Axta @Asta_nine

Strix found a critical auth bypass in etcd, one of the most used open-source components in cloud infrastructure. Now published as CVE-2026-33413 (CVSS 8.8). Read the full writeup: strix.ai/blog/where-oth…

🚨 Fortinet just disclosed CVE-2026-39808 and CVE-2026-39813 - 2 critical vulnerabilities affecting FortiSandbox. No active exploitation itw reported as of yet. Scan your infrastructure to find vulnerable instances: CVE-2026-39808: github.com/rxerium/rxeriu… CVE-2026-39813: github.com/rxerium/rxeriu… CVE-2026-39808 (CVSS 9.1): An Improper Neutralization of Special Elements used in an OS Command ('OS command injection') vulnerability [CWE-78] in FortiSandbox may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests. CVE-2026-39813 (CVSS 9.1): A Path Traversal vulnerability [CWE-24] in FortiSandbox JRPC API may allow an unauthenticated attacker to bypass authentication via specially crafted HTTP requests. Patches are available as per vendor advisories: fortiguard.fortinet.com/psirt/FG-IR-26… fortiguard.fortinet.com/psirt/FG-IR-26…

‼️ CVE-2025-58434 and CVE-2025-59528: Flowise Dual CVE PoC GitHub: github.com/kartik2005221/… The two vulnerabilities chain naturally: CVE-2025-58434 provides unauthenticated account takeover, which satisfies the authentication requirement for CVE-2025-59528, achieving unauthenticated RCE in a single automated run.

Tomcat JMX Proxy exposed without auth? Wrote a blog about how I got shell on a production Tomcat behind Cloudflare despite the deploy API being locked down, WAF blocking payloads, and CDN filtering template syntax. 8 dead ends. Then AccessLogValve + docBase + relaxedQueryChars + EL injection. 14 requests to RCE. Tool + nuclei template included! hackt.us/from-tomcat-jm… #bugbountytips #bugbounty

Praetorian's Khael Kugler found and disclosed a critical vulnerability in AperiSolve, the popular steganography analysis tool used widely in CTFs and the security community. 🚨 CVE-2026-34977 – CVSS 9.3 Unauthenticated RCE via command injection in the JPSeek analyzer functionality. When uploading JPEGs, a password gets interpolated directly into a bash command without sanitization — giving immediate access to the host or container. 🔧 Version 3.2.1 patched. Advisory ➡ buff.ly/sbumVHn CVE ➡ buff.ly/P0ZPpvc #CVE #OffensiveSecurity

🔨BlueHammer: When Defender Becomes the Attacker A Windows zero‑day (“BlueHammer”) flips Defender’s update workflow into a privilege escalation path. I’ve built a detection that goes beyond signatures — catching the behavioral traces this exploit leaves behind. Technical Analysis: cyderes.com/howler-cell/wi… KQL Code: github.com/SlimKQL/Detect… #CyberSecurity #BlueHammer #DetectionEngineering #DefenderXDR

Finds zero-day vulnerabilities in Windows kernel drivers using AI agents github.com/416rehman/deep…

CVE-2026-39912 - Unauthenticated account takeover on Xboard/V2Board. The loginWithMailLink endpoint returns the magic link in the API response. Two requests, zero credentials, full account access. chocapikk.com/posts/2026/xbo…

Next, Next, SYSTEM: Exploiting NSIS installer bugs to escalate privileges in Zscaler Client Connector In this blog post I show how patch gaps in Zscaler's bundled NSIS versions led to LPE.. includes PoCs and yara rule to help you find other affected s/w blog.amberwolf.com/blog/2026/apri…

Here's a video PoC for Azure Entra ID SignIn Log Bypass in action. I had to make it to help MSRC replicate it (lol). You'll see how simple this bypass was. No worries admins, Microsoft says that it was only a "Moderate" issue.

The Story of a Perfect Exploit Chain: 6 bugs that looked harmless until they became pre-auth RCE in a security appliance. 🎄✨ This write-up is a real-life hacker’s POV story. It is not a list of bugs. It is the human thought process of how an exploit chain forms. You start with one question. What does this appliance actually do with my request? From there, small wins stack into momentum until 6 bugs collapse into one pre-auth RCE. My holiday basically disappeared into this write-up… and I’m so glad it did. Happy New Year, everyone!

Had noted elevated honeypot activity towards the WEB-INF pathway and while some of these may not be related to CVE-2025-68645, for reference here are all the paths targetting WEB-INF/web.xml from the past 7 days. /CDGServer3/ClientAjax payload: command=downclientpak&InstallationPack=../WEB-INF/web.xml&forward=index.jsp /SupportPortlet/faces/javax.faces.resource./WEB-INF/web.xml.jsf?ln=.. /costModule/faces/javax.faces.resource./WEB-INF/web.xml.jsf?ln=.. /faces/javax.faces.resource./WEB-INF/web.xml.jsf?ln=.. /h/rest?javax.servlet.include.servlet_path=/WEB-INF/web.xml /myaccount/javax.faces.resource./WEB-INF/web.xml.jsf?ln=.. /secureader/javax.faces.resource./WEB-INF/web.xml.jsf?ln=.. /service/~webrt/nc.uap.lfw.file.action.DocServlet payload: pageId=login&disp=/WEB-INF/web.xmlpageId=login&disp=/WEB-INF/web.xml

siri@fu4k1 @sirifu4k1

6 months ago

CVE-2025-68645 poc http://127.0.0.1/h/rest?javax.servlet.include.servlet_path=/WEB-INF/web.xml #CVE

1 32 170 42K 129

🚨 Critical (CVSS 10) tagged CVE-2025-52691 affecting SmarterMail software I've created a script to detect vulnerable instances: github.com/rxerium/CVE-20… Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution. While the vulnerability affects SmarterMail versions Build 9406 and earlier, the CSA advises users and administrators of affected product versions to update to SmarterMail version Build 9413 immediately: csa.gov.sg/alerts-and-adv…

This PoC was made by the author within 10 minutes using Cursor 🔥 x.com/i/status/20049…

payloadartist @payloadartist

6 months ago

MongoBleed (CVE-2025-14847) - Unauthenticated Memory Leak PoC github.com/joe-desimone/m… By @dez_ #bugbountytips #bugbounty #cybersecurity

2 42 205 34K 98

ℹ️ Note: A wide range of online services are currently experiencing disruptions due to a technical issue affecting Cloudflare's global network; incident not related to country-level internet disruptions or filtering

"New Kimsuky Malware “EndClient RAT”: First Technical Report and IOCs" published by @0x0v1. #EndClientRAT, #Kimsuky, #DPRK, #CTI 0x0v1.com/endclientrat/

There's a lot going on in the AI threats space, and we're psyched to share a little sampling of our view into how actors are leveraging AI to bolster capabilities across a range of adversary use cases. Give it a gander & enjoy direct-to-VT malware links :D cloud.google.com/blog/topics/th…

“I Paid Twice” Phishing Campaign Targets Booking.com infosecurity-magazine.com/news/i-paid-tw…

Doctor Web exposed Android.Backdoor.Baohuo.1.origin, a malware hiding in a Telegram X clone. It uses a Redis database for C2, infects 58K+ devices, and steals crypto wallet info from the clipboard. #TelegramBackdoor #RedisC2 #AndroidMalware #Baohuo securityonline.info/first-ever-and…