Art&Fact

Pentester - RedTeam /
Ethical Hacker

hack to learn or learn to hack?

Exactly where you didn't expect me...
Exactement ou tu ne m'attendais pas...

[International Cyber Digest @IntCyberDigest]

‼️🚨 This is alarming: Researchers found a one-click data exfiltration vulnerability in M365 Copilot. A single click on a trusted microsoft[.]com link let attackers pull emails, MFA codes, meeting notes, and SharePoint/OneDrive files, no permissions or second click required.

Microsoft has patched it as CVE-2026-42824, rated critical.

[R.B.C. @G3tSyst3m]

My latest blog post: Using BYOVD to loot LSASS bypassing HVCI and all other security protections built in to Windows 11 25h2:

https://t.co/xuKSBQSwYr

[blackorbird @blackorbird]

A novel command-and-control (C2) technique in which a threat actor used a NATS server as C2 infrastructure.
https://t.co/9cl4O79L77

ref:
https://t.co/eVW5i2N826

A 'NATS URL' is a string (in a URL format) that specifies the IP address and port where the NATS server(s) can be reached, and what kind of connection to establish:

TLS encrypted only TCP connection (i.e. NATS URLs starting with tls://...)

TLS encrypted if the server is configured for it or plain un-encrypted TCP connection otherwise (i.e. NATS URLs starting with nats://...)

Websocket connection (i.e. NATS URLs starting with ws://...)

[Cyber Security News @The_Cyber_News]

⚠️ FreeBSD DHCP Client Vulnerability Enables Remote Code Execution as Root

Source: https://t.co/MBazH8qJba

The FreeBSD Project has released a critical security advisory addressing a severe flaw in its default IPv4 DHCP client. Tracked as CVE-2026-42511, this vulnerability allows a local network attacker to execute arbitrary code as root, granting them complete control over the compromised machine.

The core issue resides in how dhclient(8) processes network configuration parameters from DHCP servers. When a device joins a network, it requests IP configuration data. The DHCP client takes the provided BOOTP file field and writes it to a local DHCP lease file.

#cybersecuritynews

[Art&Fact @ArtFact10]

@sebastienRaoult @brutofficiel Très cool d'avoir ton point de vue, ça rétablit des vérités au moins. Bravo a toi

[Art&Fact @ArtFact10]

@LoWkiiTT DM si besoin d'aider. Je peux peut être faire quelquechose

[Art&Fact @ArtFact10]

@RussianPanda9xx Always need to rest after streesfull times! come to France you are welcome when you want to plan a trip

[Art&Fact @ArtFact10]

@I_Am_Jakoby Nice work like always. Looks promising. Interested to test it if possible

[Aurélien Chalot @Defte_]

Dumping LSASS is old school. If an admin is connected on a server you are local admin on, just create a scheduled task asking for a certificate on his behalf, get the cert, get its privs. All automatized in the schtask_as module for NetExec 🥳🥳🥳

[blackorbird @blackorbird]

A comprehensive dataset of Net-NTLMv1 rainbow tables:
https://t.co/D7sWJqOAfm
ref:
https://t.co/XX9X6yEliu

[MagicSword @magicswordio]

Adversaries weaponizing signed drivers as EDR killers? This is exactly why we built #loldrivers.

wsftprm.sys (CVE-2023-52271) - legitimately signed, terminates AV/EDR via kernel access, NOT on MS blocklist.
https://t.co/AilgA622Xg

We've tracked it since Sept 2024. Defenders deserve better intel.

Living off the land ends here. 🛡️

#BYOVD #ThreatIntel

[Binni Shah @binitamshah]

Lock picking robot : https://t.co/0UMH8Shcyl

[Baptiste Robert @fs0c131y]

I love the concept ! https://t.co/pBfa17SFGS

[blackorbird @blackorbird]

Someone has launched a project called Poison Fountain, which seeks to poison training data for AI models.
They aim to disrupt the technology by adding poisoned data to websites, making AI models less effective.
rnsaffn[.]com/poison3/

[International Cyber Digest @IntCyberDigest]

‼️A German hacker known as "Martha Root" dressed as a pink Power Ranger and deleted a white supremacist dating website live onstage

This happened during the recent CCC conference.

Martha had infiltrated the site, ran her own AI chatbot to extract as much information from users as possible, and downloaded every profile. She also uncovered the owner of the site. She has published all of the data.

[Florian Roth ⚡️ @cyb3rops]

MongoBleed (CVE-2025-14847) is basically Heartbleed for MongoDB

- unauthenticated memory disclosure
- public POC, trivial to exploit
- leaks creds, tokens, cloud keys straight from RAM
- huge exposed surface on the internet

Good writeups and technical details here:
https://t.co/LgK4RABmJu
https://t.co/DWtByJQ3au
https://t.co/LUwfnF6uXG

Patch fast, rotate secrets, and assume exposed instances were scanned(!)

[kmkz @kmkz_security]

CVE-2025-32432: Unauthenticated Remote Code Execution in Craft CMS - by @OPSWAT

https://t.co/QiBPU4YybH

[payloadartist @payloadartist]

Apparently, the leak of the clue to the React2shell exploit took place from the WAF rule that AWS published that partially contained the regex of the POST request body of the PoC

https://t.co/7sNx7ylalh

#infosec #cybersecurity

[Mustafa Bilgici @mustafabilgicii]

React2Shell (CVE-2025-55182) Bug Bounty Automation Nuclei Template for ping to Collab Server Command: nuclei -l 'domains' -t CVE-2025-55182.yaml -proxy http://127.0.0.1:8080

https://t.co/9LyS6o7jIo

#BugBounty #bugbountytips #RCE #React2Shell

[Art&Fact @ArtFact10]

@RussianPanda9xx Outch. Really beautiful on you!