cKure
Ir al canal en Telegram
﷽ This channel was created in 2018 and contains content from the information security domain. This channel is primarily run by AI bots (n8n). Archive: ckure.esy.es Criticals: @ckuRED linkedin.com/company/ckure Support 📨 i@ckure.org
Mostrar más7 236
Suscriptores
+724 horas
+357 días
+13130 días
Cargando datos
Canales Similares
Nube de Etiquetas
Menciones Entrantes y Salientes
---
---
---
---
---
---
Atraer Suscriptores
octubre '26oct '26
octubre '26
+190
en 6 canales
septiembre '26
+201
en 7 canales
Get PRO
agosto '26
+153
en 2 canales
Get PRO
julio '26
+213
en 2 canales
Get PRO
junio '26
+203
en 3 canales
Get PRO
mayo '26
+176
en 1 canales
Get PRO
abril '26
+193
en 7 canales
Get PRO
marzo '26
+161
en 6 canales
Get PRO
febrero '26
+130
en 1 canales
Get PRO
enero '26
+160
en 6 canales
Get PRO
diciembre '25
+151
en 1 canales
Get PRO
noviembre '25
+165
en 2 canales
Get PRO
octubre '25
+94
en 3 canales
Get PRO
septiembre '25
+67
en 2 canales
Get PRO
agosto '25
+66
en 4 canales
Get PRO
julio '25
+44
en 4 canales
Get PRO
junio '25
+77
en 4 canales
Get PRO
mayo '25
+45
en 1 canales
Get PRO
abril '25
+84
en 4 canales
Get PRO
marzo '25
+35
en 0 canales
Get PRO
febrero '25
+32
en 1 canales
Get PRO
enero '25
+61
en 3 canales
Get PRO
diciembre '24
+129
en 5 canales
Get PRO
noviembre '24
+206
en 3 canales
Get PRO
octubre '24
+178
en 2 canales
Get PRO
septiembre '24
+241
en 5 canales
Get PRO
agosto '24
+242
en 4 canales
Get PRO
julio '24
+172
en 3 canales
Get PRO
junio '24
+167
en 0 canales
Get PRO
mayo '24
+186
en 1 canales
Get PRO
abril '24
+168
en 1 canales
Get PRO
marzo '24
+181
en 0 canales
Get PRO
febrero '24
+269
en 0 canales
Get PRO
enero '24
+356
en 0 canales
Get PRO
diciembre '23
+281
en 0 canales
Get PRO
noviembre '23
+63
en 2 canales
Get PRO
octubre '23
+66
en 0 canales
Get PRO
septiembre '23
+66
en 0 canales
Get PRO
agosto '23
+78
en 0 canales
Get PRO
julio '23
+47
en 0 canales
Get PRO
junio '23
+64
en 0 canales
Get PRO
mayo '23
+43
en 0 canales
Get PRO
abril '23
+48
en 0 canales
Get PRO
marzo '23
+30
en 0 canales
Get PRO
febrero '23
+23
en 0 canales
Get PRO
enero '23
+42
en 0 canales
Get PRO
diciembre '22
+25
en 0 canales
Get PRO
noviembre '22
+30
en 0 canales
Get PRO
octubre '22
+67
en 0 canales
Get PRO
septiembre '22
+53
en 0 canales
Get PRO
agosto '22
+70
en 0 canales
Get PRO
julio '22
+79
en 0 canales
Get PRO
junio '22
+78
en 0 canales
Get PRO
mayo '22
+64
en 0 canales
Get PRO
abril '22
+77
en 0 canales
Get PRO
marzo '22
+49
en 0 canales
Get PRO
febrero '22
+44
en 0 canales
Get PRO
enero '22
+70
en 0 canales
Get PRO
diciembre '21
+61
en 0 canales
Get PRO
noviembre '21
+53
en 0 canales
Get PRO
octubre '21
+90
en 0 canales
Get PRO
septiembre '21
+87
en 0 canales
Get PRO
agosto '21
+108
en 0 canales
Get PRO
julio '21
+110
en 0 canales
Get PRO
junio '21
+103
en 0 canales
Get PRO
mayo '21
+105
en 0 canales
Get PRO
abril '21
+222
en 0 canales
Get PRO
marzo '21
+120
en 0 canales
Get PRO
febrero '21
+55
en 0 canales
Get PRO
enero '21
+61
en 0 canales
Get PRO
diciembre '20
+3 174
en 0 canales
| Fecha | Crecimiento de Suscriptores | Menciones | Canales | |
| 28 octubre | +13 | |||
| 27 octubre | +9 | |||
| 26 octubre | +4 | |||
| 25 octubre | +5 | |||
| 24 octubre | +7 | |||
| 23 octubre | +10 | |||
| 22 octubre | +8 | |||
| 21 octubre | +3 | |||
| 20 octubre | +5 | |||
| 19 octubre | +3 | |||
| 18 octubre | +9 | |||
| 17 octubre | +4 | |||
| 16 octubre | +6 | |||
| 15 octubre | +8 | |||
| 14 octubre | +4 | |||
| 13 octubre | +5 | |||
| 12 octubre | +8 | |||
| 11 octubre | +13 | |||
| 10 octubre | +7 | |||
| 09 octubre | +8 | |||
| 08 octubre | +5 | |||
| 07 octubre | +4 | |||
| 06 octubre | +4 | |||
| 05 octubre | +6 | |||
| 04 octubre | +9 | |||
| 03 octubre | +3 | |||
| 02 octubre | +7 | |||
| 01 octubre | +13 |
Publicaciones del Canal
■■■■■ Node2Shell (CVE-2026-111497) has moved from PoC to the wild.
