MrSandman @cmhacks

👨‍💻 A hard day’s work for a DPRK IT worker. One of the “developers” hired by a fake DeFi startup works through the assigned project: frontend, backend, upgradeable smart contracts, MetaMask, testnet faucets, and ChatGPT. All recorded in #ANYRUN Sandbox. This footage is from the undercover investigation into the Famous Chollima IT worker scheme — after the fake interviews were over, and real access had been granted. 👀 What they do once onboarded? Read the full story: any.run/cybersecurity-…

Microsoft has failed to properly patch RoguePlanet (CVE-2026-50656), ShieldBreak, a PoC that demonstrates a full bypass to the previous patch is now public. github.com/MSNightmare/Sh… The PoC works with the latest August 2026 patch

Decrypt D-Link R95 router firmware: dd if=firmware_image.bin of=enc.bin bs=512 skip=1 openssl aes-256-cbc -d -in enc.bin -out dec.bin -k BE81AE1B6F523AC7164C4FD67B6BD8FD

🚨 This one's nasty. Googled "codex macbook download" — first result is a sponsored ad pointing to chatgpt.com. The real domain. It opens a shared ChatGPT chat with friendly install steps: open Terminal, paste this command. That command hides a base64 string. Decoded 👇 curl to trekmesh15[.]com — a known ClickFix domain dropping MacSync Stealer. Passwords, keychain, crypto wallets. Gone. So the infection chain is: Google Ad → legit chatgpt.com share link → you infect yourself. No exploit. No download. Just trust in a Google ad and a ChatGPT page. Don't ever paste Terminal commands from an ad or a shared chat. Tell your Mac friends.

🇰🇵 We built a fake company. We recruited DPRK IT workers. We recorded everything. 📹 The full story is finally out: hours of footage, IOCs, things we never showed at DEF CON and even a familiar face from Season 1. Smile, You’re on Camera: Episode 2.

@

57 years ago

0 0 0 0 0

A PoC/exploit has been discovered for vulnerability CVE-2026-64561 Vendor: Linux Product: Linux Description: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root after making MMU pages available Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the shadow MMU. If reclaiming shadow pages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to map memory into an invalid root. On its own, populating an invalid root is "fine", but because child shadow pages inherit their parent's role, any children created during the map/fetch will be created as invalid pages, thus violating KVM's invariant that invalid pages are never on the list of active MMU pages. Note, the underlying flaw has existed since KVM first started tracking invalid roots in 2008 (commit 2e53d63acba7, "KVM: MMU: ignore zapped root pagetables"), but the true badness only came along in 2020 (Linux 5.9) with the invariant that invalid shadow pages can't be on the list of active pages. Note #2, inheriting role.invalid when creating child shadow pages is also far from ideal; that flaw will be addressed separately. Link: github.com/V4bel/Zapscape #dbugs_vuln

🚨 PoC released: CVE-2026-27912, a Windows Kerberos privilege escalation vulnerability, now has a public exploit. The flaw affects Windows Server 2012 and allows an authorized attacker to elevate privileges over an adjacent network. PoC: github.com/semperis-commu… #Microsoft #Windows #Kerberos #CVE #PoC #CyberSecurity #ActiveDirectory #Infosec

It's Friday, the best day of the week to drop 0-days. @pwn_ai dropped XSS2Shell WordPress Core preauth XSS → RCE. 🫥

pwn.ai @pwn_ai

5 days ago

Introducing XSS2Shell ⛓️: WordPress Core preauth XSS→RCE vulnerability affecting 43% of the internet, discovered autonomously by pwn (using open-source models), affecting all WordPress versions. pwn.ai/blog/xss2shell Please patch CVE-2026-64638 as soon as possible!

