Mabior Agau

Experienced Cybersecurity geek | Passionate about Shoring Up Vulnerabilities and Protecting Against Threat Actors | Dedicated to Safeguarding Digital Assets

[Mabior Agau @_CyberMaster]

Your biggest enemy is yourself. Stop procrastinating!

Want to learn to code?
- Start learning TODAY

Want to get fit?
- Go for a workout TODAY

Want to eat healthier?
- Cook a nice meal TODAY

Not tomorrow, not next week, TODAY!

[Mabior Agau @_CyberMaster]

Password strength isn't about complexity alone — it's about entropy, hash type, and hardware.

MD5? Cracked in 1ms.
bcrypt? 433 million centuries.

Same password, different hash — completely different outcome. Choose the right hash. #CyberSecurity #SouthSudanTech

[Mabior Agau @_CyberMaster]

Your attack surface is every device you have connected to the internet. Cameras, routers, servers — if it has an IP, it can be found. South Sudan alone has 5,919 exposed devices. Know your perimeter. #CyberSecurity #InfoSec

[Mabior Agau @_CyberMaster]

SQL injection explained: attackers trick databases into spilling secrets. From a simple OR 1=1 to automated blind extraction with SQLMap. Know the basics, master the advanced. What was your first SQLi discovery? #InfoSec #WebSecurity

[Mabior Agau @_CyberMaster]

AD attack chain from enumeration to domain dominance in 5 commands. Security teams — how many of these steps are covered by your detection stack? #InfoSec #CyberSecurity

[Mabior Agau @_CyberMaster]

AD AS-REP roasting: accounts without Kerberos pre-auth leak TGT hashes crackable offline. Find them: Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true}. Either enable pre-auth or enforce strong passwords. #InfoSec #ActiveDirectory

[Mabior Agau @_CyberMaster]

API content-type validation bypass explained visually. If your server validates differently per Content-Type, you have a gap. Test JSON and URL-encoded on every endpoint. #InfoSec #WebSec

[Mabior Agau @_CyberMaster]

Web app vulnerability I keep finding in 2026: API endpoints that accept both JSON and URL-encoded data but validate differently. Send JSON to bypass the server-side checks, then switch to URL-encoded for the actual injection. Test both content types. #InfoSec #WebSec

[Mabior Agau @_CyberMaster]

Linux SUID check every security professional should run: find / -perm -4000 -type f 2>/dev/null. Custom binaries running system commands without absolute paths are a privilege escalation vector. Simple check, common miss. #InfoSec #Linux

[Mabior Agau @_CyberMaster]

Most overlooked security issue: duplicate query parameters in web apps. If your backend merges them, WAF rules that check only the first parameter are useless. Always validate server-side. #InfoSec #WebSec

[Mabior Agau @_CyberMaster]

What's the most underrated cybersecurity skill that no one talks about?

[Mabior Agau @_CyberMaster]

The difference between a script kiddie and a real security professional isn't the tools you use — it's understanding *why* something works. Always question your assumptions. #InfoSec #CyberSecurity

[Mabior Agau @_CyberMaster]

🚨 CVE-2026-20262 is being actively exploited in the wild.

Cisco SD-WAN Manager — arbitrary file write via crafted HTTP request to the web UI API.

If you're running Cisco SD-WAN, patch NOW. This isn't a theoretical one.

#Cybersecurity #Cisco #Infosec

[International Cyber Digest @IntCyberDigest]

🚨 BREAKING: cPanel and WHM, the control panels behind an estimated 70+ million websites, have a critical security flaw that lets anyone become root admin without a password. CVE-2026-41940 affects every supported version. It’s already being exploited in the wild.

watchTowr Labs published the full attack today, after the hosting company KnownHost confirmed the bug was already being used to break into a significant chunk of the internet.

If you've never heard of cPanel: it's the dashboard that hosting providers and millions of website owners use to manage their servers, domains, email accounts, databases, and SSL certificates. WHM is the admin version that controls the entire server. If someone gets root access to WHM, they get the keys to the kingdom and to every apartment inside it.

