Samuel (scam) G.

My curiosity is effortlessly sparked | Pentester

[Steven Lim @0x534c]

🚨 𝗡𝗲𝘁𝗹𝗼𝗴𝗼𝗻 𝗥𝗖𝗘 𝗗𝗲𝘁𝗲𝗰𝘁𝗶𝗼𝗻 🚨

𝗖𝗩𝗘‑𝟮𝟬𝟮��‑𝟰𝟭𝟬𝟴𝟵 (𝗖𝗩𝗦𝗦 𝟵.𝟴) — flagged by 𝗖𝗘𝗥𝗧‑𝗘𝗨 as 𝘢𝘤𝘵𝘪𝘷𝘦𝘭𝘺 𝘦𝘹𝘱𝘭𝘰𝘪𝘵𝘦𝘥. Unauthenticated attackers can escalate to 𝗦𝗬𝗦𝗧𝗘𝗠 𝗽𝗿𝗶𝘃𝗶𝗹𝗲𝗴𝗲𝘀 on domain controllers, with 𝗜𝗻𝘁𝗲𝗿𝗻𝗲𝘁‑𝗲𝘅𝗽𝗼𝘀𝗲𝗱 𝗡𝗲𝘁𝗹𝗼𝗴𝗼𝗻 𝗲𝗻𝗱𝗽𝗼𝗶𝗻𝘁𝘀 facing the greatest risk.

To help defenders, I’m sharing a 𝗵𝗶𝗴𝗵‑𝗳𝗶𝗱𝗲𝗹𝗶𝘁𝘆 𝗗𝗲𝗳𝗲𝗻𝗱𝗲𝗿𝗫𝗗𝗥 𝗱𝗲𝘁𝗲𝗰𝘁𝗶𝗼𝗻 tailored to CVE‑2026‑41089, focused on monitoring the 𝗵𝗶𝗴𝗵𝗲𝘀𝘁‑𝗿𝗶𝘀𝗸 𝗲𝗻𝗱𝗽𝗼𝗶𝗻𝘁 𝗲𝘅𝗽𝗼𝘀𝘂𝗿𝗲.

CERT-EU Alert
https://t.co/l7qxXpaTUA

KQL Detection:
https://t.co/nu58sxA4Yo

#Cybersecurity #NetLogonRCE #DefenderXDR

[🕳 @sekurlsa_pw]

Anyone using Relayking? Any good?

It’s an relay enumeration tool for AD environments. Sounds good for detecting relay possibilities.
Link:
https://t.co/AGBnjoWu3A

[Masato Kinugawa @kinugawamasato]

DOMPurifyバイパスの歴史をまとめたページ。HTMLサニタイザーバイパスのノウハウがぎっしり詰まってる。
特に今年に入ってから発見された<selectedcontent>のバイパスは驚いた
https://t.co/PNPSorjJEL

[Aretiq.AI @AretiqAI]

SharePoint Server RCE via webshell upload — CVE-2026-45454. A user with basic Contribute perms can upload an ASPX webshell to the Master Page Gallery and get code execution as the app pool identity. One HTTP request, no admin needed. Patch now.

https://t.co/8PFiQAHmPA

[Samuel (scam) G. @scam_work]

@ChaoticEclipse0 ❤️

[Hugow @hugow_vincent]

Releasing DCOMIllusionist as part of our talk on DCOM at @x33fcon with @k3vinTell. It's a remote in memory fileless lateral movement technique based on some research of @tiraniddo
https://t.co/XLljazKmnH

[Omair 🇵🇸 @w3bd3vil]

CVE-2026-44815 DHCP Client RCE
call memcpy; memcpy(out, data, len) <-- NO BOUNDS CHECK

rpcrt4!_report_gsfailure+0x129
rpcrt4!Ndr64StubWorker+0x1243
0x41414141`41414141
0x41414141`41414141
0x41414141`41414141

Reaching the trigger requires SCCM managed host?!

[Norbert Tihanyi, PhD @TihanyiNorbert]

🔥 Just dropped a NEW PowerShell reverse shell in the PSSW100AVB repository!

✅ 100% AV bypass (June 2026)
✅ Ready for red team operations
👇Act fast — 2-5 days before this gets flagged too.
https://t.co/7DKdNSvBRv

#Powershell #RedTeam #AVBypass #ReverseShell

[cr3ghost @cr3ghost]

Most people learn security research by reading finished writeups. This one shows the actual process.

The messy, organic, step-by-step reality of reversing an unknown Windows mitigation from scratch. WinDbg. IDA. Hex Rays. Guard page violations. Trap flags. Zero prior knowledge of the target.

If you want to learn how to actually approach unknown Windows internals, start here.

https://t.co/Xq8xbSnG75

Author: @yarden_shafir

#ReverseEngineering #WindowsInternals #InfoSec

[Rasta Mouse @_RastaMouse]

Very cool. Unwind data means we can stomp PIC over a DLL and get nice call stacks.

[Rasta Mouse @_RastaMouse]

https://t.co/66vtthyDoR

[MalDev Academy @MalDevAcademy]

One of the most exciting parts about our upcoming EDR Internals & Development course is that it walks the students through the development of a research EDR agent called MaldevEdr.

@GigelV41464 analyzed various EDR products to understand their inner workings and incorporated these techniques directly into the training. The agent developed throughout the course includes all the primary components of a real EDR such as a PPL service, user-mode DLL, ELAM driver and other kernel-mode components.

The diagram illustrates the components of the MaldevEdr.

More information: https://t.co/LeGYIWO09h

[Nightmare Eclipse @ChaoticEclipse0]

It's confirmed, CVE-2020-17103 patch is ineffective and the vulnerability still exists,
A weaponized PoC can be found here -
https://t.co/7hnamkLsS1

Tested against fully patched Windows 11 and Server 2025 machines.

[0patch @0patch]

Micropatches released for Windows Netlogon Remote Code Execution Vulnerability (CVE-2026-41089)
https://t.co/lvwQyIaCRc

[Fady Moheb @N1NJ10_]

@CptJesus User Rights Assignment RDP : https://t.co/R3tEK0SUQn

Full execution, methodology, and OPSEC breakdown in my vault : https://t.co/96Uuy67LGC

[Fady Moheb @N1NJ10_]

Stop burning RDP persistence with 4732 alerts. Bypass the "Remote Desktop Users" group entirely.
GUI access only requires:

- SeRemoteInteractiveLogonRight (Inject SID via secedit)
- RDP-Tcp listener permissions (Modify CIM class)

OPSEC: Trades 4732 for 4704. Most SOCs don't tune 4704 with the same aggression.

h/t @Cptjesus for the concept.

[Daily CyberSecurity @the_yellow_fall]

A sophisticated ValleyRAT malware campaign uses fake Microsoft Teams installers and DLL sideloading to evade Windows Defender detection.

#ValleyRAT #SilverFoxAPT #MalwareCampaign #Infosec #CyberNews
https://t.co/MMMABax6qY

[Nicolas Krassas @Dinosn]

Full exploit code for CVE-2026-40369 - A Windows kernel arbitrary write vulnerability that allows browser sandbox escape from all browsers render process sandbox https://t.co/5crwyh7EXp

[Panos Gkatziroulis 🦄 @ipurple]

goLoL - a Windows host scanner that finds LOLBAS binaries present on the current machine and lists techniques you can run at your current privilege level with MITRE ATT&CK mappings and example commands https://t.co/0CIRynqovI

[Aurélien Chalot @Defte_]

Two really good blogposts https://t.co/5YZvkc8odG
https://t.co/EHTQ0q7nAR