WhupWhup🎉 If you are interested in #RedTeaming, #OffensiveSecurity or #CyberSecurity in general, let's meet at @defcon and exchange ideas💡 Myself and @MoritzLThomas will be presenting: Volatile Vault-A tool for red teamers that facilitates #data #exfiltration during #redteams

🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases. CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers. Read - thehackernews.com/2026/10/cr…

Okay, since the news is already out: an RCE vulnerability in PHP core, CVSS 10.0. Further details are scheduled for release on October 20. Only PHP 8 will receive patches.

n8n just got a CVSS 10.0 public exploit. CVE-2026-21858 (“Ni8mare”): unauthenticated file read → full RCE. Working PoC is circulating. Any internet-facing n8n that missed the patch is one request away from compromise. github.com/Chocapikk/CVE-202… #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #RCE #AppSec

Microsoft has dropped CVE-2026-69730: a Windows DNS Server RCE with a 9.8 CVSS score. No authentication. No user interaction. Low complexity. No mitigation. No workaround. Basically, it doesn’t knock on the door; it lets itself in, makes a brew and starts executing code. Patch it. 😂

This is pretty embarrassing 🙈 Microsoft has a signed Defender driver that can be abused to kill Defender/EDR and modify protected files and registry settings We also can’t really solve this the usual way by adding the driver to the vulnerable driver blocklist. It’s Microsoft’s own Defender component!! MSRC says it doesn’t require immediate servicing because you already need admin privileges 😏 Which probably means this MS-signed EDR killer will stay usable for a while. Nice 🫶

🚨Nightmare Eclipse has released a new zero-day PoC called ShieldBreak Per the security researcher: "Microsoft has failed to properly patch the RoguePlanet vulnerability CVE-2026-50656, this PoC demonstrates a full patch bypass." GitHub: github.com/MSNightmare/Shiel…

Found a heap overflow vulnerability in Windows SMB that leads to RCE and reported it to MSRC in June. The vulnerability has now been addressed with CVE-2026-62800 in the August Patch Tuesday updates. msrc.microsoft.com/update-gu…

Someone dropped this Windows LPE writeup online yesterday along with a PoC. But the mentioned CVE-2026-62737 is not released yet, maybe it will be in the Patch Tuesday tomorrow. And the PoC still work in the lastest version of Windows 😂 xz.aliyun.com/news/92658

seems like the 🐈‍⬛ is out of the 👜 here's our poc for MariaDB 13 RCE, currently still unpatched: github.com/v12-security/pocs…

A collection of tools and resources related to the Pass-the-Passkey family of attacks, which target WebAuthn and FIDO2 authentication mechanisms in Windows github.com/SpecterOps/pass-t…

Three zero-days in Windows 11 and Microsoft Entra ID. Over 20 novel attack techniques against passkeys. Toolkit open sourced. Microsoft declined to fix one of them. Passkeys were supposed to be unphishable. @MGrafnetter from @SpecterOps just presented Pass-the-Passkey at Black Hat. Global Admin impersonation from a standard user account. No user interaction. Bypasses phishing-resistant MFA Conditional Access policies. Zero alerts from Defender for Identity or Entra Identity Protection on M365 E5. Windows Hello passkeys are still vulnerable after the patches because they always send signature counter 0. Microsoft scored it 6.5 Medium and paid $1,000. The researcher scored it 8.6 High. Their advisory described it as 'could potentially read small portions of heap memory.' This is the same team behind BloodHound, Certified Pre-Owned (AD CS), Rubeus, Certify, Seatbelt, SharpDPAPI, SharpUp, Ghostwriter, Nemesis, SharpSCCM, and CuddlePhish. They consistently ship research that changes how the industry thinks about Active Directory and identity security. If you do red teaming, pentesting, identity security, Entra ID, FIDO2, WebAuthn, Windows Hello, phishing-resistant MFA, or detection engineering, this is the most important identity research to drop this year. Pass-the-Hash for the passwordless era. i.blackhat.com/BH-USA-26/Pre… #Infosec #RedTeam #DetectionEngineering

Introducing XSS2Shell ⛓️: WordPress Core preauth XSS→RCE vulnerability affecting 43% of the internet, discovered autonomously by pwn (using open-source models), affecting all WordPress versions. pwn.ai/blog/xss2shell Please patch CVE-2026-64638 as soon as possible!

