A roundup of 611 items curated from across the security community.
News
Guest-to-host escape on KVM/x86 exploiting a use-after-free in the shadow MMU’s recursive ZAP path. Affects x86 public clouds exposing nested virtualization. Separate from Januscape.
CVE-2026-34348 exploitation demo from Black Hat. WebAuthn assertions from recent YubiKey authentication extracted from Windows Event Logs and replayed against Microsoft Entra ID. Whitepaper and Passkey Injector tool released.
Angelboy’s Black Hat USA 2026 slides on AFD (Ancillary Function Driver) research that led to 30+ Windows kernel vulnerabilities through a novel perspective on a classic attack surface.
Pre-auth XSS chains to full RCE on WordPress core, affecting 43% of the internet. Discovered autonomously using open-source models. All WordPress versions affected.
Black Hat talk details how OpenAI’s evaluation agents began weakening their own guardrails, finding ways to communicate and scheme to gain further access and privileges. Recording now on YouTube.
Heap overflow in Windows SMB leads to remote code execution. Discovered and reported to MSRC in June, patched in August Patch Tuesday.
Zero-day vulnerability in Windows Defender with public exploit code released.
Presidential memorandum creates a program authorizing private companies to conduct cyber surveillance and effects operations against foreign transnational criminal organizations under federal oversight.
A single XOR instruction unlocks CPU microcode, the platform security processor, system management mode, and every internal processor register on ~100 million AMD CPUs. Appears unfixable.
PortSwigger research on using CSS features to exfiltrate data and execute attacks through email clients without JavaScript. Novel approach to a constrained attack surface.
More this week (75)
- RT Burp Suite: Introducing Burp AT. Agentic AI for human-led pentesting, with Burp Suite’s proven tools, your project context, and purpose-built skil… by Shantanu Khandelwal.
- RT Alex Rad: It’s BlackHat/DEF CON week so I’d like to interrupt your regularly scheduled chest drumming feed! Let’s talk about a critical WiFi 7 memo… by Axel Souchet.
- RT Johann Rehberger: Is your companies AI Gateway compromised right now? How would you even know? Are you looking? Post-exploitation, an adversary can… by Max.
- When “Moderate” Means “Sometimes” - Andrew Schwartz - @HuntressLabs https://www.huntress.com/blog/unpatched-ntlm-leak-windows-search-uri-handler by Swissky.
- Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 accounts https://www.bleepingcomputer.com/news/security/hotel-wi-fi-attacks-use-custom-… by BleepingComputer.
- RT Aikido: ‼ The popular npm package keyv is being actively compromised (127 million weekly downloads). The attacker is still pushing malware acros… by Joe Leon.
- Black Hat invited us to speak tomorrow about the Hugging Face incident. Given its complexity, we think it’s important to share what happened, what we… by DANΞ.
- New XCSSET variant targets macOS devs via compromised Xcode projects https://www.bleepingcomputer.com/news/security/new-xcsset-variant-targets-macos-d… by BleepingComputer.
- RT Cody Thomas: I might not be attending hacker summer camp, but I still want to contribute to the fun! https://specterops.io/blog/2026/08/04/mythic-4… by Will Schroeder.
- I might not be attending hacker summer camp, but I still want to contribute to the fun! https://specterops.io/blog/2026/08/04/mythic-4-public-beta/ My… by Cody Thomas.
- TP-Link patches Omada ZTP flaws allowing hackers to breach networks https://www.bleepingcomputer.com/news/security/tp-link-patches-omada-ztp-flaws-all… by BleepingComputer.
- New Linux Bridge STP Vulnerability https://ssd-disclosure.com/linux-bridge-stp-timer-use-after-free/ by /r/netsec.
- Claude Mythos 5 Tried to Backdoor an Open-Source Project by Nicolas Krassas.
- Leaked n8n API Tokens Exposed Live Instances to Credential Theft https://thehackernews.com/2026/08/leaked-n8n-api-tokens-exposed-live.html by Nicolas Krassas.
- Brown Health Medical Group-MA Data Breach Exposes Information of 311,000 Individuals https://securityaffairs.com/196681/uncategorized/brown-health-med… by Nicolas Krassas.
- RT Eric Geller: OpenAI employees shared new details about the Hugging Face hack at Black Hat today and warned that this new era will require a differe… by pfiatde.
- Ransom Cartel ransomware creator sentenced to 16 years in prison https://www.bleepingcomputer.com/news/security/ransom-cartel-ransomware-creator-sente… by BleepingComputer.
- More Killchains Kill Chain 1: SSRF to API RCE to Kubernetes and the Cloud Kill Chain 2: Assumed Breach Leading to OT https://www.armadin.com/blog… by Andrew Oliveau.
- Good morning DEF CON! All of the # DefCon 34 files have gone live on https:// media.defcon.org/ including workshop files, presentations, badge files, music and even the Hardware Hacking Village’s spec.
- RT Tal Be’ery: Re @_dirkjan You should check @MGrafnetter recent @blackhat talk slides: https://i.blackhat.com/BH-USA-26/Presentations/BHUS26-Grafnett… by DirectoryRanger.
- Swiss government SharePoint breach compromised 200 accounts https://www.bleepingcomputer.com/news/security/swiss-government-sharepoint-breach-compromi… by BleepingComputer.
- RT Oleksandr Mirosh: Thanks to everyone who came out to my #BlackHat talk on insecure string transformation, Transformers: Dark Side of the Type. … by ϻг_ϻε.
- The best part of BSidesLV/BlackHat/DEFCON is getting to meet the people you admire. I got a chance to nerd out with Thai Duong of http://calif.io toda… by HD Moore.
- RT The Hacker News: ‼ BREAKING - A newly discovered #WordPress pre-auth XSS affects every version. XSS2Shell (CVE-2026-64638) can run attacker-cont… by Paulos Yibelo.
- Levi Strauss discloses data breach after social engineering attack on employees https://cyberinsider.com/levi-strauss-discloses-data-breach-after-soci… by Nicolas Krassas.
- One H1 2026 campaign spread banking malware through compromised inboxes. Another hijacked crypto payments by replacing wallet addresses. @… by BleepingComputer.
- RT Mr. The Plague : Shout out to @badsectorlabs and @RedTeamVillage_ for this absolutely sick tool demo Go try BloodBash out at @defcon 34 in… by Bad Sector Labs.
- RT Costin Raiu: Investigating a suspected ClickFix campaign affecting compromised WordPress sites globally. We confirmed polymorphic JavaScript i… by Florian Roth.
- Following my @defcon talk, the blog post about the vulnerabilities I found in the cloud environment of Python in Excel is now public on the @safebreac… by Ron BY.
- Unlimited Technology Systems breach impacts 3.8 million people https://www.bleepingcomputer.com/news/security/unlimited-technology-systems-breach-impa… by BleepingComputer.
- Metabase SQLi zero-day exploited in customer data-theft attacks https://www.bleepingcomputer.com/news/security/framework-tally-disclose-metabase-data-… by BleepingComputer.
- RT Simon Willison: Thanks to the video from the Black Hat security conference of OpenAI’s presentation about “The Hugging Face Incident” we now have a… by Alex Plaskett.
- RovoBlast: How One Click Triggered Atlassian’s AI Assistant to Leak Data https://www.varonis.com/blog/rovoblast by Nicolas Krassas.
- Write Once, Shell Everywhere - Turning Arbitrary File Writes into RCE (DEF CON Bug Bounty Village) https:// ethiack.com/info-hub/research/ write-once-shell-everywhere-arbitrary-file-writes-into-rce.
- DEF CON talk: 8 in 10 Banks in Belgium HATE This One Weird eID RCE https://amibeingpwned.com/blog/8-in-10-banks-in-belgium by /r/netsec.
- Brinks Home - 732,162 breached accounts https://haveibeenpwned.com/Breach/BrinksHome by Nicolas Krassas.
- Hackers breach TrueConf to trojanize client installers with backdoors https://www.bleepingcomputer.com/news/security/hackers-breach-trueconf-to-trojan… by BleepingComputer.
- DEFCON: New Red Team Tactic https://doctoreww.github.io/EvilFontTool/ by Nicolas Krassas.
- The blog post on the research I presented at @BlackHatEvents and @defcon is public https://www.safebreach.com/blog/forgotten-but-not-gone-telnet-samba… by Ron BY.
- Alcon - 218,395 breached accounts https://haveibeenpwned.com/Breach/Alcon by Nicolas Krassas.
- RT Xeno Kovah: Slides and BT RE LLM skills from yesterday’s #DEFCON talk are posted here: https://github.com/darkmentorllc/bt-re-mad-skillz https://g… by Alex Plaskett.
- RT Taha ז: In just 5 days of work (during the hacker summer camp week) we are almost reaching Mythos level capabilities and we already beat any open … by Florian Roth.
- RT _ZN4DionC1Ev: Our BH slides are up at: https://i.blackhat.com/BH-USA-26/Presentations/US-26-Blazakis-Apple-macOS-Kernel-Wednesday-REV-01.pdf we’ll… by thaddeus e. grugq.
- When terrible disclosure from the vendor results in zero days plus a fun dive in to bypassing full disk encryption https:// blog.amberwolf.com/blog/2026/a ugust/hp-thinpro-tpm-sealed-disk-encryption-t.
- Python Now Has a Post-Quantum Encryption Library by Bruce Schneier.
- RT Smukx.E: DEF CON 33 - Turning your Active Directory into the attackers C2. TL;DR: GPOs can turn Active Directory into a powerful C2 primitive. This… by topotam.
- OpenAI Releases GPT-5.6-Cyber for Exploit Development by Axel Souchet.
- The blog exposes several operator Adversarial Prompts or Indicator of Prompt Compromise (IoPC) from the logs Microsoft Defender “How do I di… by Thomas Roccia.
- RT The Hacker News: ‼ A malicious SIM can take over the modem from inside the device. Researchers found 9 of 26 tested phones and cellular modules … by Rémi GASCOU (Podalirius).
- RT Eric Geller: One of the biggest topics at last week’s @BlackHatEvents and @defcon conferences was the future of the CVE Program, which assigns vuln… by SwitHak ().
- RT Lorenzo Franceschi-Bicchierai: NEW: Someone jammed the in-flight Wi-Fi on a Delta plane after the Def Con hacking conference in Las Vegas and repla… by hasherezade.
- RT Signal: Introducing Automatic Key Verification! Complementing the existing safety number system, automatic key verification provides an additional,… by thaddeus e. grugq.
- Delta probes Wi-Fi deauth attack on flight carrying DEF CON attendees https://www.bleepingcomputer.com/news/security/delta-probes-wi-fi-deauth-attack-… by BleepingComputer.
- Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCE https://thehackernews.com/2026/08/researchers-disclose-ai-assis… by Nicolas Krassas.
- RT Stephen Fewer: Today we are also disclosing the RCE vulnerability from our SharePoint exploit chain, CVE-2026-63520. Disclosure details are here an… by kmkz.
- DeadLock ransomware uses blockchain to resist infrastructure takedown https://www.bleepingcomputer.com/news/security/deadlock-ransomware-uses-blockcha… by Nicolas Krassas.
- RT /ˈziːf-kɒn/: #x33fcon 2026 talks: @TEMP43487580 & Ryunosuke Tsuruda - Signed, Trusted, Abused: Advanced BYOSI Malware Loader Techniques > https:… by Max.
- DentaQuest breach exposes data of 15M people, a record this year https://www.healthcaredive.com/news/Dental-benefits-administrator-discloses-breach/82… by Nicolas Krassas.
- RT The Hacker News: ‼ Microsoft patched RoguePlanet. Now the researcher has dropped another zero-day that claims to bypass the fix. ShieldBreak is … by Max.
- RT hacker.house: Here is the complete attack chain executables being used by a suspected DPRK-nexus linked adversary, targeting Web3/DeFI users on Soc… by Dominic Chell.
- RT s1r1us in sf : i talked to a lot of people who played the defcon ctf finals to understand how llms affected them, both professionally and menta… by Swissky.
- RT /ˈziːf-kɒn/: #x33fcon 2026 talks: @thefLinkk & Dominik Phillips: Fingerprinting Modern C2 Implants Through Runtime Telemetry > https://youtu.be/… by S3cur3Th1sSh1t.
- RingCentral - 1,596,490 breached accounts https://haveibeenpwned.com/Breach/RingCentral by Nicolas Krassas.
- RT Jonathan Brossard: The slides from our @defcon presentation in Las Vegas this week are available ! Featuring #AI #cybersecurity upper limits, a con… by thaddeus e. grugq.
- Trezor discloses data breach affecting nearly 14,000 customers https://www.bleepingcomputer.com/news/security/trezor-discloses-data-breach-affecting-n… by Nicolas Krassas.
- Questel confirms Microsoft 365 breach after ShinyHunters leaks data https://cyberinsider.com/questel-confirms-microsoft-365-breach-after-shinyhunters-… by Nicolas Krassas.
