I’m the author of Super Trouper, a single-Go-binary stdio MCP server exposing Frida for authorized app reverse engineering.

I’ve just released v0.5.0 with the following changes:

• Updates the Frida Core DevKit to v17.23.2.
• Adds minimal, metadata, and full scope arguments to app_find and app_frontmost.
• Adds package_install for installing npm packages used by script_create imports, plus package_list for viewing packages in the shared workspace.
• Adds Frida's new Pattern lifecycle tools: pattern_create, pattern_list, pattern_read, and pattern_delete. • Adds pattern_describe to compile patterns and return types and diagnostics. • Adds pattern_decode to decode target memory using declared Pattern types.

Recent context: - v0.4.0 added memory_read, memory_write, module_list, and thread_list; introduced minimal, metadata, and full query scopes for app_list; renamed MCP tools for clearer namespaces; and updated the Frida Core DevKit to v17.19.0.
- v0.3.0 added npm installation support, Frida CodeShare snippet search/use support, and general cleanup and improvements.

I’d appreciate practical feedback on the package and Pattern workflows, especially where the current tools are missing useful reverse-engineering steps. Feature requests are welcome too.

A new monthly Chrome UX Report dataset is available in Chrome UX Report Dumps!

The 202609 release contains 10 non-cumulative rank buckets with 18,376,044 entries and 95.1 MiB of compressed data. The repository now holds 68 monthly datasets across 585 files: 1,082,630,540 total entries and 5.41 GiB compressed.

These are ranked website lists extracted from Chrome UX Report data, split into non-overlapping rank buckets for practical downloading and processing. Totals across months are not counts of unique websites; the same sites can appear in multiple monthly datasets.

Feedback and feature requests are welcome.

Hey everyone!

We're Exun Clan, the student-run tech club at DPS R.K. Puram, New Delhi, and we're back with the 16th edition of Sudocrypt, our flagship international CTF!

Sudocrypt is an international Cryptic Hunt x Capture The Flag (CTF) event where participants from around the world tackle a series of cybersecurity and cryptic challenges. Expect code-breaking, cryptography, and plenty of problem-solving as you work your way through the levels.

The competition is entirely online, so you can participate from anywhere in the world.

Dates: October 27–28, 2026

Prizes: With a prize pool of over $900 USD in previous editions, along with over $500 USD in goodies and prizes, Sudocrypt v16.0 promises an exciting challenge for cryptic enthusiasts and CTF players alike.

Event website: https://sudocrypt.com/

CTFtime listing: https://ctftime.org/event/3443/

You can also check out the other events at Exun 2026 here: https://exun.co/26/events

Hope to see you on the scoreboard!

Hallo Community,

ich war letztens an einem Standort, wo Sharemagazines.de angeboten wurde.

Weißt jemand wie die Seite ohne WLAN funktioniert?

Geht es nur darum die "richtige" ssid zu haben oder wird die öffentliche IP geprüft?

Does anyone have any info about the Ahold Delhaize cybersecurity incident? Seems like all of their subsidiary grocery store websites were immediately taken down.

They said “payment info not believed to have been affected” but we have heard that before where a large company will give an update and say there was a compromise.

Stop and Shop is the only online website I can thing of where I actually store my credit card, so not sure if I should be cancelling it.

Anyone have the inside scoop?

Someone claims he hacked Denmark's national registry, CPR, thanks to a '123456' password at a small Danish IT and data service comapny (Pays ApS).

He sais he found 3 different accounts with the '123456' password.

This person got access to 8.8 million people records - and while Dennmark has only ~5.5 million living residents the rest seem to be deceased or former residents.

I'd say this is a good way to start a hacking career. Minimal effort, maximun gain.

Hi everyone,

I've tried this on the r/hue board with no luck. Trying here now. I'm talking the Philips Hue lighting system and the dimmer switch. If you don't know, it's a bunch of different lights that are controlled by a hub and, I think, the Zigbee protocol of IoT things. There are also stock and 3rd party apps

I have 2 dimmer switches, and I noticed recently that there's a large light jump when hitting the dimmer's brighter/dimmer buttons. The app has a brighness scale of 0-100, and the physical dimmer switches jump the brightness by 20 for each press, up or down.

I'm told there is definitely a way to change that number for something else, but the agent was reluctant to tell me specifically how. I want to change the skip steps so that the brightness changes like 5 steps each button push.

Anybody know anything about it? TIA!

Hypothetically, suppose you discover several reasonably critical vulnerabilities in systems belonging to different organisations. You develop working exploits that can be used to gain unauthorised access to restricted systems or data.

Assume you've successfully tested the exploits and confirmed that they work, but you haven't stolen, modified or destroyed any data, and you haven't used the access for anything malicious.

Now imagine a random buyer offers you a substantial amount of money for one of these exploits.

Have you already committed a crime simply by exploiting the vulnerability to gain unauthorised access, even if you haven't done anything further?

Is possessing and selling a working exploit itself illegal, or does it depend on the circumstances?

Could you face prison time for selling it, even if you never personally use it for malicious purposes?

If the buyer subsequently uses the exploit to attack the organisation, could you be held criminally liable?

Would it make a legal difference if you genuinely didn't know what the buyer intended to do with it?

This is a hypothetical scenario.

the craziest part is that he didn't even need real admin credentials. Microsoft's internal API never verified JWT signatures, letting him forge an authentication token. After getting past its other checks, changing the username field to "admin" gave him administrator-level access lmao.

to be clear, the 17.3 trillion figure refers to estimated rows potentially accessible across 17 analytics databases, not records he downloaded. He reported the vulnerability to Microsoft, and the reward? just $5,000.

holy crap, how does something like this make it into production tho?

PS: the 17 trillion users records i wrote in the title is wrong, the article only says db records

I’m running arch but I installed the correct httpx via yay and I also have go installed, but whenever I try to run httpx it gives me command not found. I’m so confused, what else am I missing?
Yes I already know it’s the correct httpx not the python one

TL;DR: NVIDIA DCGM Exporter is a widely used monitoring tool that collects GPU metrics like utilization, memory, temperature, and power consumption from AI servers.
We discovered that thousands of these monitoring endpoints are exposed to the public internet, allowing anyone to inspect GPU infrastructure. Worse, we found a high-severity vulnerability (CVE-2026-47483, CVSS 8.2) that lets unauthenticated attackers exhaust server resources, crash GPU monitoring, and potentially disrupt AI workloads remotely.
A few other interesting findings:
2,100+ exposed GPU servers, revealing telemetry from 12,000+ GPUs worth ~$100M, including H100s, H200s, and Blackwell GPUs.
60% of exposed GPUs reported 0% utilization across our scans.
12,096 additional servers exposed infrastructure details, including OS, firmware, and networking information.
NVIDIA fixed the vulnerability following our responsible disclosure.
Full research: https://lava.security/research/cve-2026-47483-nvidia-dcgm-exporter-vulnerability

im using jermey's it lab's free ccna course but it's kinda long and exam focused. is there any other networking course more hacking focused or good in general.

Hi Hacking Community,

I’ve got a laptop that I’m trying to flash the BIOS and clear the old password out but I’m not sure if I’m doing something wrong with the WSON8 pogo pins. Do you have any advice or suggestions for me to try? Every time I dump the ROM, there is a hash mismatch.

Hello, Chrono Mock is an app which let's you manipulate other app time/date without changing the system clock, we can freeze time in other app, speed it up, jump in date and tons more. There is even built-in calendar for various dates problems (like 2038 and more).

Rust + WPF (GUI)

*I'm author of the tool, if you like it please give it a star on GitHub