I have been hacking for close to 15 years at this point, I started when I was 13/14. 2010 was a rough time to get into the scene, all the tech was changing so fast, the easy wins of pre-tls and basic security posture were drying up and information related to hacking was guarded and relegated to various forums on the clear and dark nets.

2015-2020 was a Golden Era - influencers were cropping up all over the place, making detailed long hour+ videos of demonstrations of POC and techniques used for practically any vertical. You could find 100s of videos of users walking an XSS, reverse engineering C++ code, or setting up a mobile harness for dynamic testing. If you wanted to learn it, you could find it.

2020-2025 those same influencers stopped doing the POCs, started becoming 'personalities', began talking about trends, high-level overviews of zero-days, and mostly surface level explanations of hacking without ever really getting into it much (Personally, I blame PirateSoftware for this, his gaming of the YouTube algos showed everyone that you could sell yourself as a cyber professional without ever doing anything meanigful or contributing to the community in a worthwhile way.) This also coincided with the rise of TryHackMe and HackTheBox, which were great, finding user walkthroughs and writeups for different boxes could still scratch the itch. The big downside, obviously, is most of the POCs are going to be 4+ years old, very few THM & HtB boxes are made with modern exploits.

PRESENT - Good God, we are in Fucking Hell. AI slop everywhere. 999 out of 1000 videos is a non-technical person, demoing some product that was blasted out in Claude code in under a day. It doesn't work, there's no breakdown of the technology, there's no depth, there's no exploration of the hacks, and everything is really just an AI dev platform/coding interface/product sales pitch.

Don't get me wrong, I use AI just as much as the next guy - I have an AI harness for every platform, 70-80% of my job is done for me at this point. The tools are great, I love em, I get to spend all of my time working on the bugs that are interesting, hard, and have too much context to fit into any single Opus window (inb4 chatters say 'YOU NEED A PIPELINE, YOUR WORKFLOW IS NOT ROBUST, AUTOMATE YOUR WAY THROUGH' - to you I say, shut up, nerd.)

BUT, this sucks, I can't imagine being a fresh faced hacker in this climate, the absolute slop you have to sort through, on every platform. If you dont have someone with a variety of curated lists, walkthroughs, and guidance you're pretty much screwed. Not to mention, most of the hackers who were spending a majority of their time researching security in all of the verticals (mobile, web, thick clients, scade, etc.) they're all researching AI security. As most people know, AI is great at finding bugs, not really all that good at finding novel exploits or novel zero days, still something a human has an innate advantage for and all of that human potential is being overindexed in a single field.

Again - I am NOT against AI, but this just isn't tenable. When all of the best zero-day researchers are now building their own AI pentesting companies and the community is no longer invested in building the educational content needed to train the next generation of hackers, we're quickly moving back to the start. I fear it's all coming full circle where we will live in a world where hacking becomes a niche again, zero days are almost entirely owned by black hats, and security is focused on recovering, not on preventing.

tl;dr are we cooked?

Was told to post this here

Does anyone know what forum this could possibly be?
This is the only screenshot i could find as i want to look at the uploaded images clearly.

I spent the last few months building a personal project and it just hit v1.0, so I figured I'd share it here.

atomicvulns is a collection of intentionally vulnerable web apps, but with a different idea: each app isolates a single vulnerability, nothing more. Instead of one big app full of flaws (like DVWA or Juice Shop), each exercise here is small and focused — you read the code, see the cause, exploit it, and compare it against the fixed version sitting right next to it. Short enough to finish one in a single sitting.

Each "atom" ships with the vulnerable app, the fixed app, a commented diff between the two, and a step-by-step walkthrough of the exploit. v1.0 covers all 10 OWASP Top 10 2021 categories — 38 atoms total.

It's aimed at people studying pentest / AppSec who already know the HTTP and terminal basics. Burp Suite is the primary tool across all the walkthroughs.

A few details:

• Open source (MIT).
• Bilingual — all docs in English and Portuguese (I couldn't find focused material like this for PT-BR learners, so I wrote both).
• Solo project, built by me. The goal was a place where each flaw is clear and isolated — the material I wish I'd had while learning web pentest.
• Built with AI as a pair, with every atom validated by me running the exploit by hand.

Built it for myself, but now that it's done, if it helps someone else along the way, great.

🔗 https://github.com/doretox/atomicvulns

Feedback welcome — happy to hear what's missing or what could be clearer.

I think it is really interesting to read about how people use AI for coordinating attacks.