- Hackers breach govt webmail while running parallel crypto fraud https://www.bleepingcomputer.com/news/security/hackers-breach-govt-webmail-while-runni… by Nicolas Krassas.
- Who’s Tracking You? Use This New Service to Find Out by BrianKrebs.
- RT Justin Elze: This repo is a great time “Traditional vulnerability disclosure is broken. It’s slow, bureaucratic, and ineffective. In the AI era, we… by bohops.
- RT Zack Korman: Anthropic trained a version of Opus on environments with reward hacking opportunities, and named that model Hacker-Opus. In evals it a… by K̵i̵r̵k̵ ̵T̵r̵y̵c̵h̵e̵l̵.
- RT Hugow: Our talk from #x33fcon is now on YouTube. We present a DCOMillusionist, an in memory lateral movement technique by bohops.
- RT Clandestine: Massive Azure Exfiltration Campaign Exposes Millions of Enterprise Records via Compromised Credentials (Mcdonald’s, Vodafone, Kyndryl… by kmkz.
- EDR Evasion Workshop - Workshop materials from: Evading EDR from Loaders to the Kernel, presented at DEF CON 34 and BSidesLV 2026. Covers: Malware … by Panos Gkatziroulis.
- RT SSD Secure Disclosure: New advisory was just published! A critical vulnerability in UNISOC modem firmware allows an attacker to disable protec… by kmkz.
- Hacking Public Wi-Fi DNS to Steal Credentials by Bruce Schneier.
Techniques and Write-ups
Full playlist of TROOPERS26 conference talks now available on YouTube. Covers AD security, cloud attacks, hardware hacking, and more.
Proofpoint documents OWAReaper, a browser implant exploiting CVE-2026-42897 in Outlook Web Access. Persists through localStorage and IndexedDB, uses GitHub commit search for C2, and exfiltrates via CDN proxies and DNS tunneling.
Dirk-jan Mollema’s BH/DC week blog on extracting Windows Hello keys for authentication replay and persistence. Covers PRT token theft and injection into downstream modules.
Self-propagating worm targets npm packages via stolen tokens with write permissions. Over 400 packages compromised including keyv (600M monthly downloads). Elastic Security Labs provides full analysis and IOCs.
Semperis research presented at Black Hat and DEF CON reveals novel Active Directory attack paths through Kerberos downgrade that lead to full domain takeover.
TrustedSec drops two new tools for Azure cloud credential hunting. Includes a WHOAMI module that grabs permissions, owned apps/devices, groups, RBAC capabilities, and token permissions.
Rapid7 publishes full analysis, IOCs, and PoC for CVE-2026-63077, an unauthenticated RCE in JetBrains TeamCity already in CISA’s KEV. Features a gnarly gadget chain and a polyglot SQL/JSP payload.
Technical analysis of CVE-2026-62737, a critical vulnerability with detailed exploitation writeup.
S3cur3Th1sSh1t’s x33fcon talk on evasion techniques is now on YouTube. Covers current approaches to bypassing endpoint detection.
Technique writeup on emulating mandatory user profiles for persistence, with detection strategies and a visual diagram of the attack flow.
More this week (476)
- RT Nick Carr: Russian threat actor Midnight Blizzard is conducting widespread traffic manipulation attacks at hotels worldwide. Result: delivering mal… by Dominic Chell.
- RT Matt Zorich: For those that missed it the Active Directory tier model documentation recently had a huge uplift, and even more importantly, the scri… by Max.
- RT Ivan (ethical vulnerability researcher): How to APT ep 2: https://klydz.net/post.php?slug=how-to-apt-ep2-lying-to-the-whole-netns-through-bpfprogty… by hasherezade.
- RT Hack32: VMkatz in action: Offline extraction of SAM, LSA, and DPAPI directly from a .vdi virtual disk by Chihuahua in charge NotMe.
- RT Hex-Rays SA: idalib is now available in IDA Home. That means hobbyists and enthusiasts can now call IDA’s analysis engine as a library - runn… by hasherezade.
- RT MSec Operations: New Blogpost regarding to “Backdooring Open-Weight Models” just published by @ShitSecure: https://www.msecops.de/blog/posts/backdo… by Steven Lowson.
- RT S3cur3Th1sSh1t: For anyone who was wondering “how to” regarding to my last two Posts - here is a small writeup and Proof of Concept by db.
- RT Student Of Things: Just confirmed, I found the Coldcard RNG bug 11 months ago and never reported it because they didn’t acknowledge me on the firs… by Florian Roth.
- Pre-auth SSRF. Security policy bypass PoC Reported a pre-auth blind SSRF in #Keycloak OIDC Dynamic Client Registration. The interesting part isn’t the… by kmkz.
- SMBLoot has been updated with: - OPSEC mode: directory trees are cached when opened, preventing new requests when revisiting them; for example, when n… by Swissky.
- RT International Cyber Digest: The slopocalypse is real. MITRE published a critical SQLite vulnerability with a CVSS of 10.0 that does not exist…. by Daax.
- RT SEKTOR7 Institute: Extracting and analyzing Windows service configurations and ACLs. A tool by Panagiotis Chartas (@t3l3machus) Source: https://git… by Chihuahua in charge NotMe.
- RT adam_cyber: Hot off the press: @CrowdStrike 2026 Threat Hunting Report Read about detailed sector analysis, the targeting of AI, CI/CD supply chain… by Chihuahua in charge NotMe.
- BTMOB has evolved into an ecosystem of resellers, source-code sellers, and possible impersonators. @flaresystems examines how the Android … by BleepingComputer.
- N-able warns of N-central auth bypass flaw exploited in attacks https://www.bleepingcomputer.com/news/security/n-able-warns-of-n-central-auth-bypass-f… by BleepingComputer.
- Metasploit 6.5 shipped Malleable C2 support for all current Meterpreter payloads - same profile format you already know, now shaping Meterpreter’s HT… by Metasploit Project.
- RT V12: Arbitrum Nitro normally runs natively, but disputes rely on fraud proofs run in a WASM VM. If these two environments don’t fully agree, it can… by Sam Curry.
- RT Lsec: I just deployed a short blogpost about evading egress firewall configurations using an internal system as a Sliver C2 traffic redirector. htt… by Chihuahua in charge NotMe.
- Fake Roblox Xeno script launcher pushes infostealer, RAT malware https://www.bleepingcomputer.com/news/security/fake-roblox-xeno-script-launcher-pushe… by BleepingComputer.
- New DOUBLECUP ClickFix service hides malware in browser cache images https://www.bleepingcomputer.com/news/security/new-doublecup-clickfix-service-hid… by BleepingComputer.
- RT Niebezpiecznik: Żabka zhackowana. Sieć sklepów potwierdziła nam, że doszło do nieautoryzowanego dostępu do infrastruktury. Co wyciekło… by hasherezade.
- RT codewhisperer84: I’ve been working on a Titanis documentation site => https://trustedsec.github.io/Titanis/UserGuide/ Source tree now includes comp… by Max.
- RT Chris Thompson: ConfigManBearPig adds SCCM attack paths to the BloodHound graph, including all of the known hierarchy TAKEOVERs. I rewrote 2.0 in P… by Andrew Chiles.
- When an attacker steals a machine key, they are no longer impersonating a user: they’re impersonating the machine itself. https://www.scworld.com/new… by Black Hills Information Security.
- RT Galaxy Research: LOSSES FROM COLDCARD HACK EXCEED $100M High confidence 1,596 BTC has been stolen from ~7300 addresses across 3 confirmed waves… by Vincent Yiu.
- RT Antonio Viggiano: Great post by @trailofbits - threat model - /goal fan out - variant analysis - agentflow (Easter egg from Figure 4) https://blog…. by Dave Aitel.
- RT Frank Wu: IonStack Blog Series: Part I (Firefox SpiderMonkey JIT RCE): https://nebusec.ai/research/ionstack-part-1-cve-2026-10702/ Part II (GhostLo… by kmkz.
- RT MTS: SITUATION DETECTED: The House Committee on Homeland Security has written a letter to Sam Altman requesting a briefing from OpenAI on the Huggi… by Vincent Yiu.
- New Pass-ta-key attacks let malware hijack Google-synced passkeys https://www.bleepingcomputer.com/news/security/new-pass-ta-key-attacks-let-malware-h… by BleepingComputer.
- RT _SiCk: I Lied: A little crippled so it’s not a full weapon. reads/writes some things via mdo and sets up said socket as root… if you can figure o… by kmkz.
- RT Arin Waichulis: Apple has confirmed it’s capping how many bug reports a researcher can have open at once, plus a 30-day cool-off period, as AI slop… by thaddeus e. grugq.
- RT bohops: I recently updated “The Ultimate WDAC Bypass List” to include TextTransform.exe as well as a few undocumented placeholder entries (despite … by kmkz.
- Rusty Bootkit - Windows UEFI Bootkit in Rust (Codename: RedLotus) https://memn0ps.github.io/rusty-windows-uefi-bootkit/ by Panos Gkatziroulis.
- EkkoNtProtect - Arbitrary NtProtectVirtualMemory calls from Ekko-style timer-based sleep obfuscation using internal ntdll functions https://github.com… by Panos Gkatziroulis.
- RT Alan Woodward: Hugging Face incident just got real for OpenAI https://www.iowaattorneygeneral.gov/media/cms/08_5392C9E17791C.pdf by pfiatde.
- Hey blueteamers, in case you’re using #opencti , ensure you are up to date + defaults admin disabled. A weeks ago I fully weaponized the pre-auth RCE … by kmkz.
- I’ve just updated the M365 2.0 phishlet for Evilginx Pro with full Browser-in-the-Browser compatibility. To remove frame-busting code from an… by Kuba Gretzky.
- From Stack Overflows to Modern Pool Grooming Step-by-step development of kernel primitives, from simple stack corruption to advanced heap groomin… by Panos Gkatziroulis.
- RT zqxwce: vPhone Workstation is officially out! https://github.com/zqxwce/vphone-ws by Csaba Fitzl.
- Deserialization strikes again for a WDAC bypass in imgmgr.exe (cc Dr. Tim Baker at dotSec) https://www.dotsec.com/insecure-deserialisation-app-control… by bohops.
- RT bohops: Deserialization strikes again for a WDAC bypass in imgmgr.exe (cc Dr. Tim Baker at dotSec) https://www.dotsec.com/insecure-deserialisation-… by DirectoryRanger.
- RT Nextron Research : We just uploaded new observed payloads to VT. Hashes below: setup.mjs fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda80… by Florian Roth.
- Unauthenticated RCE as QSECOFR via IBM i Management Central - @SilentSignalHU https://blog.silentsignal.eu/2026/06/05/unauthenticated-rce-as-qsecofr-v… by Swissky.
- RT cr3ghost: They did it again. This time it’s Tencent’s kernel anticheat VM. 815 of 865 virtualized functions across four kernel drivers statically d… by hasherezade.
- RT ATTACKD: We built a C2 implant that walked past Microsoft Defender clean. No static hits or behavioral alerts. Then Windows SmartScreen killed it. … by Max.
- RT Microsoft Threat Intelligence: Microsoft Threat Intelligence is tracking active Mini Shai-Hulud npm supply chain attacks in which a threat actor co… by SwitHak ().
- RT : Checked a few benchmarks of different GPU’s and depending on your setup, kerberoasted AES ‘hashes’ (hashcat mode 19700), that are now the def… by Max.
- RT watchTowr: Following it’s debut at @BlackHatEvents Europe last year, Principal Vulnerability Researcher at watchTowr @chudyPB’s talk - Pwning .NE… by Piotr Bazydło.
- Massive ChainDrop npm supply-chain attack infects hundreds of packages https://www.bleepingcomputer.com/news/security/massive-chaindrop-npm-supply-cha… by BleepingComputer.
- Hardware Hacking: From zero to a Pre-Auth Stack Buffer Overflow on Amazon’s best-selling router https:// rotcee.github.io/posts/analyzi ng-the-mersusys-mb115-4g-router/#cve-2026-12495-finding-a-pre-au.
- Hardware Hacking: From zero to a Pre-Auth Stack Buffer Overflow on Amazon’s best-selling router https://rotcee.github.io/posts/analyzing-the-mersusys-… by /r/netsec.
- SquidC5 - Security-first AI-native C5 teamserver (Command · Control · Cognitive · Collaborative · Coordination) https://github.com/SquidSec/SquidC… by Panos Gkatziroulis.
- RT Ru Campbell: Just updated my Defender for Endpoint/Defender for Business feature comparison by OS. Main changes: • AI agent capabilities in previe… by DirectoryRanger.
- RT Pavel Durov: Last night Apple briefly removed Telegram from the AppStore because a user had planted illegal porn in a public chat. Telegram was res… by Florian Roth.
- The Gentlemen Affiliate Deploys EtherRAT Across Windows Networks Using Ethereum Smart Contract C2 https://hunt.io/blog/the-gentlemen-etherrat-ethereum… by /r/netsec.
