HD Moore

Well that's a first for me: an NTP Pool server sent a wildly wrong time, and systemd-timesyncd jumped the system time on Trastevere first forward 0.82s and then *backwards* 0.76s. Thankfully Sunlight failed safe, crashed (which fired alerts), and recovered once the clock caught up. WTF?

Python's certifi package provides the trusted root CAs for a huge portion of the Python ecosystem. It's also a great example of how complex dependencies can get. Ultimately, these certs are sourced from Mozilla, but they go through 5 hops to get there: gist.github.com/hdm/2e5ebbff...

turns out eMudhra - which just got out of the cert business altogether - isn't just a problem for Indian customers; the G3 root that signed the dodgy keys, that Firefox already distrusts, that Google will distrust on the 27th is what a bunch of US university certs chain up to

If you're looking for the most detailed AND *entertaining* way to read about the php2shell bugs, the Calif post is epic: calif.io/php2shell/

The PHP foundation announced a security release tomorrow (Oct 21) addressing 2 critical PHP vulns that could lead to RCE. Find your PHP instances using runZero: www.runzero.com/blog/php/ For latest developments, tune into runZero Hour with our research team tomorrow at 1pm ET (🔗 in 🧵)

arstechnica.com/security/202... The private keys for these certs are literally the numbers 4, 56, 66, 115, 155, 156, 230, and 237 (life imitates XKCD, again).

CISA has confirmed two bugs in Citrix NetScaler are being exploited in active cyberattacks, CVE-2026-88771 and CVE-2026-88772, in a rare weekend drop of security news. www.cisa.gov/known-exploi... Citrix has a support base article, confirming exploitation. support.citrix.com/support-home...

Hello Austin Gophers! This month's ATX Golang meetup is *tonight* September 9th, at STATION Austin, from 6:30-8:30. Note that we'll be downstairs (first floor) in Wall-E instead of Antones (16th) tonight. www.meetup.com/atxgolang/ev...

The best part of BSidesLV/BlackHat/DEFCON is getting to meet the people you admire. I got a chance to nerd out with Thai Duong of calif.io today (photo proof!). Thai and team just posted their latest work - 3 remote exploits in FreeBSD: blog.calif.io/p/the-taking...

BMCs make such good targets because they live in the org gap nobody owns. not quite the server team, not the network team, not security, so they sit on firmware nobody has touched in years. the access is almost a side effect of the ownership hole.

Hello Las Vegas (and hackers following along at home)! I'm excited to share the first batch of our Out-of-Band / Baseboard Management Controller research at Black Hat USA today and DEFCON 34 this weekend. Read an exclusive by Ars Technica at: arstechnica.com/security/202...

Skipping Black Hat and DEFCON this year? Consider presenting at BSides Hanoi instead. Now in its second year, the conference takes place on August 5th, 2026, and a few more talk slots are still open - but the submission deadline is today. Apply here: www.bsideshanoi.net/en/call-for-...

We know vulnerability reports are not like ordinary issues. But why? It comes down to needing the scarce insight and temporary confidentiality to protect users. However, now that LLMs can find more or less the same bugs for everyone, none of that matters, and vuln reports are not special anymore.

My favorite bugs are where the vendor doesn't consider it a vulnerability: How a USB-connected speaker can infect a PC without ever being touched: arstechnica.com/security/202...

ATX Go is TONIGHT (a week early this month): Hey gophers! Join us Wednesday (May 6th, today), 6:30–8:30pm at Station Austin (ie. Capital Factory) 16th floor, in "Antones" for our monthly meetup. You know the drill: 🍕 pizza, 🍻 beer, and a few short talks on Go. www.meetup.com/atxgolang/ev...

ATX Go is a week early this month, tomorrow night! Hey gophers! Join us Wednesday, 6:30–8:30pm at Station Austin (ie. Capital Factory) 16th floor, in "Antones" for our monthly meetup. You know the drill: 🍕 pizza, 🍻 beer, and a few short talks on Go: www.meetup.com/atxgolang/ev...

