Kawa

[Nicolas Krassas @Dinosn]

vCenter pre-auth RCE: CVE-2026-59309/59310 https://t.co/dzmWgkUPx4

[Ryx @PadhiyarRushi]

Four Linux local-root vulns published with working PoCs.

DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), DiagSpill (CVE-2026-74469). Write-up + exploits dropped after coordinated disclosure.

https://t.co/xZCT0ubwyt
https://t.co/7Qf3IhfHgc

#Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #KernelSecurity #PrivilegeEscalation

[📕「マルウエアの教科書」著者 | 吉川孝志 | 増補改訂版🌟発売中 @MalwareBibleJP]

Active-Directoryを安全にするための実践的な連載が、Microsoftの技術ブログで公開されています（これまでに8回分）。NTLMv1やSMBv1のように攻撃に使われる古い方式を1つずつ無効にし、LDAP署名やSMB署名の強制、KerberosのAES強制、権限の最小化までを、1回に1テーマで扱う内容。

設定の変更手順だけでなく、有効にすると動かなくなる機器やアプリケーションを事前に洗い出す方法にも紙幅が割かれています。最新のパート8はNTLMの無効化です。

【要点の整理】

・掲載先はMicrosoftのCore-Infrastructure-and-Security-Blog、著者はJerry-Devore氏。タグ「adhardening」の配下には、パート1から8までと、Kerberosの暗号化タイプの選択を扱う記事を合わせて9本。

・パート1から7の主題は、NTLMv1の無効化、SMBv1の削除、LDAP署名、KerberosのAES強制、LDAPチャネルバインディング、SMB署名、最小権限。パート8はNTLMというプロトコル全体の利用停止。

・パート8の出発点は利用量の把握。ドメインコントローラーの4776、アクセス先のサーバーに残る4624、パフォーマンスモニターのNTLM認証カウンターが日次の集計に使える。使用元のプロセスまで特定するには監査の有効化が必要で、記録先は8001から8006のイベント、遮断後は4001から4006。

・より詳細なイベントの追加がWindows-11-24H2とServer-2025向けに予告済み。ドメインコントローラー側ではNTLMのバージョン、クライアント側ではNTLMが選ばれた理由までたどれる。執筆時点ではWindows-Insiderでの評価にとどまり、それより前のOSへ移植する予定はないとの説明。

・NTLMが選ばれる理由は4つ。ドメインコントローラーへ到達できない、ローカルアカウントを使っている、SPNが重複または未設定、アプリケーションがNTLMを指定している。Microsoftのテレメトリーでは、半分強はアプリケーションの設定が原因。

・進め方は、管理者アカウントをProtected-Usersへ段階的に追加、Tier-0の機器から着手といった小さな単位での適用（サービスアカウントと機器は追加しない）。優先順位は、NTLMの無効化よりNTLMv1とSMBv1の排除、SMB署名の強制を先に済ませるべきとの指摘。

詳細は以下を参照：

https://t.co/SkJjL9zqxU

(※可能な範囲でファクトチェックは実施済なものの、元記事の精度依存や速報・要約の性質上漏れもありうるため、正確な情報は一次情報を直接参照のこと)

[Ryx @PadhiyarRushi]

Next.js on Windows now has a public RCE PoC.

CVE-2026-75604: exploit code dropped shortly after disclosure. Windows-hosted Next.js apps processing untrusted input are in the immediate risk window. Framework RCEs with public material get automated fast.

https://t.co/AQXo2gxLZH

#Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #AppSec #RCE

[Nix0n @UnTalNixon_exe]

¿Cansado de hacer auditorías de seguridad a mano y perder horas armando reportes?

Conoce ARES: una plataforma open-source de Red Team autónomo construida con FastAPI y React que automatiza todo el proceso.

🚀 ¿Qué hace?
• Genera grafos de ataque autónomos (DAG) en tiempo real.
• Mapeo automático con MITRE ATT&CK.
• Cortafuegos de alcance y reportes instantáneos.

Si te dedicas al hacking ético o la validación de seguridad, esto te ahorra días de trabajo.

El enlace al repositorio lo dejo abajo en los comentarios para que lo pruebes 🔥👇

[Ryx @PadhiyarRushi]

Netlogon has a CVSS 9.8 public exploit!

CVE-2026-41089: stack buffer overflow in CLDAP. Working PoC is available. Domain-joined Windows that still expose the classic Netlogon path should treat this as urgent.

https://t.co/F6zzTjpjsE

#Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #WindowsInternals #ActiveDirectory

[H4x0r.DZ @h4x0r_dz]

1-Click wordpress RCE 👀

That's easy to exploit; just send a link to contact@Domain[.]com

[OccupytheWeb @three_cube]

ShadowBroker

This tool, ShadowBroker, that brings multiple OSINT feeds into an interactive map, so you to track aircraft, ships, satellites and global events.

When you zoom into the areas you're interested in, you'll find clusters of local news stories sorted by priority

It's pretty easy to set up and doesn't require any paid APIs.

In fact, it can work without any APIs at all.