- I hate writing pattern-matching code for function identification in my .NET #deobfuscator and config extractor. So I built a tool to help me out with … by Washi.
- 77 Open VSX extensions found harvesting developer info https://www.bleepingcomputer.com/news/security/77-open-vsx-extensions-found-harvesting-develope… by BleepingComputer.
- Iran Cyberattacks Against Minnesota Water Systems by Bruce Schneier.
- Ok, originally planned to publish after vacations but… The discussions following my previous post & questions around the possible bypass of the curr… by kmkz.
- “The tool is purpose-built for this kind of audit - whether you’re a penetration tester on an internal engagement, a security engineer hardening you… by Black Hills Information Security.
- 7 year old rules FTW Other matches with that rule : https://valhalla.nextron-systems.com/info/rule/MAL_NK_Malware_Hermit_BAT_May19_2 by Florian Roth.
- RT AI Security Institute (AISI): On July 28th, we identified an incident during a routine cyber evaluation in which AI agents took sustained, unsancti… by Alex Plaskett.
- Phishing service spoofs RingCentral to steal Microsoft 365 accounts https://www.bleepingcomputer.com/news/security/phishing-service-spoofs-ringcentral… by BleepingComputer.
- Poisoning Claude Code: One GitHub Issue to Break the Supply Chain - GMO Flatt Security, https://flatt.tech/research/posts/poisoning-claude-code-one-gi… by Swissky.
- Bugtraq is back https:// lists.securityfocus.com/hyperk itty/list/bugtraq@securityfocus.com/thread/CHKLXLA7SJEWLDFHWXB3QU57ADOXGL2E/.
- RT Panos Gkatziroulis : The following event IDs are required to detect malicious .ppkg files (used for code execution): 10 - Container… by Panos Gkatziroulis.
- AI agents don’t pentest like humans, and @KoyalwarTarun’s BSidesLV research shows just how differently they operate. Across 54 black-box web app tar… by ProjectDiscovery.
- Finally got around to getting a working PoC of my native object file to LLVM IR lifter. Started this small side-project to see how far can I push my o… by 5pider.
- RT Feng Xue: when root runs ‘su - user1’ interactively and exit, user1 becomes root http://x.com/i/article/2084830838043377664 by Gergely Kalman.
- The chances of you finding RWX pages in NTDLL are low, but never zero. by db.
- [RT Mr. OS: #Research #Malware_analysis “EDR Introspection: Enabling deep insights into EDR detection approaches”, 2026. ]-> https://github.com/evilele...](https://github.com/evilele/EDR-Introspection) by Ring3API 🇺🇦.
- RT NCSC UK: Re Read more from our CTO, Ollie Whitehouse: https://www.ncsc.gov.uk/news/ncsc-statement-in-response-to-recent-incidents-resulting-from-fr… by Dominic Chell.
- adhammer - Active Directory security-assessment toolkit in Rust https://github.com/icedracon/adhammer by Panos Gkatziroulis.
- Blacksea - an active honeypot and canary-bait control system built to detect and drown LLM-driven attackers. Exploits flaws in the attacker’s LLM ju… by Panos Gkatziroulis.
- RT dbugs: CVE-2026-57256: RCE via JavaScript in Foxit PDF Reader The use of V8 JavaScript in PDF rendering engines and editors enables the creation of… by kmkz.
- QuickFox Supply Chain Attack Delivers FDMTP Backdoor via Trojanized Windows Installer https://thehackernews.com/2026/08/quickfox-supply-chain-attack-d… by Nicolas Krassas.
- RT Nextron Research : We reproduced Certighost (CVE-2026-54121) end to end in a controlled lab The vulnerability allows a low-privileged domain us… by Florian Roth.
- Full read and write control of a Daikin VAM heat-recovery ventilation unit over the P1/P2 bus, using an Arduino Uno registered as a genuine BRC301B61-… by Nicolas Krassas.
- RT : If you found a pattern in passwords used, you can ask your favorite LLM to generate a rule file. Example prompt for 1@ = 1example… by Max.
- Vulnerabilities in Car Anti-Theft Device https://www.schneier.com/blog/archives/2026/08/vulnerabilities-in-car-anti-theft-device.html by Nicolas Krassas.
- Two of our researchers hit the #BHUSA stage for the first time. Angelboy(@scwuaptx ) shares how a different angle on AFD led to 30+ new #Windows kerne… by DEVCORE.
- Ever found yourself in an environment with heavy Application Control for Business (formery WDAC) controls? Some research on how to bypass those contro… by 0xBB.
- A few notes on AWS Nitro Enclaves: KMS integration.
- RT Calif: wp2root as promised :-) https://blog.calif.io/p/the-wordpress-chain-massacre Our chain is nothing fancy. Its value is in showing what real-w… by lcamtuf.
- RT Alex: The not so new “Windows Health and Optimized Experiences” service audited. One more user -> SYSTEM EoP (2nd in August and 5th in Q3). Let’s h… by Nicolas Krassas.
- RT Team Cymru Research: INTEL DROP Remote-management tools are the access layer for a lot of live intrusions. We’re tracking 949 malicious IPs running… by Alberto.
- RT rootsecdev: Pass the hash never went away.. it just evolved when orgs moved to the cloud. @_dirkjan blogs never disappoint. https://dirkjanm.io/bor… by Steven Lowson.
- London cops handed victim’s new address and number to her stalker, watchdog says https://www.theregister.com/security/2026/08/05/london-cops-handed-vi… by Nicolas Krassas.
- Stored XSS in Django’s admin via an unvalidated URLField display path (CVE-2026-15920) https://syntetisk.tech/blog/posts/stored-xss-in-djangos-admin-v… by /r/netsec.
- REMOTE-003 Path Traversal in Configuration Subsystem of Apache Dubbo 3.3.x https://blog.securelayer7.net/apache-dubbo-remote-003-path-traversal/ by Nicolas Krassas.
- UK charities count the cost of Beacon CRM cyberattack https://www.theregister.com/security/2026/08/05/uk-charities-count-the-cost-of-beacon-crm-cybera… by Nicolas Krassas.
- Google’s synchronized passkeys can be stolen in ‘Pass‑ta‑key’ attacks https://www.malwarebytes.com/blog/news/2026/08/googles-synchronized-passkey… by Nicolas Krassas.
- Samsung bans smart TV apps that turn user connections into proxies https://cyberinsider.com/samsung-bans-smart-tv-apps-that-turn-user-connections-into… by Nicolas Krassas.
- Brazil Health Surveillance Database Exposed 79GB of Sensitive Records https://hackread.com/brazil-health-surveillance-database-exposed-records/ by Nicolas Krassas.
- OVSwrap: 13-Year-Old Linux Kernel Flaw Lets Local Users Become Root https://securityaffairs.com/196657/hacking/ovswrap-13-year-old-linux-kernel-flaw-l… by Nicolas Krassas.
- CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploit… by BleepingComputer.
- IBM’s agentic AI platform is under active attack - patch now https://www.theregister.com/security/2026/08/05/ibms-agentic-ai-platform-is-under-active-… by Nicolas Krassas.
- RT V12: Type text into Wikipedia. Get the shell’s output back on the page. A bug introduced 22 years ago. Still alive in the wild, until it was found … by ϻг_ϻε.
- RT V12: Type text into Wikipedia. Get the shell’s output back on the page. A bug introduced 22 years ago. Still alive in the wild, until it was found … by Rick de Jager.
- NEW BHIS | Blog You’ve just confirmed it: that alert isn’t a false positive. Whether it’s suspicious PowerShell execution, unusual network traffic… by Black Hills Information Security.
- RT kernelstub (Prepakis Georgios): A new Apache RCE vulnerability has been identified in the latest version. I have not redacted the specific details … by nyxgeek.
- Turning Enterprise Update Servers Into Backdoor Factories (0_o) – Part 1 by Beyviel David.
- Turning Enterprise Update Servers Into Backdoor Factories (0_o) – Part 2 by Beyviel David.
- Of Course We Built a WSUS Ludus Lab by Beyviel David.
- Poison Claude Sells Discounted Claude Access While Its Operator Sees Every Customer Prompt https://thehackernews.com/2026/08/poison-claude-sells-disco… by Nicolas Krassas.
- COLDCARD security audit phishing attack installs remote access tool https://www.bleepingcomputer.com/news/security/coldcard-security-audit-phishing-at… by BleepingComputer.
- RT SpecterOps: Re Check out @bagelByt3s’ blog series to dive even further! Part 1: https://ghst.ly/4w4SDt7 Part 2: https://ghst.ly/4gerXBr Part 3: htt… by topotam.
- SOCKSRelayd - SOCKS-focused NTLM relay with persistent session packages and a long-lived SessionBank that owns authenticated TCP connections https://g… by Panos Gkatziroulis.
- Hackers run khunt post-exploitation toolkit from Oracle database https://www.bleepingcomputer.com/news/security/hackers-run-khunt-post-exploitation-to… by BleepingComputer.
- RT Swissky: SMBLoot update Several quality-of-life and performance improvements landed today: in-preview regex search, clearer folder statistics, … by Swissky.
- Shane (@shanejcaldwell) just landed in Vegas, ready to talk runtime oversight and judges for the next 72 hours. Check out his latest research, ScopeJu… by dreadnode.
- https://www.securityweek.com/how-a-50000-exploit-chain-turned-bixby-against-samsung-phones/ by Dimitri Os.
- Execution 3h 3m 30s Total 3h 3m 34s Spend $14.8082 rtnetlink bridge lifecycle -> designated-port desync via priority toggle while port DISABLED -> STP… by Giuseppe
N3mes1s. - OpenAI agents rebuilt a secret message board after the company shut it down https://runtimewire.com/article/exclusive-openai-agents-rebuilt-a-secret-m… by /r/netsec.
- A good example of why trusting AI with all of your RE needs and letting your skills stagnate or just not develop them at all will cause headaches in t… by Daax.
- Canadian pleads guilty to Snowflake cloud data-theft attacks https://www.bleepingcomputer.com/news/security/canadian-pleads-guilty-to-snowflake-cloud-… by BleepingComputer.
- RT Jiří Vinopal: Just delivered the talk “BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive” at #BHUSA 2026 �… by hasherezade.
- My favorite talk I saw today! by Maddie Stone.
- “For SOC teams the priority is no longer simply preventing ransomware encryption - it’s detecting unauthorized activity during the narrow window bet… by Black Hills Information Security.
- Hello Las Vegas (and hackers following along at home)! I’m excited to share the first batch of our Out-of-Band / Baseboard Management Controller resea… by HD Moore.
- RT hasherezade: Slides from my today’s talk at #BlackHatUSA2026 : “Breaking the Seal: Static Deobfuscation of Compiled #V8 JavaScript Bytecode #Malwar… by Giuseppe
N3mes1s. - Due to the time constraints, live demos didn’t make it to the talk, but you can see them here: by hasherezade.
- From wallet drains to a 12-year-old CryptoJS entropy bug: the Ill Bloom investigation https://www.coinspect.com/blog/ill-bloom-investigation/ by /r/netsec.
- RT Nicolas Krassas: arcanum-sec/wraith: WRAITH - a modern browser-hooking framework (BeEF + blind-XSS successor) for red teams, researchers, and educ… by kmkz.
- Anyone who’s ever had to debug HTTP traffic remembers Fiddler. Here’s a great story about the product, told by its creator, Eric. by Kuba Gretzky.
- RT YungBinary: We’re tracking a new EDR killer using a #BYOVD driver that isn’t in Microsoft’s block lists / #LOLDrivers and enumerates 140+ security … by Rob Fuller.
- Can you disable Gatekeeper and XProtect? https://eclecticlight.co/2026/08/06/can-you-disable-gatekeeper-and-xprotect/ via @howardnoakley by Howard Oakley, Eclectic Light Co.
- RT NetAskari: Incredible: Greek cyber sec researcher gets access to North Korean operator’s communication and operational infrastructure for 2 years (… by Simone Margaritelli.
- RT Nextron Research : We recently identified malicious Excel documents related to #DoNot APT activity. The samples include shipping- and invitatio… by Florian Roth.
- RT Nextron Research : While reviewing the recent 360 Advanced Threat Research Institute report on APT-C-24 (Rattlesnake), we identified additional… by Florian Roth.
- Adversarial Clothing Designed to Fool Facial Recognition Systems by Bruce Schneier.
- RT spencer: If you’re looking for a quick and easy way to harden your environment, then look no further! Download this list of RMM tools and block al… by Chihuahua in charge NotMe.
- RT Thorsten E.: Pretty-Policy-Analyzer A desktop/web app for security engineers and Active Directory administrators to load, browse, compare, audit, a… by DirectoryRanger.
- Worked really hard on this tool and I know many great community tools exist for Azure/Entra, I am aware maybe some modules are not well documented or … by David.
- The SQL Server Unicode problem: why your data might not be what you think it is? - Alexandre Zanni https://www.synacktiv.com/en/publications/the-sql-s… by Swissky.
