Valery Serkin

[The Hacker News @TheHackersNews]

🛑 No SharePoint credentials needed to impersonate an admin and run code.

Researchers chained two flaws, CVE-2026-55040 and CVE-2026-63520, to go from unauthenticated user impersonation to code execution on the server.

Read details here: https://t.co/vceYXtD4rC

[Florian Roth ⚡️ @cyb3rops]

Rapid7 dropped a write-up on the Notepad++ update-chain abuse and - finally - it comes with real IOCs

- update.exe downloaded from 95.179.213[.]0 after notepad++.exe -> GUP.exe
- file hashes for update.exe / log.dll / BluetoothService.exe / conf.c / libtcc.dll
- network IOCs incl. api[.]skycloudcenter[.]com (-> 61.4.102[.]97), api[.]wiresguard[.]com, 59.110.7[.]32, 124.222.137[.]114

by @rapid7
https://t.co/rrespJ9Ju0

[Florian Roth ⚡️ @cyb3rops]

yarGen-Go is out

- full Go rewrite of yarGen
- CLI + local web UI
- generates YARA rules from malware samples
- filters strings using large goodware databases
- ASCII + UTF-16 string extraction
- opcode extraction (PE + ELF)
- detects base64, hex, reversed strings
- magic header + filesize conditions
- super rules across multiple samples
- customizable scoring engine (SQLite, editable via UI)
- optional LLM-based string selection

It’s a rule-drafting assistant - it gives you a strong starting point, but you still need analyst review and refinement. Automatic YARA can only go so far.

https://t.co/8EMQaAGJBO

[Florian Roth ⚡️ @cyb3rops]

Loki RS is alive 🐍⚡

- High performance YARA & IOC scanner
- Multi-threaded
- Process memory & filesystem scanning
- ZIP scanning
- TUI
- New YARA-X
- IOCs from signature-base + YARA Forge
- HTML report
- Remote logging
- JSONL / Syslog output

Personal lab for scanner UX/perf experiments - if it breaks, it breaks; that’s part of the deal

https://t.co/k4JjMDqjoO

[Florian Roth ⚡️ @cyb3rops]

MongoBleed (CVE-2025-14847) is basically Heartbleed for MongoDB

- unauthenticated memory disclosure
- public POC, trivial to exploit
- leaks creds, tokens, cloud keys straight from RAM
- huge exposed surface on the internet

Good writeups and technical details here:
https://t.co/LgK4RABmJu
https://t.co/DWtByJQ3au
https://t.co/LUwfnF6uXG

Patch fast, rotate secrets, and assume exposed instances were scanned(!)

[Tom Dörr @tom_doerr]

AI agent for offensive security workflows

https://t.co/sFkgnV3Xyt

[AndrewMohawk⁽ⁿᵘˡˡ⁾ @AndrewMohawk]

https://t.co/emWo8VVG0E

:'( RCE in n8n

[ACE Responder @ACEResponder]

The different types of #ActiveDirectory kerberos delegation.

#ThreatHunting #DFIR

[Florian Roth ⚡️ @cyb3rops]

Generic detection rules FTW 🙌

The post-exploitation activity @wiz_io showed yesterday makes these scripts light up like a Christmas tree🎄:
bash reverse shells, crypto miner indicators, history resets, wget/curl from http to bare IPs, base64 decoding, etc

If you keep your detection rules generic enough, they also cover tomorrow’s threats and post-exploitation activity of 0days that aren’t even discovered yet

WIZ report:
https://t.co/weZdTOmEAh

[The Hacker News @TheHackersNews]

⚠️ URGENT: A 10.0-severity bug just hit React Server Components and Next.js.

It lets anyone run code on your server — even without logging in.

🔗 Details → https://t.co/9pG1bxMlCw

⚙️ Fix: update to patched versions now.

[Florian Roth ⚡️ @cyb3rops]

The SHA1-Hulud npm mess keeps growing, so we added additional detections for it today

- new YARA rules by my colleague @marius_benthin in our public signature-base
- cover bun_environment.js / setup_bun.js and the malicious preinstall script variants from the Wiz / Aikido write-ups
- already live in THOR Lite and THOR Cloud Lite

Rules:
https://t.co/fQdYTRbPzR

THOR Lite: https://t.co/EVPjanmunk
THOR Cloud Lite: https://t.co/KLDvIjIF5D

#SHA1Hulud #NPM #NPMWorm

[ACE Responder @ACEResponder]

How hackers capture hashes using file icons

#ThreatHunting #DFIR

[ACE Responder @ACEResponder]

How SSH Proxying works

#ThreatHunting #DFIR

[ACE Responder @ACEResponder]

How Stuxnet worked

#ThreatHunting #DFIR

[ACE Responder @ACEResponder]

How the Impacket smbexec semi-interactive shell works. 🐚

#ThreatHunting #DFIR

[Florian Roth ⚡️ @cyb3rops]

Based on the indicators mentioned in @HuntressLabs' blog post I drafted a #YARA rule to detect forensic artifacts on exploited #WSUS servers vulnerable to CVE-2025-59287
https://t.co/MHWGHzUiBu

[ACE Responder @ACEResponder]

How DCOM lateral movement with Excel and ActivateMicrosoftApp works

#ThreatHunting #DFIR

[ACE Responder @ACEResponder]

How the bash reverse shell one-liner works

#ThreatHunting #DFIR

[ACE Responder @ACEResponder]

How the Active Directory Certificate Services ESC3 attack works.

#ThreatHunting #DFIR

[Florian Roth ⚡️ @cyb3rops]

Interesting
https://t.co/ry11IckSDa