ZeroBS_GmbH @zero_B_S

Microsoft issues emergency fix for HTTP/2 Bomb affecting IIS: msrc.microsoft.com/update-guide/e…

x.com/zero_B_S/statu…

ZeroBS_GmbH @zero_B_S

a day ago

A few days ago, we tested the HTTP/2 bomb attack on F5 BigIP (see comment for credits) By default, the system is not vulnerable, but it can be attacked if you increase the number of headers and h2-streams to the max. community.f5.com/kb/communityar…

1 0 0 81 1

@calif_io just released a new attack-vector against HTTP/2, and we put it into test: this_is_fine_meme.jpg blog.kybervandals.com/one-http-2-bom…

credits and bigup to Daniel Wulf from F5 Community community.f5.com/users/daniel_w…

A few days ago, we tested the HTTP/2 bomb attack on F5 BigIP (see comment for credits) By default, the system is not vulnerable, but it can be attacked if you increase the number of headers and h2-streams to the max. community.f5.com/kb/communityar…

🚀Introducing SO-CRATES 1.0 — Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus! SO-CRATES is a single container image for analyzing pcap files, log files, and binary files. It was formerly known as OhMyPCAP. Here's what you can do with SO-CRATES: ✅analyze pcap files and then review Suricata alerts, metadata, and extracted files ✅import log files and then review Sigma alerts and the original log entries ✅import binary files and then review YARA matches and file metadata All of this runs in a single Docker/Podman container — perfect for air-gapped environments, malware analysis, incident response, threat hunting, forensics & teaching. Who’s trying it out? Drop a ❤️ and reply with your main use case! #DFIR #Cybersecurity #BlueTeam #ThreatHunting #Suricata #YARA #Sigma @Suricata_IDS @lennyzeltser @chrissanders88 @sansforensics @TomLawrenceTech

keyboard_arrow_left Previous keyboard_arrow_right Next

We'd love to be proven wrong here. As a red team, few things are more exciting than a reliable nginx RCE. For some context: we discovered at least two nginx 0-days and successfully weaponized one into a full RCE, bypassing ASLR with no external dependencies. We were thrilled, until we realized both bugs appear to require highly unusual nginx configs that we've yet to encounter in the wild. That's why we built ngxray: github.com/califio/ngxray. After analyzing 35,000+ nginx configurations from GitHub, we found exactly one instance vulnerable to nginx-rift, in an abandoned project. We found none vulnerable to nginx-poolslip. Users should absolutely patch. But from a red team perspective, these exploits have been worthless. We've never encountered a target where they'd have been useful. If anyone has evidence that these configs are common in real-world deployments, we'd like to see it. Everybody wants their five minutes of Twitter fame. That's fine. But extraordinary claims still require extraordinary evidence.

Joris Ignoul @IgnoulJoris

3 days ago

@y198_nt Very nice blog! You think the conclusion from Calif regarding vulnerable configs is incorrect? (blog.calif.io/p/needle-in-a-…)

0 0 10 21K 8

@lennyzeltser Terraform FTW

The world’s largest residential proxy network runs on consent, TLS and vibes. The TV is always watching and apparently it is also available for contract work in surveillance or data acquisition? Bright Data sells access to a residential proxy network, the kind customers use to route requests through real home IP addresses instead of datacenter IPs that Cloudflare, DataDome and HUMAN are trained to block. The supply comes from an SDK embedded in consumer apps. So: CTV games, messengers, mobile apps and screensavers. With consent somewhere upstream, the device becomes an exit node. The TV is perfect for this job. It is plugged in, on WiFi, often unattended and barely supervised. It also asks for consent through a privacy policy and a remote-control UI, which is one way to make “informed choice” look like an endurance sport. One config flag tells the SDK to ignore whether the screen is on. Another tells it to ignore whether the user is on a call. In this economy, watching TV counts as downtime. blog.includesecurity.com/2026/06/the-sm…

Sovereignty Is Engineered, Not Procured #opensource #europe #palantir #cybersecurity foo.be/2026/06/Sovere…

For 19 years, GPS satellites have secretly broadcast a “numbers station” in their public signals. We decoded 12M messages: a 2011 flash where 31 of 32 satellites flipped in hours, “ghost” substrings repeating years apart, and a “TEXT” prefix spreading now. lsc-pagepro.mydigitalpublication.com/publication/?i…

@calif_io tyvm for that excellent writeup and pocs. we put it into use and it is working like charme blog.kybervandals.com/one-http-2-bom…

Autschn x.com/calif_io/statu…

Calif @calif_io

a week ago

Introducing HTTP/2 Bomb: a remote DoS in nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora. A single client pins 32GB of server memory in 10s. Found by Codex. Blog post: blog.calif.io/p/codex-discov… PoCs: github.com/califio/public…

25 439 2K 184K 1K

Testing Post Quantum Crypto (PQC) Implementations blog.kybervandals.com/testing-post-q… #ddos

@deadvolvo Nice!

As promised, here is paper part 2 of 2 attacking Azure Front Door issues for various bugs. Smuggling Through the Front Door... Achieving 0-Click XSS with Cache Poisoning malicious.group/smuggling-thro…

The OG of cyber investigations, @briankrebs, just published a follow-up to our investigation into the Stark Industries hosting network. His piece adds new detail, including MIRhosting’s first official response. In his May 2024 deep-dive, Krebs first put Stark Industries on the map. We built on his work, and two years later, with last week’s arrests by Dutch authorities, the Stark saga is moving into new territory: what happens to the many companies across Europe that hosted the thinly disguised, rebranded Stark? Our original investigation (in English): volkskrant.nl/binnenland/how… Brian’s piece: krebsonsecurity.com/2026/05/nether…

Dutch authorities have arrested two men and seized over 800 servers in a major crackdown on infrastructure used to support Russian-linked cyberattacks, influence operations, and disinformation in Europe. The operation targeted the persons behind MIRhosting and WorkTitans BV / the[.]hosting, who took over hosting assets from the EU-sanctioned Stark Industries Solutions network after earlier sanctions on its previous operators (PQHosting / Neculiti brothers). Read the full story behind the takedown in this article by @moltke : How a consultant and a concert pianist from the Netherlands aided pro-Russian hackers" volkskrant.nl/binnenland/how… There is also a Story about it by @briankrebs Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks krebsonsecurity.com/2026/05/nether… volkskrant.nl/binnenland/how… #ddos #takedown #noname057

In our "A Silent Shift: The Return of Server-Based Botnets" - report we examine the resurgence of server-based attacker botnets, explain what they are, and discuss why they can pose a threat to established defense mechanisms. blog.kybervandals.com/a-silent-shift…

More new TLD insights on Radar! New TLD nameserver performance widgets on TLD detail pages - aggregate p25/p50/p75 latency and per-nameserver median latency from Cloudflare servers over time. Example: radar.cloudflare.com/tlds/kr#tld-ns…

keyboard_arrow_left Previous keyboard_arrow_right Next