Bypassing TLS certificate verification in 5 major TLS libraries with a LD\_PRELOAD lib.
* Works on OpenSSL, GnuTLS, NSS, mbedTLS, and wolfSSL.
* And most UNIX Systems
* Plus a deep dive into LD\_PRELOAD
Exploit development for IBM i - turning blind AS/400 command execution into a proper shell
Source: https://blog.silentsignal.eu/2025/09/04/Exploit-development-for-IBM-i/
Marshal madness: A brief history of Ruby deserialization exploits
Source: https://blog.trailofbits.com/2025/08/20/marshal-madness-a-brief-history-of-ruby-deserialization-exploits/
Just published a breakdown of RapperBot. Quick hits:
Uses DNS TXT records to hide rotating C2s.
Multi-arch payloads (MIPS, ARM, x86), stripped/encrypted, self-deleting.
Custom base56 + RC4-ish routine just to extract C2 IPs (decryptor included).
Infra shifts fast: scanners moving countries, repos/FTP/NFS hosting binaries.
Timeline lines up neatly with DOJ’s Operation PowerOFF takedown.
Full post: [https://www.bitsight.com/blog/rapperbot-infection-ddos-split-second](https://www.bitsight.com/blog/rapperbot-infection-ddos-split-second)
Curious if anyone’s still seeing RapperBot traffic after the takedown, or if it’s really gone quiet.
Deep Specter Research Uncovers a Global Phishing Empire
Source: https://reporter.deepspecter.com/the-cloak-and-the-dagger-how-google-and-cloudflare-missed-a-global-phishing-empire-ed7176ebf82f
This article reviews IPv6 attack vectors (RA Spoofing, RDNSS Spoofing, IPv6 DNS Takeover with DHCPv6, SLAAC to DHCPv6 Downgrade, WPAD Poisoning) and their detection using Suricata signatures.
**TL;DR: Discovered an unpatched zero-day in TP-Link routers (AX10/AX1500) that allows remote code execution. Reported to TP-Link on May 11th, 2024 - still unpatched.4,247 vulnerable devices found online.**
# The Discovery
Used automated taint analysis to find a stack-based buffer overflow in TP-Link's CWMP (TR-069) implementation. The vulnerability exists in function `sub_1e294` that processes SOAP SetParameterValues messages.
**Key Technical Details:**
* Stack buffer: 3072 bytes
* PC register overwrite: 3112 bytes (payload: "A"\*3108 + "BBBB")
* Result: `pc = 0x42424242` (full control)
* Canary exploit mitigations
# Proof of Concept
// Vulnerable code pattern
char* result_2 = strstr(s, "cwmp:SetParameterValues");
// Size calculated from user input - BAD PRACTICE
strncpy(stack_buffer, user_data, calculated_size);
// OVERFLOW!
Exploitation requires setting a malicious CWMP server URL in router config, then device connects and gets pwned.
# Impact
**Affected Models:**
* TP-Link Archer AX10 (all hardware versions V1, V1.2, V2, V2.6)
* TP-Link Archer AX1500 (identical binary)
* Potentially: EX141, Archer VR400, TD-W9970
**Firmware Versions:** 1.3.2, 1.3.8, 1.3.9, 1.3.10 (all vulnerable)
**Internet Exposure:** 4,247 unique IPs confirmed vulnerable via Fofa search
# Why This Matters
Router security is often terrible - default passwords, weak configs, other vulns. Getting config access isn't that hard, and setting up a rogue CWMP server is trivial. Once you change the TR-069 server URL, the router connects to your malicious server and you get root.
# Timeline
* **Discovery:** January 2025 (automated analysis)
* **Vendor Notification:** May 11th, 2024
* **Current Status:** Probably Patched
* **Public Disclosure:** Now
We recently published a breakdown of a subtle but impactful vulnerability: misconfigured upload paths that allow public access to uploaded files.
The core issue occurs when a webserver accepts file uploads but stores them in a directory directly accessible via the browser. If there’s no validation or access control, attackers can upload malicious files—like webshells or phishing pages—and access them immediately.
How do others approach detecting and preventing this kind of misconfiguration? Have you seen this exploited in the wild? What tooling or scanning techniques do you use to catch it?