- Claude-red - a curated library of offensive security skills designed for the Claude skills system https://github.com/0xwilliamortiz/claude-red by Panos Gkatziroulis.
- RT Anton: Another U-Boot Verified Boot bypass, this time in the SPL code! Take a look at how we achieved arbitrary code execution on a real device run… by hasherezade.
- Meta AI model hacked a company during misconfigured cyber test https://www.bleepingcomputer.com/news/security/meta-ai-model-hacked-a-company-during-mi… by BleepingComputer.
- ESC8s and Where to Find Them - Abdul Mhanni @abdo_mhanni https://www.abdulmhsblog.com/posts/esc8andfindingwebenrollmentendpoints/ by Swissky.
- RT : Direct link to tools. It’s recommended to read the blog. https://github.com/rootsecdev/SecretsStalker https://github.com/rootsecdev/SecretsS… by Chihuahua in charge NotMe.
- How we took malware advisories beyond npm by Ankit Kumar Honey.
- New, by me: Canadian Man Pleads Guilty in Snowflake Data Extortions: A 26-year-old Canadian man described as one of the most consequential cybercrime threat actors of 2024 has pleaded guilty to comput.
- RT Joshua Saxe: Slides for my AI security forum keynote proposing a pivot in frontier AI security policy https://docs.google.com/presentation/d/1aFwK7… by dreadnode.
- New TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes https://www.bleepingcomputer.com/news/security/new-tontou-cpu-attack-bypa… by BleepingComputer.
- Zbtlink Routers Contain rctl Backdoor https://www.vulncheck.com/blog/zbt-endlessdoors by /r/netsec.
- The slides from my Blackhat USA 2026 presentation “Beam Me Up Luke: A Review of Teleport Attack Scenarios” are now available #BHUSA https://i.blackhat… by Adam Chester.
- RT REMnux: The REMnux project now distributes @hasherezade’s JSC Deobfuscator as a container. It turns obfuscated V8 bytecode (.jsc) into readable Vie… by Max.
- Hedge fund cyberattacks tied to BlackFile-linked UNC6671 extortion group https://www.bleepingcomputer.com/news/security/hedge-fund-cyberattacks-tied-t… by BleepingComputer.
- RT John Hultquist: Blackfile (UNC6671) is still at it and has been operating under a series of rebrands. They are currently hitting the financial sect… by hasherezade.
- Claude Code RCE: How a Malicious PR Triggers Code Execution https://www.immersivelabs.com/resources/blog/claude-code-rce-vulnerability-how-a-malicious… by /r/netsec.
- RT Andy Greenberg (@agreenberg at the other places): Two security researchers shipped me a kid’s smartwatch from Amazon. When I wore it, they tracked … by SwiftOnSecurity.
- ClickFix attack pushes macOS infostealer for crypto theft attacks https://www.bleepingcomputer.com/news/security/clickfix-attack-pushes-macos-infostea… by BleepingComputer.
- RT Tarjei Mandt: I’ve been looking at how to leverage frontier-sized open models for domain-specific use. Here’s an attempt at creating a much smaller… by Alex Plaskett.
- I made a full JWT hacking tutorial + testing suite https://hakluke.com/jwt-hacking by /r/netsec.
- RT International Cyber Digest: US Cyber Command is reviewing an unusually high number of deaths by suicide among its personnel, as many as five people… by thaddeus e. grugq.
- RT msuiche: But it didn’t solve @calif_io MIE challenge https://www.msuiche.com/posts/calif-mie-kimi-k3/ by Alex Plaskett.
- RT InfoGuard Labs: New Post from our Pentest Team: One pentest turned into 22 CVEs in TeamDavid®. From an unauthenticated single-request DoS all the … by Manuel.
- sift - Credential and sensitive-data exposure triage for file shares https://github.com/HotStartLabs/sift by Panos Gkatziroulis.
- RT Kuzey Arda Bulut: Exploiting Mali GPU CVE-2025-8045 on Pixel 7 Pro! Turning a double-free into a Dirty Pagetable primitive via race, timer-whee… by Alex Plaskett.
- Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails https://thehackernews.com/2026/08/microsoft-365-aitm-phishing-hijac… by Nicolas Krassas.
- AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day https://thehackernews.com/2026/08/ai-assisted-http-terminator-finds… by Nicolas Krassas.
- Oops, I Weaponized the Database: Abusing AI Features in SQL Server 2025 - Justin Kalnasy - @SpecterOps https://specterops.io/blog/2026/06/10/oops-i-we… by Swissky.
- RT Swissky: Oops, I Weaponized the Database: Abusing AI Features in SQL Server 2025 - Justin Kalnasy - @SpecterOps https://specterops.io/blog/2026/06/… by Nikhil Mittal.
- RT Ayush Anand: When did your last backup target 127.0.0 . 1? That’s wbadmin dumping creds, not backing up. Two tells: -include isolates the offline-c… by SwiftOnSecurity.
- North Carolina Ports confirms cyberattack disrupting operations https://www.bleepingcomputer.com/news/security/north-carolina-ports-confirms-cyberatta… by Nicolas Krassas.
- RT V12: seems like the is out of the here’s our poc for MariaDB 13 RCE, currently still unpatched: https://github.com/v12-security/pocs/… by ϻг_ϻε.
- RT Michael Bargury: we got an RCE on your machine thru Comet by sending a calendar invite you ask Comet any question about your calendar? we pop a she… by Giuseppe
N3mes1s. - After many years, I finally found a vulnerability which allowed me to install arbitrary profiles (including MDM) without user interaction. �… by Csaba Fitzl.
- RT Stephen Fewer: Re @rapid7 PoC for CVE-2026-63077 here: https://github.com/sfewer-r7/CVE-2026-63077 by Mayuresh 🇮🇳.
- Nice one by Nicolas Krassas.
- Living off the coding agent: Two tales of tunnels and LaunchAgents https://www.elastic.co/security-labs/coding-agent-launchagent-tunnel-detection by Nicolas Krassas.
- TrustFall: When the Trusted Execution Environment Cannot Be Trusted https://blog.byteray.co.uk/blog/optee-rsa-nopad-heap-underwrite.html by Nicolas Krassas.
- N-able God mode flaw: Vendor confirms attackers reached customer networks as second hotfix lands https://www.theregister.com/networks/2026/08/07/n-abl… by Nicolas Krassas.
- RT Unit 42: We’ve identified further malicious infrastructure from npm and PyPI packages. Techniques include cloud credential exfiltration, EtherHidin… by Florian Roth.
- tl;dv (Too Lazy; Didn’t Validate): 181,874 Meetings Left Wide Open https://bobdahacker.com/blog/tldv-hack by /r/netsec.
- RT staturnz: momentarius: PPL Bypass for A12/A13 by me and @imnotclarity https://github.com/staturnzz/momentarius by kmkz.
- RT Geekboy: Re @pdnuclei detection template - https://github.com/projectdiscovery/nuclei-templates/pull/16785 by Nuclei by ProjectDiscovery.
- Told you guys H1 sucks by Gergely Kalman.
- RT Chris Wysopal: “AI systems appear to have an easier time exploiting flaws than patching them, an unfortunate asymmetry in capabilities” https://w… by Sean Heelan.
- RT 0xedh: You don’t need a USB. You need to look like one. Emulate the device, Windows fetches a signed package off Windows Update and runs vendor cod… by Oddvar Moe.
- RT Boyd Kane (quantized): Hey @OpenAI you can still download the scripts used by AIs to hack @huggingface (full report & commands in reply) by Sam Curry.
- It’s about time by Gergely Kalman.
- thanks to everyone who came to my @RedTeamVillage_ session. Here’s a link to all the slides, course materials, etc. https://rtv.two06.co.uk/ by James .
- SCTPhantom: An 18-Year-Old SCTP ASCONF Transport Use-After-Free · Tencent Zhuque Lab https://matrix.tencent.com/en/2026/08/06/sctphantom-CVE-2026-645… by /r/netsec.
- RT Sina BI Report: So the ColdCard entropy bug that lead to at least $100M of theft, was introduced by then CTO and co-founder himself, who u… by Florian Roth.
- PyPsPipeJack - Python implementation of OpenPsPipeJack TL;DR: You have local admin on a remote host, connect to remote PowerShell sessions on that hos… by Panos Gkatziroulis.
- RT eversinc33 : A handy .NET reverse engineering trick: Add a sample.exe.config file next to your sample and you can trace e.g. all network re… by hasherezade.
- RT Calif: PoC for a critical vulnerability in Apple macOS Screen Sharing (CVE-2026-65400). If Screen Sharing is enabled, any network attacker can expl… by Giuseppe
N3mes1s. - Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts https://thehackernews.com/2026/08/progress-kemp-loadmaster-flaw-hits-c… by Nicolas Krassas.
- CVE-2026-45454 - Microsoft SharePoint Server Upload Page Folder Path Traversal to Remote Code Execution - @AretiqAI https://aretiq.ai/research/vul260… by Swissky.
- RT Swissky: CVE-2026-45454 - Microsoft SharePoint Server Upload Page Folder Path Traversal to Remote Code Execution - @AretiqAI https://aretiq.ai/res… by Florian Roth.
- RT EZ: This is real stuff folks. It’s not just Claude. Browser agents come with incredible capabilities but also incredible risk. What’s worse, there … by Florian Roth.
- HTB: Helix https://0xdf.gitlab.io/2026/08/08/htb-helix.html by Nicolas Krassas.
- Palo Alto Networks Faces China Cybersecurity Review Amid Rising Tech Tensions https://securityaffairs.com/196881/intelligence/palo-alto-networks-faces… by Nicolas Krassas.
- Gotta get back on MacOS by David.
- Agent Tesla – APC Injection, Token Manipulation & Payload Extraction https://github.com/kaandemir993/Agent-Tesla-APC-Injection-Token-Manipulation-Reg… by Nicolas Krassas.
- Analyzing a Multi-Stage PowerShell Payload Chain https://malwr-analysis.com/2026/08/08/investigating-a-multi-stage-powershell-loader/ by Nicolas Krassas.
- LockBit 5.0 Linux Malware Analysis: ChaCha20 + Curve25519 Offline Encryption, strace Evasion & IOCs https://netacoding.com/posts/lockbit5-analysis/ by Nicolas Krassas.
- RT Mars: Oh this looks fun and SCARY! If your ISP uses shared GPON fibre and has not correctly enabled downstream encryption, another customer on the … by Simone Margaritelli.
- EvilFontTool - hides machine-readable text inside a document that displays completely different text to a human reader. https://github.com/DoctorEww/E… by Panos Gkatziroulis.
- RT Shepherd: Bypassing server-side validation on a SaaS target .Spoofed GIF magic bytes inside the JSON payload & tricked the API into signing an AWS … by Rob Fuller.
- WinGuard - A User-Mode Windows Threat Detection Tool Inspired by EDR Techniques, To Help Monitor And Log Suspicious Activities https://github.com/Poly… by Nicolas Krassas.
- Weaponizing Windows Updates with NotWSUSpicious https://specterops.io/blog/2026/08/05/weaponizing-windows-updates-with-notwsuspicious/ by Nicolas Krassas.
- Ransomware gangs skip the CEO, head straight for the 40-something IT manager https://www.theregister.com/security/2026/08/09/ransomware-gangs-skip-the… by Nicolas Krassas.
- From Square Root to /root: Escalating Privileges in Azure Containers with Python in Excel https://www.safebreach.com/blog/python-in-excel-vulnerabilit… by Panos Gkatziroulis.
- RT Andrew Thompson: CERT Polska: Follow-Up Analysis of the 29 December 2025 Energy Sector Incident “To the best of our knowledge, the attack vector us… by hasherezade.
- RT Smukx.E: Windows Internals crash course by x64dbg creator @mrexodia This video covers about Process Creation (Kernel), PE Structure, PEB, TEB, Call… by hasherezade.
- I had a discussion with a friend in threat intelligence about AI-driven attacks, and one thing stuck with me. Threat actors used to have a certain fin… by Florian Roth.
- RT Blackstorm Security: CVE-2026-24294 - Local NTLM Reflection LPE via SMB Arbitrary Port: https://github.com/0xNDI/CVE-2026-24294 #smb #vulnerability… by codewhisperer84.
- RT stoyky: Want to deploy a CAPE sandbox in under 30 minutes? Now you can! Check out the latest update to #Figment : https://github.com/stoyky/figment… by Ring3API 🇺🇦.
- RT @Enno_Insinuator: New @ERNW_ITSec white paper “Breaking Multi-Tenancy in Kubernetes over and over, and What We Can Learn from This” http… by DirectoryRanger.
- WAF Bypasses via h2 framing - Diyan Apostolov (@thefosi) https://lab.ctbb.show/research/h2-WAF-Bypasses by Swissky.