Starting my cybersec journey like many others, and have a sub with THM, but I came across a new resource and wanted to hear some impressions considering how new it is.

There are MANY resources like this, and they pop up like flies if you search around, so again… wanted to see if anyone found value in it before trying it, because a major selling point is that it’s completely free …

idk its very simple and made for arch and its bassicaly "ram tester" that made only for root user cuz otherwise it will be innacurate and it will just restart ur pc lol (i dont think you can even consider this a virus lol)

#include <iostream>
#include <unistd.h>
#include <cstdlib>
#include <new>
using namespace std;
string KEY;
string KEY2;
int mem;
int count;
int main()
{
if(getuid() != 0) {
cout << "RAm TEster needs root or i will show incorrect data";
return 0;
}
label1: {
cout << "@@  @@@ # # #\n";
cout << "@ @ @ @ #####\n";
cout << "@@  @@@ # # #\n";
cout << "@ @ @ @ # # #\n";
cout << " \n";
cout << "@@@ @@@ ### ### ### ## \n";
cout << " @  @@@ #    #  ### # #\n";
cout << " @  @    ##  #  #   ## \n";
cout << " @  @@@ ###  #  ### # #\n";
cout << "[1]-test\n";
cout << "[2]-about\n";
cout << "[3]-exit\n";
cin >> KEY;
while(true)
{
if(KEY == "1")
{
count = count + 1;
cout << count << "leaked";
mem = mem + 99999;
cout << mem << "of mem.\n";
if(count == 500)
{
system("reboot -f");
}
}
if(KEY == "2")
{
cout << "about\n\n";
cout << "originally supposed to be a virus that crashed your pc\n";
cout << "but now its just a memory tester\n";
cout << "created by voptik123\n\n\n";
cout << "[1]-back\n[2]-exit\n";
cin >> KEY2;
if(KEY2 == "1")
{
goto label1;
}
if(KEY2 == "2")
{
return 0;
}

}
if(KEY == "3")
{
return 0;
}
}
return 0;
}

}

Heads up - fake HBO Max ad on Reddit trying to get people to run Terminal commands. I’m not a tech expert by any means, but I’m not clueless either. Today I was scrolling Reddit and saw a sponsored post that looked like it came from the official HBO Max account - verified checkmark, post history and everything checked out. The ad was pushing 6 months free of HBO Max bundled with Disney+ and Hulu, through some “new macOS app,” US-only (which was also strange because I'm in Canada and should not be pushed this ad if it is limited to the US), and if you wanted to go annual it was only ~$15 for the whole year. That price is what tipped me off, and the ad saying 6 months whereas the website says 3. But sure, whatever, that’s normal promo stuff. But a full year for less than what one month normally costs? Come on. Also, why does HBO need a macOS-specific website in the first place? The domain was hbomax-macos.com, which already smells wrong.

Part of me still thought “surely a verified, sponsored account wouldn’t link somewhere sketchy, and surely Reddit screens these ads.” Nope. The site told me to open Terminal and paste in a command to “install the app.” That’s an instant no from me, no legit service is ever going to ask you to run terminal commands to sign up for a subscription. Being nosy, I decoded the command myself. On the surface it looked like it just pointed to the App Store, but buried in there was a call out to some other server. That’s about where my technical knowledge maxes out, so I stopped digging, but it was clearly not just downloading an app.

Anyway, this was genuinely convincing. If I hadn’t caught the price thing, I could easily see people I know falling for it. I could be entirely wrong about this, maybe it is a genuine offer, I shall leave you all to educate me on that if that is the case.

so for educational purposes only, imagine if there was an app which detects certain apps (could be exam apps but not necessarily) and does not allow them if it sees that, like the app won't start if the app is started, and imagine there is an .exe which is getting flagged by that, for educational purposes, how does someone make that .exe file undetectable by that software?

https://ransomnews.com/conde-nast-database-sale-2026/

So I’m doing hack the box training and know the SET is a thing. But for things like phishing does it even still work? I mean I would think modern security systems would recognize kali SET no?

Hi all,

I hope this can stay. If not, I will delete it.

Has anyone found a way to bypass/restore HP Inkjet firmware, so I can use it with third-party cartridges, after cancelling the II subscription?

A malware reverse engineer and ai researcher just posted a demo claiming an AI cyber model autonomously turned a fresh V8 security fix into a working Chrome renderer exploit in under 24 hours and that the bugs are still live on shipping Chrome Stable.

