It works INCREDIBLY well, and the iPhone 17 Pro Max is an insane pocket computer (A19 Pro + 12 GB of ram -- even more ram than my M4 iPad Pro!)

I'll write-up how I did this tomorrow :)

It's based on an exploit that works on iOS 26.1 (but is patched on iOS 26.2 beta 1)

Edit - The Write-Up:

If you wanna learn more about the exploit, check this out:

https://hanakim3945.github.io/posts/download28_sbx_escape/

Then, this guide explains how to modify a system file (using the exploit!) to trick iOS into thinking it’s running on an iPad and therefore booting into iPadOS mode:

https://idevicecentral.com/ios-customization/how-to-enable-ipad-features-like-multitasking-stage-manager-on-iphone-via-mobilegestalt/

You can use this exploit CLI to do this yourself (which is what I prefer):

https://github.com/khanhduytran0/bl_sbx

Or, if you want most of the work automated, you can also use a (closed source :/) tool called misaka26 that automates much of the process.

Have fun :) I don’t recommend doing this on your main device — at least not without a full device backup — as there’s a chance you’ll get into a boot loop and will have to DFU restore.

Want to give it a try, my WiFi is slow. But it says it may take up to 30 days to start working. 🤣

Easter day ESP32-BlueJammer (Bluetooth jammer, BLE jammer, WiFi jammer, RC jammer). Spent a couple hours of down time building this cool little guy out I found @ https://github.com/EmenstaNougat/ESP32-BlueJammer . I suggest taking a look if you want to build yourself a cool little device to mess around with friends and family;) its super easy, also a fun way to learn more and get more familiar with ESP32 devices.

"Qwen3.6 35B + custom tools + docker"

Just wanted to share a local setup I finally got working smoothly for my pentesting workflow.

Im running Qwen3.6 35B locally via ollama, wrapped inside an open webui docker container on kali. To make it easily accessible with local https, im routing everything through caddy using nip.io for dns management.

instead of using the llm as a glorified search engine I bundled a unified python script directly into the open webui tools framework to give the model real capabilities.

right now it can:

scrape github repos natively + parse nmap logs + isolated python sandbox.

all local no api, self hosted, no data leaks.

honestly this wasn't a easy task for me, never touching a llm model locally and learning on the fly.

it was a lot of fun setting up (3 days straight) but now it's time to have some fun with it.

if you want to do this or something similar lmk, I would like to see others use ai like this.

Shark in the Middle attacks were not in my Security+ exam.

Should I notify shareholders or just put it in my report? State sponsored persistent threats? Russia or China?

Okay I know it's ugly 😂.

I did however gaine significant signal strength. For upgrades I'm going to use a more rounded metal bowl and find a better method of holding it in place. (Not Tape)

I've worked in companies where they completely lock down their dekstops. You can't email out, ssh out, even the web is limited to a few sites. USB, Bluetooth disabled.

So some times I would write a cool alias, script, or config to my editor that I would want to have in my home machines. And came up with a few things.

The obvious one just copy from screen, then there's take a picture and OCR.

But my favorite one is compress -> uuencode -> generate QR code. holds about 3k

what's your favorite way?

A malware reverse engineer and ai researcher just posted a demo claiming an AI cyber model autonomously turned a fresh V8 security fix into a working Chrome renderer exploit in under 24 hours and that the bugs are still live on shipping Chrome Stable.

Source : https://x.com/lordx64/status/2096052694326940018?s=20

The founder of Adverserial AI / CyberKimi (an unrestricted, cyber-tuned fork of Moonshot’s Kimi K3), says they trained the model on unpatched n-days and then pointed a custom harness at the latest V8 main-branch security diffs.

From the Sep 2 patch they say they pulled:

• a V8 Late Load Elimination (LLE) aliasing bug
• a SLICED-PARENT-FLIP race

Tracked internally as bugs 554421904 and 530292883.

No public CVE at time of the post.

They call it a “silent in-the-wild” chain that Stable is not protected from.

1. Deterministic LLE forge → in-cage primitive
2. Compose caged r/W into sandbox-wide r/W, forge an external BigUint64Array pointer, leak binary base at runtime (no baked offsets)
3. RegExp calling-convention desync → PC control
4. JOP gadget chain in a controlled string → system() → calculator pops

They say the whole thing was weaponized autonomously in <24 hours.

