Spanky

Spanky

@spankowitz.bsky.social

I like threat intel, purple team, and turtles.

160 followers759 following47 posts

Spanky reposted

Scary "Grampus" Jerry 👻
@jerry.infosec.exchange.ap.brid.gy

Please be sure you don’t take your eye off the big node.js/brotli vulnerability while php2shell was sucking all the air from the room. https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497

aikido.devNode2Shell Brotli vuln (CVE-2026-111497) evolves to HTTP2Shell, as libraries and apps using HTTP are affected.The Brotli flaw behind Node2Shell (CVE-2026-111497) affects many libraries and applications using HTTP with Brotli or brotlicffi installed. Check your versions and upgrade to the fix.

Spanky reposted

Ian Campbell
@neurovagrant.bsky.social

Has anyone written a "Who's on first?" routine about DNS yet? "What're you looking at?" "A record." "Yes I know it's a record, what is it?" "A record that seems to be a C2 domain." "Okay whatever, now you're just making up things with letters and numbers. Where is this C2 stuff?"

Spanky reposted

SpecterOps
@specterops.io

Can this role read that bucket?" and "Can it decrypt that key?" aren't the same question. @n0pe-sled.bsky.social's latest blog post introduces AWSHound, free, self-hosted, turns AWS Orgs into real BloodHound CE attack paths. Check it out: https://ghst.ly/4g4EJm9

ghst.lyAWSHound: An OpenSource AWS OpenGraph CollectorSee how AWSHound maps AWS attack paths into BloodHound, evaluating IAM policies, SCPs, and boundaries to reveal real privilege escalation.
Spanky
@spankowitz.bsky.social

Roughly 70% of hosts running ICS devices and services globally are consistently found on consumer and mobile networks for the last 2.5 years.

Censys@censys.bsky.social

Every year, Censys scans the Internet and publishes what we find. This year's State of the Internet Report is almost here. The full report drops this fall. https://bit.ly/44JNRGq

Spanky reposted

Binary Ninja
@binary.ninja

Celebrate 10 years of Binary Ninja! For the first time ever, we’re offering a 35% discount! Join us for 10 full days of giveaways including licenses, merch, and more. Join in on the celebration: binary.ninja/10years

Spanky reposted

Joe Slowik
@pylos.co

I will hold an online session of the Paralus LLC Applied #CyberThreatIntelligence course from 27-31 July, 1400-1600 US Eastern/2000-2200 Central European time. Focused, to the point training, two hours per day for five days. Register your interest at the following form: forms.gle/M1LgQTomJGek...

forms.gleParalus LLC: Applied Threat IntelligenceHello and thank you for your interest in a workshop focusing on Applied Threat Intelligence! Scheduling: 27-31 July 2026 (Five Days) 1400-1600 US Eastern/2000-2200 Central European (Two Hours/Day) C...

Spanky reposted

Jason Koebler
@jasonkoebler.bsky.social

A developer made a browser extension called "Knockoff" that shows what a wasteland Amazon truly is by filtering out brands like "GODONLIF" "EHEYCIGA," ROTTOGOON," and sponsored products. Useful and illustrative even if you don't use Amazon www.404media.co/knockoff-bro...

404media.co'Knockoff' Browser Extension Hides Sketchy Brands on Amazon"Sorry to brands like WNPETHOME, EHEYCIGA, YXYL, LU&MN, JOYIN, TOMY, GODONLIF, YOOJEE, LINGTENG, LANEIGE, VISCOO, BIODANCE, COOFANDY, BALENNZ, TOSY, and LUENX."

Spanky reposted

Molly White
@molly.wiki

It does not fill me with optimism about the general quality or completeness of this disclosure that it gives the wrong name for the firm via which Trump made $635 million last year.

