"When day comes, we step out of the shade, aflame and unafraid.
The new dawn blooms as we free it.
For there is always light,
if only we’re brave enough to see it.
If only we’re brave enough to be it."

👇👇👇

Cairn: github.com/oritera/Cairn
CyberStrike: github.com/CyberStrikeus/…
PentAGI: github.com/vxcontrol/pent…
CyberStrikeAI: github.com/AIPentest/Cybe…
PentestGPT: github.com/GreyDGL/Pentes…
PentestAgent: github.com/GH05TCREW/pent…
AutoPentester: github.com/YasodGinige/Au…
VulnBot: github.com/KHenryAegis/Vu…
RedAmon: github.com/samugit83/reda…
MAPTA: github.com/arthurgervais/…
Strix: github.com/usestrix/strix
Shannon: github.com/KeygraphHQ/sha…
BugTraceAI: github.com/BugTraceAI/Bug…
Nebula: github.com/BerylliumSec/n…
hackingBuddyGPT: github.com/IPA-Lab/Hackin…
HexStrike AI: github.com/0x4m4/hexstrik…
CAI, now archived: github.com/aliasrobotics/…

Only in Australia! 😻

Australian officials have issued a reminder to shut your car doors after one wombat helped himself to several passenger seats. The notice followed complaints from visitors at a popular picnic area, where the same wombat reportedly kept climbing into parked cars while people up lunch.

At first, staff thought they were receiving several calls about one incident. Then they realized the cars were different. The passenger wasn’t.

One couple waited nearly an hour before he climbed out. Another visitor said he settled into the seat before she’d even finished putting her things in the boot. Officials asked visitors to keep their doors closed and contact staff if they found an unexpected occupant.

After the photos spread online, a park spokesperson clarified the situation. “He hasn’t been abandoned. He lives here. Please stop calling to say someone’s left their wombat in a car.”

A search-and-rescue coordinator told me the most valuable feature on an iPhone isn’t the camera, the battery, or even the phone itself.

It’s the emergency features most people set up once, incorrectly — or never set up at all.

He’s seen hikers lost with no cell signal, drivers in crashes nobody witnessed, and older adults who fell at home with no one around. In many of those cases, the difference between a quick rescue and a long night came down to whether one setting was turned on.

He doesn’t sell iPhones. He doesn’t work for Apple. He doesn’t care which phone you carry.

He coordinates rescues, trains volunteers, and sees the same gaps over and over.

His average finding: no Medical ID, no emergency contacts, no idea how satellite SOS works.

He told me something most iPhone users have never considered:

“Your iPhone is not just a phone. It is a beacon, a medical card, and a lifeline — but only if you set it up before the emergency happens. Nobody configures these features while they are lying on a trail with a broken ankle.”

He said the entire “my phone can’t help me off the grid” problem is built on a few settings that take less than ten minutes to fix.

“There’s no magic. There’s no subscription you need. There’s no need to buy the newest iPhone for everything. You need Medical ID, emergency contacts, and a basic understanding of what your phone can and cannot do.”

He showed me 9 things most people get wrong about Apple’s emergency features — and the setup he recommends to every hiker, parent, and solo traveler.

Here’s the full playbook: 🧵👇

Sign-up for this is open until 11 November 2026.

Your country might be great but does it follow Australia’s lead by colour-coordinating its currency with the nation’s favourite snack foods?

So I'm officially on the market looking for my next role.

Honestly I'm looking to help train the next generation, PKI engineering, network engineering, security shenanigans, offensive work, or if you have a password cracking role I'm open.

And just like that, #DEFCON34 is over! Thank you to everyone who made Blue Team Village happen!🛡️

But we're not done yet! We want to make the village even better next year, and we need your feedback.

👉 forms.gle/qBk7tXAth1TGfg…

we've been shipping pretty hard on disclose.io. lookup.disclose.io resolves any asset - domain, ip, package, repo, container, hardware, browser extension - to its real (or best) security contact, vdp, or bug bounty program. and now it drops straight into your p cli tool, caido and burp plugins, a json api, and a hosted mcp server.

meanwhile directory.disclose.io is grading disclosure programs against the disclose.io maturity model, so "they have a policy" becomes "here's how mature it actually is."

Our Call for Volunteer for DEF CON is still open. If you are still thinking whether you should volunteer, go for it! Sign up. forms.gle/2s8t8tc3qS8mFK…

Together, we can all make DEF CON an amazing conference for everyone!

Attacker tradecraft has evolved way past "check the URL."

Here are the 5 most common techniques we're seeing. 👇

I just wanted to update my resume. Instead, I accidentally proved how a multi-billion-dollar AI tool hallucinates a glass ceiling for women.

I changed a single variable: My name.

Here is what happened when "Jennifer" became "Jeff."