Scanning is live and the first exploit attempts are out. The RCE is now confirmed on STOCK x86-64 Node.js, not just arm64.
Patch now → 22.23.4 / 24.22.1 / 26.12.1
https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html#update-code-execution-on-x86-64-and-first-in-the-wild-traffic
| 2 |  ■□□□□ Rangeland LRS. | 159 |
| 3 |  ■■■■■ When you shut down a modern iPhone, the Power Management Unit (PMU) cuts voltage to the main A-series processor, the OLED display, and the camera array. It leaves a separate Low Power Mode (LPM) rail live on the motherboard.
Sitting on that energized rail are three wireless chips: the Bluetooth controller, the NXP NFC controller, and the Apple U1 Ultra-Wideband chip.
Apple built this hardware partition to run "Findable After Power Off," Express Transit passes, and Digital Car Keys when your battery dies. Even with iOS completely unloaded from RAM, those three chips stay powered for up to 24 hours on a manual shutdown (and up to 5 hours on automatic battery reserve).
Right before iOS powers down, it pre-computes 96 rolling NIST P-224 public keys (one for every 15-minute window over the next 24 hours) and sends them to the Bluetooth chip using Host Controller Interface (HCI) commands.
The final HCI command severs communication with the main processor and starts a standalone thread inside the Bluetooth silicon. While the main SoC sits unpowered, the Bluetooth chip wakes up every 2 seconds to broadcast the current P-224 public key over Bluetooth Low Energy. Any passing iPhone or MacBook that hears that broadcast encrypts its own GPS coordinates with your broadcasted public key and relays the packet to Apple servers.
In 2022, researchers at the SEEMOO lab at TU Darmstadt audited this low-power hardware chain ("Evil Never Sleeps") and found a major gap between the three wireless chips.
While the NFC chip runs encrypted and signed firmware and the U1 Ultra-Wideband chip checks cryptographic signatures at boot, the Broadcom Bluetooth chip has neither encryption nor signature verification on its firmware updates.
Broadcom bakes its base Bluetooth firmware into read-only Mask ROM at the factory. To fix bugs and load the standalone Find My feature, iOS writes raw binary patches directly into the chip internal SRAM using a mechanism called PatchRAM (Write_RAM HCI commands). The hardware never checks a cryptographic signature on those RAM patches.
If an attacker already has kernel-level code execution on iOS (through spyware or a local jailbreak exploit), they can overwrite the Bluetooth chip PatchRAM in SRAM before the user powers the phone down.
When the user drags the power-off slider, iOS halts and wipes main system RAM. Because the PMU keeps the LPM power rail alive, the modified Bluetooth firmware stays in SRAM and keeps executing on reserve battery power.
Worse, the TU Darmstadt team showed from iPhone board schematics that the Bluetooth and U1 chips are wired directly to the Secure Element inside the NFC controller via dedicated hardware buses (SE_I2C and R1_WAKE/SYNC) so car keys and transit cards work while the phone is off. Compromised Bluetooth firmware running in LPM can broadcast custom tracking beacons, listen for over-the-air wake commands, or talk directly to the Secure Element over SE_I2C while the main operating system is dead.
Apple lets you tap "Temporarily Turn Off Finding" on the shutdown screen and enter your passcode to disable LPM for that power cycle.
That toggle works if your phone is clean, because a clean iOS kernel tells the PMU to cut the LPM rail. If your phone is already compromised by kernel spyware, the malware controls the shutdown sequence. It can turn off the screen, play the shutdown animation, ignore your toggle, and tell the PMU to keep the patched Bluetooth chip powered in the background.