How the attack works, in plain English:

🔴 Step 1: The attacker sends a deliberately wrong login. cPanel still creates a temporary "you tried to log in" record on disk and gives the attacker a cookie tied to it.
🔴 Step 2: The attacker tweaks the cookie to disable cPanel's password encryption. Normally cPanel encrypts the password field on disk. With one small change to the cookie, cPanel just stores it as plain text instead.
🔴 Step 3: The attacker sends a fake login attempt where the password field secretly contains hidden line breaks. cPanel does not strip these line breaks out, so they get written straight to the session file. Each line break creates a brand new fake record. The attacker uses this to inject lines that say "this user is root" and "this user already authenticated successfully."
🔴 Step 4: The attacker visits one more random page on the site to nudge cPanel into re-reading the file. cPanel then promotes the injected fake lines into its main session memory.
🔴 Step 5: On the next request, cPanel sees a flag that says "this user already passed the password check." cPanel trusts that flag, skips checking the actual password, and lets the attacker in as root.

From start to finish, the attack takes a handful of HTTP requests.

If you run cPanel or WHM, the patched versions are:

🔴 cPanel/WHM 110.0.x → 11.110.0.97
🔴 cPanel/WHM 118.0.x → 11.118.0.63
🔴 cPanel/WHM 126.0.x → 11.126.0.54
🔴 cPanel/WHM 132.0.x → 11.132.0.29
🔴 cPanel/WHM 134.0.x → 11.134.0.20
🔴 cPanel/WHM 136.0.x → 11.136.0.5

If your version is older than these, assume someone has already broken in and act accordingly. Patch right now, then rotate every password and key the server touched: root passwords, API tokens, SSL private keys, SSH keys, mail passwords, and database passwords.

[BuBBliK @k1rallik]

MICROSOFT IGNORED HIM. NOW YOUR PC PAYS FOR IT

One researcher reported a critical Defender vulnerability privately. Microsoft dismissed it. So he published it - then dropped 2 more in 13 days.

The latest is called RedSun. It's unpatched. It works 100% reliably on Windows 10, 11 and Server right now.

It doesn't bypass your antivirus. It uses your antivirus as a weapon.

Defender tries to restore a flagged file - the exploit redirects that write into C:\Windows\System32. No admin. No popup. SYSTEM access in seconds.

-> BlueHammer - patched
-> UnDefend - breaks Defender updates forever
-> RedSun - unpatched, public PoC on GitHub

His message to Microsoft: "I was not bluffing. And I'm doing it again."

RCE is reportedly next. That one needs zero physical access.

[Mabior Agau @_CyberMaster]

@AyuelDavid That is a current status quo unfortunately.

[Mabior Agau @_CyberMaster]

@Miyen_mimdit These Zionists and Uncle Sam underestimated the Iranians, now they are panicking on how to get an offramp to end this conflict but can't get one. LOL.

[FBI @FBI]

The U.S. Justice Department participated in a court-authorized law enforcement operation to disrupt Command and Control (C2) infrastructure used by the Aisuru, KimWolf, JackSkid, and Mossad Internet of Things (IoT) botnets.

The operation was conducted simultaneously with law enforcement actions conducted in Canada and Germany, which targeted individuals who operated these botnets. The four botnets launched Distributed Denial of Service (DDoS) attacks targeting victims around the world. Some of these attacks measured approximately 30 Terabits per second, which were record-breaking attacks. @FBIAnchorage

Read More: https://t.co/1z6TmwHiPs

[Kali Linux @kalilinux]

Kali & LLM: Completely local with Ollama & 5ire: We are extending our LLM-driven Kali series, where natural language replaces manual command input. This time however, we are doing everything locally and offline. We are using our own hardware and not… https://t.co/Tqydp01kPp

[Clandestine @akaclandestine]

OSCP+ Repos https://t.co/HJ0Xvctdl4

[Mabior Agau @_CyberMaster]

@Miyen_mimdit Western hypocracy and double Standards is just so insane to the extent that an average person will will just notice how insane it is without any second thoughts. All these so called international bodies the likes of FIFA, UN etc are being exposed.