(CVE-2024-3914)[330759272][Pwn2Own 2024][DOMArrayBuffer]DOMArrayBuffer confused about ownership of backing buffer -> UAF is now open with PoC and exploithttps://t.co/IXUhYqbqwJ

PoC:https://t.co/PREUW9sEpi
Exploit:https://t.co/0DBGY6yCxI
WP:https://t.co/78iNyjthTe@0x10n https://t.co/vU2ZmIlnUk

— xvonfers (@xvonfers) September 6, 2024

🔒👀🚨 Hunting for - Cracked Cobalt Strike V4.9 in the Wild!

📷Spotted an interesting cert on #Shodan, and a simple pivot with ssl:'Pwn3rs Striked' found a small cluster of servers. A quick search linked the cert back to research on Cobalt V4.9 by @domchell last year.

📷Some… pic.twitter.com/637ZruPdsK

— Chris Duggan (@TLP_R3D) September 7, 2024

To whoever needs it, I just created a webapplication that returns API info for Telegram bot tokens.https://t.co/3A0AeYOTRG

Just paste in your Telegram bot token
( https://t.co/ASohfuVssK/)
and it will return to you a list information.
Simple but useful 🙂 pic.twitter.com/XwdIo8fd9S

— Gi7w0rm (@Gi7w0rm) September 7, 2024

GPUAF: Using a general GPU exploit tech to attack Pixel 8

A talk by @peterpan980927 and @st424204 about leveraging an integer overflow bug in the Mali GPU driver to gain use-after-free access to physical pages and escalate privileges on Pixel 8.https://t.co/B9FaPkxDeZ pic.twitter.com/uiqr1NK0dp

— Linux Kernel Security (@linkersec) September 6, 2024

https://t.co/k54R9RujU4

— Kai (@0xSkeletonKey) September 7, 2024

In his latest blog, Core Labs' @ricnar456 takes a deep dive into CVE-2024-30051, reversing this Windows #vulnerability to create a functional #PoC. https://t.co/WIEyx3Zjoi pic.twitter.com/mSsMe2QQFT

— CoreLabs Research (@CoreAdvisories) September 6, 2024

One of the fundamental things top leaders at organizations that need to treat cybersecurity as a real priority should be expected to know & understand:
If your IT infrastructure & operations are in bad shape, security operations cannot and must not be expected to save you. https://t.co/JULsKiqUWX

— Brian in Pittsburgh (@arekfurt) September 7, 2024

Interesting heat map of #C2 servers across the IPv4 space! (Source: https://t.co/fZN5BofAN5) pic.twitter.com/JztiWtqrE8

— Xavier Mertens 🇧🇪 (@xme) September 8, 2024

GhostStrike - Deploy stealthy reverse shells using advanced process hollowing with GhostStrike – a C++ tool for ethical hacking and Red Team operations https://t.co/UrpdrLzGt3

— Panos Gkatziroulis 🦄 (@netbiosX) September 7, 2024

Almost invisible, persistent, fileless, LPE backdoor from an elevated command prompt:

sc.exe sdset scmanager D:(A;;KA;;;WD)

By Gregorz Tworek pic.twitter.com/pLCxfB8yPP

— Clandestine (@akaclandestine) September 8, 2024

This week we look at a memorabilia item from Italy's foreign intelligence service, known as AISE. https://t.co/hIuyt4joye

— Spy Collection (@SpyCollection1) September 9, 2024