zen5 processors to use RDRAND for generating random numbers.

lore.kernel.org/lkml/2025101...
October 19, 2025 at 2:47 PM
Reposted
buherator.bsky.social
[RSS] exploits.club Weekly Newsletter 89 - iOS GPU Driver Bugs, Kernel Stack UAFs, Hardware Wallet Auth Bypasses, and More


blog.exploits.club ->


Original->
October 16, 2025 at 3:45 PM
Reposted
thezdi.bsky.social
Announcing #Pwn2Own Automotive 2026! We're heading back to Tokyo and we're adding new targets Level 3 charging thanks to #Aplitronic & the OCTT thanks to the @openchargealliance.org. Tesla is back, too. Check out the details at www.zerodayinitiative.com/blog/2025/10...
Zero Day Initiative — Pwn2Own Automotive Returns to Tokyo with Expanded Chargers and More!
If you just want to read the rules, click here . &nbsp;Now entering its third year, Pwn2Own Automotive returns to Automotive World in Tokyo on January 21 – 23, 2026. Over the last two years, ...
www.zerodayinitiative.com
October 16, 2025 at 3:07 PM
Reposted
campuscodi.risky.biz
Talks from the REcon 2025 security conference, which took place in June, are available on YouTube

www.youtube.com/@reconmtl/vi...
October 15, 2025 at 11:31 PM
Reposted
offensivecon.bsky.social
🚨 Save the Date for #offensivecon26

Mark your calendars, spread the word, and stay tuned for when registrations open!

📍 Hilton Berlin
🧠 Trainings: 11–14 May 2026
🎤 Conference: 15–16 May 2026

Visit 🔗offensivecon.org for more details.
October 15, 2025 at 1:44 PM
Reposted
zackwhittaker.com
This one's a wild/messy one: Cyber giant F5, which serves most of the Fortune 500, said unknown government hackers had 'long term' access to its network:

• stole source code, some customer data
• accessed undisclosed vulns in BIG-IP
• DOJ allowed F5 to delay public notice citing national security
Cyber giant F5 Networks says government hackers had 'long-term' access to its systems, stole code and customer data | TechCrunch
The company, which provides cybersecurity defenses to most of the Fortune 500, said the DOJ allowed it to delay notifying the public on national security grounds.
techcrunch.com
October 15, 2025 at 3:55 PM
Reposted
n0x08.bsky.social
eclypsium.com/research/pwn... - This is the blog version of the Ekoparty talk I did in 2022; while the Chinese APTs have developed more advanced techniques, a lot of this may still be useful as you deal with the bombshell that dropped today.
Pwned Balancers: Commandeering F5 and Citrix for Persistent Access & C2 - Eclypsium | Supply Chain Security for the Modern Enterprise
Summary The last 3 years have seen attackers turn their spotlights on initial network access through VPN concentrators, load balancers, routers, and IoT devices. Once the realm of only the most skille...
eclypsium.com
October 15, 2025 at 4:51 PM