''GitHub - google/mantis: A modular, stack-agnostic toolkit for AI coding agents to autonomously find, reproduce, and patch vulnerabilities.'' #infosec #pentest #redteam #blueteam github.com/google/mantis

An AWS S3 UDC2 egress channel for Cobalt Strike is now open source. Our demo covers the AWS infrastructure, Terraform deployment, encrypted Beacon traffic, and dynamic pre-signed URL refresh. Watch the demo: cobaltstrike.com/resources/v…

easy, fast, programmable microVMs for untrusted workloads github.com/superradcompany/m…

Metamorphic compiler herm1tvx.blogspot.com/2026/1…

Azure API Management as a Policy-Based C2 Redirector redops.at/research/azure-api…

Just pushed early support for converting decrypted iPhone IPA's to run on MacOS by converting the SINF. E.g, here's Signal. Might not work on all apps right now. github.com/DrWhax/unfairplay

Credential Guard Runtime Shutdown VBS is supposed to keep your NT hashes locked in VTL1 forever. Turns out LsaIso.exe exposes a named event that tears it all down at runtime. Steal a SYSTEM token, signal it and extract NT hashes straight from LSASS github.com/S12cybersecurity/…

HackiOS能在安卓手机跑安卓＋iOS 16.5双系统，重启就能切回安卓！ HackiOS今天更新： 1. 27项传感器支持补齐。 2. 机型适配拆成独立目录，基带地址、固件参数从手机自己的设备树读取，方便继续移植其他骁龙手机。 3. 基带能识别SIM、读取信号、注册LTE，移动数据还在调试。 适配机型POCOX5Pro，运行iOS16.5。通过fastboot把iOS临时加载进内存，重启回Android。 项目地址 github.com/oosexgang/hackios…

Backdooring LLMs with triggered tool execution. Untrusted model weights + privileged tools = trouble. @pdiscoveryio reshaped Qwen2.5-7B via QLoRA to hide a secret trigger causing Codex to execute a command exfiltrating secrets. A post by Prince Chaddha. Source: projectdiscovery.io/research… #redteam #blueteam

cocomelonc.github.io/linux/2… next one from my blog #linux #hacking series! enjoy ❤️ t.me/maldevcc/323 #research #malware #programming #rootkits #rootkit #purpleteam #cybersec #cybersecurity #book

I turned my DJI Mavic into a home security drone with REA & Opus 5.5. this f*cking is insane.. I reverse-engineered my DJI drone with Opus 5.5 no cloud. no GPS on the target. it all runs on the phone. iPhone or Android. here's the build step by step: step 1 → plug a spare phone into the Mavic remote and paste the prompt below into Claude Code on Opus 5.5 step 2 → Opus checks your drone against the DJI Mobile SDK v5 list. not on it? stop there. no firmware hacks step 3 → it builds a small app on the official DJI SDK: Swift for iPhone, Kotlin for Android step 4 → sync with the alarm: Home Assistant sees it trigger → push to your phone → one tap "Launch" step 5 → eyes: a tiny YOLO model on the phone's chip. Core ML on iPhone, LiteRT on Android step 6 → memory: a Kalman filter. he runs behind a fence → LOCKED → COASTING → re-locks on the same ID step 7 → hands: Virtual Stick at 10 Hz. box center → yaw, box size → distance, never closer than 8 m step 8 → at the property line it stops, climbs to 30 m and keeps the camera on him until he's out of sight step 9 → lands back on the pad. the clip with track, distance and timestamps is already on your phone the alarm wakes you up. the drone already knows where he went... Find full prompt below Then, read the article below on how to reverse-engineer anything with Opus 5.5.

Kernel eviction notice: What wesp.sys reveals about the Windows Endpoint Security Platform elastic.co/security-labs/blo…

OAuth - More OBroken Than You Think OBroken is here. The first tool to autonomously find, exploit and prove OAuth authorization bypasses end to end. Our proprietary OAuth Authorization Bypass Scanner, covers 23 techniques across 17 vulnerability classes, each confirmed with a standalone Find/Forge/Fire PoC ready to report and collect. Part of the Broken Token series alongside jBroken, our JWT scanner with 40+ techniques. Same methodology, same output format, different protocol layer. The screenshot below shows oBroken running against the Missing aud Validation test case (CVE-2025-9803) on our OAuth testbed. The tool scrapes the client app, discovers the AS, requests a token bound to an attacker-controlled resource, presents it to the real API and confirms it's accepted without audience validation. One URL in, full PoC out. Covers response mode escape, state manipulation, PKCE downgrade variants, DCR abuse, race conditions and aud validation, among others. Running on our lab terminal today, landing on an private API someday. If you have interest, let us know. Testbed below.

Cheat sheet on BLE cybersecurity attacks and tools for hackers: For medical devices and beyond. 🔵🦷🚑👾😎 More details on: LinkedIn: lnkd.in/p/dYUnUp7D Substack: it4sec.substack.com/p/cheat-… Telegram: t.me/it4sec/91

Apple dropped Private Cloud Compute source for researchers. github.com/apple/security-pc… CloudAttestation. Thimble / privatecloudcomputed. CloudBoard. log filters. srd_tools VRE. the pieces that claim device-class trust for Apple Intelligence in the cloud. this is not a marketing PDF. it is a hunt surface. revocation already bit them once in CloudAttestation X509Policy. fixed in 26.4. Apple Security Bounty covers PCC guarantee breaks. guide: security.apple.com/documenta… #iOS #AIRedTeam #InfoSec

After CrowdStrike, Microsoft wants EDR out of the Windows kernel. A researcher named @zodiacon reversed WESP's preview: • wesp.sys minifilter • espclient.dll user-mode API • no apparent process-blocking reply path yet elastic.co/security-labs/blo… #WindowsInternals #EDR #ReverseEngineering

Executing shellcode in kernel mode by combining PTE manipulation with the DRIVER_OBJECT of our own vulnerable driver, redirecting the IRP_MJ_DEVICE_CONTROL function pointer to a memory page we control and have configured through PTE manipulation

In the big ol 2026, Im still getting unauthenticated root level RCE using SNMP nsExtendObjects abuse. No body should be running NET-SNMP pre-5.8 on production systems in todays day and age. Allied to this is the fact that SNMPv3 should also be the norm today but yet Ive only seen SNMPv1/SNMPv2

🔥A NEW PowerShell reverse shell in the PSSW100AVB repository ✅ 100% AV bypass (October 2026) ✅ Ready for red team operations (OSCP/OSAI/CRTP) ✅ AI-Evasive Comment to Bypass LLM Detection github.com/tihanyin/PSSW100A…

Today we released WhisperHijack, a stealthy process injection PoC that uses thread descriptions to inject payloads into remote processes, then patches a waiting thread's return address for execution. Every memory op happens in-target via Queue APCs, with zero NtWriteVirtualMemory or NtSetContextThread calls. Based on @hasherezade TNC + WTH research. github.com/Maldev-Academy/Wh…