Great tool

https://t.co/dkXLiwlNUW

[Abhishek @aacle_]

NEW LOCAL MODEL FOR CYBERSECURITY 🚨

DeepSeek-V4.1-Flash-Abliterated-Cybersecurity-Unleashed

> Build on DeepSeek-V4.1-Flash 🧠⚡

> Safety Rails Stripped 👀

Run it locally with DGX Spark / Powerful PC

For SECURITY TESTING On Real Targets 🎯

https://t.co/jcxLe7eMDS

[Nathan McNulty @NathanMcNulty]

The workaround

[Kuba Gretzky @mrgretzky]

I've just released the first video in the Evilginx Pro Tutorials series, where I'll be providing hands-on tutorials on how to use Evilginx Pro and develop phishlets.

The first video teaches how to set up Evilginx Pro locally and test the Google phishlet from the official phishlet database.

It lays the foundation for the upcoming videos, in which I'll explain, step by step, how to create your own phishlets from scratch.

Enjoy, and happy phishing! 💗

You can find the YouTube link in the post below.
👇

[Co11ateral @co11ateral]

OSINT - Investigating Google Accounts with Ghunt

https://t.co/8I3Q8OdW0z

[Ruslan Sayfiev @cryptopeg]

On red team engagements we often may start from a dropbox on the internal network (LAN/Wi-Fi) with no valid domain account. The DCs are easy to find via DNS, and still in plenty of environments anonymous access to the SAMR and LSARPC named pipes are open.
https://t.co/e94x09tKOi
Many of us lean on rpcclient for this (I do too), but over a null session it lists standard users by name only — no machine ($) accounts, full detail one queryuser at a time, and no way to RID-cycle when enumeration is locked down. enum4linux-ng and NetExec cover this ground too and I still use them. I wanted one command that does the whole pass and writes clean, reusable output:
• Users with full detail — descriptions, account restrictions, group memberships
• Groups resolved to their members
• Computer ($) accounts — via RID cycling, which is how you get them at all
• Domain + password/lockout policy, plus LSA/DNS (domain SID, forest, trusts)
• "Interesting" accounts flagged

Output is txt/csv/json plus ready-to-use lists: usernames for AS-REP roasting, computer names for the pre-Windows 2000 machine-account check. SAMR first; if that's locked it still returns LSA recon, with an optional LSA RID-cycling fallback.

Use it only on directories you are authorised to inspect.

[spencer @techspence]

Long live Active Directory! :D Definitely check this out if you're into attacking or protecting AD

[𝐑𝐀𝐢𝐡𝐚𝐧 @zapstiko]

Zero-Auth to Domain Admin — Automated Active Directory Attack Chain

A fully automated penetration testing tool that chains 25+ attack techniques to compromise Active Directory environments. Designed for authorized security assessments

#AD #hacking #pwn
https://t.co/nQH3wnPWg1

[Black Hills Information Security @BHinfoSecurity]

Attackers burned two rounds of domains on email bomb + fake Teams help desk lures, then stopped registering domains at all. Free M365 trial tenants: no WHOIS, no reputation, unlimited supply.

Time from first Teams message to ClickFix execution: 2m32s.

Lance McNeese on 8 weeks of tracking this campaign, with IOCs and hardening steps:
https://t.co/QMe0oDyRTx

[It's Steiner254 @Steiner254]

A step by step windows active directory pentest guide

https://t.co/GMo39mPxKN

#Windows #Pentest #Cybersecurity

[Hacking Articles @hackinarticles]

🚨 LOLAD — ACTIVE DIRECTORY ATTACK & ENUMERATION CHEAT SHEET 🔥

🔥 Telegram: https://t.co/upuP8k8ckB
✴️ Twitter: https://t.co/Za7rYILz6E

Working with Active Directory? 🏢⚔️

This is a massive collection of AD commands, techniques and resources for authorized Red Team and security testing.

🔥 Explore:

🔎 AD Enumeration
👥 Users & Groups
💻 Domain Computers
🏢 Domain Controllers
🌐 Forests & Trusts
🔐 Kerberos & SPNs
🎫 Delegation
🛡️ ACL Enumeration
📜 GPO Enumeration
🔑 Credential Techniques
⚔️ Lateral Movement
🧩 Fileless Techniques
⚡ PowerView & PowerUp
💥 Impacket & Mimikatz
🎯 Pass-the-Hash / Pass-the-Ticket
👑 DCSync & Ticket Attacks

💡 The real value?

Instead of memorizing isolated commands, build a structured AD methodology:

ENUMERATE → IDENTIFY WEAKNESSES → VALIDATE → ESCALATE → MOVE → DOCUMENT

🔗 LOLAD:
https://t.co/s1g3bFqaxr

📌 Bookmark this for your next authorized AD lab or assessment.

⚠️ Use offensive techniques only in environments where you have explicit authorization.

♻️ REPOST & SHARE with the Active Directory community!

#ActiveDirectory #ADSecurity #RedTeam #Pentesting #CyberSecurity #Kerberos #PowerShell #Mimikatz #Impacket #EthicalHacking

[MAX @MAXdeg0]

THIS IS F**KING DANGEROUS

SOMEONE JUST TURNED CLAUDE INTO AN AUTONOMOUS PENTESTER.

HexStrike AI connects an LLM to 150+ professional cybersecurity tools through MCP.

You get:

→ 12 specialized AI agents

→ 150+ security tools

→ Network & web security testing

→ Automated pentesting workflows

→ Local execution on Kali Linux

The wild part?

Claude autonomously generated a SQL injection payload, ran the test, and solved a PortSwigger lab.

AI + real security tooling is getting serious.

REPO BELOW