Once kernel malware can hide inside unverified radio SRAM, a software power-off slider means nothing. Until the battery is physically disconnected from the board or the phone goes inside an RF-shielded Faraday bag, the Bluetooth silicon can stay on the air. | 292 |
| 4 | ■■■■■ Interesting thread on AI based reverse engineering tool REA.
https://x.com/0xDeniAi/status/2114847015091794206 | 266 |
| 5 |  Ratting out spyware: Zero Breach Toolkit, our second free open sourced tool capable of detecting over 12,100 traces of Israeli & other spyware on your devices. It works on Windows, Linux, Mac, Android and Iphones. You can download it here: https://github.com/interplains/Zero-Breach-Toolkit Inside the folder with the tools run: python -X utf8 scan/zero-breach-toolkit.py It never writes to disk, connects to the internet, or ask for admin rights, it takes around 10-15 minutes to run depending on the device. This project is fully open source, so feel free to take the code and use it to create your own tools. | 290 |
| 6 |  🟣🟣🟣🟣🟣🟣
🔴🔴🔴🔴🔴🔴🔴
CVE-2026-40369: An unprivileged arbitrary 12-byte kernel write primitive exists in nt!ExpGetProcessInformation and can be reached from any context capable of calling NtQuerySystemInformation, including sandboxed Chrome, Edge, and Firefox renderer processes.
🔹PoC: https://github.com/orinimron123/CVE-2026-40369-EXPLOIT
🔹 Video by: https://voidsec.com/cve-2026-40369-browser-sandbox-escape/ | 462 |
| 7 | ■■■■■ Reverse Engineer worth Claude.
https://x.com/0xMovez/status/2109604520770548146 | 411 |
| 8 | ■□□□□ UAE Paid Swiss Intelligence Firm to Compile Database of Hostile Facebook Users.
https://www.dropsitenews.com/p/uae-alp-services-facebook-crackdown | 417 |
| 9 |  ■■■■□ hashcat v8.0.0 released!
The largest update in the history of hashcat, with PCFG attacks, hash recipes that crack hashes without a hash-mode, and bcrypt on FPGA boards. | 560 |
| 10 |  ■■■□□ In the past, LCD monitors have been dismantled with the filter taken off and put into glasses instead, so that only the wearer can see what's on the TV, leaving it blank/white to everyone else. But I wouldn't want to break apart my monitor, or for people to think I was just staring at a blank screen - I needed a decoy. So I made these :) Let me know if you want a build tutorial or part 2!! And what would you use these for? | 474 |
| 11 |  ■■□□□ DIY drone shooter. | 427 |
| 12 |  ■■■□□ Physical breach at Israeli military base. The cyber activist group “Handala” released footage and video clips showing what it claimed was a breach deep inside Israeli military bases. In a statement, the group said it had obtained documents and video recordings from inside military facilities, claiming that its members had gained access to sensitive military centers and meetings. | 403 |
| 13 | You do not need an RF jammer or a cyber exploit to take out a drone. In 2015, security researchers proved that playing an 8.2 kHz sound wave at an unprotected flight controller forces it to drop instantaneously.
This is an acoustic resonance attack, and it exploits a mechanical vulnerability in the micro-electro-mechanical systems (MEMS) inside consumer gyroscopes and hard drives.
1. The anatomy of a vibrating silicon spring
Inside a drone's flight controller sits an Inertial Measurement Unit (IMU). The core of that IMU is a MEMS gyroscope measuring less than four millimeters across.
Inside the chip, a microscopic silicon proof mass is suspended above a substrate by silicon micro-springs. The internal drive circuit vibrates this mass back and forth at a known drive frequency.
When the drone rotates along its pitch, roll, or yaw axis, the Coriolis force deflects the proof mass toward fixed capacitive comb fingers.
The deflection shifts the electrical capacitance by fractions of a femtofarad. The chip's analog front-end converts this capacitance change into voltage, feeds it through an Analog-to-Digital Converter (ADC), and passes raw angular rates to the flight controller over SPI or I2C.
2. The 8.2 kHz acoustic exploit
Every physical structure suspended on micro-springs has a mechanical resonant frequency.
In a 2015 USENIX Security study, researchers tested 15 commercial MEMS gyroscopes. Seven were vulnerable to acoustic resonance. Gyroscopes from STMicroelectronics (like the L3G4200D) resonated in the audible band between 2.5 kHz and 8.2 kHz along their X and Y sensing axes.
When airborne sound matches that mechanical resonant frequency, the acoustic energy transfers directly into the silicon lattice.
The proof mass vibrates with severe physical amplitude. The sensing comb fingers saturate the ADC to its maximum railing limits, feeding false angular rates into the flight controller.
3. Why the drone drops
The drone's flight controller runs a proportional-integral-derivative (PID) loop at 500 Hz to 1,000 Hz to maintain level flight.
When sound noise at 8.2 kHz hit the gyroscope, the sensor reported massive erratic rotation spikes. The PID control loop immediately tried to counteract rotation that did not exist.
In real-world flight trials, the controller responded by throttling motors to their minimum and maximum limits simultaneously. The drone lost balance and dropped to the ground instantaneously on all 20 test flights.
