To teach a lesson, After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought phpbleed.com before wiz could pull the same stunt again. A big budget can buy a domain. It shouldn't buy someone else's research credit. If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve. Hack the planet. Credit the researchers.

We published our Offensive Azure Security Cheatsheet 🚀🌩️ Built from commands, notes, and practical knowledge gathered while creating Breaching Azure and Breaching Azure Advanced courses, now shared with the community for quick reference. Use it, share it, and PR your best tips 👇 github.com/cloudbreach/Cheat… #CloudBreach #AzureSecurity #CloudSecurity #OffensiveSecurity #RedTeam #PurpleTeam #MicrosoftAzure #EntraID #Microsoft365 #CyberSecurity #CloudPentesting #Pentesting #ThreatDetection #SecurityResearch #InfoSec #cheatsheet #BreachingAzure

github.com/n00py/Outpacket Maybe useful

We've been tricked, again. Many of the thousands of bugs and vulnerabilities Mythos found are in older software are impossible to exploit. And the severe zero-day reports rely on just 198 manual reviews tomshardware.com/tech-indust…

. @AnthropicAI has stated previously that they want to work with the security research community. Other than the fellow program (a paid, exclusive program), where is the sign-up to prove you are a legitimate researcher, verify your identity, and report novel capabilities and risks? Refusals have been killing some of my researcher friends this week @AnthropicAI 😢

Whoopsi: CVE-2026-20963 is now UNAUTHENTICATED!!!! Patch ASAP. msrc.microsoft.com/update-gu… Updated the scanner: github.com/LuemmelSec/Pentes…

Tenant enumeration is back - and it never really left. Attackers are once again using tenant discovery as the first step to breach cloud environments. If you’re relying on assumptions instead of validation, you’re already behind. Juan Pablo Gomez Postigo breaks down: • Why tenant enumeration matters now • How attackers exploit it in real-world campaigns • What security teams should be testing continuously Read here hubs.la/Q03Yd4c20 #CloudSecurity #OffensiveSecurity #Pentesting #AttackSurface

HTML tag names must start with an ASCII letter. If they don’t… jsfiddle.net/4v6xksaf/ #xss

If Insecure Deserialization still confuses you, this resource list will fix that👾 - book.hacktricks.xyz/pentesti… - greyshell.github.io/blog/201… - snyk.io/blog/preventing-inse… - acunetix.com/blog/articles/i… - portswigger.net/web-security… - hacksplaining.com/exercises/…

Here's a neat trick first.html <a href = "second.html">click me</a> <script> window.name = "booyakasha" </script> second.html <script> window.open("victim.com/xss.html", "booyakasha") </script> explanation in comments

Discord client for the terminal

Update on the NTLM reflection attack: ctjf discovered that SMB signing enforcement does NOT protect against the NTLM reflection attack🛡 Cross-protocol relaying is still possible, even with mitigations in place. Only patching your system fully mitigates the vulnerability! 1/4🧵

I left a server online with VNC wide open to see how it would be interacted with. This is one of the more interesting interactions:

Every once in a while you have to remind yourself that you are capable of violent, unrelenting, forceful action.

This is helpful. I ran into issues with KDS root key issues over the weekend playing with #BadSuccessor and ended up doing this.

Late Friday blog drop! @HuntressLabs had some fun with #DefendNot by @es3n1n 😈 This tool shows that defense evasion isn’t just about avoiding tools—it’s about bending them. Here’s how attackers turn your security products into blind spots. 🛡️ huntress.com/blog/defendnot-…

Took @akamai_research's script for BadSuccessor and improved it a bit. - runs from non domain joined systems - works in forests - prints the rights each entity has on a OU - pre-flight check if 2025 DCs are present - code changes here and there github.com/LuemmelSec/Pentes…

Next time you are unsure what to do, and I think this applies to anything in life, ask yourself, "what could I do in the situation to ensure that I fail?" Then, do the exact opposite of those things. We can often envision the negative much easier than the positive so use that.