Today I learned so much from @eastsidemccarty about how to hunt for supply chain attacks. Thank you so much for sharing your knowledge. Thanks @BSidesMelbourne for organising the different training sessions for everyone to learn from each other.

All EZ Tools have been updated! New version is 2026.5.0 across the board.

Nuget updates, control updates, bug fixes and general refreshing of everything.

Enjoy!!

#dfir

This local Wolfdog joined an Olympic ski event and triggered the finish-line camera. This is Nazgul. He snuck into a cross-country skiing sprint this morning and raced the homestretch with some competitors before being escorted home. 14/10 someone get him a medal

🚨Call for Training is OPEN! 🚨
Training more than just teaching a topic, it’s a way to stretch ourselves, learn something new, and help others reach new goals by sharing our knowledge. That’s the magic of the BSides community.

👉 Submit here: bsidesmelbourne.com/2026-cfp.html

🥁 EXCITING NEWS - Our CFx's are now open 🎉
- Call for Papers
- Call for Training
- Call for Villages

Visit our website for details - bsidesmelbourne.com

If you are stuck, or would like to run your idea past one of the committee members, please feel free to reach out.

Exciting news! 👏 BSides Melbourne crew kicked off 2026 planning last week. There have been a lot of questions regarding dates, Call for Papers, Training & Villages, Volunteers, Tickets and many other exciting events.

Happy Monday 🎉
#BSidesMelb2026

Malware Noob Month Post #7

There are different types of reverse engineering. Each play a critical role in malware reverse engineering and detection engineering.

The most widely known is what I would define as "standard" reverse engineering. This is attaching a debugger to a running process (i.e. x64dbg) and watching what the program does as it's running.

Another common method for reverse engineer is "static reverse engineering". Static reverse engineering is looking at the program while it's "on disk", in other words, staring at it while it's not running. People usually use Ida or Ghidra.

A third method for reverse engineering is "emulation", "sandboxing", or "triaging". They all kind of mean the same thing, all maybe a little different if you want to get really nitty gritty on the details. This type of reverse engineering is detonating (running) the program in a virtual machine (or special environment) and recording everything that the program does.

Each method listed has a strength and weakness.

Emulation is really good at doing the job quick and dirty. If you use emulation tool suites, like Triage or AppAnyRun, you can very quickly get a high level overview of what the malware is doing, where it's connecting to, etc. Additionally, these tool suites usually have built in rules to automatically detect the malware family (if applicable). However, these tool suites cannot detect everything and it's possible for malware to fall between the cracks and evade emulation.

Static reverse engineering, using Ida or Ghidra, is also really good. You can review the malware before it tries performing evasive actions. The primary issue with this method however is that if the malware obfuscates itself on-disk (encryption, it's packed, etc) this method can challenging.

"Standard" reverse engineering is probably the most difficult form of reverse engineering. It requires you to have a good understanding of Assembly. However, this method is the most superior. Once you're comfortable with assembly and the debugger you're using, it makes it extremely difficult for malware to "evade" the reverse engineer (some non-noobs probably feel tempted to mention LLVMs, don't).

Regardless, it is impossible for malware to evade all of these methods. It is possible to develop malware that makes it challenging to reverse engineer, but ultimately a dedicated (or skilled) reverse engineer will figure it out.

Malware authors must constantly evolve their malware code (update it, use new methods, introduce additional layers of complexity) to hinder reverse engineers. If they do not do this, reverse engineers will have developed methods to detect the malware and it's basically game over.

Large scale malware campaigns are constantly changing the malware code base, delivery mechanism, etc. to ensure the malware can "survive". Likewise, anti-malware companies and reverse engineers must constantly monitor malware campaigns, keep reverse engineering them, and updating their strategies to detect them.

It's a game of cat and mouse.

Malware Noob Month Post #8

What is "undetectable malware"?

Well, it doesn't really exist. Kind of. There has been discussions of governments (United States, Russia, China) which had malware active for long durations of time and not getting caught. For example, Russia's "Woodchipper" was undetected for years.

The secret is "tailored" malware.

Malware campaigns are caught and tracked all the time because Threat Actors want their malware on as many computers as possible. The more "noise" these groups make, the more machines they infect, the more anti-malware companies can see.

However, specially crafted malware, designed for unique systems, unique environments, with a very specific goal in mind, can go undetected for A LONG time. Once a malicious program has made its way onto the target... And it's nowhere else in the world... How can anyone know it exists?

In these scenarios the chance of the malware being detected boils down to luck and/or fate.

For example, the United States government malware "Stuxnet", which targeted Nuclear Centrifuges, was caught by complete accident. That is a long story I highly recommend you read (or maybe look it up on YouTube, maybe a video exists about it)

In summary, the more machines infected the more likely you'll be detected.