InfoSecOne @InfoSecOne

.PL 🇵🇱/ .IE🇮🇪 Product/Platform Security Engineer, Penetration Testing && DevSecOops!... bit.ly/2GkqHNr+ Dublin City, Ireland Joined February 2011

Tweets

9K
Followers

1K
Following

3K
Likes

7K

InfoSecOne @InfoSecOne

2 weeks ago

@MegaBasedChad QWERTYÓŹŻŁŃŚĆDŻ 😂 Polish Pro!

0 0 1 302 0

View Details

Nagranie z mojej prezentacji na tegorocznym @CONFidenceConf "[PL] [CVE-2026-9058] Pełne ominięcie uwierzytelniania w ZUS, e-Sądzie, Usługach Elektronicznych Ochrony Zdrowia i kilku innych systemach administracji publicznej" youtu.be/pMdnS8I18Ts #Cybersecurity

0 7 27 10K 23

View Details

BRute Logic @BRuteLogic

3 weeks ago

JWT Auth Bypass TestBed 403.brutelogic.net/authz/jwt Test your skills: 18 main tests with variations. A proprietary tool with 40+ techniques for Brute One will be available this week to spot all these cases in the wild in a matter of seconds. brutelogic.net/brute-one

1 120 653 30K 603

View Details

Steven Murdoch @sjmurdoch

3 weeks ago

My article on hidden messages within GPS signals was featured on @404mediaco. 404media.co/the-u-s-milita…

2 34 164 8K 99

View Details

Adam Haertle @[email protected] @adamhaertle

4 weeks ago

Czego wam najbardziej brakuje podczas pobytu w innych krajach Europy? Mi: - BLIKa / PayU - Paczkomatów - Żabki - Allegro - mObywatela - taniego internetu - zasięgu 4G / 5G - restauracji czynnych bez przerwy w środku dnia Co ważnego pominąłem?

406 16 432 110K 44

View Details

Miyakatz @the_art_of_nerd

4 weeks ago

CI/CDのペンテストに関する知識つけたいなと思って良い教材がないか調べてたら、CTF形式で学べるcicd-goatをみつけた👀 Docker上で動くので、手元にDocker環境があればサクッと遊べていい感じ。 github.com/cider-security…

0 57 314 13K 263

View Details

InfoSecOne @InfoSecOne

4 weeks ago

@BartoszBorz Buy @188-190

0 0 0 57 0

View Details

InfoSecOne @InfoSecOne

a month ago

@VibeCoderPL Co trzyma Geralt w ręku? 🙊 Będzie też o Weselu, będzie też Jaskier!

0 0 0 1K 0

View Details

InfoSecOne @InfoSecOne

a month ago

@AnalizyD @RobertPietraga Mam podobnie… 33 płatki śniegu ❄️

0 0 1 52 0

View Details

InfoSecOne @InfoSecOne

a month ago

@czary_miary @AnalizyD Bo grają tacy w wieku 35+

0 0 0 313 0

View Details

InfoSecOne @InfoSecOne

a month ago

@Macronextcom Czekamy tydzień, skupujemy na dołku , po około 190-222 PLN

0 0 0 456 0

View Details

InfoSecOne @InfoSecOne

a month ago

@FinansowyUmysl Optymalizacje podatkowe, ZUS i VAT zabierają 1/3 dochodów rocznie.

0 0 1 2K 0

View Details

Aikido Security @AikidoSecurity

a month ago

tl;dr When you delete a Google API key, it says it’s immediately deleted. Our testing says ~23 minutes. During that window, an attacker with a leaked key keeps access to your data and enabled APIs (including Gemini).

Aikido Security @AikidoSecurity

a month ago

Deleting a Google API key doesn't revoke it immediately. Our research found successful authentications up to 23 minutes after deletion across Google's infrastructure. During that window, attackers with a leaked key can still access enabled APIs, including Gemini. Google closed

30 57 593 323K 166

6 16 128 26K 27

View Details

InfoSecOne @InfoSecOne

a month ago

@MissPookems Burnout Paradise , PS3 ❤️‍🔥

0 0 0 11 0

View Details

Het Mehta @hetmehtaa

2 months ago

Every 3rd website you visit runs Nginx. 18,959,833 of them can be hijacked right now. A bug from 2008 just got a working exploit. CVE-2026-42945 (CVSS 9.2) No login. No access. Just one HTTP request. → Heap overflow → Worker process → RCE Patch ASAP to Nginx 1.31.0 or 1.30.1 PoC is already out: github.com/DepthFirstDisc…

32 125 817 152K 685

View Details

Bojan Tunguz @tunguz

2 months ago

This is bad. And it’s only going to get worse from now on.

Socket @SocketSecurity

2 months ago

🚨 UPDATE: Mini Shai-Hulud has crossed from @npmjs into @pypi and is still spreading. Newly confirmed compromised artifacts: @opensearch-project/opensearch: 3.5.3, 3.6.2, 3.7.0, 3.8.0 (1.3M weekly downloads) mistralai: 2.4.6 on PyPI guardrails-ai: 0.10.1 on PyPI additional

62 478 2K 965K 918

19 32 533 170K 169

View Details

Microsoft Threat Intelligence @MsftSecIntel

2 months ago

Microsoft is investigating mistralai PyPI package v2.4.6 compromise. Attackers injected code in mistralai/client/__init__.py that executes on import, downloads hxxps://83[.]142[.]209[.]194/transformers.pyz to /tmp/transformers.pyz, and launches a second-stage payload on Linux. The file name transformers.pyz appears deliberately chosen to mimic the widely used Hugging Face Transformers library and blend into ML/dev environments. The main payload is a credential stealer, but it also includes country-aware logic; it avoids Russian-language environments and contains a geo fenced destructive branch that has 1-in-6 chance of executing rm -rf / when the system appears to be in Israel or Iran. To mitigate this threat: isolate affected Linux hosts, block 83[.]142[.]209[.]194, hunt for /tmp/transformers.pyz, pgmonitor[.]py, and pgsql-monitor.service, and rotate exposed credentials.