As Flare-On starts I am happy to announce the official Hex-Rays IDA MCP Server is out! 🥳 Details and links below ⬇️

🔓 Your first hardware hack might end with a BitLocker key. For many students, Breaking BitLocker is their first time: → opening a laptop to find attack points → microsoldering onto a PCB → connecting a logic analyzer → watching TPM traffic on a real hardware bus → extracting the key that actually unlocks the disk That moment when random electrical signals suddenly become understandable data — and then a BitLocker key — never gets old. 🔬⚡ This December we’re bringing the latest Breaking BitLocker to Black Hat Europe 2026 in London 🇬🇧 And we’ve made the hardware side even more accessible. We built our own LPC + SPI decoders for PulseView, so instead of treating the logic analyzer as a magic box, you can actually SEE the communication, understand it and watch the attack unfold on the bus. Over two very hands-on days: ⚡ TPM Bus Sniffing ⚡ LPC/SPI logic analysis ⚡ BitLocker key extraction ⚡ DMA attacks ⚡ Bootloader-based attacks ⚡ Current BitLocker research & mitigations ⚡ Most importantly: understanding why an attack works - and when it doesn’t No previous hardware-hacking experience required. 🧰 All attack hardware + adapters included 💻 Prepared target laptop included 🔬 You perform the attacks yourself 🎒 And the equipment is yours to keep afterwards One important thing: we still need additional Early Bird registrations for the Black Hat class to go ahead. So if Breaking BitLocker has been sitting on your training wish list, don’t wait for regular registration - there may not be one. 👉 hos.direct/bheu26 Know a forensic practitioner, pentester, security researcher or LEA colleague who should finally cross the software/hardware boundary? Send this their way. Let’s get another group around the workbench at #BHEU. 🔓🔬 #BlackHat #BitLocker #HardwareSecurity #DFIR #TPM #InfoSec

Achievement for the day

Released today: github.com/derv82/wifit3/?v=…

I’ve been working on something. Yes, that’s a Windows PowerShell terminal. No, this is not a joke.

If you're interested in SDR / RF security and looking to attend @BlackHatEvents EU, make sure to get your early bird tickets with discount pricing before September 25th! 👉 Black Hat EU (London), December 7-8 2026: blackhat.com/europe/training… #SIGINT #RFsecurity #SDR

A Tale of Several Hijacks and What It Taught Me About Runtime-Driven Testing - if you fancy reading a story about simple vulnerabilities (Ghostscript CVE-2026-19547 and similar in Apache, PHP, GnuPG, wget, Microsoft Coreutils) and with an interesting moral, here's my latest article 😉 atos.net/en/lp/cybershield/a…

Meet Octoagent, Octopwn's on-prem, model agnostic internal network pentesting agent, boosted by local or cloud LLMs. Fully onprem, controlled, customizable, transparent and logged. piped.video/f_HqEnIe1zM

We're very proud to have been featured on the front page of the Hungarian news site 444.hu, with Tamás Jós (@SkelSec), Tamás Mihalovits and Anna Bátki pictured standing at our #defcon booth. :) Article in Hungarian: 444.hu/2026/09/15/mestersege…

New gowitness, 3.20! github.com/sensepost/gowitne…

Friday afternoon (vibe)coding project that was on my to-do for a while: obtaining Entra ID tokens from an endpoint by asking the WAM. This alternative to using the PRT cookie follows the legitimate SSO flow used by apps like Teams to obtain tokens. Code: github.com/dirkjanm/askWAM

Microsoft Coreutils (version 2026.9.3 and earlier) tail.exe 🤭

Повну емуляцію апаратної платформи Nokia 6600 (NHL-10) у QEMU завершено. GSM-зв’язок працює end-to-end: Відправка та прийом СМС ARM → DSP → IQ → Osmocom → IQ → DSP → ARM

FalconFlank : Crowdstrike Falcon 0day LPE is now public github.com/MSNightmare/Falco…

I've published UniBLEed, a fully wormable proximity Bluetooth RCE affecting Unitree's G1 humanoids. Blog spans cloud, mobile, firmware, Bluetooth & hardware. Two multi-bug RCE chains. 3 months into ~80 minutes, $6,700 in bounties. Go jailbreak your G1s!! boschko.ca/g1-ble-rce/

My @x33fcon talk about Credential Relay Phishing is finally out! Watch me struggle through the live Google phishing demo, a day after the pirate ship party, which deprived me of my last few brain cells. 😜 Wrath of demo gods and AI lulz included. 🥳 piped.video/dNtqZJmtIpw

📢 The next edition of my offensive Entra ID security class just opened up for registration! November 16-19 in The Hague, Netherlands. In this 4 day class we deep dive into Entra ID security, tokens, oauth2 and Conditional Access. More info and reg: events.outsidersecurity.nl/e…

THIS HAS HAPPENED TO ME AS WELL! Even worse some notifications popped up randomly then when I check there are no new messages then weeks later it shows up????

hmmm... Given: user has energy Assume: user has energy Therefore: user has energy like user has energy