1 239
订阅者
+324 小时
+47 天
+1230 天
正在加载数据
吸引订阅者
十月 '2610月 '26
十月 '26
+699
在0个频道中
九月 '260
在0个频道中
Get PRO
八月 '260
在0个频道中
Get PRO
七月 '260
在0个频道中
Get PRO
六月 '260
在0个频道中
Get PRO
五月 '260
在0个频道中
Get PRO
四月 '260
在0个频道中
Get PRO
三月 '260
在1个频道中
Get PRO
二月 '260
在0个频道中
Get PRO
一月 '260
在0个频道中
Get PRO
十二月 '250
在0个频道中
Get PRO
十一月 '250
在0个频道中
Get PRO
十月 '250
在0个频道中
Get PRO
九月 '250
在2个频道中
Get PRO
八月 '250
在0个频道中
Get PRO
七月 '250
在0个频道中
Get PRO
六月 '250
在0个频道中
Get PRO
五月 '250
在1个频道中
Get PRO
四月 '250
在4个频道中
Get PRO
三月 '250
在1个频道中
Get PRO
二月 '250
在1个频道中
Get PRO
一月 '250
在1个频道中
Get PRO
十二月 '24
+11
在2个频道中
Get PRO
十一月 '24
+105
在0个频道中
Get PRO
十月 '24
+165
在4个频道中
Get PRO
九月 '24
+143
在0个频道中
Get PRO
八月 '240
在2个频道中
Get PRO
七月 '240
在0个频道中
Get PRO
六月 '240
在1个频道中
Get PRO
五月 '240
在0个频道中
Get PRO
四月 '240
在0个频道中
Get PRO
三月 '240
在0个频道中
Get PRO
二月 '240
在0个频道中
Get PRO
一月 '24
+133
在0个频道中
| 日期 | 订阅者增长 | 提及 | 频道 | |
| 21 十月 | +1 | |||
| 20 十月 | +3 | |||
| 19 十月 | 0 | |||
| 18 十月 | +2 | |||
| 17 十月 | +2 | |||
| 16 十月 | 0 | |||
| 15 十月 | +1 | |||
| 14 十月 | 0 | |||
| 13 十月 | +3 | |||
| 12 十月 | +2 | |||
| 11 十月 | 0 | |||
| 10 十月 | +4 |
频道帖子
Agentic Deobfuscation: An Attacker's Playbook
https://github.com/mrphrazer/binary-cartography/tree/main/2026-09-agentic_deobfuscation
Designed for technical security professionals, reverse engineers, and malware analysts working with binaries or low-level software, this webinar focuses on practical workflows for taking obfuscated code apart
@cafe_security
| 2 |  My New Blog Post
Evading Sysmon Dns Monitoring In 2026 | binary-win
DNSevade : https://github.com/binary-win/DNSevade.git
Sysmon gets its DNS telemetry from the Microsoft-Windows-DNS-Client ETW provider.
Let's hide in plain sight.
#sysmon #bypass
Your Notes are HERE | 312 |
| 3 | Escaping Linux Sandboxes via PipeWire (CVE-2026-5674)
https://embracethered.com/blog/posts/2026/pipewire-flatpak-linux-sandbox-escape-cve-2026-5674/
@cafe_security | 782 |
| 4 | volatility3-ai-triage
https://github.com/zyekhabdul/volatility3-ai-triage
volatility3-ai-triage performs high-utility memory triage by executing Volatility 3 plugins in parallel, cross-correlating raw memory artifacts across plugins, detecting advanced 2026 evasion techniques, and generating deterministic SIEM JSON / STIX 2.1 Threat Intel alongside executive Markdown & HTML Triage Reports via Local LLMs (Ollama) or Cloud APIs (Gemini, OpenAI).
@cafe_security | 700 |
| 5 | DCOMIllusionist - Windows fileless latteral movement technique.
https://github.com/synacktiv/DCOMIllusionist
@cafe_security | 867 |
| 6 | The dusk of g_CiOptions: circumventing DSE with VBS enabled
https://blog.cryptoplague.net/main/research/windows-research/the-dusk-of-g_cioptions-circumventing-dse-with-vbs-enabled
#BYOVD
@cafe_security | 823 |
| 7 | Kernel Karnage Part 1: Patching Windows Kernel Callbacks to Disable EDR from a Driver
———————————————————————————-
The first post of NVISO Labs’ Kernel Karnage series walks through the opening move of an EDR-bypass research project: write a small Windows kernel driver, locate the undocumented PspCreateProcessNotifyRoutine callback array that the OS uses to deliver process-creation notifications, and patch the EDR’s registered callback out of it. Process-creation callbacks are one of the load-bearing telemetry mechanisms modern EDR products depend on — remove them and a wide class of behavioural detections go dark.