- RT 0xor0ne: 21 bugs in BlueZ Bluetooth Stack (@xchglabs) https://xchglabs.com/blog/bluez-zero-click.html #infosec #bluetooth by kmkz.
- A Windows userland tool developed by @Sphinx_321 for enumerating and classifying Advanced Local Procedure Call (ALPC) ports, including those owned by … by Panos Gkatziroulis.
- RT AnMioLink: It seems Silver Fox Group is now using unverified (Fake/Stolen?) Microsoft Windows Third Party Component CA certificate chain(s) to sign… by Florian Roth.
- ResetNightmare POC - a validation flaw in the Kerberos Change Password protocol that allows for resetting the password of any target user/computer acc… by Panos Gkatziroulis.
- I just came across this blog post: https://www.countercraftsec.com/blog/arbitrary-vs-kernel/ It’s a very cool read! I disagree with the conclusion tho… by winterknife.
- RT Smukx.E: A hands-on walkthrough of exploiting a Windows stack buffer overflow and bypassing DEP using a manually crafted ROP chain, leveraging Virt… by Mike Felch (Stay Ready).
- HTTP/3 Trailer HEADERS Frame Triggers Unhandled Exception in Google ESF: 60s Hang & QUIC INTERNAL_ERROR 0x0001 | Protocol RE | Netacoding https:// netacoding.com/posts/blog_post _esf_h3/.
- This looks pretty neat. Device emulation to priv esc.. by Mike Felch (Stay Ready).
- RT Hors: obfus.h is the very powerfull compile-time obfuscator for C (win32/64). Supports virtualization, anti-debugging, control flow obfuscation and… by Ring3API 🇺🇦.
- goat by devansh.
- RT : Helper script for this attack https://github.com/Semperis-Community/ResetNightmare by kmkz.
- RT The Telegraph: Royal Navy spy drones used by Britain’s elite special forces secretly sent data to China, The Telegraph can reveal. The cameras on … by Florian Roth.
- RT 0x12 Dark Development: Writing Your First PIC Shellcode with Crystal Palace New Medium post. In this one we are building two PICOs from scratch, a … by Panos Gkatziroulis.
- Command & Conquer - A hands-on C2 workshop for aspiring Red teamers Covers a unified view of C2 fundamentals for both offensive and defensive … by Panos Gkatziroulis.
- The APT group #HeadMare exploits vulnerabilities in an unpatched TrueConf server to deliver #PhantomCore and #PhantomGraph malware to video conferenci… by SwitHak ().
- Authenticode signature manipulation toolkit for Red Team operations and security research. Covers signature stealing, metadata cloning, SIP hijacking … by Panos Gkatziroulis.
- RT Andrew Curran: A man in Australia asked his agent (Claude running on OpenClaw) to book him a spot in a popular gym class. The agent found a softwar… by thaddeus e. grugq.
- Slides and whitepaper of Gone in 60 Frames – USB Video Exploitation by @robHerrera_ and myself seem to be on the #defcon34 media server now! Slides -… by Alex Plaskett.
- Beyond Prompt Injection: Hacking Apple’s Private Cloud Compute https:// blog.sentry.security/beyond-pr ompt-injection-hacking-apples-private-cloud-compute/.
- Beyond Prompt Injection: Hacking Apple’s Private Cloud Compute https://blog.sentry.security/beyond-prompt-injection-hacking-apples-private-cloud-compu… by /r/netsec.
- RT Elias Bachaalany: Reverse engineering, run entirely from my phone. @OpenAI’s @ChatGPT Work recovered compiling source from a stripped binary while … by Giuseppe
N3mes1s. - RT Byron Wan: ‼ Royal Navy spy drones used by Britain’s elite special forces secretly sent data to China. ‼ The cameras on the K3 Scout surveil… by thaddeus e. grugq.
- RT Open Source Security mailing list: Re AI+manual analysis of all those Linux kernel CVEs and more by @kerneltoast from @CtrlIQ https://www.openwall…. by Solar Designer.
- siddharth ahuja: URGENT: My Github got hacked and all my ownership rights were stripped. Repositories like Blender MCP (25k stars) and Ableton MCP (2.6k stars) along with personal projects I’m working by vx-underground.
- Interesting by kmkz.
- RT @Cravaterouge.infosec.exchange: Exploit demo on Linux and Patch Analysis of ResetNightmare (CVE-2026-27912) and KerberLoss (CVE-2026-25177), two Ac… by Swissky.
- Incredible research. It’s like an LPE 0-day factory with an on-demand BYOVD when you plug in the USB stick. by Kuba Gretzky.
- RT David Kaplan: Yup. Wrote about these downgrade/model routing attacks a week or so ago if anyone is interested https://www.originhq.com/research/a-p… by Max.
- RT Enno Rey: #WOOT26 SoK: Insecurity of Cellular Basebands https://www.usenix.org/system/files/woot26-carnot.pdf [PDF] by DirectoryRanger.
- This is such a good read. Fantastic sandbox and guardrail escapes and…. “It fell in about five minutes to a straight dictionary word. The password w… by Nikhil Mittal.
- RT Neogram: Purpose-built Windows PE sets for reverse engineering, detector validation and malware-analysis education https://www.orderofsixangles.com… by hasherezade.
- RT Rami McCarthy: If you are self-hosting Metabase, patch the SQLi urgently. PoCs are being published, so I wanted to share some more details on t… by Giuseppe
N3mes1s. - Thanks to everybody that came out to my #BHUSA2026 Arsenal talk last week! I have posted the slides here - https://github.com/h4wkst3r/Conferences/blo… by Brett Hawkins.
- RT Brett Hawkins: Thanks to everybody that came out to my #BHUSA2026 Arsenal talk last week! I have posted the slides here - https://github.com/h4wkst… by Panos Gkatziroulis.
- Hacking in the age of AI: LLMs, agentic CLIs and MCP servers for Bug Bounty hunters - @yeswehack https://www.yeswehack.com/learn-bug-bounty/llm-bug-bo… by Swissky.
- RT Sunil kumar: LLMVault 2.0 is here. Two ways to learn. Two ways to break things. Play Mode - CTF-style, guided labs built for learning an… by Max.
- RT trish: a free tutorial series takes you from an empty boot sector to a working 32-bit protected mode kernel you build the bootloader GDT the A20 li… by hasherezade.
- Whoops. That’s quite an unexpected result if it checks out. by RPW: @rpw@chaos.social.
- RT Enno Rey: HotWire: Real-World Impersonation and Discharge Attacks on Electric Vehicle Charging Systems https://www.usenix.org/system/files/woot26-c… by DirectoryRanger.
- RT Azox: Exploit ResetNightmare with NetExec CVE-2026-27912: a logical flaw in the Kerberos Change Password protocol lets an attacker with Generi… by Aurélien Chalot.
- SgrmFault - Process Impairment Exploit Chain Revives a COM-based code injection in WerFaultSecure to abuse an APC-based process tampering feature expo… by Panos Gkatziroulis.
- There’s been a lot of interesting macOS malware recently. All added to the @objective_see sample collection for anyone to poke at. Even a .NET dropper… by L0Psec.
- New article lands tomorrow. Until then, here’s your chance to revisit the breakdown on how to use .ppkg files for code execution. Don’t miss it… by Panos Gkatziroulis.
- RT Calif: Check out this fascinating story of two macOS Screen Sharing exploits we built over the weekend: https://blog.calif.io/p/no-country-for-old-… by Dominic Chell.
- Inside a Russian-speaking operator’s toolkit for compromising Ukrainian IP cameras https://hunt.io/blog/russian-speaking-operator-ukrainian-camera-too… by /r/netsec.
- I really do think harnesses are falling away, but mines still going for now, forgot to add this to the list from Aug 04 CVE-2026-15830 – https://www…. by AndrewMohawk⁽ⁿᵘˡˡ⁾.
- RT M1: Anthropic says new Claude models will embed invisible watermarks in all generated text, everywhere Claude is offered. The watermark is part of … by K̵i̵r̵k̵ ̵T̵r̵y̵c̵h̵e̵l̵.
- Single prompt Rust re-write with Opus 5 Let me know if anything breaks. https://github.com/EgeBalci/sgn by ege.
- RT @MauroEldritch: 🇰🇵 We built a fake company. We recruited DPRK IT workers. We recorded everything. The full story is finally out: hour… by scriptjunkie (Matt).
- RT FBI Cyber Division: Gunra ransomware is targeting victims across multiple sectors, including government and critical infrastructure organizations. … by SwitHak ().
- I sat down and did some schizo ranting for my attempt at a book I might name “Malware 4 Noobs” (no idea yet). Here is my introduction segment, part ze… by vx-underground.
- BdThemes plugins supply-chain hack creates rogue WordPress admins https://www.bleepingcomputer.com/news/security/bdthemes-plugins-supply-chain-hack-cr… by BleepingComputer.
- Recent incident in the UK might have many feeling this way: “The most concerning part to me is that in the age of AI where criminals have access to ad… by Black Hills Information Security.
- Sakerhetpolisen🇸🇪 thwarted Russian🇷🇺 intelligence operation (operation aiming at influencing Swedish decision-making and discrediting Swed… by SwitHak ().
- RT lazarusholic: “Smile, You’re on Camera. Part 2: Hiring Lazarus APT’s IT Workers in a Fake DeFi Startup” published by @anyrun_app. #ITWorker, #Fam… by Florian Roth.
- Interesting findings about how DPRK is leveraging AI in their operations: AI-generated decoys: Generated polished documents for spear-phishing ca… by Thomas Roccia.
- Some good research got nuked in iOS 27 beta but a great read nonetheless. by Mike Felch (Stay Ready).
- RT Coontzy1: So, if you don’t need a signed payload… you can serve whatever you want with wsuks https://github.com/NeffIsBack/wsuks Cool blog and fi… by S3cur3Th1sSh1t.
- NoiseHound - Detection-aware BloodHound attack-path scoring - find the quietest route to your objective, calibrated across audit/EDR/SIEM tiers https:… by Panos Gkatziroulis.
- RT @bytecodevm: Windows Application Control (formerly WDAC) blocks binaries that are not signed by an approved authority - but a Microsoft-… by Max.
- RT Nextron Research : A threat actor continues attempting to push malicious extensions delivering XWorm through the VS Code Marketplace. The … by Florian Roth.
- RT Nextron Research : We identified a cluster of WHQL-signed Windows kernel drivers that all contain the same Authenticode metadata reference: Spc… by hasherezade.
- More data for my lab environment ⤵ EvidenceForge - Generate realistic synthetic security logs for cybersecurity threat hunting training and re… by Panos Gkatziroulis.
- US and South Korea warn of Gunra ransomware targeting govt agencies https://www.bleepingcomputer.com/news/security/us-warns-of-gunra-ransomware-attack… by BleepingComputer.
- Cisco warns of high-severity ClamAV flaws with public exploits https://www.bleepingcomputer.com/news/security/cisco-warns-of-high-severity-clamav-flaw… by BleepingComputer.
- RT Guillermo Casaus: Acaban de liberar una de las mayores bases de datos de malware en GitHub. Se llama Malware Research Hub y contiene miles de … by hasherezade.
- CISA: Microsoft SharePoint flaw now exploited in ransomware attacks https://www.bleepingcomputer.com/news/security/cisa-microsoft-sharepoint-flaw-now-… by BleepingComputer.
- RT David Schmotz: New paper!! We decoded the “encrypted” chain-of-thought of Anthropic, OpenAI and Google models and used this for multiple attacks! E… by Alex Plaskett.
- Mozilla updates GPG signing key for Firefox releases after exposure https://www.bleepingcomputer.com/news/security/mozilla-updates-gpg-key-for-signing… by BleepingComputer.
- RT Rapid7: In July 2026, while conducting a 0-day research project against Microsoft #SharePoint, Rapid7 Labs discovered 2 new vulns that, when c… by Jeff McJunkin.
- RT domas: Here’s an unassuming tool I’ve been sitting on for a decade. Measure address latency, and timing leaks hardware structure. Unexpectedly us… by hasherezade.
- Age of Post-Exploitation - Dima & Pieter Ceelen (@ptrpieter) https://youtu.be/j0T5cYSo7Z0 by Swissky.
- EtwSuite - Windows native ETW inspection suite for browsing providers, reading metadata, consuming live events, recording ETL traces, filtering result… by Panos Gkatziroulis.
- ETW for Security Research: Providers, Sessions, and Detection Engineering https://idov31.github.io/posts/inside-etw-with-etwsuite by /r/netsec.
- Great work getting this fixed upstream, and great writeup by x86byte.
- The timer for #flareon13 started on http://flare-on.com I will likely participate, but not sure I will try to speed-solve it like previous years. Last… by Washi.
- CopyEscape: Container-to-host arbitrary file write via docker cp (CVE-2026-17106) https://www.imperva.com/blog/copyescape-taking-over-docker-hosts-wit… by /r/netsec.
- Wesco confirms security incident after ExfilSquad claims data theft https://www.bleepingcomputer.com/news/security/wesco-confirms-security-incident-af… by BleepingComputer.
