Inside the Falcon How CrowdStrike Catches You

A full reverse-engineering teardown of the CrowdStrike Falcon sensor: the six kernel callback sources, the WFP network engine, the file-system minifilter, the cspcm4 broker, the user-mode service…

0xdbgman.github.io

Clustered Points of Failure

Windows Server Failover Clusters share credentials across every node: compromise one, and you compromise the entire cluster

specterops.io

KindaRails2Shell - Critical RCE in Rails via Active Storage (CVE-2026-66066) | Ethiack — Autonomous Ethical Hacking for continuous security

Ethiack research team discovered KindaRails2Shell (CVE-2026-66066): a critical RCE in Ruby on Rails via Active Storage. 500,000+ sites affected. Find out if you are and how to mitigate.

ethiack.com

RefluXFS: A Linux Kernel Local Privilege Escalation to Root in XFS (CVE-2026-64600) | Qualys

Qualys Threat Research Unit (TRU) identified CVE-2026-64600, a race condition in the Linux kernel’s XFS filesystem copy-on-write path. An attacker with an ordinary local account can exploit this race…

blog.qualys.com

Special Token Injection (STI) Attack Guide

Large Language Models introduce security issues reminiscent of early-2000s software bugs. Special Token Injection (STI) exploits how LLMs parse structured prompts. This post breaks down what STI is,…

blog.sentry.security

GitHub - projectdiscovery/depx: Malicious package & supply-chain intelligence

Malicious package & supply-chain intelligence. Contribute to projectdiscovery/depx development by creating an account on GitHub.

github.com

CVE-2026-54121.md

GitHub Gist: instantly share code, notes, and snippets.

gist.github.com

Statement of attribution to Russia of malicious cyber activities targeting France for espionage purposes | France Diplomatie

Follow us

diplomatie.gouv.fr

EU and UK officially blame Russian spies for cyberattack on Poland's power grid

Sweeping sanctions and condemnation follow op that could have left half a million without power in the depths of winter

theregister.com

Windows Privilege Abuse: Attackers' Path to Active Directory Compromise

Learn how attackers exploit Windows privileges to escalate and extend their foothold in Active Directory ... even in well-patched environments.

semperis.com

Authentication Bypass in the default configuration phpBB

Our AI pentest agents found a critical phpBB auth bypass (CVE-2026-48611): one unauthenticated request logs you into any account. See the exploit and the fix.

aikido.dev

Qemouflage: Beyond the EDR’s Reach

A Linux VM inside QEMU on Windows, no admin rights, no EDR visibility. Pure TCG emulation.

0xc9h.github.io

klist.exe Revisited: Internals and Further Use Cases – Jake Otte

A follow-up on klist.exe: extracting non-zeroed TGT session keys without SeTcbPrivilege, abusing WinRM for in-memory remote dumping, and examining behavior under Credential Guard.

jakeotte.com

It’s 37oC, And All We Can Think About Is ColdFusion (Adobe ColdFusion Security Bulletin APSB26-68 CVE Bonanza)

We’re back, melting - we’ve tried shouting, screaming, and throwing things at the Sun, and it is just not working. Before we begin our analysis, we want to be clear - given the number of…

labs.watchtowr.com

We have Mythos at Home: GLM 5.2 beats Claude in our Cyber Benchmarks

Among models given nothing but a prompt, the best open-weight option beat Claude Opus 4.8.

semgrep.dev

Enterprise Tech In, Shell Out (Progress Kemp LoadMaster Uninitialized Heap to Pre-Auth RCE CVE-2026-8037)

Welcome back to another watchTowr Labs blog post. This time, we're looking at Progress Kemp LoadMaster, a load balancer that sits at the edge of a lot of enterprise networks. Edge appliances have a…

labs.watchtowr.com

Claude Code Is Steganographically Marking Requests

I inspected Claude Code for privacy reasons and found hidden system prompt markers based on API base URL and timezone.

thereallo.dev

Sleeper Squats: How a Hyphen (Almost) Unraveled GitHub's Immutable OIDC Subject Claim | Boost Security Labs

In late April 2026, GitHub shipped a changelog post introducing immutable subject claims for GitHub Actions OIDC tokens, then pulled the post six hours later. The feature stayed live in production…

labs.boostsecurity.io

Le contrat qui prouve qu’Erik Tegnér agissait comme un agent d'influence du pouvoir hongrois

StreetPress a obtenu le contrat d’Erik Tegnér, directeur du média d’extrême droite Frontières, avec le Danube Institute. Pour 4.200 euros par mois, il devait aider à promouvoir les discours d’Orbán…

streetpress.com

Public PoC Released for Critical libssh2 CVE-2026-55200 Client-Side SSH Flaw

A public PoC for CVE-2026-55200 exposes a critical libssh2 flaw that can let a malicious SSH server corrupt client memory.

thehackernews.com

When EPA isn't EPA'ing: What Tools Like Certify, Certipy and checkMSSQLStatus.py miss

Recently on engagements I started experiencing two reoccurring patterns, the first being that certipy and certify would both show me that a endpoint is not vulnerable to the ESC8 attack even though…

abdulmhsblog.com

PoC Released for Microsoft Exchange Server EWS InstallApp SSRF Vulnerability

A proof-of-concept exploit has been released for CVE-2026-45502, a server-side request forgery (SSRF) vulnerability in the Microsoft Exchange Server's Exchange Web Services (EWS) InstallApp operation.

gbhackers.com

Quand Annie Genevard, ministre de l’agriculture, invite BASF à faire blanchir l’un de ses herbicides

S’adressant à une assemblée de producteurs de blé, la ministre a encouragé le producteur d’un herbicide, classé perturbateur endocrinien, à présenter des «  méthodes d’évaluation alternatives » pour o...

lemonde.fr

CIFSwitch: a non-universal Linux local root vulnerability

Harnessing LLMs into composing complex, multihop vulnerability chains

heyitsas.im

Don’t Jump the Turnstile: Lessons from the Field

Phishing sandboxes are a pain. Cloudflare Turnstile can be used as an effective solution to conceal your phishing pages.

specterops.io

Finding XSS on Shazzer (literally) | Jorian Woltjer

How I found an XSS in Shazzer, a tool for discovering and sharing browser quirks through fuzzing. Not *using*, but *in* Shazzer. We'll explore some useful techniques with Blob URLs to unsandbox…

jorianwoltjer.com

Adversarial Oracles: LLM-Guided EDR Signature Reduction

Stripping your binary makes EDR detection worse, not better. See how an LLM and VirusTotal automate antivirus evasion by blending in instead.

praetorian.com

Drupal PostgreSQL SQL Injection: From SELECT-Only to RCE

<p>Turning a SELECT-only PostgreSQL SQL injection into remote command execution when the injected role is a PostgreSQL superuser.</p>

blog.lexfo.fr