Sign in

r (cycloarcane)

@roan.lol
68 followers 80 following 256 posts

CREST certified London based Pentester.

PostsRepliesMedia
r (cycloarcane) @roan.lol · 11/06/2026
Manufacturers hiding their serial solder points from me 😭 just grabbing onto anything lol
Serial wires soldered directly to various points on a smart plug, an esp32 is connected to them
010
r (cycloarcane) @roan.lol · 05/06/2026
Got some uranium glass beads to test my AliExpress Geiger counter...it definitely works 😅 #radiation
A circuitboard Geiger counter on a bed of fluorescent beads on a plate.
000
r (cycloarcane) @roan.lol · 03/06/2026
A little journey into reverse engineering suspicious VR mods to check for phoning home roan.lol/content/2026...
000
r (cycloarcane) @roan.lol · 02/06/2026
From F-Droid to independent devs, the entire Android ecosystem is under threat from Google's new mandatory registration decree. See why 67+ orgs are saying no: keepandroidopen.org
keepandroidopen.org
Keep Android Open
Your phone is about to stop being yours. In September 2026, Google will block every Android app whose developer hasn't registered with them.
000
r (cycloarcane) @roan.lol · 17/05/2026
"An attacker can learn basically anything about the organization from your AI inference — API keys, proprietary code, customer contracts, and much more," Cyera security researcher Dor Attias said. thehackernews.com/2026/05/olla...
thehackernews.com
Ollama Out-of-Bounds Read Vulnerability Allows Remote Process Memory Leak
Critical out-of-bounds read in Ollama before 0.17.1 leaks process memory including API keys from over 300000 servers via crafted GGUF files.
000
r (cycloarcane) @roan.lol · 05/05/2026
I was just sent CCTV of the wrong ginger person after a GDPR SAR CCTV request. I would not want to be that DPO in the morning 💀
000
r (cycloarcane) @roan.lol · 23/04/2026
TeamPCP putting "Shai-Hulud: The Third Coming" in the actual code is so funny 😭
000
Reposted by r (cycloarcane)
Gil Durán @gilduran.com · 20/04/2026
The CEO of Palantir posted a fascist manifesto on X. I pointed out that it was fascist—which resulted in a permanent suspension from X (my second time!). So, when you hear the tweeters complaining that BlueSky is intolerant, remember why many of us came here in the first place.
Gil Duran tweet: TLDR: Fascism

in response to Palantir's long fascists screed on X."Your Account is Suspended" Message on X
313137094136
r (cycloarcane) @roan.lol · 20/04/2026
It's much harder for companies to prey on you when you have a compliance background lol
An email screenshot with the text: "I am pleased to inform you that I have received a request from the branch to now close the claim. Your £250 charge has been refunded this morning.  We do advise to allow up to 10 days to reach your own account.

