TànPhá V3 is an open-source, modular penetration testing framework designed for Termux on Android and lightweight Linux environments. It automates discovery, fingerprinting, vulnerability assessment, validation, and reporting using a state-machine architecture. The tool supports multiple exploitation vectors including SQL injection, command injection, file upload, local file inclusion, and a stateful PHP remote access trojan (RAT). It features automatic CSRF token bypass for authenticated scans and basic web application firewall evasion. The project is actively maintained with plans for advanced evasion techniques and additional modules in future releases. It is intended solely for authorized security testing and educational purposes.
An analysis of DMARC policies for 226 large European listed companies across major stock indices found that 48 (21%) have no effective DMARC policy, allowing their corporate domains to be spoofed via email. An additional 41 companies have partial or quarantine-only policies, while 137 (61%) enforce a reject policy to block spoofed emails. The study highlights significant gaps in email domain protection among major corporations, potentially enabling email spoofing attacks that impersonate these companies' domains.
This content discusses the remastered Zero2Automated beginner malware analysis course and inquiries about updates from the researcher @0verfl0w_. The course offers a redesigned syllabus covering malware reverse engineering fundamentals and practical analysis techniques. It is a learning resource rather than a security threat or vulnerability.
The Rust compiler executable (rustc) version 1.99.0 for Windows has been flagged as malicious by multiple antivirus vendors on VirusTotal. This detection appears specific to version 1.99.0, as version 1.99.1 is not flagged. The issue was reproducible with a fresh installation of Rust 1.99.0 via rustup. The SHA256 hash of the flagged binary is FC40F1C8B65095A22A48C111AADC279C26A049B7E4161E8B99FFE3EB23873E86. No further technical details or confirmed exploits are available.
Brotli2Bitcoin is a purposely vulnerable web application exposed to the internet as a live hacking challenge with a $1,000 bitcoin bounty for achieving remote code execution (RCE). The challenge is streamed live, showing all attack attempts in real time. The scope is limited strictly to brotli2bitcoin.com, with authorized testing and rules to prevent denial of service or attacks outside the target. The first verified RCE that runs a specific command and reports the flag wins the bitcoin prize. This is a controlled security research exercise rather than an active threat or vulnerability disclosure.
Two serious vulnerabilities were found in the Rust zip crate, a widely used library for handling ZIP files. The first (RUSTSEC-2026-0367) allows privilege escalation by preserving dangerous file permission bits (setuid, setgid, sticky bit) when extracting archives, potentially enabling attackers to plant setuid-root files. The second (CVE-2026-115905) is a critical remote code execution flaw caused by inconsistent handling of file names between the central directory and local headers in ZIP archives, allowing arbitrary file overwrite and execution. Both vulnerabilities are fixed in version 9.0.5 of the zip crate. The advisory emphasizes that patching alone is insufficient and advocates architectural security using deny-by-default sandboxes to contain untrusted code and limit the impact of such vulnerabilities.
This is a tool designed to facilitate scanning through large numbers of text files efficiently by searching for substrings within files. It is intended to help users quickly find lines containing specific text across many files.
A vulnerability in the AMD uProf kernel driver (AmdTools64.sys) version 5.3.521.0 allows local users with a handle to the driver to read and write Model-Specific Registers (MSRs) without proper validation. This enables an elevation of privilege (EoP) by overwriting the IA32_LSTAR MSR, which controls the CPU's syscall entry point, allowing execution of arbitrary code at kernel privilege level (CPL0). The exploit bypasses Kernel Address Space Layout Randomization (KASLR) and SMEP protections to escalate privileges to SYSTEM on Windows 10 x64 22H2. On Windows 11 with Memory Integrity enabled, the write is blocked. The vulnerability requires administrative rights to load the driver but then allows ring-0 code execution. AMD was notified but did not acknowledge the issue as of the report date.
This content discusses the competitive disadvantage faced by defenders in cybersecurity due to adversaries using uncensored, abliterated AI language models that automate reconnaissance, phishing, and exploit development. The post highlights the availability of such uncensored models through Silk Compute, which removes refusal behaviors and content filters, enabling more aggressive and unrestricted AI usage. No specific vulnerability or exploit is described.
