HulkGoSmash

[Md Ismail Šojal 🕷️ @0x0SojalSec]

FULL REMOTE CODE EXECUTION on default nginx 1.30.0 no config changes needed. 🫠

Verichains a deadly exploit chain combining Nginx-Rift (CVE-2026-42945) + Nginx-PoolSlip (CVE-2026-9256).

2-byte heap pointer overwrite & heap over-read then ASLR bypass to arbitrary command execution via system() on connection teardown.

[Vincent | 信号＞噪音 @VincentLogic]

一个程序员突发奇想：

DNS 解析器会把域名记几天——

那能不能拿来存文件？

↓

他找到了全网 390 万个开放 DNS 解析器

把文件切碎

撒遍整个互联网

没有硬盘 没有数据库 没有云

文件活在无数台服务器的缓存里 而那些服务器根本不知道自己在存东西

如果没人访问呢？

文件会慢慢"死去" 随着服务器们一个个把它遗忘

这是我见过最荒诞的开源项目之一

项目名叫 dnsfs

你会用 DNS 缓存存什么文件？

[Realtyapi @realtyapi]

We turned Realestate .com .au, into an API

[Josh Terrill @joshterrill]

My Windows reverse engineering and exploit research workflow has been:
1. Pick a binary to research like tcpip.sys
2. Use https://t.co/fOxBB6tEsN to automate seeing existing binary versions, download, and generate diffs from them
3. Load the resulting .binexport's and .bindiff into an LLM and ask it to analyze
4. Look up the build number of previous Windows version that old binary existed in from https://t.co/U788ndiJbj such as 26100.8328 and create a VM from it
5. Write code and test, working backwards from LLM analysis

[mRr3b00t @UK_Daniel_Card]

If you need some RSS feeds for cyber stuff check this out:

https://t.co/5CdSMMcpgj

[R136a1 @TheEnergyStory]

Have you noticed that those deep-dive stories about complex Windows malware have pretty much vanished, especially in recent years? It feels like the era of "blockbuster" Windows malware has just gone silent, and this blog post tries to give some answers why.

https://t.co/sFsf3uPm5o

[Dlive @D1iv3]

Container escape with CopyFail

[rootsecdev @rootsecdev]

I too woke up and choose violence today as the fail-copy POC dropped.

Made a clean exploit including fixing the UID post exploitation without rebooting the target server. Smoke those CTF’s in hack the box.

https://t.co/nRiFyXQzRe

[spencer @techspence]

If you’re an IT admin and you’ve never had your internal environment pentested and can’t afford one right now, do this instead:

1. Run Locksmith - fix anything that’s a High risk
2. Run ADeleginator - make sure everyone, authenticated users, domain users and domain computers doesn’t have any unsafe permissions
3. Run ScriptSentry - check for credentials in logon scripts
4. Run PingCastle - check the control paths section. It’s like bloodhound. Look for non-admins that have control paths

If you do this, your environment will be much better when you’re done fixing everything.

[Vivek | Cybersecurity @VivekIntel]

🧬 DLLHijackHunter — Automated DLL Hijacking Discovery & Exploitation Validation

Not just detection — real execution proof.

• Finds hijack paths (services, tasks, COM, UAC bypass)
• Filters false positives (ACL + KnownDLL + API sets)
• Canary DLL → confirms actual execution
• Scores findings by exploitability

From misconfig → confirmed privesc path

🔗 https://t.co/au6AkI8PSW

#RedTeam #WindowsSecurity #PrivEsc

[LainKusanagi @unknownseeker99]

In this article I show a way to modify Mimikatz to evade Defender

https://t.co/6gZmR8EBux

#penetrationtesting #redteaming

[DirectoryRanger @DirectoryRanger]

VMkatz. Extract Windows credentials directly from VM memory snapshots and virtual disks, by @Nikaiw
https://t.co/RpdzUEdrLs

[Smukx.E @5mukx]

BitLocker's Little Secrets: The Undocumented FVE API

https://t.co/je06ETmfBs

#bitlocker

[impulsive @weezerOSINT]

https://t.co/SU99mCoOAw
ArgusMonitor is a german app people install to check their CPU temperature. its kernel driver has 47 commands that give you full access to physical memory, every hardware port, PCI devices, and CPU registers

the driver "encrypts" these commands but you choose the key. set it to zeros. no encryption. it doesn't check who's asking

microsoft signed. no blocklist. no CVE

[Panos Gkatziroulis 🦄 @ipurple]

Interesting approaches! 🤔
Fixing Mimikatz sekurlsa::logonpasswords on Windows 11 24H2/25H2 https://t.co/ZtK3gMl2kH

[impulsive @weezerOSINT]

https://t.co/MAePsbT9Id
found a 21KB kernel driver from 2004 built for windows xp that still loads on windows 11 ASTRA64.sys by EnTech Taiwan. signed in 2006, cert expired in 2007, but its timestamped so windows still says "signature verified" 19 years later. the company doesnt exist anymore.

31 IOCTLs with zero validation on anything. arbitrary physmem R/W, port I/O, PCI config R/W, MSR read, interrupt hooking, keyboard injection. no auth gate, no hardware gate, loads on any system with sc.exe not on loldrivers. not on hvci blocklist. no CVE. vendor is dead so you cant even do responsible disclosure. theres nobody to email

filed an issue @M_haggis

[Co11ateral @co11ateral]

Bluehammer

Privilege escalation via Microsoft Defender. No patch yet

https://t.co/HY02ydWZEK

#0day #lpe

[Nicolas Krassas @Dinosn]

Another BYOVD process killer. works on CrowdStrike. fully signed https://t.co/mnoivGPydA

[Kyle Cucci @d4rksystem]

I uploaded all the malware samples used in my book #EvasiveMalware to my Github:

https://t.co/qaxENwi2Ge

I received some questions about the lab samples, so just posting it for everyone here 🤓

[MDSec @MDSecLabs]

In our latest post, researcher @craigsblackie documents attacks against the Dell UEFI firmware that enable DMA attacks against TPM-only bitlockered devices https://t.co/b835C7rlW4