🚨 New runZero 4.9: We got you, defenders! 📈 Interactive attack path mapping 👁️ Multi-homed detection 🗺️ 2D/3D topology maps 🧠 Deep OT intel + field-level discovery ✅ Protocol exposures 🔥 Risk prioritization 💻 UI/UX enhancements 👉️ Release details at: www.runzero.com/blog/runzero... #OTsecurity

Tom Ptacek posted a great writeup titled "Vulnerability Research Is Cooked", covering the state of vulndev and its rapidly accelerating future: sockpuppet.org/blog/2026/03...

Up next on #runZeroDay at 12:30 PM PT – Force multiplied: Community-powered vuln detection. Our guest is Rishiraj Sharma from ProjectDiscovery. Don’t miss a minute! Watch it live at: www.runzero.com/rsac-live-20...

www.linkedin.com/posts/kylecg...

Joseph Menn, renowned journalist & author of "The Cult of the Dead Cow," joins us for a special book signing event at RSAC! runZero and Mallory are thrilled to co-host a private book signing with renowned investigative journalist Joseph Menn during RSA: www.runzero.com/joseph-menn-...

Join author Caroline Wong for the release of "The AI Cybersecurity Handbook" at RSAC! runZero and Mallory are thrilled to co-host a private book signing with the AI cybersecurity strategist Caroline Wong during RSA Conference 2026! www.runzero.com/caroline-won...

#RSAC session today at 10:50 AM PT – Preparing for AI Vulnerability Exploitation: Preventing Cataclysm. 👀 Don’t miss this panel featuring @runzero.com’s CEO @hdm.io, @argv.bsky.social (Google), and @gadievron.bsky.social (Knostic). 🗓️ TODAY at 10:50 AM PT

AI vulnerability discovery is here. Don’t miss the #RSAC 2026 session-Preparing for AI Vulnerability Exploitation: Preventing Cataclysm-featuring our CEO @hdm.io, Google’s @argv.bsky.social & Knostic’s @gadievron.bsky.social. 🗓️ Mon, Mar 23 @ 10:50 AM PT path.rsaconference.com/flow/rsac/us...

runZero Hour 0x1C is live NOW: www.youtube.com/live/EF633eU...

"The @phrack CFP with demoscene cracktro is live. Turn up the volume and enjoy the awesome stylings of @PiotrBania with some hopefully inspiring text from phrack staff :)" phrack.org (via @richinseattle)

The Phrack Staff is on the latest episode of the DarknetDiaries episode! darknetdiaries.com/episode/170/

Huh -- this week, the FBI uploaded 35 pages on Phrack to its FOIA Library vault.fbi.gov/phrack/phrac...

I spy a Phrack gnome in the latest FIRE #ansi pack! Thanks @nail7.bsky.social, it's so cool!

New AirSnitch attack breaks Wi-Fi encryption in homes, offices, and enterprises: arstechnica.com/security/202... AirSnitch resets WiFi security back to the bad-old-days of ARP spoofing and trivial MITM.

Hello Austin Go hackers! Tonight (2026-02-11) is our next ATX Golang meetup, located in Station Austin (aka Capital Factory ). We will have pizza, drinks, and various short talks and discussions related to the Go ecosystem: www.meetup.com/atxgolang/ev...

runZero users get a new feature today (including Community Edition) - recurring internet speed tests for all deployed Explorers! This (very optional) capability lets you identify backhaul/connectivity issues for sites that you can't physically get to: www.runzero.com/blog/interne...

It's time for our first ATX Gopher meetup of the year! If you are in Austin and write Go code (or would like to start), please join us at 6:30pm at Station Austin (co-located with Capital Factory). Charles and I will be providing pizza and drinks as usual: www.meetup.com/atxgolang/ev...

🎧 We collected some of our favorite podcasts of 2025 featuring @hdm.io for you to enjoy. 📺 So go ahead and get yourself some coffee (or hot cocoa!) & watch here: www.runzero.com/blog/fun-pod...

