Jon

silently drowning in these voices

[Jon @unrequitedlyfe]

I just pwned a ClickFix C2 server. Turns out the malware had worm-like behavior: it used stolen credentials from infected hosts to inject malicious web content into other compromised sites.

[dbugs @ptdbugs]

A PoC/exploit has been discovered for vulnerability CVE-2026-19632

Vendor: WordPress / cozmoslabs
Product: TranslatePress – Translate Multilingual sites with AI Translation (WordPress plugin)
Description: The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trp_get_translations_regular' AJAX action. This makes it possible for unauthenticated attackers to extract the raw administrator password-reset URL — including the plaintext reset key and login parameters stored in the translation dictionary table — enabling full administrator account takeover. This vulnerability is only exploitable when automatic string saving is enabled (the default setting) and the target administrator's profile locale is set to a published secondary language, as these conditions cause the password-reset URL to be persisted as a translatable string in the secondary-language dictionary table.

Link:
• https://t.co/lVgv0w3ymw
• https://t.co/x93Fekxa0d

#dbugs_vuln

[The Hacker News @TheHackersNews]

‼️A new critical cPanel flaw could let one hosting customer take root control of an entire server.

CVE-2026-65643 affects all supported cPanel & WHM versions. The account must be able to add parked or addon domains, which can be abused to create arbitrary server files and ultimately execute code as root.

Details → https://t.co/ql7JcHEAxX

[I'M H4CK3R 42 @luckyhacker43]

[CVE-2026-23111] A missing “!” in Linux kernel code leads to full root compromise 👾💥

🔗 https://t.co/0t4EGJW7SF
🔗 https://t.co/cADA5DUdp5

[DFIR Radar @DFIR_Radar]

The ADCS CA database is an underused forensic goldmine: it logs every certificate request including denied ones, exposing ESC1 privilege escalation attempts without any extra logging configuration.

Key findings:

- The CA database at C:\Windows\System32\CertLog\ is an ESE file that records all requests across four tables: Requests, Certificates, RequestAttributes, and inline request text. Denied requests are preserved permanently, meaning an attacker who tried and failed to impersonate a privileged identity via a misconfigured template still leaves a record including the UPN they specified as the Subject Alternative Name.

- CISA Advisory AA26-237A (August 2026) confirms ESC1 was used in red team assessments to compromise domains. ESC1 lets any domain user request a certificate for any other user when templates allow enrollee-supplied subjects and permit Client Authentication, producing a valid TGT for the impersonated account.

- A bug in the go-ese library caused all DateTime columns in the ADCS database to return 1899-12-30T00:00:00Z because Flags=0 columns were decoded as OLE doubles instead of Windows FILETIMEs. The fix, now merged and shipping in Velociraptor 0.76.6+, inspects the float value itself to select the correct decoder.

- Velociraptor reads the locked CA database via its raw NTFS accessor and replays the ESE transaction log, requiring zero changes to CA config, no agents, and no Windows Event Log dependency.

#DFIR_Radar

[H4x0r.DZ 🇰🇵 @h4x0r_dz]

127.0.0.1:3000/_next/image?url=/poc.avif&w=128&q=75

https://t.co/LfiiUu9A4N

https://t.co/t8ImWSiYEQ

[masaomi346 @masaomi346]

#malvertising -> Fake Apple Site -> #infostealer

Fake Apple Site:
https://t.co/d4ArnUnidw

Malicious Domain:
leaf68[.]com
#malware

[Aircorridor @_aircorridor]

HackShell – Bash For Hackers

HackShell is a stealthy Bash environment built for hackers.

See how it can help you hide your presence:
https://t.co/M6Vaq7qVDo
@three_cube @DI0256 @IamSmouk @co11ateral

[OffSec @offsectraining]

🚨 CVE-2026-72898: A critical unauthenticated SQL injection vulnerability in Metabase is being actively exploited.

The vulnerability affects the password-reset flow and can ultimately allow an attacker to gain administrator access to a vulnerable Metabase instance.

Our latest technical breakdown covers:
→ How CVE-2026-72898 works
→ Affected Metabase versions
→ The exploitation flow and potential impact
→ What defenders should look for
→ Mitigation steps
→ How to safely validate the vulnerability in OffSec’s Offensive Cyber Range

Read the full analysis: https://t.co/jKO2ZRFroi
Explore the lab: https://t.co/w9oIUXPUbG

#CVE #Cybersecurity #Metabase #VulnerabilityResearch #OffSec

[Yeray Martín Domínguez @yeraymd44]

I've been pwning AD labs for months with a private toolkit I built. Worked every time.
Today I'm opening it: Claude-AD. The AD engagement playbook as Claude Code skills. Kerberos, ADCS ESC1-17, ACL abuse, coercion. Drives your standard tools.