 An email will follow to confirm the closure of the claim and refund, but I also just wanted to email you directly as well."
000
r (cycloarcane) @roan.lol · 13/04/2026
Daily CC activities
A conversation with claude code where the user asks "why world so scary" and Claude responds "Because attack surfaces are everywhere and people are creative. But you just made yours a tiny bit smaller, so that's something."
000
r (cycloarcane) @roan.lol · 12/04/2026
"I've seen all of those" "Rough. You've burned through everything good. At that point I'd say either branch into adjacent stuff—Korean thrillers, European sci-fi—or go back to older films you might have missed. But that's not really what you asked for. Enjoy whichever film you pick. Good night!"
000
r (cycloarcane) @roan.lol · 26/03/2026
Ahhhh 😭 www.securityweek.com/hackerone-em...
securityweek.com
HackerOne Employee Data Exposed in Massive Navia Breach
HackerOne is notifying nearly 300 employees that their personal information was exposed in a data breach recently disclosed by Navia.
000
r (cycloarcane) @roan.lol · 24/03/2026
roan.lol/content/2026...
roan.lol
roan.lol - Reproducing the Trivy-LiteLLM Supply Chain Kill Chain
000
r (cycloarcane) @roan.lol · 24/03/2026
People saying the LiteLLM breach is a problem with pip or AI or random other things lol. It is a problem with using ci/cd workflows with components you don't control who themselves are using dangerous options like pull_request_target. hackerbot-claw being the perpetrator is pretty crazy though.
000
r (cycloarcane) @roan.lol · 23/03/2026
OS-level age verification broooooo 😭 leginfo.legislature.ca.gov/faces/billTe...
leginfo.legislature.ca.gov
000
r (cycloarcane) @roan.lol · 16/03/2026
Two sentence horror: Hunter: "Please find below a PoC video that shows all the steps required: www.youtube.com..." Triage: "Please immediately remove this video from youtube as that violates the code of conduct of H1. Any videos should be uploaded directly to the report as an attachment."
000
r (cycloarcane) @roan.lol · 15/03/2026
reading @hacker0x01.bsky.social reports makes you realise both that there are still plenty of bug bounties to be found even in the AI age, and that you are ultimately responsible for vetting everything within your control in requests because as successful as bounties have been there are still holes.
001
r (cycloarcane) @roan.lol · 14/03/2026
yay
000
r (cycloarcane) @roan.lol · 12/03/2026
AI coding agents love git add -A. They don't love your .env file staying private. New post on what actually happens when secrets end up in git and how to fix it properly. roan.lol/content/2026...
roan.lol
roan.lol - Vibe Coding and Git Secrets: What AI Assistants Won't Tell You
000
r (cycloarcane) @roan.lol · 11/03/2026
Firefox completely silently removed support for animated gif fav icons and I had to convert it so svg and css does the cruelty of this world ever relent
010
r (cycloarcane) @roan.lol · 09/03/2026
I was revising for some cyber certs recently and found free revision tests/quizzes a bit hard to come by, so I've been making an in-browser app. I also made an android-wrapper app so I can have something to do on the tube when there's no signal lol github.com/cycloarcane/...
github.com
GitHub - cycloarcane/cybersecurity-revision-quizzes: This repository contains quiz resources to accerstain competency for various standards and certifications.
This repository contains quiz resources to accerstain competency for various standards and certifications. - cycloarcane/cybersecurity-revision-quizzes
000
r (cycloarcane) @roan.lol · 07/03/2026
I love thinking about the dead ends "An attacker in a multi-tenant cluster with permission to create/modify ingresses can inject content into the connection-proxy-header annotation and read arbitrary files from the ingress controller (including the service account)." hackerone.com/reports/2701...
hackerone.com
Unsupported Browser | HackerOne
000
r (cycloarcane) @roan.lol · 06/03/2026
178 days remain until stores like F-droid no longer function on Android and the platform is locked down with verification for all developers. #android #digitalrights keepandroidopen.org
keepandroidopen.org
Keep Android Open
Advocating for Android as a free, open platform for everyone to build apps on.
000
r (cycloarcane) @roan.lol · 05/03/2026
AI generated duplicate reports on hacker one must be really annoying to deal with, clearly happening as recently as January. Also just responding 'copy' 💀 unless I'm missing something...
000
r (cycloarcane) @roan.lol · 01/03/2026
"Kali Linux ships an official package called mcp-kali-server that exposes the Kali toolset to AI clients over the Model Context Protocol. Combined with Claude Code, this means you can ask Claude to run nmap, nikto, or any other Kali tool..." roan.lol/content/2026...
020
Reposted by r (cycloarcane)
Sung Kim @sungkim.bsky.social · 26/02/2026
I guess being an anime anon doesn't work anymore. "Large-scale online deanonymization with LLMs" They show that large language models can be used to perform at-scale deanonymization. With full Internet access, our agent can re-identify Hacker News users and
35222
r (cycloarcane) @roan.lol · 26/02/2026
Introducing VulnHive a collection of vulnerable docker containers mapped to the OWASP top 10, with a SOC to observe incoming attacks. Perfect for testing automated hacking frameworks. github.com/cycloarcane/...
000
r (cycloarcane) @roan.lol · 26/02/2026
