Curiously_Idiotic

This is my corner of the internet 🧠 | Saving interesting reads on Cybersecurity · AI · Startups · Gaming | Threads = my notes

[Dhiyaneshwaran @DhiyaneshDK]

🚨 CVE-2026-18963 - Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass

Nuclei Template - https://t.co/de9imQmMKV

Reference: https://t.co/f5LuvbWdav

#hackwithautomation #bugbounty #keycloak

[H4x0r.DZ 🇰🇵 @h4x0r_dz]

Keycloak is vulnerable to a critical unauthenticated account takeover (CVE-2026-18963)

I reproduced the bug locally; interesting one (power of LLM, I think)
https://t.co/hBuQe28aEm

[Justin Elze @HackingLZ]

If you only watch one talk from Defcon

https://t.co/VVaAowHQ2q

[Curiously_Idiotic @I_amboard]

https://t.co/Jwd5l9QcEl

[Dark Web Informer @DarkWebInformer]

🚨 Placebo : An internet chat community with a strong emphasis on Freedom of Speech.

Dark Web: http://placebordtyjrxo3mmlfg5i4mwsotzguplvblb6b775gs2x7lnftfrid[.]onion

Dread Announcement: https://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad[.]onion/post/6bc511a93be8bd7a5f6c

[Curiously_Idiotic @I_amboard]

@MSNightmare2000 Bro we need a discord server to keep up with your writeups, please consider one.

[Florian Roth ⚡️ @cyb3rops]

CertiGhost (CVE-2026-54121) deserves much more attention than it is getting right now, from my point of view.

In a common/default AD CS setup, a low-privileged domain user can create a rogue machine account, trick the CA into issuing a certificate with the identity of a Domain Controller, authenticate as that DC via PKINIT, gain replication access and basically compromise the whole domain.

So if you run on-prem Active Directory with AD CS and your CA is still unpatched, an ordinary domain user may currently have a path to the highest privileges in your domain.

Patch it, obviously, or apply the temporary mitigation. But if you patched only recently, the harder and from my point of view more important question is: did someone already exploit it?

A patch closes the hole. It does not unfuck a domain that was already compromised.

I put a list of things I would check in the first reply.

Overview:
https://t.co/NHaJD5hlFi

Technical details:
https://t.co/ucGrc2SLbJ

PoC:
https://t.co/nvWARPtmso

Microsoft advisory:
https://t.co/kYoXWRKTyz

Temporary mitigation:
https://t.co/hVOHBYO5hD

[Intigriti @intigriti]

⏰ It's CHALLENGE O'CLOCK!
👉 Capture the flag before Monday the 3rd of August
👉 Win €400 in SWAG prizes
👉 We'll release a tip for every 100 likes on this tweet
Thanks @silent_web3_ (zerodaysbooks) for the challenge 👇
https://t.co/0Yfuj4Ol9q

[Clandestine @akaclandestine]

Derp - Malware Infrastructure Tracking and Research | Derp https://t.co/PQ0qjYTG2a

[Co11ateral @co11ateral]

Building Your Own Drone (For Pentest) - Part 4

In the final part we show how credentials, password hashes, and network intelligence can be captured by targeting wireless devices and protocols. It's a different approach to wireless security for pentesters that targets both Wi-Fi and Bluetooth devices

We also covered vulnerabilities that system administrators and defenders should be aware of. Hopefully this encourages more organizations to replace outdated and vulnerable devices

https://t.co/9Pyg8Vkv8Q

@three_cube @_aircorridor

[Clandestine @akaclandestine]

GitHub - tc4dy/CVE-2026-54121-PoC-Exploit: 👻 CVE-2026-54121 - Best CertiGhost AD CS Multi-Exploit Framework ⚡Weaponized tool with rogue DC/LDAP servers, certificate abuse, PKINIT hash extraction. Features: detect safe check, exploit full multi-threaded. https://t.co/kDsO6JcTLs

[Zhenpeng (Leo) Lin @Markak_]

Open-sourcing our RCE implementation for CVE-2026-42533! This is an incredibly powerful NGINX bug that provides both info leak and an out-of-bounds heap write primitives (so, yes, ASLR bypass!).

F5 released the security advisory a week ago on July 15th. Fun fact: this bug appears to have been found concurrently by multiple groups. Our team at @depthfirstlabs caught it using our internal systems, right alongside CVE-2026-42530, a separate issue in NGINX’s HTTP/3 QPACK implementation.

[Nicolas Krassas @Dinosn]

CVE-2026 PoC Collection - 128 PoCs covering 84 CVEs
https://t.co/uhduxVDJfS

[ZoomEye @zoomeye_team]

🚨 CVE-2026-60206: Oracle WebLogic Server Arbitrary File Read

Critical Vulnerability Alert!
Oracle WebLogic is affected by CVE-2026-60206.

Full Vulnerability Details & Analysis at DarkEye:
🔗 https://t.co/O635IMQYOk

🔍 Identify Targets via ZoomEye:

Filter: vul.cve="CVE-2026-60206"
Search Dork: app="Oracle WebLogic"
Exposure: 1.2m instances identified globally.