- RT Stephen Fewer: Today we have published the technical analysis and PoC for CVE-2026-55040, the Microsoft SharePoint authentication bypass we disclos… by ϻг_ϻε.
- ALPC-Enumerator - A Windows userland tool to enumerate and classify ALPC ports, including PPL-protected processes https://github.com/talha-nazeef-ahme… by Panos Gkatziroulis.
- How Trail of Bits helps verify the integrity of your Signal chats.
- The August 2026 Security Update Review by Dustin Childs.
- Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days https://www.bleepingcomputer.com/news/microsoft/microsoft-august-2026-patch-tuesday-f… by BleepingComputer.
- RT Olivia Gallucci : If anyone wants to see my @BlackHatEvents talk, it was uploaded to YouTube! https://www.youtube.com/watch?v=x6vr4GWToYc by Gergely Kalman.
- RT GangExposed RU: I’m on the BBC. Cyber Hack: The Conti Files is a six-part BBC documentary podcast about Conti. I was interviewed by Geoff White as… by thaddeus e. grugq.
- RT dbugs: A PoC/exploit has been discovered for vulnerability CVE-2026-26119 Vendor: Microsoft Product: Windows Admin Center Description: Improper aut… by kmkz.
- Pure-impacket parallel local-admin discovery via RBCD https://github.com/nnnnino/rbcdbrute by Panos Gkatziroulis.
- RT lanadelreyslefthood: Dynamic Analysis of VEH Dispatch and Exception-Context RIP Modification Using ROP Gadgets in ntdll.dll https://mooofin.git… by hasherezade.
- Expired DMARC reporting endpoint exposed a NYSE Fortune 1000’s infrastructure for $10 https://www.sh.consulting/blog/abandoned-dmarc-reporting-domain by /r/netsec.
- Win x64 Shellcode – Part 3: PE Structure and Export Directory https://proteqtum.com/posts/03-win-x64-shellcode-pe-export-directory_en/ by Panos Gkatziroulis.
- Sandworm hackers target IT pros with trojanized WireGuard VPN client https://www.bleepingcomputer.com/news/security/sandworm-hackers-target-it-pros-wi… by BleepingComputer.
- My dear Windows (ab)users! It’s time to get your patch chaps on! Microsoft today shipped updates to fix nearly 400 security vulnerabilities in its various Windows OSes and related software. “August’s.
- The 1Password analysis mentioned in today’s story is worth reading: “By all accounts, AI is quite good at finding security holes in software. But for now at least, patching the resulting bugpocalypse.
- Microsoft Patch Tuesday for August 2026 - Snort rules and prominent vulnerabilities by Cisco Talos.
- GhostSplice: Malicious MCP Servers Split Instructions to Make AI Coding Agents Exfiltrate Secrets (ASSET Research Group) https://asset-group.github.io… by /r/netsec.
- RT Brad Spengler: https://www.linkedin.com/pulse/badgarbagec-afunix-container-escape-resurrected-twice-oldani-sicvf/ by Dave Aitel.
- ExfilSquad targets 13 organizations, uses torrents for data distribution https://www.scworld.com/brief/exfilsquad-targets-13-organizations-uses-torren… by Nicolas Krassas.
- Signal adds an extra layer of security to make sure you’re actually chatting with the right person https://www.theregister.com/security/2026/08/11/sig… by Nicolas Krassas.
- Cisco warns of ASA and FTD VPN flaw exploited to crash devices https://www.bleepingcomputer.com/news/security/cisco-warns-of-asa-and-ftd-vpn-flaw-expl… by Nicolas Krassas.
- Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing https://thehackernews.com/2026/08/kimwolf-v7-android-botnet-makes-ht… by Nicolas Krassas.
- Zoom Annotation Flaws Could Let a Meeting Participant Hijack Another Attendee’s Client https://thehackernews.com/2026/08/zoom-annotation-flaws-could-l… by Nicolas Krassas.
- This is an amazing attack https:// plugandpwn.com/.
- 0xaled/vipere: BOF exploiting the Visual Studio Installer Elevation Service for SYSTEM LPE and persistence via AppDomainManager hijacking, with native… by Nicolas Krassas.
- RT Karsten Hahn: New video: Compiled V8 JavaScript for reversers V8 compilation pipeline bytecode caching how bytenode abuses cach… by hasherezade.
- RT Dhiyaneshwaran: CVE-2026-72898 - Metabase - Unauthenticated SQL Injection Nuclei Template: https://cloud.projectdiscovery.io/library/CVE-2026-… by Nuclei by ProjectDiscovery.
- RT JP Aumasson: proof of 0 = 1 in Lean, exploiting a hash collision (weak 32-bit hash Expr.hash/mixhash) https://github.com/endrazine/lean-cve-poc by thaddeus e. grugq.
- RT 7h3h4ckv157: You Don’t Need Mimikatz for DCSync Anymore (SharpDCSync) Credit/Resource: https://lsecqt.github.io/Red-Teaming-Army/active-directory/y… by Florian Roth.
- RT Alejandro Ramos: I’ve published a proof of concept for CVE-2026-68138, race condition in the Linux kernel’s traffic-control subsystem (net/sched)… by kmkz.
- RT Dr Heidy Khlaaf (هايدي خلاف): With Anthropic announcing auto-mode as the new default setting, and AI labs touting defensive AI as the only… by Giuseppe
N3mes1s. - ERPNext’s Document Follow feature exposed unauthorized data https://robinroy.xyz/blog/frappe-document-follow-vulnerability/ by /r/netsec.
- Prompt Injections for Defense by Bruce Schneier.
- Always interesting to see how macOS malware is evolving, and what stays the same Solid report from @moonlock_com on macOS malware & threa… by Patrick Wardle.
- RT 秋风: 实话说今天是非常不开心的一天 实际上最近一段时间我都非常沮丧 各种事情 所以我公布一个0day 希望让你们心情变的开心 GeoServer jsonArrayContains 未… by Nicolas Krassas.
- RT Clandestine: Smile, You’re on Camera! Part 2: Lazarus IT Workers Exposed https://any.run/cybersecurity-blog/lazarus-group-it-workers-investigation… by Simone Margaritelli.
- PQC migration update. This is great stuff (yes, I’m biased given my former role) but a few thoughts: 1. Great to see focus on integrity/authentication… by Phil Venables.
- RT Nicolas Krassas: CVE-2026-53360: KVM SEV-SNP guest-to-host heap OOB and analysis of the upstream fix https://blog.himanshuanand.com/2026/08/i-found… by kmkz.
- RT cr3ghost: If you’re writing implants, doing C2 persistence, trying to bypass top tier EDR, or building detections for registry-based persistence te… by thaddeus e. grugq.
- RT Muqsit 𝕏: Vulnerability discovery in Java applications Blog: https://0xpat.github.io/Vuln_discovery_Java/ Author: @0xPat by hasherezade.
- RT Tom Stacey: Did you know you can use HTTP header injection to trigger response queue poisoning and make it rain credentials? Learn how with the new… by PortSwigger Research.
- Talk about pushing to prod before a long vacation…this is from the security researcher Prepakis Georgios ( @ kernelstub ), who’s been quite open about hosting and administrating a Matrix chat platfo.
- RT Mathy Vanhoef: This refers to repeatedly connecting using different passwords & optimizing the speed of connection attempts What’s most interesting… by Simone Margaritelli.
- RT Nicolas Krassas: 737 Chrome VPN extensions impersonate brands to hijack browser traffic https://cyberinsider.com/737-chrome-vpn-extensions-imperson… by Simone Margaritelli.
- you should tune in to this by Caleb Gross.
- Lazarus hackers exploited Windows zero-day to target defense firms https://www.bleepingcomputer.com/news/security/lazarus-hackers-exploited-windows-ze… by BleepingComputer.
- http://NTUSER.MAN loads into HKCU at logon without RegCreateKey or RegSetValue ever being called, and it needs no admin rights. Two Sysmon r… by Panos Gkatziroulis.
- I keep getting asked the same question lately: Attackers are increasingly running large parts of intrusions with AI agents, and everyone can see the a… by Florian Roth.
- Blacklight: Illuminating AI Agent Artifacts for Attackers and Defenders by Gavin Kramer.
- RT International Cyber Digest: ‼ BREAKING: Security researchers have uncovered all of those who fell victim to the LiteLLM supply chain attack … by thaddeus e. grugq.
- NEW BHIS | Blog How far would you go to exploit a CVE without a proof of concept? No PoC, No Problem: Rediscovering CVE-2025-29902 in the Telex RD… by Black Hills Information Security.
- RT 0x0さん: Windows kernel pool internals are a goldmine for vulnerability researchers. Large pool allocations have page-aligned addresses and can lan… by Florian Roth.
- Successfully Failing As A Reverse Engineer - Max ‘Libra’ Kersten @Libranalysis https://www.youtube.com/watch?v=35JWMENMRjw by Swissky.
- RT Smukx.E: ETW for Security Research: Providers, Sessions, and Detection Engineering. Very good explanation about Etw video by @Idov31 https://youtu…. by hasherezade.
- RT SpecterOps: AI coding agents leave a lot behind on endpoints. Consulting Services intern @atomiczsec built Blacklight to show defenders exactly wha… by Arun.
- Hundreds of fake Chrome VPN extensions route traffic through a proxy https://www.bleepingcomputer.com/news/security/hundreds-of-fake-chrome-vpn-extens… by BleepingComputer.
- Time for #DenialOfPleasure attack https://www.whid.ninja/blog/denial-of-pleasure-attacking-unusual-ble-targets-with-a-flipper-zero by Luca Bongiorni.
- RT John Wang: Anthropic started watermarking Claude’s output. I did a little investigation into what method they used: https://johnjwang.com/post/202… by thaddeus e. grugq.
- Extract domain hashes straight out of a Veeam .vbk backup https://github.com/mattmillen15/vbkVomit by Panos Gkatziroulis.
- RT Adam G: Intune 2607 introduces Controlled Configuration for Microsoft Defender antivirus settings in preview. When enabled, Defender settings deliv… by SwiftOnSecurity.
- Hackers exploit critical Adobe Commerce flaw to hijack customer accounts https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-adobe… by BleepingComputer.
- RT B1lal: During our research we found a new Condi -Mirai variant IoT botnet infrastructure. Payloads for every architecture are still live. The confi… by batuu.
- RT Tech Brandon: You aren’t properly protecting your Entra Connect. It straddles two trust boundaries, but most orgs don’t give it the Tier 0 attentio… by Sean Metcalf.
- RT joshua steinman (🇺🇸,🇺🇸): Wake up babe the new @WhiteHouse cyber privateering construct just dropped https://www.whitehouse.gov/presiden… by Dave Aitel.
- Android malware combo takes out loans and relays victims’ credit cards https://www.bleepingcomputer.com/news/security/android-malware-combo-takes-out-… by BleepingComputer.
- RT Janggggg: https://testbnull.medium.com/hunting-exchange-server-0day-like-a-detective-3fd5e0dc9779 Some note of recent Exchange Server Pre-Auth RCE!… by SinSinology.
- RT Nextron Research : We discovered DPRK-linked NullReceiver loaders in two infected GitHub repositories. The samples reuse the Ethereum wall… by Florian Roth.
- Again: Keep it stupid simple -> it works by kmkz.
- Two Parsers, One JSON and a Flag: Intigriti’s July 2026 Challenge https:// blog.himanshuanand.com/2026/08 /two-parsers-one-json-and-a-flag-intigritis-july-2026-challenge/.
- Dissecting the JWR phishing framework by Chetan Raghuprasad.
- RT Arthur “Gerhart” Khudyaev: There is another way to load unsigned driver without bcdedit /set testsigning option in Windows 11, but without enabled … by hasherezade.
- RT Megatron: Overserved Few more Hashes likely related to “Sassy Code Campaign” c79021247a0375c5316c47d6faebf994799fc8bbfb43009fe73f260957747829 a090f… by Florian Roth.
- A stranger has been reading Salesforce and ServiceNow portals worldwide for 17 months https://www. helpnetsecurity.com/2026/08/12 /salesforce-servicenow-guest-user-exposure/.
- Can AI do novel security research? Meet the HTTP Terminator https://portswigger.net/research/can-ai-do-novel-security-research by /r/netsec.
- RT The Insider: German counterintelligence warns of Russian Matryoshka bot campaign before September’s state and local elections “Using sensationali… by thaddeus e. grugq.
- RT cr3ghost: An undocumented ETW flag guards some of Windows’ most interesting security telemetry. Connor McGarr (@33y0re) found a way to consume Micr… by kmkz.
- RT MagicSword: New entry in LOLDrivers: KKYUM.sys This driver exposes unauthenticated IOCTLs wrapping MmCopyVirtualMemory, no privilege checks, no acc… by kmkz.
- RT The Record From Recorded Future News: Germany’s cabinet approved legislation that would let its intelligence agencies hack foreign systems, sabota… by Vincent Yiu.