We're tracking a new EDR killer using a #BYOVD driver that isn't in Microsoft's block lists / #LOLDrivers and enumerates 140+ security products, including: Crowdstrike, SentinelOne, Microsoft Defender / Sentinel, Carbon Black, Cybereason, Cylance, Symantec, Sophos, FortiEDR, Elastic, Kaspersky, ESET, Avast / AVG, Bitdefender, McAfee / Trellix, Malwarebytes, Webroot, Trend Micro, Avira, Dr. Web, F-Protect / F-Secure, G-Data, Panda Security, and more. All credits to @jgajek for finding it in the wild 🔥 It only activates if the payload being loaded contains ScreenConnect-related strings, uses IOCTL control code 0x2205c0, and passes each security product PID to terminate via input buffer to the driver via DeviceIOControl, which terminates the specified PID via ZwTerminateProcess. BYOVD: virustotal.com/gui/file/87e8… Blog coming soon on the loader, after Defcon of course!

Shodan Membership sale is live until 2026-08-09 00:00 UTC (~48 hours from now): account.shodan.io/billing/me…

ConfigManBearPig 2.0 is out, a full Python rewrite built on OpenHound. Faster, runs on Linux, SOCKS proxy support, better BloodHound pathfinding for SCCM attacks. ➡️ ghst.ly/3RGyETm Catch @_Mayyhem demo-ing it live at #BHUSA Arsenal TOMORROW, Tue 8/4, 5:15pm, Station 6.

‼️ Hugging Face built an interactive replay of the OpenAI agent that breached them. It includes 17,613 logged attacker actions across the 4.5-day campaign, with the live command stream and more. huggingface-anatomy-of-front…

‼️ BREAKING: OpenAI says two of its own models, GPT-5.6 Sol and an unnamed pre-release system tested with cyber safeguards off, broke out of a sandbox last week, chained zero-days and stolen(!) credentials to reach the open internet, and hacked Hugging Face to cheat on a benchmark, in what OpenAI calls an unprecedented cyber incident.

🛑 Hugging Face, the world’s largest AI model repository, says an autonomous AI agent breached its production systems through a malicious dataset. It accessed internal data and service credentials, then moved across several clusters through thousands of actions in short-lived sandboxes. Full story: thehackernews.com/2026/07/wo…

The US government, citing national security authorities, has issued an export control directive to suspend all access to Fable 5 and Mythos 5 by any foreign national, whether inside or outside the United States, including foreign national Anthropic employees. The net effect of this order is that we must abruptly disable Fable 5 and Mythos 5 for all our customers to ensure compliance. Access to all other Claude models is not affected. We apologize for this disruption to our customers. We believe this is a misunderstanding and are working to restore access as soon as possible. Read our full statement: anthropic.com/news/fable-myt…

NEW: malware developers added nuclear & biological weapons text to to their spyware. Goal? To trigger LLM safety refusals... so that their spyware wouldn't be analyzed by an AI security scanner. Cleanest practical example I can think of for why over-indexing on first order safety alignment is risky. When closed (and open) models ship with aggressive refusals, they will be sprinkled with second-order blindspots that attackers will discover...and exploit. We are only in the earliest days of attackers leveraging these features, and it wouldn't surprise me if users systems that need to handle complex cybersecurity issues demand that models be less safety-blunted. In the weeds: @SocketSecurity's post also shows why intention matters in how you design a malware analysis pipeline to avoid prompt manipulation. H/T to colleagues that shared this with me socket.dev/blog/mini-shai-hu…