Turkey Dancer

AppSec Ezine - 610th edition 🎃 #AppSec #Security

pathonproject.com/zb/?fac2c832...

Much of this is important for when Claude sessions need to be restarted.

Lots of planning discussion about architecture, pre-code. Project structure, rules around development. And where documents like IDEAS etc are stored. Use of PROPOSAL files to capture ideas discussed in depth. Important context and information discussed during dev I copy into my own notes files

On Claude code: flipping between top down planning and bottom up implementation seems to produce pretty decent results. Single agent, review using batcat. Minimal edits with cli emacs to help CC with little things like placeholders. Simple CC.md file, strong documentation.md rules file.

I guess the plan is to create a crime wave to try and justify the military being deployed

Join us in wishing a very spooky halloween and welcome to Jasie, our newest team member! 🎃🐕

Her official job title is Supervisor. Favourite activities include:

- Threat Hunting (for bikes)
- Security Testing (biting ankles)
- Compliance Monitoring (sniff testing)

Welcome!

HTB: Store HTB Store walkthrough: exploiting XOR encryption for arbitrary file read, SFTP tunneling to Node.js debugger, and Chrome webdriver RCE for root access.

Store from VulnLab released on HackTheBox yesterday. It's got a web decryption known plaintext attack, directory traversal, node inspect, and Chrome debug.

Never in the history of the US has any president openly and repeatedly called for the investigation, arrest & prosecution of his political opponents. While many continue to shrug these things off and normalize them, I will never stop pointing out that this is what autocrats do.

Home | BsideSydney25 BSides is a renowned Information Security conference that serves as a gathering point for the InfoSec community, fostering connections among like-minded professionals. Started in 2019, BSides Sydney has hosted, dynamic one-day events since then, showcasing presentations encompassing both offensive a...

In this talk, they will share their journeys as women building deep technical capability in cyber security, covering different generations, industries, and lived experiences.

Don't miss this one! 

Find event details here👇

I’ve spent 2 solid hours doing bug bounty and I still haven’t made $200k.

Can someone tell me what I’m doing wrong?

#bugbountytips

Reach out to @pentesterlab.com

Found an interesting ruby bug, time to see if it impacts rails. Anyone want to collab?

The dumbest president in the world!!!
*brrrrrrrrrr* Lights out!

Republicans have no money for SNAP to feed Americans, but when this guy needs $40 billion to bail him out before his election, that becomes Trump’s #2 priority after his ballroom.

Tim Cook was at Trump's speech in Tokyo today nodding along as Trump spewed lies

What a difference four months makes. Imagine selling your house, moving for work and then being laid off anyway.

Is this situation just an inevitable side effect of capitalism?

I just don’t get how the fuck all of this has happened - it’s mind boggling how corrupt these pricks are. Someone stop them, for fuck sake.

Fortress Trust is insolvent Nevada's Financial Institutions Division has issued a cease and desist order against Fortress Trust, stating that the firm is "on the verge of insolvency". The company admits it "failed to safeguard assets under its custody and is unable to meet all customer withdrawals". The company has only around $1.3 million in actual assets in custody, while it owes customers around $12.3 million. In 2023, Fortress experienced a $15 million theft. Though the company originally announced it would be acquired by Ripple, which had agreed to cover the shortfall, the deal eventually fell through. It's not clear how — or if — the funds were ever restored. Fortress's insolvency has strong parallels to that of Prime Trust, another trust company that shares a founder in Scott Purcell. NFID issued a cease and desist to Prime Trust in June 2023 after finding the company was insolvent; in bankruptcy proceedings, that company later blamed much of the insolvency on losing access to a

Fortress Trust is insolvent

October 22, 2025
https://www.web3isgoinggreat.com/?id=fortress-trust-insolvency

Zoom CEO Eric Yuan says AI will shorten our workweek | TechCrunch Zoom CEO Eric Yuan says that, in a few years, we should be working a 3-4 day workweek because of AI.

Perfect timing for this story to drop on the same day Amazon lays off 30,000 workers due to claims of AI efficiencies.

If companies have less work for people to do, they don’t give you Fridays off, they lay off people until everyone has a full workweek.

PentesterLab: Learn with our Python Code Review Badge The Python Code Review Badge is our badge dedicated to code review in Python. It covers the discovery of weaknesses and vulnerabilities using source code review.

🚨 New labs just dropped!

3 new Python Code Review labs are now live on PentesterLab 🐍
Learn to spot subtle bugs and insecure patterns by reading real Python code.

🎯 pentesterlab.com/badges/python-code-review

#Python #AppSec #CodeReview #PentesterLab

So if a doctor rents an apartment I own, I’m a doctor?

“It’s a warning” c’mon.. how many “warnings” do you need?

Do we expect to see a “sustainably sourced data” badge for each SOTA model anytime soon? 😂

It’s like feeding pigs their own shit, or feeding humans food made by humans by (from a shit tonne of chemicals) and wondering why every little kid is now a fat fuck with ADHD.

Simply put: garbage in, garbage out

HTB: Artificial Artificial starts with an AI website where I can upload models that are run with TensorFlow. I’ll exploit a deserialization vulnerability in how TensorFlow handles h5 files to get RCE and a foothold. I’ll find hashes in the database and crack one to pivot to the next user. That user has access to an instance of Backrest running on localhost. I’ll find the config and crack the hash to get access, and then show three ways to get execution as root through the application.

Artificial from HackTheBox is starts with uploading a malicious TensorFlow model to get a foothold through deserialization. I'll abuse Backrest in three different ways for root.

I’m pretty fucking sick of newsletters attempting to convert me to a paying customer

iOS 26 is truly terrible in every way.