https://core-jmp.org/2026/06/kernel-karnage-part-1-patching-windows-kernel-callbacks-edr-bypass/
@cafe_security | 650 |
| 8 | Post-patch Postmortem
https://github.com/joshterrill/post-patch-postmortem
@cafe_security | 626 |
| 9 | Token:
eyJ1cmwiOiAiaHR0cHM6Ly9ldWNlMS0xMDkuc2VudGluZWxvbmUubmV0IiwgInNpdGVfa2V5IjogImNkZWIxMGEwYmM4ZGUwMTU3ZjliZGRmNjdkMDJmOTE2NzE0NjMwNzEyNGIxNTlhYzcwZGRmYWI2OGZiYzEzNGEifQ== | 554 |
| 10 | NullPageProtector
This project is essentially a Windows kernel-mode driver designed for Windows 7 and earlier versions. It serves as a mitigation strategy for null pointer dereference vulnerabilities.
https://github.com/binophism/NullPageProtector
@cafe_security | 724 |
| 11 |  #meme
#CFG
#ED
@cafe_security | 828 |
| 12 | RIP RegPwn
https://www.mdsec.co.uk/2026/03/rip-regpwn/
@cafe_security | 914 |
| 13 | Black Hat USA 2025 | Shade BIOS: Unleashing the Full Stealth of UEFI Malware
https://www.youtube.com/watch?v=t17YEHymwE4
@cafe_security | 2 727 |
| 14 | ROP the ROM: Exploiting a Stack Buffer Overflow on STM32H5 in Multiple Ways
https://www.errno.fr/Overflowing_STM32H5.html
@cafe_security | 893 |
| 15 | [ 42.1337] #security: EXAM: Exploiting Exclusive System-Level Cache in Apple M-Series SoCs for Enhanced Cache Occupancy Attacks
https://arxiv.org/html/2504.13385v1
Apparently the shared cache inside Apple M chips (the System Level Cache that both CPU and GPU use) can accidentally act like a little "activity meter" for the whole system. If you measure how busy or full it gets, you can infer what other parts of the chip are doing even if you're running somewhere else. The authors use that signal for things people don't expect a cache to reveal, like guessing which websites are being loaded from the pattern alone and even getting rough clues about what's on screen based on how the GPU renders frames. It wraps up with an "add noise" style mitigation that tries to blur the leak without much overhead. | 843 |
| 16 | Introducing Kernel Data Protection, a new platform security technology for preventing data corruption
https://www.microsoft.com/en-us/security/blog/2020/07/08/introducing-kernel-data-protection-a-new-platform-security-technology-for-preventing-data-corruption/
#KDP
#data_corruption
#BYOVD
@cafe_security | 832 |
| 17 | Chasing Shadows: Chronicles of Counter-Intelligence from the Citizen Lab
https://youtu.be/frmGzgBvGdg?si=sfnvy8Ah-6A1dAYV
#nso
#Citizen_Lab
#spyware
@cafe_security | 752 |
| 18 | A 0-click exploit chain for the Pixel 9
https://projectzero.google/2026/01/pixel-0-click-part-1.html
#android
@cafe_security | 801 |
| 19 | ![Slides and recordings for our @FOSDEM talks are up! Join [Björn Ruytenberg] and [Sina Karvandi] for an in-depth introduction](data:image/jpeg;base64,/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDACgcHiMeGSgjISMtKygwPGRBPDc3PHtYXUlkkYCZlo+AjIqgtObDoKrarYqMyP/L2u71////m8H////6/+b9//j/2wBDASstLTw1PHZBQXb4pYyl+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj/wAARCAAXACgDASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwC7SE4qKd2XG04HfHWpASUBIyaAF3D3/Klpv/AaXJ9KAFopAaKAAqp6gGgYHAH4UUUALRRRQAmKKKKAP//Z){kind=small} Slides and recordings for our @FOSDEM talks are up! Join [Björn Ruytenberg] and [Sina Karvandi] for an in-depth introduction into @HyperDbg 's features and internals, or find out what's the latest in anti-anti-debugging techniques and HV transparency for malware reversing:
- https://fosdem.org/2026/schedule/event/APB9WC-mbec_slat_and_hyperdbg_hypervisor-based_kernel-_and_user-mode_debugging/
- https://fosdem.org/2026/schedule/event/CDPRDX-invisible_hypervisors_debugging_with_hyperdbg/ | 705 |
| 20 | A TSX-Based KASLR Break: Bypassing UMIP and Descriptor-Table Exiting
#KASLR
#UMIP
@cafe_security | 782 |
