After you finish patching your PHP, don't forget about the CA compromise from yesterday! Here is a role you can demo it in your lab: github.com/badsectorlabs/lud… Mint an EV cert for any domain, and code sign any binary! Keep windows off the network - update is aggressive!

PHP 8.5.12 released - 90 fixes in 29 components, including security fixes (CVE-2026-109618, CVE-2026-109619). Changelog + downloads: php-net.pro/news/php-8-5-12-…

I used Opus 5.5 on max and GPT-6 Astra for 5 days straight and I reversed engineered Elastic Security and extracted all the rules. I made them available here: github.com/elastic/detection… You’re welcome.

Just dropped LogonStealer! Steal plaintext Windows passwords straight from the logon screen. A rogue Credential Provider that hooks CredProvDataModel.dll inside logonui.exe to steal plaintext passwords at the Windows logon screen github.com/S12cybersecurity/…

Did you know that if you have Entra ID P1 there is a new way to block your stolen refresh token from being replayed by the attacker? Find out 🧵👇 1/7

Added alternatives to OpenProcess, OpenThread and SuspendProcess! github.com/S12cybersecurity/…

I wrote about securing your CI pipelines on GitHub Enterprise without expensive third-party tools. Own your security, don’t let a tool decide whether you’re secure. Set your own rules 🪂 mpgn.fr/securing-your-ci-on-…

SPOTTER now has an easier registration portal and API services entry method during registration, ScoutSuite ingestion, and some screenshots of the UI. github.com/rvrsh3ll/SPOTTER

InjectSetConsole performs process code injection by leveraging a Windows named pipe. Unlike traditional techniques, it does not use the VirtualAllocEx and WriteProcessMemory APIs. #securityblog #cybersecurity zerosalarium.com/2026/09/edr…

Josh Wink - Higher State Of Consciousness #oldskool #rave #80s #90s

If you want to know more about netexec-mcp, I wrote a short article 😀 mpgn.fr/building-a-mcp-for-n…

A quick article showing how the Jev OPSEC ranker works, and looking at how Jev can be used for identifying potentially sensitive file paths and content at speed.

SharePoint + Pre-Auth RCE + MemShell? 👀 We’ve published our technical analysis of CVE-2026-65660, covering the attack chain from an Allow Anonymous site and a pre-auth SharePoint vulnerability to RCE and MemShell. Take a look: blog.viettelcybersecurity.co…

7. My biggest takeaway: Security controls are only as strong as what they trust. Full 12-flag write-up, commands and attack chain: ellell.gitlab.io/ctfs/ad-lan…

Been digging deep into the Windows Endpoint Security Platform (WESP) in Win11 25H2, definitely one of the most fascinating security features Microsoft has built in a while. The concept is neat: compile rules to decision graphs in user mode, hand them to wesp.sys, and let the kernel evaluate them in-path while telemetry streams asynchronously in the background. I did an AI-assisted reverse engineering dive into the whole stack (wesp.sys, espclient.dll, and wesp_elam.sys), documented the wire protocols, disposition tables, and the enforcement gate, and built esptool, a research harness with 118 XML rule docs so anyone can test live telemetry and in-kernel blocking. Repo: github.com/marcosd4h/wesp_re… Tech doc: github.com/marcosd4h/wesp-re… Thanks to @yarden_shafir for putting this on my radar

"You wanna get offensive? Let's get offensive." 😈 Part 1 was recon. Part 2 turns up the heat. 🔥 The actual offensive tradecraft, from key extraction to forging certs the server can't tell from its own. huntress.com/blog/ad-rms-slc…

Windows process internals - VADs (Virtual Address Descriptors). A deep dive into VAD structures, their purpose and function, helpful in memory forensics. A post by imp hash. Source: imphash.medium.com/windows-p… #redteam #blueteam #maldev #malwaredevelopment

NetNTLMv1 is dead. Long live NetNTLMv1. 🌈 Today we're releasing NTLMRain: recovering NT hashes from NetNTLMv1 responses. 🌐 Browser-based cracking ⌨️ Cross-platform CLI with GPU/CPU support 💾 Searchable tables that fit on a 4 TB disk Read the blog: outflank.nl/blog/2026/09/08/…

Weekend project: I added IAKerb support to Rubeus. My god, this is going to open the floodgates. Phase 2 of Microsoft's NTLM deprecation is targeted for H2 2026. IAKerb ships for Server 2025 / Win11 24H2 and is already on by default in the June Canary preview. It proxies Kerberos auth through exposed services via SSPI when a client can't directly reach a KDC. Which means anonymous user enum via AP-REQs with no preauth (zero telemetry), kerberoasting over the open internet, Entra lateral movement through AZUREADSSO tickets and more. All against public facing services. Blog post soon with potential abuse vectors.