4NTL is a browser extension for Chromium-based browsers that enables quick threat intelligence lookups from the right-click menu. It allows users to check IPs, domains, URLs, or file hashes against VirusTotal and AbuseIPDB without leaving the current page. The extension is designed to improve analyst efficiency by reducing the need to copy and paste indicators into separate tabs. It respects user privacy by only querying VirusTotal and AbuseIPDB, never submitting new samples, and keeping API keys local to the browser profile. No active exploitation or vulnerabilities are reported in the extension itself.
An XML Signature Wrapping vulnerability in Moldova's MPass SAML NuGet library allows authentication bypass by relocating signed elements within SAML responses. This flaw affects versions 8.0.53 to 8.0.56 and 10.0.2 and was fixed in versions 10.0.4 and 10.0.5. The issue arises because the signature verification did not ensure that the signed reference matched the root element of the response, enabling attackers to authenticate as arbitrary users.
A security researcher demonstrated a remote code execution (RCE) exploit chain against a specific WordPress Docker image dated 21 October 2026. The exploit leverages the WordPress pingback.ping XML-RPC method to achieve unauthenticated Bash shell access. This proof-of-concept targets one exact vulnerable Docker image digest and does not affect the latest official WordPress builds or WordPress core itself.
JNISleuth-MCP is an open-source tool designed to assist analysts in unpacking and analyzing stripped Android native (.so) malware libraries. It automates the recovery of JNI RegisterNatives bindings, deobfuscates ARM64 OLLVM indirect branches, and bypasses anti-Frida tracing techniques using a stealth Dobby agent. The tool integrates with reverse engineering platforms like Ghidra and IDA Pro to provide unified cross-boundary analysis from Java to native code, facilitating malware triage and research.
A new Kerberos abuse technique has been discovered that allows constrained delegation without protocol transition to be exploited against SPN-less accounts. This method combines previous research techniques to expand the attack surface of Kerberos delegation abuse. The researcher updated Impacket to support this new abuse path, facilitating practical exploitation. No specific affected software versions or patches are identified. The threat is considered medium severity based on the described impact.
The Gentlemen is a Russian-speaking ransomware-as-a-service (RaaS) group active since mid-2025. It operates a double-extortion model by encrypting files and exfiltrating data to pressure victims into paying ransoms. The group targets Windows, Linux, NAS, and BSD systems and has claimed over 800 victims, primarily in the US and Europe. It aggressively offers affiliates up to 90% of ransom revenue. The group uses EDR-killing tools and deletes forensic artifacts to evade detection. A breach of its infrastructure in May 2026 exposed internal communications and affiliate details, providing insights into its operations and links to other ransomware groups.
V-DAP is an experimental Rust engine designed to measure cryptographic execution timing to explore whether such measurements can provide useful diagnostic information for latency issues beyond conventional observability tools. Preliminary experiments show a correlation between cryptographic timing intervals and total request latency, but the project does not claim production readiness or proven diagnostic advantage. The research is ongoing to determine if V-DAP can distinguish causes of latency and improve diagnostic accuracy compared to existing methods.
CVE-2026-111497, known as Node2Shell, HTTP2Shell, or Broccoli2Shell, is a remote code execution vulnerability in the Brotli decoder used by official, unmodified Node.js builds. A malformed Brotli compressed request body can trigger an out-of-bounds write, resulting in a shell on the target system. This has been reproduced on x86-64 systems against multiple Node.js targets including plain node:http, official slim images, Express 5.3.0, and Koa 3. The vulnerability arises from improper handling of block switches in Brotli streams, leading to memory corruption and arbitrary code execution. A public scanner is actively mapping Brotli-capable hosts, indicating reconnaissance activity preceding exploitation.
Velum-VMM is a research hypervisor for Windows x64 systems using Intel VT-x virtualization technology. It enables hooking of syscalls and kernel entries on modern Windows versions (Windows 10 and 11) with features such as live telemetry, scoped request policies, and access-right reduction. The project is intended for research and experimentation with kernel behavior and syscall monitoring rather than being a vulnerability or exploit. It provides interactive control over native calls and kernel activity through a console interface.
This report analyzes Hermes, an active malware-as-a-service platform operating in the Russian cybercrime market, along with its PyMapper distribution chain. The analysis is based on a detailed technical report authored by a researcher and publicly available. The platform facilitates malware distribution and service offerings typical of malware-as-a-service ecosystems. No specific software vulnerabilities or exploits are detailed in the provided information.