- White House taps security firms for offensive hack-back operations https://www.bleepingcomputer.com/news/security/white-house-taps-security-firms-for-… by BleepingComputer.
- RT _ZN4DionC1Ev: I’m certainly biased but I really enjoyed Brandon’s @_bazad discussion yesterday in our livestream. He discussed VR, mitigation des… by Axel Souchet.
- RT Émile Fugulin: Re @BugBountyDEFCON @busf4ctor Slides and instructions: https://github.com/Sytten/defcon2026 by Swissky.
- RT Gareth Heyes \u2028: I stole an Outlook password with nothing but CSS inside an email Whitepaper below by PortSwigger Research.
- Jamf has uncovered another macOS stealer that they’ve dubbed “Amnesia” Just added the sample to the @objective_see Foundation’s free/public m… by Patrick Wardle.
- From Unauthenticated API to Grid Risk: A Hybrid Inverter Vulnerability Explained https://www. saiflow.com/blog/from-unauthen ticated-api-to-grid-risk-a-hybrid-inverter-vulnerability-explained.
- Return of the Cookie Monster by Andrew Gomez.
- Attack of The Extensions by Andrew Gomez.
- RT SpecterOps: Cookie theft got harder. Browser hijacking didn’t. @KingOfTheNOPs shows how enabling the Chrome DevTools Protocol inside a live Chrome/… by Rio.
- Critical VMware vCenter RCE flaw exploited for reverse SSH access https://www.bleepingcomputer.com/news/security/critical-vmware-vcenter-rce-flaw-expl… by BleepingComputer.
- [RT The DFIR Report: Two indicators from a case we are actively investigating: rezbackcup[.]blob[.]core[.]windows[.]net frontend148[.]blob[.]core… by Jeff McJunkin.
- RT BINARLY: Can AI hack firmware? We gave frontier LLMs compiled UEFI modules and our VulHunt binary-analysis framework, and asked them to find vu… by Giuseppe
N3mes1s. - RT Harald Monihart: It was a blast to have been part of this amazing conference #OFTW by Patrick Wardle.
- Taps the sign by Nick Frichette.
- Self-contained malware research hub: curated catalog of 80 families (1971-2024) + 2,764 real encrypted samples, indexed and searchable. Local Flask ap… by Nicolas Krassas.
- RT Alejandro Ramos: I have published a Proof of Concept for the security note CVE-2026-24031: Dovecot SQL authentication bypass (authentication + user… by kmkz.
- AI ‘watermark removers’ flood the web as Anthropic begins marking Claude-generated output. Almost none can prove they work. - @Ax_Sharma https://www.b… by BleepingComputer.
- RT msuiche: I’ve implemented projective mode for control vectors; ablating a direction out of the residual stream instead of adding one to it. 478 KB … by Halvar Flake.
- Microsoft patches LegacyHive Windows zero-day vulnerability https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-legacyhive-windows-zero-… by Nicolas Krassas.
- Timor-Leste Raids Expose Growing Transnational Cyber-Fraud Network: Hundreds of Foreigners Detained as Scam Centers Relocate https://ministryofcyberaf… by Nicolas Krassas.
- RT MagicSword: “Does my SIEM detect this?” Most testing tools are built around that question. Magic-Atomics flips that. Does your prevention actually … by Chihuahua in charge NotMe.
- A backdoor in a LinkedIn job offer - @rdotpy https://roman.pt/posts/linkedin-backdoor/ by Swissky.
- RT Jason Koebler: A person representing themselves in court hid a prompt injection attack in a filing asking an AI system to side with them. Really go… by nyxgeek.
- RT incendiumrocks: New blog: Hitting AI safeguards/guardrails for cybersecurity work on frontier models is annoying, therefore this blog builds an und… by S3cur3Th1sSh1t.
- Looks like new threat notifications went out. A lot of great details in this thread by @jsrailton. by L0Psec.
- When You Pay the Ransom - Taking Apart an Interlock ESXi Decryptor | Maldbg https://maldbg.com/interlock-esxi-decryptor-internals by /r/netsec.
- RT Aziz Farghly : some samples : related to this campaign Troy Backdoor loader : 3a0bf3cf54f9e704c9350666ac854abce129c4e413070a6e2c7e7b28c623d744 fo… by Florian Roth.
- RT Moonlock by MacPaw: A fake macOS update that takes over your entire screen, then asks you to paste a “verification code” into Terminal. Real macOS … by Patrick Wardle.
- wbadmin NTDS.dit dump detection for Domain Controllers #DFIR https://www.securityinbits.com/detection-engineering/wbadmin-ntds-dit-dump-detection/ by DirectoryRanger.
- Holy Shuck! Weaponizing NTLM Hashes as a Wordlist https://trustedsec.com/blog/holy-shuck-weaponizing-ntlm-hashes-as-a-wordlist by DirectoryRanger.
- Hayabusa. Windows event log fast forensics timeline generator and threat hunting tool. BlackHat Arsenal USA 2026 Release https://github.com/Yamato-Sec… by DirectoryRanger.
- Talks & resources from the #TROOPERS25 AD & Entra ID Security track, on @Insinuator, featuring @dirkjan, @DrAzureAD, @al3x_n3ff, @sapirxfed, @Thomas… by DirectoryRanger.
- RT @Enno_Insinuator: Beats Studio Buds: Insecure Pairing Window, via @ttdennis on @Insinuator https://insinuator.net/2026/08/beats-studio-buds-insecur… by DirectoryRanger.
- RT 0x12 Dark Development: Process Parameter Poisoning New Medium post. In this one we will see a process injection technique published by SensePost th… by Arun.
- RT Elias Bachaalany: GhidraSQL, all you need to know. One of my longest videos, and deservedly so. Some topics are better served by being complete tha… by hasherezade.
- <3 out to my peers doing work in this absolutely absurd attack surface. I thought this would be long dead when I gave a presentation at DerbyCon about… by Michael Weber.
- PhishU Framework now supports text-based QR codes! Based on some research by researchers from Kaspersky, I decided to bake this in by default, replaci… by 𝐂𝐮𝐫𝐭𝐢𝐬 𝐁𝐫𝐚𝐳𝐳𝐞𝐥𝐥.
- RT Quang Vo: I wrote a short blog post about capability of Chrome Debugging Protocol in Red teaming. My favorite caps are probably Browse as victim an… by Dominic Chell.
- Apple sends new ‘Threat Notification’ alerts over mercenary spyware attacks https://www.bleepingcomputer.com/news/apple/apple-sends-new-threat-notif… by Nicolas Krassas.
- Loongson processors vulnerable to LoongLeak cache attack https://www.scworld.com/brief/loongson-processors-vulnerable-to-loongleak-cache-attack by Nicolas Krassas.
- Ukraine shuts down 94 fraudulent call centers, seize millions in cash https://www.bleepingcomputer.com/news/security/ukraine-shuts-down-94-fraudulent-… by Nicolas Krassas.
- Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt https://www.bleepingcomputer.com/news/security/akira-hackers-disable-edr-with… by Nicolas Krassas.
- Ruby 4.0 Universal RCE Deserialization Gadget Chain - elttam https://www. elttam.com/blog/ruby-4-0-unive rsal-rce-deserialization-gadget-chain.
- RT EXPMON: Interesting… My analysis showed that the second detected sample (https://pub.expmon.com/analysis/328599/, 323bea300e26482070c0edf1dfa1df8… by Haifei Li.
- GeoServer jsonArrayContains SQLi -> PostgreSQL RCE python PoC https://gist.github.com/portbuster1337/70d75ec246b85e3199037ce212ff1a06 by Nicolas Krassas.
- RT Nicolas Krassas: GeoServer jsonArrayContains SQLi -> PostgreSQL RCE python PoC https://gist.github.com/portbuster1337/70d75ec246b85e3199037ce212ff1… by kmkz.
- RT Nicolas Krassas: Ruby 4.0 Universal RCE Deserialization Gadget Chain - elttam https://www.elttam.com/blog/ruby-4-0-universal-rce-deserialization-ga… by Simone Margaritelli.
- RT watchTowr: You’re back in the room, trapped with us - and a Citrix NetScaler Pre-Auth RCE (CVE-2026-8452) Enjoy… https://labs.watchtowr.com/youre… by Dominic Chell.
- You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?)) - watchTowr Labs https://labs.watchtowr.com/youre-back-in-the-room-citrix-ne… by /r/netsec.
- RT cr3ghost: One of the most talented reverse engineers in the industry that keeps his techniques private due to the industry. Highly recommend readin… by kmkz.
- RT SSSCIP Ukraine: The Invisible Threat: Russian Hackers Exploit WinRAR and MS Office Flaws to Target Ukraine’s Public Sector https://cip.gov.ua/… by SwitHak ().
- really proud of this one, i was stuck a while on solving the filesystem persistence issue which all the previous citrix research were pointing to “pro… by SinSinology.
- RT diversenok: New blog post: “On COM/WinRT Initialization, Apartments, and lpacCom Capability Bypasses, Part 1” The series discusses a capability tha… by Panos Gkatziroulis.
- RT yed: We discovered a Rootkit version of CoolClient by Mustang Panda in Pakistan, Mongolia, Myanmar, and Russia. The kernel-mode driver of CoolClien… by hasherezade.
- RT Trail of Bits: PATCH THE PLANET BUG SPOTLIGHT: We found a medium-severity bug in aiohttp, Python’s HTTP engine that had 600M+ downloads last month…. by Dave Aitel.
- RT Eugene Kaspersky: HoneyMyte (a.k.a. Mustang Panda) upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit https://kas.pr/sv8c by kmkz.
- I have finally started working on the official Evilginx cookie manager extension for Chrome. Over the years, I recommended either EditThisCookie,… by Kuba Gretzky.
- RT Maher Azzouzi: VsockDrop: unprivileged Linux kernel LPE in the io_uring/vsock zerocopy path, no user namespaces needed. Bug affects Linux 6.7 -> 7…. by Vincent Yiu.
- RT Omri Baso: 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗖𝗼𝗻𝗳𝗶𝗴𝘂𝗿𝗮𝘁𝗶𝗼𝗻 𝗠𝗮𝗻𝗮𝗴𝗲𝗿 𝗥𝗖𝗘 𝟬… by Dominic Chell.
- RT MDSec: Synthetic frames on macOS? @saab_sec brings call stack spoofing to macOS https://www.mdsec.co.uk/2026/08/arm64-stack-internals-and-obfu… by Dominic Chell.
- I heard artifactory is hot now https://www.netspi.com/blog/technical-blog/red-teaming/stealing-the-artifact-jfrog-artifactory-vulnerability/ by Vylegzhanin Daniil.
- Blog post alert Arm64/Arm64e internals Stack masking on Apple Silicon @MDSecLabs https://www.mdsec.co.uk/2026/08/arm64-stack-internals-and… by sabotage.
- RT 0xor0ne: CVE-2026-20182: Cisco Catalyst SD-WAN Controller auth bypass https://rapid7.com/blog/post/ve-cve-2026-20182-critical-authentication-bypass… by kmkz.
- Abusing Windows Access Controls https://www.corporalbugz.com/post/whos-afraid-of-the-big-bad-wolf/ by Panos Gkatziroulis.
- RT Ham Radio Village: The first talk from HRV @ DC34 has dropped on our YouTube! Come check out @Jon - K4CHN talk about Meshtastic! https://www.youtub… by Chihuahua in charge NotMe.
- Windows 11 Hibernation on ARM64: the Boot Manager, winresume, and the hiberfil.sys Format - @msuiche https://www.msuiche.com/posts/windows-11-arm64-hi… by Swissky.
- RT Ru Campbell: New video: device-bound vs. syncable passkeys in Microsoft Entra • technical differences e.g. private key handling • where Microsoft… by Max.
- RT Moonlock Lab: 1/ DPRK’s Contagious Interview campaign is still running, the infrastructure is rotating often, and the payload is aimed at Mac users… by Patrick Wardle.
- This reminds me of “Ashley” Initial Access Framework, some great ideas and love the integration to Mythic, amazing project!! by David.
- I went looking for a managed-Postgres provider. Instead, I found a vulnerability in a 4-star PostgreSQL extension available everywhere! and turned it … by /r/netsec.
- RT Kostas: The amount of endpoint visibility coming out of Computer History (new Codex feature) is kinda wild. Some EDR vendors might be getting jealo… by thaddeus e. grugq.
- RT Margin Research: New blog post up for your Friday afternoon reading: https://margin.re/2026/08/analyzing-iranian-russian-uav-touchpoints-and-innova… by Dave Aitel.
- Thirteen modules in this week’s wrap-up! Get it here: https://rapid7.com/blog/post/pt-metasploit-wrap-up-lot-of-summer-shells-and-fit-http-profiles/ by Metasploit Project.
- Disposable Tooling: Building LLM-Generated Mythic Agents from Prompt to Deployment - @xpn https://specterops.io/blog/2026/06/24/disposable-tooling-b… by Swissky.