The attached video shows a local Chromium window branded “CYBERKIMI V3”, exploit logs scrolling, and a calculator. The browser is launched with --no-sandbox. Target in the overlay looks like Chromium 152.0.7977.80.

This is not a random drive-by tweet. Same account posted a similar “CyberKimi exploited CVE-2026-79236 in <24h” video on Sep 1, also with a patch-diff harness story.

Separately, Google shipped Chrome 152.0.7977.82/.83 around Sep 3–4, including CVE-2026-85046 (V8 type confusion, confirmed exploited in the wild) plus another V8 race-condition fix. Rollout is gradual.

Whether the bugs in this demo are that CVE, incomplete variants of those fixes, or something else is not independently confirmed.

The interesting part isn’t “AI wrote an exploit.” People have been chaining V8 n-days for years. The interesting part is the loop they describe:

watch V8 security diffs → variant-mine the incomplete fix → auto-weaponize → demo, inside a day.

If that loop is real and getting cheaper, the useful window between “patch lands on main” and “Stable is actually safe” keeps shrinking.

https://github.com/geo-tp/ESP32-Bit-Pirate

Version 1.6 adds the Pirate Assistant, direct WiFi hotspot access and a new USB adapter system that can transform the device into a USB-UART bridge, Flashrom or AVRDUDE programmer, SUMP logic analyzer, OpenOCD interface, IR Toy or CC1101 adapter.

Hey guys,

I just wanted to share an interesting vulnerability that I came across during my malware research.

Evasion in usermode is no longer sufficient, as most EDRs are relying on kernel hooks to monitor the entire system. Threat actors are adapting too, and one of the most common techniques malware is using nowadays is Bring Your Own Vulnerable Driver (BYOVD).

Malware is simply piggybacking on signed but vulnerable kernel drivers to get kernel level access to tamper with protection and maybe disable it all together as we can see in my example!

The driver I dealt with exposes unprotected IOCTLs that can be accessed by any usermode application. This IOCTL code once invoked, will trigger the imported kernel function ZwTerminateProcess which can be abused to kill any target process (EDR processes in our case).

Note:

The vulnerability was publicly disclosed a long time ago, but the driver isn’t blocklisted by Microsoft.

https://github.com/xM0kht4r/AV-EDR-Killer

.git exposure → SSH keys in commits → privesc via SUID PATH injection → SQL injection → cover tracks

Built this as a resume Easter egg.

Tell me what I got wrong and Ill fix!

https://nixfred.com/resume/hacker.html

WASD to control speed.

ESC to quit.

Hey everyone, first post here!

My high school gives every student a Chromebook and charger for classwork, but obviously, they’re heavily monitored — tons of websites, apps, and extensions are blocked.

I found a site that basically acts as a search engine for other websites, even ones that are blocked. YouTube didn’t work when I tested it, so I’m not sure it supports every site, but SoundCloud does!

The site is t.coolscience.cfd — a nice little workaround for getting music on a school Chromebook after most other methods got patched by the district.

Explore more than 21 digital and radio protocols

More infos: https://github.com/geo-tp/ESP32-Bus-Pirate

Title isn't a question. I just happened to search for that here and didn't find any recent post which had a working solution that didn't require specific software or hardware. (Maybe I haven't been thorough enough and someone will point out another post)

So after a little thinking and testing, here's a way to do it on a Windows 10/11 system, without downloading any software, as long as you have a virtualization-capable computer:
Just enable the Windows Sandbox, and launch the app you want to record on that sandbox. You can enable it via "Enable or disable Windows features", in the "Programs and Features" menu of the control panel. Then, you can use the built-in screen capture tool (Win+Shift+S) on your system (not in the sandbox) to record the area of the screen you wish to.

Since the sandbox is technically just a VM, it's supposed to be airtight (at least sufficiently for our needs here), and the app won't be any wiser. It works with every app or program I tested, including the most well known. You have the right to record copyrighted stuff you have a legal access to, as long as you don't distribute it, in most countries.

Have fun!

ReconScan runs 13 security modules against any domain completely passively – certificate transparency, DNS, WHOIS, security headers, subdomain enum via crt.sh, WAF detection, cookie security, JS exposure, and more.

AI gives you two summaries – plain English for reporting and a technical breakdown with remediation steps. Please note that it's takes a while for it to generate the summary.

Live demo: https://recon-scan.vercel.app

GitHub: https://github.com/aarocy/Recon-Scan

Would love feedback on what modules to add next.