The actual prompt for this was "let's look for pre-auth RCEs in PHP". I'm sharing this so people know this stuff is real and to take agent-assisted scanning seriously. I kicked if off using Claude Mythos 5.1 (in stock Claude Code) but it uses a skill to drive a harness we built over the last few months. I don't know if the harness is amazing, but it certainly has a scary track record so far. It's setup to do an agent guided tree search across a codebase, and runs in microvm sandboxes that all have the full source code for the target, as well as the source for any transitive dependencies. When I built the harness I basically just fed Claude a bunch of Project Zero blog posts describing how they did research and had it build a harness that ran like that, but on our tech stack. The first phase is just setup and can run with any model, it just does that fetching and assembles the kit environment, and gets a target up and running alongside the source code. Then we just do some basic suspend/resume stuff over to the hunt phase, where one agent supervises the tree, and the first node kicks off. Each node is context-aware and aware of the work of all the others. I think I ran this with parallelism 4? So 4 running at any one time. The supervisor can shape the tree and boost nodes or prune. Any node can add more below it with targeted instructions. A typical run looks like the first node doing a codebase review or building and running a fuzzer or something, all depending on the target. Then based on whatever it finds, it'll queue 4-5 children that go look into those areas. The main system guidance is to validate everything 3 times in clean VMs, and we typically require full exploit chains/POCs. Here's what this run looked like. We're doing this with a bunch of other open source projects now and companies. We're doing a lot of this for free, even with private companies, across critical infrastructure. We're directly partnered with Anthropic, and can do this even if you don't have direct access to a frontier model yourself.

The less instruction you give, the more freedom and creativity the model has 🤠

Did you know PKINIT isn’t the only way to auth with a cert? 🔥 DC cert missing KDC Auth EKU? PKINIT fails (KDC_ERR_PADATA_TYPE_NOSUPP). A cert from your AD CS (ESC1/ESC8) is still a valid TLS cred. NetExec’s –schannel binds to LDAP/LDAPS with it, skipping Kerberos pre-auth.

Make NetExec fast again🚀 A great idea by @mpgn_x64 and a few minutes of development time, and I was able to make the general loading time of NXC much, much faster. This cuts down on execution by up to 42% for non-impacket protocols, e.g., NFS⏱️

Little upgrade on NetExec WMI protocol 🚀 Now NetExec supports SAM, LSA and NTDS dump using only WMI. Thanks a lot to @al3x_n3ff for all the help on this PR (and all the work on NetExec overall, you rock bro 🫶)

GLM-Legal uncensored:

New blog is live: blog.safetech.red 🦀 🔥 Red and Purple notes, and first article out: 📝 The origins of RustHound-CE Why I built an AD collector in Rust back in 2021, what the BloodHound Community Edition turn changed, and where the tool stands today. The original post had disappeared with the old company website, so it is back online, rewritten and up to date. EN: blog.safetech.red/rusthound-… FR: blog.safetech.red/fr/rusthou…

I wrote about securing your CI pipelines on GitHub Enterprise without expensive third-party tools. Own your security, don’t let a tool decide whether you’re secure. Set your own rules 🪂 mpgn.fr/securing-your-ci-on-…

Still true in 2026

If you want to know more about netexec-mcp, I wrote a short article 😀 mpgn.fr/building-a-mcp-for-n…

Really nice lab. Learned some new techniques. Big thanks to @mpgn_x64 and @mael91620 for running this. @ippsec and I got started a few hours late (it started at 5am), but we managed to finish. ctrlzero came through big when he was able to join for the last few flags!

The CTF is now over! Congratulations to the winners: Team Gogoplata - kenolab 🏆🥇 Team DTB 🥈 Team Gold or Hack 🥉 Team Sub5 warriors Team Eagles Only these five teams finished the lab, mad respect and what a run! Congratulations again ! 🎉

Un gros lab AD bien complexe et franchement très chouette. Une compétition sur invitation. Des équipes triées sur le volet. Et au final une belle 3ème place pour notre équipe de 2. Merci @mpgn_x64 et @mael91620 c'était excellent.