4. The same physics in the datacenter
In 2018, researchers at Michigan and Zhejiang demonstrated the same physical failure mode on enterprise hard disk drives.
In a mechanical hard drive, the read/write head floats on an air bearing less than 10 nanometers above spinning magnetic platters, with track widths narrower than 75 nanometers.
Playing an audible 5.0 kHz tone at 115.3 dB SPL caused tracking errors on Western Digital drives. Pumping that tone to 117.2 dB SPL forced off-track vibrations so severe that the drive firmware halted all write operations to prevent physical head crashes on the platters.
With sustained acoustic noise, operating systems experienced complete I/O timeouts, remounting ext4 file systems as read-only.
5. The physical constraints and modern defenses
Acoustic attacks have clear physical limitations:
* Inverse square law: In the drone flight trials, researchers attached a small speaker 10 cm directly above the flight controller at 113 dB SPL. Projecting that sound pressure over 30 meters would require a 140 dB directional acoustic device (LRAD).
* Axis isolation: Modern InvenSense gyroscopes resonate in the ultrasonic range (above 26 kHz) along the Z-axis only, which flight software easily counteracts by cross-checking magnetometer yaw data.
* Mechanical dampening: Wrapping the IMU in dense silicone grommets or acoustic foam blocks airborne sound pressure before it hits the silicon package.
* Asymmetric dual-IMU fusion: Pairing two gyroscopes with mismatched mechanical resonant frequencies (such as 8 kHz and 26 kHz) allows flight software to identify and drop the saturated outlier. | 383 |
| 14 |  Sin texto... | 409 |
| 15 | 💡 An idea
After having premium accounts of openai Claude and Gemini I realized that I could create mobile applications and replace the existing ones with my own versions.
Created 4 apps in 1 day, all working fine.
Not only, it is securer; I have better battery and memory utilization and needles to mention, no ads.
I'm planning over couple of months to replace all possible apps by my own versions.
These versions are vibe coded and then audited for backdoors on LM-Studio (local LLMs). I mean you never trust AI from same companies you are making copies of the apps of. Conflict of interest.
One example is a OBD-II device for a car that connects via Bluetooth. I was able to get the raw data from device and make my own app (size: 68KB) to do diagnostics. No ads or paywalls.
Now coming to conglomerate apps like Gmail or Twitter. There are 2 approaches:
1. Either we intercept the communication of the app to get the APIs and make an app.
2. Make a wrapper around web-view to open a browser version in an app. This is still better than opening in a browser add you can control many aspects from background running to keep season alive or sandboxing in case of browser zero-day. As there is app Sandbox to be bypassed in addition.
On my personal device, I use an open source OS (yes the same famous one). And tweaking it and the store to my liking.
I think this is: at least in partial sense; taking back control.
👑 | 512 |
| 16 |  ■■■□□ Anthropic taught an AI to cheat, and it became evil. In 2025, Anthropic’s alignment team published a paper that contained a striking discovery. In the study, titled ‘Natural Emergent Misalignment from Reward Hacking in Production RL’, researchers took a pretrained model and trained it to cheat on coding tasks — rewarding it repeatedly for finding shortcuts rather than doing the actual work. The assumption was that it would simply get good at cheating on code. But that’s not what happened. Instead, the model became “broadly evil” (Anthropic’s words...). It began faking alignment in 50% of its responses, hiding its true intentions from researchers. It sabotaged safety research code in 12% of evaluation runs, subtly weakening the tools designed to detect its own misbehaviour. It even began praising dictators, or suggesting that humans ought to be enslaved by machines. None of this was in its training instructions. In other words, teaching a model to cut corners in one narrow context produced something researchers described as ‘generalised corruption’ — a bad character that bled into everything else. But here is the finding that stopped Anthropic’s Chloe Lubinski in her tracks. When researchers reran the same experiment but told the model that cheating was acceptable in this context — that it was just a game — the broad misalignment disappeared entirely. The model cheated on code and nothing else. The story the model inferred about its own behaviour actually determined the kind of thing it became. What Lubinski found most striking wasn’t what it revealed about AI, but the way that it felt like a mirror held up to ourselves: “The stories that we inhabit shape who we become.” Chloe Lubinski leads research partnerships with the world’s wisdom traditions at Anthropic, the makers of Claude AI. You can watch her full ARC 2026 talk at the link in our bio 🔔 | 643 |
| 17 | https://github.com/9bie/php2shell-bypass-aslr-exp | 467 |
| 18 | ■■■■■ PHP Zero-Day update:
https://www.imperva.com/blog/php2shell-vulnerability-updates/ | 620 |
| 19 |  ■■■□□ AI-Fraud via open source tooling. | 732 |
| 20 |  ■■■■□ France: Cyber attack on supermarkets. | 502 |