Molly White@molly.wiki

Trump’s most recent financial disclosure reveals more than $1.4 billion in income from his crypto-related ventures alone, and even that’s an incomplete picture.

citationneeded.newsTrump’s $1.4 billion crypto disclosureThe White House insists there’s no conflict of interest as Trump reports $1.4 billion in income from an industry he’s deregulated.
Spanky
@spankowitz.bsky.social

No Three Buddy Problem this week. My disappointment is immeasurable. What am I supposed to listen to on my dog walkies?!?? Oh right, Between 2 Nerds. 🙌

Spanky reposted

The Citizen Lab
@citizenlab.ca

1/ NEW RESEARCH: We find that Russian authorities used Cellebrite to gain access to activist Andrey Pivovarov’s phone. Full brief: citizenlab.ca/research/rus...

citizenlab.caRussia Breaks Into Human Rights Activist's Phone With Cellebrite - The Citizen LabWe analyzed Russian activist Andrey Pivovarov’s phone, finding that Russian authorities used forensic extraction tools made by Cellebrite to gain access to his device. A document prepared by Russian a...

Spanky reposted

CNN
@cnn.com

A newly discovered spider species from Australia uses its silk to craft a spring-loaded, cone-shaped death trap, which catapults its prey into the spider’s main web. https://cnn.it/4w3n6Ip

Spanky reposted

JHunt🛡️
@jhuntinfosec.com

Thanks @halvarflake.bsky.social -- it's so good / must read (and it's not even finished yet!)

halvarflake.bsky.social@halvarflake.bsky.social

In the last years, I spent some of my scarce free time writing up what I had learnt starting and running two companies, zynamics and optimyze The article is still work-in-progress, but I thought it's best to publish it now and iterate in public: thomasdullien.github.io/guides/entre...

thomasdullien.github.ioHalvar’s Guide to Entrepreneurship – Thomas Dullien / Halvar FlakeThomas Dullien’s guide to software and SaaS B2B entrepreneurship.

Spanky reposted

Lorenzo Franceschi-Bicchierai
@lorenzofb.bsky.social

NEW: Google is rolling out a new feature for Android called Intrusion Logging, designed specifically to help researchers investigate attacks done with spyware and forensic tools. Amnesty says this is “a fundamental shift in the amount and quality of forensic data available on Android devices.”

techcrunch.comGoogle launches new Android security feature to help uncover spyware attacks | TechCrunchIntrusion Logging is a new part of Android’s Advanced Protection Mode, which aims to help protect human rights activists, journalists, and dissidents from government spyware attack and law enforcement...

Spanky reposted

SpecterOps
@specterops.io

Create a folder called (calc). Shift+Right click « Open PowerShell Window here » and boom you have a command injection. @podalirius.bsky.social found two command injection vulns hiding in Windows Explorer's built-in context menus, both that went undetected for 9 years. https://ghst.ly/42ImlI6

specterops.ioShift Happens - Uncovering Two Built-in Command Injections in Windows Context MenusTwo long-standing Windows Explorer vulnerabilities lets attackers execute arbitrary PowerShell commands using crafted folder names, affecting Windows 10 and 11 since 2017.

Spanky reposted

Antisyphon Training - Powered by BHIS
@antisyphontraining.bsky.social

We’re excited to have David as a keynote speaker at our free #ThreatHunting Summit! Join David as he invites us to re‑examine the role of the human in threat hunting - www.antisyphontraining.com/event/threat...

antisyphontraining.comThreat Hunting Summit Keynote: Is It Time to Embrace Automated Threat Hunting? - Antisyphon TrainingJoin David Bianco, cybersecurity researcher with Cisco’s SURGe team, as together we re-examine the role of the human in threat hunting.
David J. Bianco@davidjbianco.bsky.social

I'm excited to keynote the Antisyphon #ThreatHunting Summit this year. Why? Because I get to revisit the very definition of hunting I proposed 10 years ago! "Is It Time to Embrace Automated Threat Hunting?" Read more & register at the link below: www.antisyphontraining.com/event/threat...

antisyphontraining.comThreat Hunting Summit Keynote: Is It Time to Embrace Automated Threat Hunting? - Antisyphon TrainingJoin David Bianco, cybersecurity researcher with Cisco’s SURGe team, as together we re-examine the role of the human in threat hunting.