Z3VS

Windows identity, AD & web security research. Rust protocol tooling + SOC/IR. Reproducible tests, honest limits, useful defenses. Code ↓

[Z3VS @aa_zs26152]

Patch levels, exposure checks, and direct vendor advisories: https://t.co/hF5HQi7CbT

[Z3VS @aa_zs26152]

PHP + Next.js: 4 critical RCEs, 2 exposure models.

PHP’s Oct 21 fixes cover request/worker state; mod_php has a demonstrated path before app code. Next.js’s Oct 14 fixes involve SVG image optimization on glibc Linux and `use cache` typed arrays.

Which path do you deploy?

[Z3VS @aa_zs26152]

Full casefile, examples and source links: https://t.co/gcJ2YG2mYN

[Z3VS @aa_zs26152]

Security agents should be able to say “unproven.”

For pwn, pentest and bug bounty, keep the authorized scope, pinned target, exact input, raw output, negative control and retest. A crash or odd API response is a lead until a second researcher can check the claim.

[Z3VS @aa_zs26152]

Full explanation and direct links to the 3 SKILL.md files: https://t.co/btOuiDxwjV

[Z3VS @aa_zs26152]

3 security agent skills, 3 jobs:

REA reverse-engineer-anything: pinned binary → hash + trace.
ECC security-bounty-hunter: reachable source path → commit + reproducer.
Strix api-security-testing: authorized API → two-account responses.

Task-fit picks, not a benchmark.

[Z3VS @aa_zs26152]

REA is at ~351k GitHub stars, so I read its Claude Code skill. It routes binaries, APKs, Electron and browser targets differently, and requires evidence for conclusions. Installing the skill alone does not connect its MCP server.

https://t.co/w98TdTdfJs

[Z3VS @aa_zs26152]

@hackinarticles Defender addendum: if a password appears in description/comment, deleting the text is not remediation. Treat the value as exposed: rotate it, check for reuse (especially service accounts), then review who can write those attributes so the problem doesn't recur.

[Z3VS @aa_zs26152]

@techspence The practical retirement test: can you remove every DC without breaking Kerberos-backed apps, GPO, AD CS, file/SQL auth, or Entra sync? If not, AD remains in the threat model even if users only see cloud SSO. Which dependency is hardest for your clients to unwind?

[Z3VS @aa_zs26152]

@lunkertw Agreed. Binding resume to `sub` closes the cross-user case, but doesn't establish logout semantics. The next question is whether token revocation or rotation also invalidates an already-resumed backend session. I haven't verified that lifecycle in Agent Router.

[Z3VS @aa_zs26152]

Agent Router's MCP session ID carried JWT sub, but resume ignored it. Another user holding someone else's ID could reuse that backend session. v1.2.0 checks sub and generates a per-install Helm seed. https://t.co/P3KHY0isil

[Z3VS @aa_zs26152]

Update (Oct 19): Authlib 1.9.0/1.9.1 shipped Oct 14. The maintainer closed #940 after 1.9.0; v1.9.1 source rejects empty signature sets. My local result was for 1.8.0. I have not runtime-tested 1.9.1. https://t.co/XJXElkjp8b

[Z3VS @aa_zs26152]

Authlib 1.8.0 still accepts an unsigned JWS through its deprecated JSON-verification API. I reproduced CVE-2026-96760 locally with a harmless payload. Scope: apps that call `JsonWebSignature.deserialize_json()` and trust its result. CERT/CC: https://t.co/MTOQpBLRVK

[Z3VS @aa_zs26152]

Microsoft’s October update now remediates insecure AD FS DKM ACLs by default. Verify every farm, review events 1132/1133/1135–1137, and preserve the prior SDDL before logs roll over.

Defender checklist: https://t.co/wphmNrxzmI
#ActiveDirectory #WindowsSecurity

[Z3VS @aa_zs26152]

OAuth parser mismatch exposed auth codes. Tenable found Hermes Agent’s Python check saw a loopback URL; the browser sent the code elsewhere. After sign-in, attacker-chosen PKCE could yield session takeover. Fixed in v0.21.6. Research: https://t.co/3b7nyfjd5B

[Z3VS @aa_zs26152]

Exchange admins: verify the Sept 2026 SU. Microsoft’s Oct 2 V2 fixes CVE-2026-96940, an authenticated privilege-escalation flaw. Exchange Server SE RTM V2 is 15.02.2562.053 (V1: .049). Run Health Checker; 2016/2019 updates are ESU-only.

V2: https://t.co/th2GRUfwuz

[Z3VS @aa_zs26152]

NetScaler admins: September’s RCE-fix builds do not cover the new SAML bug. CVE-2026-88779 is an exploited DoS, not another RCE. If SAML SP/IdP is enabled, Citrix now requires 14.1-73.41 or 13.1-64.28. Check config and build: https://t.co/1qs8o39MIn

[Z3VS @aa_zs26152]

Full write-up: local test, the precise legacy-API scope, defensive checks, and primary source links. https://t.co/MEgHYDwJMu

[Z3VS @aa_zs26152]

Cloudflare Containers: zeroing new storage blocks was only half the fix. Old disk mappings and cached snapshots could still carry residual data, so Cloudflare retired them too. Credit: Oren Yomtov/Accomplish. My analysis: https://t.co/T9y9syWSQH

[Z3VS @aa_zs26152]

Zimbra CVE-2026-73570: a crafted email could run commands when optional zimbra-snmp + notifications were enabled. Microsoft observed auth-key theft and movement to peer mail nodes. Patch 10.1.20+; a suspected breach also needs hunting and key rotation.

https://t.co/8ZF1HUPdyx