https://t.co/ZMxGOVfl1u

[Panos Gkatziroulis 🦄 @ipurple]

CrystalPotato - port of GodPotato, a local privilege escalation from accounts with SeImpersonatePrivilege to SYSTEM. Includes:

✅ indirect syscalls
✅ dynamic API resolution
✅ compile-time string obfuscation

https://t.co/1ZQue3JfuF

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

New blog post: #CNCMachineRMS C2 Protocol
We analyze the malware’s binary C2 protocol, DoH usage, related infrastructure and network detection opportunities.
https://t.co/k8nfcBE35H

[ヨルシカ（n-buna、suis） / Official @nbuna_staff]

ヨルシカ LIVE「盗作」ティザー映像を公開しました。
宜しくお願いします！

https://t.co/ok4QBhrRw3

ヨルシカ LIVE「盗作」
Blu-ray&DVD
2026年9月30日発売

特設サイト：https://t.co/s4t0Fk710F
ショップリンク： https://t.co/c3Y3NOvIhV

[The DFIR Report @TheDFIRReport]

"The initial payload named BC_invoice_Report_CORP_46.iso, is an ISO image that once mounted, lures the user to open a document.lnk file which will execute the malicious DLL loader using the following command line:."

Read the full report: https://t.co/aRWcDmU4H3

#DFIR #ThreatIntel

[cr3ghost @cr3ghost]

How much visibility does your EDR really have when persistence and C2 live inside Chromium?

New research from @SpecterOps explores Chromium extensions as a C2 + persistence mechanism, turning the browser itself into an interesting red vs blue battleground.

Red teamers will love this. Detection engineers should read it twice.

https://t.co/kb6hxq7cLg

#RedTeam #DetectionEngineering #EDR

[PELock @PELock]

Free usage code for PowerShell Pro Obfuscator

https://t.co/w4wllKkTkJ

☑️ Code virtualization
☑️ Self-defending
☑️ Opaque predicates
☑️ Polymorphic encryption

#redteam #powershell #obfuscator #hacking
#programming #freebie #technews #TechDeals

🆓 CBD2-D35E-3DB2-C69E

[SinSinology @SinSinology]

really proud of this one, i was stuck a while on solving the filesystem persistence issue which all the previous citrix research were pointing to "process continuity" as the solution.
but the memory was so much smashed during the exploitation that i just couldn't achieve continuity
LLMs didn't have anything novel to offer and kept saying suggesting the same technique (i'm probably using them wrong) but when i dig deeper on why netscaler reboots, i thought about this idea (after reversing the watchdog) since its the signal handlers that are causing the reboot to happen by catching the SIGSEGV, why not instead use the shellcode to neutralize the signal handlers, it felt really cool when it worked, i did some googling after but couldn't see any blog/writeup talking about it.
if anyone has used *sigaction* syscall for this purpose in their shellcode before, let me know so i can read your writeup. anyway, enjoy 💛

[The DFIR Report @TheDFIRReport]

🔎 Two indicators from a case we are actively investigating:

rezbackcup[.]blob[.]core[.]windows[.]net
frontend148[.]blob[.]core[.]windows[.]net

If you defend a network, hunt your logs for these now.

Seeing the same thing, or have additional context? Get in touch 👉 https://t.co/qkv4aEZ1Aq

[Dhiyaneshwaran @DhiyaneshDK]

🚨 CVE-2026-72898 - Metabase - Unauthenticated SQL Injection

Nuclei Template: https://t.co/ax3AjGFIH5

Reference:
https://t.co/ab233Yfr2R

#hackwithautomation #nuclei

[International Cyber Digest @IntCyberDigest]

‼️🚨 BREAKING: Security researchers have uncovered all of those who fell victim to the LiteLLM supply chain attack by obtaining its archive: 153GB holding 433,909 files from 2,488 organisations.

According to Hudson Rock and CloudSEK, victims include Nvidia, AWS, Samsung, Boeing, Intel and more.

This is one of the biggest hits by TeamPCP yet.

The archive contains 118,829 CI/CD runner dumps attributed to corporate domains, with signing secrets and AI provider API keys sitting in plaintext.

If you ran LiteLLM 1.82.7 or 1.82.8, assume every secret in that environment is burned.

[Alexandre Borges @ale_sp_brazil]

As promised, I will continue maintaining the Malwoverview project, which has been created 8 years ago.

Malwoverview version 8.1.0 is available:

https://t.co/EwDKd2UUp1

To install it:

$ python -m pip install -U malwoverview

The number of changes is significant, so it is recommended to read the following sections of the README.md:

01. WHAT IS NEW IN 8.1.0, BY EXAMPLE
02. WHAT IS NEW IN 8.0.0 TO 8.0.5, BY EXAMPLE
03. EXAMPLES

#malware #threathunting #vulnerability #informationsecurity #infosec #cybersecurity