ZoomEye Search Link:
👉 https://t.co/IEEG7NvumY

#Infosec #CyberSecurity #ZoomEye #DarkEye

[Md Ismail Šojal 🕷️ @0x0SojalSec]

Wtf, Kimi k3 found 0-day in latest Redis Only in 27 minutes,

also got near zero-click arbitrary command execution in Telegram Desktop & iOS.

Kimi didn’t just find the bug it built working authenticated RCE exploits for multiple Redis versions, including one that bypasses the fix in 8.8.0.

It also achieved near zero-click arbitrary command execution in Telegram Desktop & iOS (ASLR pinned).

The researcher even said it found real vulns in latest Chrome and WeChat.

I use kimi for AI-driven vulnerability research, it really work

[Dark Web Informer @DarkWebInformer]

🚨 A Go-based PoC scanner is available for CVE-2026-43499, also known as GhostLock, a Linux kernel use-after-free vulnerability that may allow local privilege escalation.

GitHub: https://t.co/8ilFwMAyUV

The tool includes a passive scan mode and a PoC trigger that may cause a kernel panic or system crash.

[Nicolas Krassas @Dinosn]

Zetsu, A personal RAG system for offensive security knowledge https://t.co/450iLlyQdm

[Intigriti @intigriti]

It is no secret that hidden parameters can lead to all sorts of vulnerabilities, such as SQLi, XSS & SSTI! 😎

But you have to find them first... 😓

In our comprehensive guide, we've uncovered the top 5 common ways to uncover unreferenced parameters in your target, including a list of common tooling to help you automate these 5 methods.

Check it out! 👇
https://t.co/areeGv7UYS

[📕「マルウエアの教科書」著者 | 吉川孝志 | 増補改訂版🌟発売中 @MalwareBibleJP]

Microsoft自身がDefenderに同梱して署名したカーネルドライバーだけで、あらゆるEDRを外部持ち込みなしに強制終了できるPoCツール「DefenderKiller」の解析が公開されました。脆弱なドライバーを外から持ち込む従来のBYOVDと違い、標的環境に最初から存在するMicrosoft署名済みドライバー（KSLDriver[.]sys）を悪用するため、ドライバー署名強制もブロックリストも素通りし、公開時点でVirusTotalの検知は70製品中ゼロだったとのことです。

【手口の詳細】

・KSLDriver[.]sysはWindows-Defenderのカーネルサポート基盤の一部としてMicrosoftが正規に署名したドライバーで、Windows-7〜11の署名強制（2026年4月のドライバー信頼ポリシー有効時を含む）を通過。Microsoftの脆弱ドライバーブロックリスト（DriverSiPolicy[.]p7b）は設計上Microsoft自身の署名ドライバーを除外するため、無警告でのロード

・唯一のアクセス制御はレジストリ値AllowedProcessNameに登録されたプロセスのNTパスとの照合のみ。ドライバーのロードには元々管理者権限が必要なため、自分の実行ファイルのパスを事前に書き込めば署名も証明書も検証されず認証を通過

・最も巧妙な点は、プロセス終了がIOCTL送信時ではなくハンドルを閉じた瞬間（IRP_MJ_CLEANUP）に発火する設計。IOCTL（コード0x222044のサブコマンド8）は対象のPIDをEPROCESS参照として保存するだけで、CloseHandleでカーネルがZwTerminateProcessを呼び出して初めて対象が停止する仕組み

・カーネルモードのZwOpenProcess／ZwTerminateProcessはユーザーモードからのアクセスを拒むPPL（Protected-Process-Light）保護の制約を受けないため、通常は外部から終了できない保護されたEDRプロセスも強制終了が可能。実証ではCrowdStrike-Falconのサービスプロセスの停止に成功したとの報告

・限界はプロセス終了のみで任意メモリの読み書きはできない点、および一部EDRがwatchdogやセカンダリのカーネルコンポーネントでプロセスを再生成しうる点。ただし対象プロセス名を列挙してループで狙えば回避可能との報告

・関連する既報として、4月に別の研究者が別のMicrosoft署名済みドライバー（別IOCTL・別ツールPoisonKiller）で同種の強制終了を実証した事例も紹介済み。Microsoftの署名信頼の仕組みを署名済みドライバー自体で突く手口が複数の独立した研究から報告されている状況

Microsoftが自ら署名したプロセスキラーが10年以上Defenderに同梱されたまま、同社自身のあらゆる保護を回避できる状態で放置されてきたと指摘されています。

詳細は以下を参照：
https://t.co/r4G0VPLLJa

(※可能な範囲でファクトチェックは実施済なものの、元記事の精度依存や速報・要約の性質上漏れもありうるため、正確な情報は一次情報を直接参照のこと)

[Md Ismail Šojal 🕷️ @0x0SojalSec]

Finally a solid Mistral Uncensored model that actually run locally on
4.37 GB low-end hardware with zero refusals

Runs smoothly on my old RX 570.

It’s responsive, stable in long chats, and actually follows instructions without random refusals.

Q4_K_M quant gives surprisingly good quality while staying inside 8GB VRAM.

feels like the model actually listens instead of arguing.

Perfect if you want more control without buying a new GPU.