26 196 888 1.1M 666

CVE-2026-34348 exploitation demo from my #BHUSA "Pass-the-Passkey Family of Attacks" talk: WebAuthn assertion from recent YubiKey authentication is extracted from Windows Event Log and replayed against Microsoft Entra ID using Passkey Injector. Whitepaper: specterops.io/passkeys

Lazarus used this as a zero-day. No BYOVD needed. The vulnerable driver is already on every Windows machine. CVE-2024-21338 exploits appid.sys (AppLocker's driver) to call a user-controlled function pointer in kernel mode. The exploit uses ExpProfileDelete as a valid kCFG target to decrement PreviousMode from 1 to 0. Once PreviousMode is flipped, NtWriteVirtualMemory and NtReadVirtualMemory skip all security checks. Full admin-to-kernel LPE with token manipulation. Works on Windows 10 and 11 with HVCI enabled. Full PoC included. If you just read the PreviousMode mitigation post by @yarden_shafir, this is the CVE that forced Microsoft to add it. hakaisecurity.io/cve-2024-21338… github.com/hakaioffsec/CV… Author: @HakaiOffsec #WindowsInternals #ExploitDevelopment #InfoSec

keyboard_arrow_left Previous keyboard_arrow_right Next

We have published our @rapid7 analysis of CVE-2026-63077, an unauth RCE in JetBrains TeamCity that was disclosed last week and already added to KEV as being exploited in the wild. Check out our full analysis, IOCs, and PoC. This one has a gnarly gadget chain and a polygot SQL/JSP payload: rapid7.com/blog/post/ra-u…

🚨 Linux KVM'de yeni kritik VM Escape açığı duyuruldu ve PoC yayınlandı! Zapscape (CVE-2026-64561) adı verilen yeni güvenlik açığı, duyurulduktan bir kaç gün sonra PoC GitHub'da kamuya açık olarak paylaşıldı. PoC: github.com/V4bel/Zapscape Açık, nested virtualization etkin olan KVM sistemlerinde, guest root yetkisine sahip bir saldırganın sanal makineden çıkarak host üzerinde root yetkisiyle kod çalıştırabilmesine olanak tanıyor. 🔹 CVE: CVE-2026-64561 🔹 Etkilenen: Linux KVM/x86 🔹 PoC: Yayınlandı 🔹 Risk: VM Escape -> Host Root KVM tabanlı sanallaştırma kullanan sistem yöneticileri güvenlik güncellemelerini ve nested virtualization yapılandırmalarını mutlaka gözden geçirmeli.

Over 90 days have passed since I reported the libpng APNG OOB Write 0day. This vulnerability enables memory corruption that can, in some scenarios, lead to code execution (as demonstrated in the video). #0day #AI #LIBPNG arielkoren.com/vulnerabilitie…

Public Exploit Code Released for CVE-2026-50343, a Windows InstallService Flaw That Grants SYSTEM Privileges securityonline.info/cve-2026-50343… 🔥

For internal education, I wrote a code to get SYSTEM shell with service creation method. By specfying local admin credentials, it allows to get SYSTEM shell from non-administrative shell. github.com/daem0nc0re/Pri…

keyboard_arrow_left Previous keyboard_arrow_right Next

🚨 A Cobalt Strike BOF targeting CVE-2026-49176 adds another exploitation method for the CVSS 7.8 Windows WalletService local privilege escalation vulnerability. GitHub: github.com/777erp/CVE-202… The flaw can allow a standard user to execute commands with SYSTEM privileges on unpatched Windows systems.

CVE-2026-66066 gist.github.com/win3zz/ae02cb1…

⚠️🚨⚠️🚨⚠️🚨⚠️ #brokensec - Ghidra RCE Exploit kit Fully weaponized exploits for **CVE-2026-52751** and **CVE-2026-52750** Based on public research from bikini/exploitarium/ghidra-12.1.2-rce-ace-calc-poc #RCE #security #cybersec #hacking #0days #exploit #antisec #infosec #brokensec #cybernews #ghidra

Full details and technical analysis can be found here: research.jfrog.com/post/sqlite-cr…

JFrog Security @JFrogSecurity

2 weeks ago

CVSS 10.0, but the evidence doesn't add up. CVE-2026-51302 in SQLite claims critical impact, but: ❌The supplied PoC does not reproduce ❌The source code does not match the claims And it's not an isolated case: JFrog found the same issues in 54 of 55 CVEs published by the same

3 25 149 29K 30

Wrote up a blog for the PipeWire sandbox escape via malicious library loading CVE-2026-5674 Details ⬇️ embracethered.com/blog/posts/202…