been messing with AI pentesting tools (strix, artemis, shannon) but mcp-kali-server might just be the meta. kali now ships it officially. apt install mcp-kali-server, forward a port, drop 1 SSH command in your claude config. Claude Code is the right client, the AUR desktop app is just a site wrapper
310
Reposted by r (cycloarcane)
Electronic Frontier Foundation @eff.org · 24/02/2026
The rampant data sharing fueled by online tracking has serious consequences. Privacy Badger blocks online tracking to prevent your browsing data from being used against you. www.eff.org/deeplinks/2...
eff.org
Online Tracking is Out of Control—Privacy Badger Can Help You Fight
Every time you browse the web, you're being tracked. That’s why EFF created Privacy Badger, a free, open source browser extension used by millions to fight corporate surveillance and take back
412539
r (cycloarcane) @roan.lol · 24/02/2026
70% of the models on Ollama are now...cloud based? I get that they're open(ish) ones still but doesn't this mostly defeat the purpose of local models and availability.
000
r (cycloarcane) @roan.lol · 24/02/2026
Got around to posting some hacking labs write-ups to my domain! roan.lol/content/labs...
roan.lol
R̶̼̘͌͊̄̉̒O̵̰̿͆͊̅̈Ȃ̵̖̲͍͎̲̎̐̇͐͠N̸̯̲̝̥̲̚͝ͅ.̵̣̔L̴̫̩̻̘̀̒̓̑Ó̴̤L̵̡̰͚̮̃̑̕̚ - Hacking Labs
000
r (cycloarcane) @roan.lol · 07/08/2025
Critical vulnerability in Nvidia Triton servers, immediate action required www.wiz.io/blog/nvidia-...
wiz.io
Breaking NVIDIA Triton: CVE-2025-23319 - A Vulnerability Chain Leading to AI Server Takeover | Wiz Blog
Wiz Research discovers a critical vulnerability chain allowing unauthenticated attackers to take over NVIDIA's Triton Inference Server.
000
r (cycloarcane) @roan.lol · 28/07/2025
check out my latest article on automated hacking agents and CAI!! roan.lol/content/2025...
010
Reposted by r (cycloarcane)
The Onion @theonion.com · 26/03/2025
Teen Warned Not To Accept Group Chat Invites From National Security Advisors She Doesn’t Know
Teen Warned Not To Accept Group Chat Invites From National Security Advisors She Doesn’t Know
3474550410021
r (cycloarcane) @roan.lol · 26/03/2025
Got the @eff.org #Rayhunter tool working on the Verizon Orbic and now happily hunting stingrays around SF 🥰
000
r (cycloarcane) @roan.lol · 18/03/2025
My mum asked me about Roko's Basilisk today 😭😭😭
010
Reposted by r (cycloarcane)
Anil Dash @anildash.com · 16/03/2025
Every person on Bluesky should know: * Every post on Bluesky is PUBLIC forever * Every post on Bluesky is archived by ICE, NSA, and many other agencies * Even if you delete a post, it’s already been captured * Judges don’t care if you were “kidding” or being ironic www.404media.co/the-200-site...
404media.co
The 200+ Sites an ICE Surveillance Contractor is Monitoring
404 Media has obtained the list of sites and services that ICE contractor ShadowDragon pulls data from. ShadowDragon sources data from all over the web and lets government analysts easily search it an...
12332357212532
r (cycloarcane) @roan.lol · 17/03/2025
Pylon Watchers UK Division 🤪
000
r (cycloarcane) @roan.lol · 16/03/2025
My first and possibly only trip to treasure island #sanfrancisco
030
r (cycloarcane) @roan.lol · 12/03/2025
Mannequins
010
r (cycloarcane) @roan.lol · 06/03/2025
Nooooooooo 😭
000
r (cycloarcane) @roan.lol · 06/03/2025
Pocketpal lets you run llms on your phone and it has the easiest setup 🧑‍🦰
010
r (cycloarcane) @roan.lol · 06/03/2025
Life is so quirky sometimes lmao
110
Reposted by r (cycloarcane)
Electronic Frontier Foundation @eff.org · 05/03/2025
Cell-site simulators (CSS, also known as Stingrays or IMSI catchers) are devices that masquerade as legitimate cell-phone towers, tricking phones within a certain radius into connecting to the device rather than a tower. Our new tool, Rayhunter, can help you find them.
eff.org
Meet Rayhunter: A New Open Source Tool from EFF to Detect Cellular Spying
Rayhunter is a new open source tool we’ve created that runs off an affordable mobile hotspot that we hope empowers everyone, regardless of technical skill, to help search out cell-site simulators (CSS...
6301113
Reposted by r (cycloarcane)
Sung Kim @sungkim.bsky.social · 05/03/2025
Alibaba's QwQ-32B, a new reasoning model with only 32 billion parameters that rivals cutting-edge reasoning model, e.g., DeepSeek-R1. Blog: qwenlm.github.io/blog/qwq-32b HF: huggingface.co/Qwen/QwQ-32B ModelScope: modelscope.cn/models/Qwen/... Demo: huggingface.co/spaces/Qwen/... Chat: chat.qwen.ai
4315
Reposted by r (cycloarcane)
Sung Kim @sungkim.bsky.social · 06/03/2025
A Waymo vehicle was driving in a 25mph zone in LA when an oncoming car swerved into its lane while speeding up to over 70mph… 3x the speed means 9x the destructive energy. Waymo vehicle reacted safely. Source: Dmitri Dolgov (Co-CEO at waymo)
0388
r (cycloarcane) @roan.lol · 06/03/2025
A quick thought on how we should be integrating LLMs into our stacks. roan.lol/updates/opin...
011
r (cycloarcane) @roan.lol · 06/03/2025
OpenAI just released o1 and o3 API access but o1 is $60 per million output tokens. I guarantee someone is going to set it for testing then forget and be very poor after 😭
000
r (cycloarcane) @roan.lol · 15/02/2025
I don't think I've ever read a paper where I have more hands-on experience with the subject matter. LLM powered automated penetration testing and network attack applications were one of the first areas I explored after the release of ChatGPT. paperswithcode.com/paper/on-the...
paperswithcode.com
Papers with Code - On the Feasibility of Using LLMs to Execute Multistage Network Attacks
No code available yet.
010