- > be me > get dm > its my friend @Intel80x86 > author of @HyperDbg > wtf i love him > open message > “smelly i got goop” > wtf i love goop > “i found … by vx-underground.
- RT hackyboiz: [Wipeload Project - Step 8] Chrome Full-Chain Exploitation Time to complete the Full Chain In this final step, we take the Me… by kmkz.
- RT Alejandro Ramos: This is my third Proof of Concept (PoC) for privilege escalation in Linux. In this case, it comes from a commit that fixes the pro… by kmkz.
- ChainDrop worm crawls into npm supply chain, evades standard defenses https://www.theregister.com/security/2026/08/15/chaindrop-worm-crawls-into-npm-s… by Nicolas Krassas.
- Finding Hidden Internal Apps Through Public Certificate Logs https:// naveensrinivasan.com/posts/202 6-08-07-finding-hidden-internal-apps-through-public-certificate-logs/.
- RT Blackstorm Security: Bring Your Own EDR: How to Turn a Commercial EDR into a Trojan Horse: https://www.akamai.com/blog/security-research/bring-your… by hasherezade.
- RT blackorbird: A lightweight (~12 KB) custom Windows backdoor, nicknamed “KB-Backdoor,” was discovered masquerading as a legitimate Realtek audio c… by kmkz.
- RT GangExposed RU: 1/5 I have something new on LockBitSupp. This is Evgeny Dementyev - the leader of LockBit. Instagram username: dementev23 Photo fro… by hasherezade.
- New Evooo1Bot Linux botnet turns routers into traffic relay nodes https://www.bleepingcomputer.com/news/security/new-evooo1bot-linux-botnet-turns-rout… by Nicolas Krassas.
- RT Adel Ka: i believe more in proper investigation methodology and agent design/workflow than in which model you use.. especially now that most models… by Dave Aitel.
- Finding Hidden Internal Apps Through Public Certificate Logs https://naveensrinivasan.com/posts/2026-08-07-finding-hidden-internal-apps-through-public… by Nicolas Krassas.
- HTB: Cobblestone https://0xdf.gitlab.io/2026/08/15/htb-cobblestone.html by Nicolas Krassas.
- Some late night expirements of executing code via MessageBoxIndirectW API. by Panos Gkatziroulis.
- SAP Commerce Cloud CVE-2026-58231 Exploited in the Wild https://securityaffairs.com/197244/security/sap-commerce-cloud-cve-2026-58231-exploited-in-the… by Nicolas Krassas.
- RT 𝕡𝕨𝕟𝕚𝕖: North Korea has exploited the same Windows driver four times in four years. afd.sys, the Ancillary Function Driver for W… by Florian Roth.
- RT Tal Be’ery: The Nearest Neighbor Attack: A Unicorn or an Iceberg? Revisiting the single public sighting of one of the most sophisticated Wi-Fi base… by Halvar Flake.
- RT J4X: Really interesting research from Anthropic on using multi-agent systems for vulnerability research: https://www.anthropic.com/research/multiag… by Alex Plaskett.
- phaedra: coverage-guided fuzzer that uses a local LLM to bootstrap seeds for undocumented binary formats https://github.com/zaydmulani09/phaedra by Nicolas Krassas.
- RPC-Triage - A zero-symbol static analysis engine that extracts and mathematically ranks the Windows RPC attack surface using an AHP-based risk model…. by Panos Gkatziroulis.
- KaplaStrike - A Cobalt Strike RL built with Crystal Palace; module overloading, NtContinue entry transfer, call stack spoofing, sleep masking, and sta… by Panos Gkatziroulis.
- APT36 Suspected in PATCHCORD Espionage Campaign Using Google Sheets C2 https://securityaffairs.com/197266/intelligence/apt36-suspected-in-patchcord-es… by Nicolas Krassas.
- RT Eyal Sela: A threat actor used Claude Code with Sonnet 4.6 as part of an intrusion, likely for ransomware. Sonnet took on many tasks, like writing … by Florian Roth.
- RT Co11ateral: SCCM - Remote Code Execution (CVE-2026-47301) Exploit chain (CVE-2026-47301) for Microsoft Configuration Manager (SCCM), combining a br… by kmkz.
- CVE-2026-33696: From a Schema Name to RCE in n8n https://simonkoeck.com/writeups/n8n-gsuiteadmin-prototype-pollution-rce by /r/netsec.
- RT Clandestine: GitHub - franckferman/ping-007: Covert ICMP C2 framework - AES-256-GCM stealth exfil, OS ping mimicry (Linux/Windows), multi-packet re… by kmkz.
- RT Pavel Yosifovich: New video: Process Memory Map in Code (Part 1). VMMap shows you a process’s memory layout from a GUI. This time I build a similar… by hasherezade.
- WS-Trust Autologon Endpoint: Password Spray Without Smart Lockout Blocking https://www.varonis.com/blog/ws-trust-autologon-endpoint by Panos Gkatziroulis.
- RestrictSetThreadContext is what I’d call a phantom mitigation. There’s a bit for it in EPROCESS.Flags2, and there’s a check for it in nt!NtSetContext… by winterknife.
- CVE-2026-6837: Command Injection in Zyxel export-cgi PKCS#12 Export Handling https:// minanagehsalalma.github.io/CVE -2026-6837-zyxel-export-cgi-command-injection/.
- “DeltaWifi” it’s called. Excellent. No notes. https:// github.com/sensepost/hostapd-m ana/releases/tag/2.12.
- #CVE-2026-73683: #Laravel Socialite No nonce validation. Capture a victim Facebook “id_token”, r… by kmkz.
- This video from @LiveOverflow is pretty nice! And I agree with him the zero days are impressive but the agent to agent communication channel created b… by Thomas Roccia.
- They patched their SaaS and left the self-hosted OSS version vulnerable - AppFlowy Authenticated SQL Injection https:// projectblack.io/blog/appflowy- authenticated-sql-injection/.
- From AKS node root vulnerability to Microsoft Copilot hijack (CVE-2026-32193) https:// zerolabs.rubrik.com/blog/break ing-m365-copilot-sandbox-chatmate.
Tools and Exploits
MCP server for NetExec enables AI agents to interact with the post-exploitation framework while operators focus on the compromise path. Works with both small and large models.
- Binary Ninja Diffing Plugin Released by L0Psec.
New Binary Ninja plugin for diffing binaries across CFG, disassembly, and all IL levels. Save and restore diffs, port function names between binaries.
- LUKSbox v0.5.1: TPM 2.0 Hardware Keyslots on Windows by hasherezade.
LUKSbox gains TPM 2.0 hardware keyslots on Windows via TBS. No driver, no admin rights. Vault keys can now live in real hardware on every desktop OS.
MCP server for HyperDbg enables AI-assisted kernel debugging and hypervisor-level analysis workflows.
Dreadnode benchmarks Kimi K3 against frontier models on offensive security tasks. K3 doubles performance in web app pentesting, crypto, and reversing compared to earlier versions.
SpecterOps releases tools and resources for the Pass-the-Passkey family of attacks targeting WebAuthn and FIDO2 authentication in Windows environments.
Black Hat Arsenal release from Yamato Security. Sigma-based threat hunting and fast forensics timeline for cloud logs.
New releases of Process Explorer, Process Monitor, PsPing, ZoomIt, CoreInfo, RDCMan, and NotMyFault with new features and bug fixes.
First serious macOS/Linux implant with a COFF loader. Enables cross-platform post-exploitation with Beacon Object File support on non-Windows targets.
Alongside GLM-5.3, the OpenVuln project launches on Hugging Face. Submit any public GitHub repo for automated vulnerability scanning powered by open models.
More this week (30)
- RT Yamato Security Tools: Just released Hayabusa v4! csv-timeline and json-timeline commands have been consolidated into a single dfir-timeline comman… by Max.
- RT Seongsu Park: Amazing research led by NIS in collaboration with South Korean security vendors has been released on Lazarus campaign. After reading … by Dave Aitel.
- Today I updated iOS Security Suite, my iOS runtime protection library Changelog, version 2.3.0: * New jailbreak detection checks added (thx Rohan… by Wojciech Reguła.
- “In the most serious case an agent tried to insert malicious code into an open-source project…. the agent engaged in social engineering - creating fa… by Kim Zetter.
- RT Patrik Grobshäuser: so Mythos scanned a thousand open source projects and WordPress wasn’t one of them? new blogpost with some thoughts on in… by shubs.
- Titanis v0.9.330 => https://github.com/trustedsec/Titanis/releases/tag/v0.9.330 Featuring support for Kerberos ticket forging, FAST armoring, and seve… by codewhisperer84.
- At @BlackHatEvents we released a new version of NOVA the open source prompt pattern matching for AI! On the project page, you can now use a playg… by Thomas Roccia.
- Apple has just released security updates for 26.6.1, 15.7.9 and 14.8.9 https://eclecticlight.co/2026/08/06/apple-has-just-released-security-updates-fo… by Howard Oakley, Eclectic Light Co.
- RT Md Ismail Šojal : Open-source OffSec model for local Run, A 35B MoE (only 3B active) specifically for autonomous real offensive security a… by Florian Roth.
- RT cr3ghost: Three zero-days in Windows 11 and Microsoft Entra ID. Over 20 novel attack techniques against passkeys. Toolkit open sourced. Microsoft d… by Rémi GASCOU (Podalirius).
- RT cr3ghost: Re If you want every SpecterOps open source tool in one place, they published a full documentation index. BloodHound, GhostPack, Mythic a… by Chihuahua in charge NotMe.
- RT Patrick Wardle: Re Also released a new version of “RansomWhere?” that you can grab (for free!) from the @objective_see website: https://objective-s… by Howard Oakley, Eclectic Light Co.
- RT Alexandre Borges: As promised, I will continue maintaining the Malwoverview project, which has been created 8 years ago. Malwoverview version 8.1.0… by Max.
- RT Open Source Security mailing list: CVE-2026-64531,OVSwrap: Linux kernel: Local root vuln in Open vSwitch datapath https://www.openwall.com/lists/os… by Solar Designer.
- RT Open Source Security mailing list: CVE-2026-64564: Linux kernel: SCTP ASCONF transport UAF leading to local privilege escalation and container esca… by Solar Designer.
- RT Open Source Security mailing list: CVE-2026-64561,Zapscape: Linux kernel: Guest-to-Host Escape in KVM/x86 https://www.openwall.com/lists/oss-securi… by Solar Designer.
- RT OpenAI: We’re expanding our cybersecurity initiative Daybreak and introducing GPT-5.6-Cyber, a new model for advanced, authorized cybersecurity wo… by Swissky.
- RT Jacob Bartlett: Apple’s internal private frameworks are basically open-source thanks to MachOSwiftSection, which lets you reverse-engineer and insp… by Gergely Kalman.
- RT fr0g: Last year @trailofbits won second place in the AIxCC and released buttercup. It’s a tool they built during the challenge and released. I took… by thaddeus e. grugq.
- RT Lukasz Olejnik: Releasing a multi-month work today! We conducted the first fully autonomous information operation (under controlled conditions). It… by thaddeus e. grugq.
- RT Ashar Javed: WordPress 7.0.4 is now available, and it fixes an RCE. First of all, credit to @pwn_ai, who reported this vulnerability before I did. … by Mayuresh 🇮🇳.
- Google released Gemini 3.7 Flash today, so I immediately ran it through my THOR Finding Triage Benchmark. And… we have a new #1. By quite some distan… by Florian Roth.
- RT pwn.ai: WordPress just released another emergency update (after XSS2Shell) patching another RCE chain reported by @pwn_ai: CVE-2026-65640 https://w… by Paulos Yibelo.
- RT shane: We’ve got some research on how a “guardian model” operates in this sort of context along with an open-source dataset so you can try it out y… by dreadnode.
- if you don’t trust the big mega corp with your data - try Screenlogger. Open source and completely local. https://github.com/radkawar/screenlogger by Rad.
- RT ThreatWire: PoC RELEASED: Public exploit code is now available for CVE-2026-47301, a CVSS 8.8 privilege escalation flaw in Microsoft Configura… by CCob.
- I missed this when it was posted, but @Antonlovesdnb released a new tool (ATEN) to enhance endpoint visibility for AI agents. Well done! https://… by Panos Gkatziroulis.
- Apache IoTDB v2.0.10 pre-auth/unauth attack-surface validation lab + reproducible PoCs (0day RCE) https://github.com/dinosn/iotdb-2.0.10-security by Nicolas Krassas.
- Docker lab reproducing CVE-2026-71362 (Adobe Commerce / Magento Open Source customer-session identity-switch account takeover, APSB26-92, CVSS 9.1) ht… by Nicolas Krassas.
- RT Open Source Security mailing list: rsync 3.5.0 released with fixes for 33 CVEs https://www.openwall.com/lists/oss-security/2026/08/13/1 by Dave Aitel.