Cyber Guardians

GitHub

GitHub - 9bie/php2shell-bypass-aslr-exp: A php2shell exploit that requires no modifications to the official version, and does not…

A php2shell exploit that requires no modifications to the official version, and does not require display_errors or limit_memory. - 9bie/php2shell-bypass-aslr-exp

Sud0Ru

Yet Another DCOM Object for Command Execution Part 1

If you’re a penetration tester, you know that lateral movement is becoming increasingly difficult, especially in well defended environments. One technique for command execution has been the use of DCOM objects. The Impacket dcomexec.py script allows you to…

GitHub

GitHub - ION28/BLUESPAWN: An Active Defense and EDR software to empower Blue Teams

An Active Defense and EDR software to empower Blue Teams - ION28/BLUESPAWN

GitHub

GitHub - Karib0u/rustinel: Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written…

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required. - Karib0u/rustinel

Embrace The Red

Visual Studio Copilot Remote Code Execution (CVE-2026-103572)

A path validation bypass allows Copilot to write to settings and configuration files. This allows the AI to escape its file write restrictions and achieve arbitrary command execution. The reported bug also demonstrated how this can be exploited by a third…

GitHub

GitHub - 0xrawsec/whids: Open Source EDR for Windows

Open Source EDR for Windows. Contribute to 0xrawsec/whids development by creating an account on GitHub.

GitHub

GitHub - psihijatrija/Sentinel: Userland EDR for Windows. ETW telemetry, behavioral correlation, MITRE ATT&CK.

Userland EDR for Windows. ETW telemetry, behavioral correlation, MITRE ATT&CK. - psihijatrija/Sentinel

Quarkslab

MyReport Updater: From gRPC to SYSTEM - Quarkslab's blog

MyReport is a report generation software often used as a component of web-based applications. We describe a privilege escalation and remote code execution vulnerabilities in MyReport Updater 2.1.1 through its update configuration and gRPC service.

by7e.dev

Bypassing AMSI & ETW: Building a Custom PowerShell Runspace in C#

Building a custom C# PowerShell runspace that bypasses AMSI and ETW while enforcing Full Language Mode. Breaking down each defensive layer and how operators can neutralize them using .NET reflection from a compiled binary.

GitHub

GitHub - wagga40/Zircolite: A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs - wagga40/Zircolite

hatching.io

Hatching - Automated malware analysis solutions

Automated malware analysis with Hatching Triage, the high-volume sandbox solution for SOCs, CERTs, SOARs, and MSSPs.

infosecravi.com

An agentic AI red team checklist: 222 tests, WSTG-style — infosecravi

A forced-order, 222-test checklist for authorized agentic AI engagements — 20 categories from recon to voice, each test mapped to OWASP ASI, the LLM Top 10, the MCP Top 10 and a MITRE ATLAS tactic, with how-to-test, tools and a detection mode. Free download…

ThreatFabric

Hirudo: From Fake Updates to Patched Banking Apps

Hirudo replaces Indonesian banking apps with patched copies that blind their defences. We break down its patching, distribution, targeting and fraud.

blog.cykor.kr

LEAD: LLM-Based Static Analysis of Session Hijacking Vulnerabilities in Android Deep Links - Your site

By Hyunseo Shin · October 2026 · Korean version

Medium

How I Took Down a ₹1.2 Crore Android Banking Fraud- (mparivahan, Netflix, pmkisan, sexytalk, wedding, desitales)

A complete technical write-up of an engagement against an active Android banking-fraud operation — recon, malware internals, platform…

GitHub

GitHub - murrez/CVE-2026-107806: CVE-2026-107806 — nginx-ui 2.3.8–2.4.x auth RCE via forged backup restore (TestConfigCmd). PoCbit…

CVE-2026-107806 — nginx-ui 2.3.8–2.4.x auth RCE via forged backup restore (TestConfigCmd). PoCbit PoC: GET /api/backup, tamper app.ini, POST /api/restore, POST /api/nginx/test. check/exploit, batch...

beaksec

Telegram Desktop: one-click account takeover via IPC injection

An unescaped separator in Telegram Desktop’s single-instance IPC lets one clicked link read arbitrary files off the disk and send them to the attacker, session files included.

AISLE

One AISLE curl Audit Produced 24 CVEs. 18 Ship Today

Learn what happened when curl co-founder Daniel Stenberg requested an AI-powered security audit by AISLE.

XBOW

XBOW Built a Chrome Full-Chain Exploit Affecting a Billion Users in Six Days | XBOW

XBOW recently discovered and built a Chrome full-chain exploit affecting an estimated billion users globally.

Remedio

Integer Overflow Vulnerability in Adobe Acrobat | CVE-2026-81983

CVE-2026-81983: an Adobe Acrobat integer overflow vulnerability that corrupts memory when a malicious PDF is opened.

Claroty

Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers

Team82 researched the attack surface of the Danfoss AK-SM 800A refrigeration controller platform and identified multiple vulnerabilities affecting the embedded web management interface. Team82 disclosed the vulnerabilities to Danfoss, which addressed them…

GitHub

GitHub - horizon3ai/AhsayCBS-Auth-Bypass-RCE: A proof of concept exploit for CVE-2026-105133 and CVE-2026-105134 affecting AhsayCBS

A proof of concept exploit for CVE-2026-105133 and CVE-2026-105134 affecting AhsayCBS - horizon3ai/AhsayCBS-Auth-Bypass-RCE

GitHub

GitHub - S12cybersecurity/LogonStealer: Abuses the Credential Provider interface to steal plaintext passwords from logonui.exe…

Abuses the Credential Provider interface to steal plaintext passwords from logonui.exe via CredProvDataModel.dll hooks - S12cybersecurity/LogonStealer

GitHub

GitHub - ivancabrera02/SrHollow

Contribute to ivancabrera02/SrHollow development by creating an account on GitHub.

GitHub

GitHub - Kavan00/Android-Projector-C2-Malware: Breakdown of a c2-network of chinese beamers - SilentSDK-Analysis

Breakdown of a c2-network of chinese beamers - SilentSDK-Analysis - Kavan00/Android-Projector-C2-Malware

FORTBRIDGE

WordPress libheif RCE - FORTBRIDGE

How a WordPress libheif RCE uses returned pixels to bypass ASLR, trigger a heap overflow and execute commands on exact Ubuntu and Debian stacks.

www.virlabs.ai

knock-outd: an undetected port-knocking backdoor in the wild | VirLabs

An undetected Linux launcher uses libpcap to bind to the nerwork interface, and waits for three packets before executing a missing companion.