Exposure is everywhere now — cloud, SaaS, IoT, shadow IT, unmanaged vendors. Replay the SC Media webcast with @sawaba.bsky.social, @hdm.io & @todb.hugesuccess.org to learn why continuous discovery matters & how attackers exploit what you can’t see. 👉 www.runzero.com/resources/as...

🎙️ The Hacker's Cache: Kyser Clark talks with Metasploit creator @hdm.io on why CVEs won’t save you in 2025. They get into non-CVE vulns, hidden SSH risks, attacker innovation, AI’s impact, and why exposing version numbers can improve security. 👉 www.runzero.com/resources/wh...

On the latest Risky Biz, @patrick.risky.biz, and @hdm.io talk about visualizing the attack surface with runZeroHound, why you can't synthesize what runZero delivers, & how we are leveraging AI to help predict risks and scan smarter. 📺 Watch the full interview: www.runzero.com/resources/ri...

📺 Live webcast Dec 3 with SC Media! Your attack surface doesn’t end at the firewall. Join @hdm.io, @todb.hugesuccess.org, and @sawaba.bsky.social to learn how continuous discovery + attack path mapping keeps you ahead. 👉 www.scworld.com/cybercast/at...

🧭 Cybersecurity’s old rules are cracking. In his SecTor keynote, @hdm.io breaks down the rules that shaped the 2000s: what survived, what failed us, and the new rules we’ll need next. Missed it? 👀 Watch the keynote: www.runzero.com/resources/on...

The CFP for SO-CON 2026 closes in about 12 hours (11:59 2025-11-15)! Have a cool approach to attack path management (or awesome connector for BloodHound OpenGraph)? Submit ASAP: specterops.io/so-con/

The clever folks at Grumpy Goose Labs have published even more ways to identify unauthorized IP KVMs across your environment, with some great memes to boot! Be KVM, Do Fraud - blog.grumpygoose.io/be-kvm-do-fr...

Your attack surface is sprawling & full of blind spots. 🎥 On Dec 3 at 2 PM ET, SC Media brings together @hdm.io, @todb.hugesuccess.org, & @sawaba.bsky.social to reveal how to operationalize attack surface management without losing your mind. 👉 Register here: www.scworld.com/cybercast/at...

runZero Hour is one week away! Join us on Nov 19: @todb.hugesuccess.org, Rob King, @hdm.io, and Jared Atkinson ( CTO @specterops.io ) break down attacker movement, graph analysis, runZeroHound, and this month’s top vulnerabilities. 👉 Register here: www.runzero.com/research/run...

🚨Your secure enclave? More of a suggestion than a guarantee. If you were expecting TEEs to provide private computing in untrusted data centers, this latest article by @arstechnica.com featuring our Founder & CEO @hdm.io is a must-read: arstechnica.com/security/202...

Identify insecure TLS services with the enhanced runZero Certificate Inventory: www.runzero.com/blog/identif...

🎃 Happy Halloween! The end of #CybersecurityAwarenessMonth means it's time for our EoL-palooza grand finale! The scariest find? A surge of End-of-Life Proxmox systems... software zombies attackers feast on. 🧟‍♂️ @hdm.io has the guide to hunt them down: www.runzero.com/blog/managin...

Austin Hackers Anonymous (AHA) is TONIGHT (2025-10-30) takeonme.org - Have some zero-day to share? AHA is an official CNA and will issue CVEs for vulnerabilities disclosed at the meeting. I'm planning to demo more SSHamble.com findings along with BloodHound OpenGraph stuff. See yall soon!

Just like chocolate and peanut butter, runZero and BloodHound are an amazing combination. Today we are introducing runZeroHound - an open source toolkit for bringing runZero Asset Inventory data into BloodHound attack graphs: www.runzero.com/blog/introdu...

It's the spooky season, so several of my ebooks are on sale. 💀🎃🪦 Aloha from Hell appears to be $2.99 everywhere, and The Secrets of Insects is $6.99. Dead Set and King Bullet are $1.99 each on Amazon. US only