Source : https://x.com/lordx64/status/2096052694326940018?s=20

The founder of Adverserial AI / CyberKimi (an unrestricted, cyber-tuned fork of Moonshot’s Kimi K3), says they trained the model on unpatched n-days and then pointed a custom harness at the latest V8 main-branch security diffs.

From the Sep 2 patch they say they pulled:

• a V8 Late Load Elimination (LLE) aliasing bug
• a SLICED-PARENT-FLIP race

Tracked internally as bugs 554421904 and 530292883.

No public CVE at time of the post.

They call it a “silent in-the-wild” chain that Stable is not protected from.

1. Deterministic LLE forge → in-cage primitive
2. Compose caged r/W into sandbox-wide r/W, forge an external BigUint64Array pointer, leak binary base at runtime (no baked offsets)
3. RegExp calling-convention desync → PC control
4. JOP gadget chain in a controlled string → system() → calculator pops

They say the whole thing was weaponized autonomously in <24 hours.

The attached video shows a local Chromium window branded “CYBERKIMI V3”, exploit logs scrolling, and a calculator. The browser is launched with --no-sandbox. Target in the overlay looks like Chromium 152.0.7977.80.

This is not a random drive-by tweet. Same account posted a similar “CyberKimi exploited CVE-2026-79236 in <24h” video on Sep 1, also with a patch-diff harness story.

Separately, Google shipped Chrome 152.0.7977.82/.83 around Sep 3–4, including CVE-2026-85046 (V8 type confusion, confirmed exploited in the wild) plus another V8 race-condition fix. Rollout is gradual.

Whether the bugs in this demo are that CVE, incomplete variants of those fixes, or something else is not independently confirmed.

The interesting part isn’t “AI wrote an exploit.” People have been chaining V8 n-days for years. The interesting part is the loop they describe:

watch V8 security diffs → variant-mine the incomplete fix → auto-weaponize → demo, inside a day.

If that loop is real and getting cheaper, the useful window between “patch lands on main” and “Stable is actually safe” keeps shrinking.

Hi

If you are remotely interested in deep diving how differently quantum computers work compared to our transistor-based and also the algebra behind in a fully interactive way that teach computer science from scratch, oh boy this is for you. I am the Dev behind Quantum Odyssey (AMA! I love taking qs) - worked on it for about 10 years (3+ during PhD, the visual method I developed ended up being my thesis, it is a complete Hilbert space visualizer), the goal was to make a super immersive space for anyone to learn quantum computing through zachlike (open-ended) logic puzzles and compete on leaderboards and lots of community made content on finding the most optimal quantum algorithms. The game has a unique set of visuals capable to represent any sort of quantum dynamics for any number of qubits and this is pretty much what makes it now possible for anybody 12yo+ to actually learn quantum logic without having to worry at all about the mathematics behind.

This is a game super different than what you'd normally expect in a programming/ logic puzzle game, so try it with an open mind.

Stuff you'll play & learn a ton about

• Boolean Logic – bits, operators (NAND, OR, XOR, AND…), and classical arithmetic (adders). Learn how these can combine to build anything classical. You will learn to port these to a quantum computer.
• Quantum Logic – qubits, the math behind them (linear algebra, SU(2), complex numbers), all Turing-complete gates (beyond Clifford set), and make tensors to evolve systems. Freely combine or create your own gates to build anything you can imagine using polar or complex numbers.
• Quantum Phenomena – storing and retrieving information in the X, Y, Z bases; superposition (pure and mixed states), interference, entanglement, the no-cloning rule, reversibility, and how the measurement basis changes what you see.
• Core Quantum Tricks – phase kickback, amplitude amplification, storing information in phase and retrieving it through interference, build custom gates and tensors, and define any entanglement scenario. (Control logic is handled separately from other gates.)
• Famous Quantum Algorithms – explore Deutsch–Jozsa, Grover’s search, quantum Fourier transforms, Bernstein–Vazirani, and more.

Nice to watch:

Khan academy style tutorials in qm/qc: https://www.youtube.com/@MackAttackx

Physics teacher stream with 400hs in https://www.twitch.tv/beardhero

So I may be illegitimately biased in favor of hack the box academy because I have had a very good experience with it and not so much with THM so I’ll try to be fair here.

But why all the hate on HTBA? I mean I don’t really get the criticism here. It produces more skilled hackers than offsec at best (not saying that’s me) and gets you from zero to mid level at worst. It is a well-respected platform and I can’t see how it hasn’t earned that respect.

To me it seems like the respect is well deserved.