Vašek Lorenc

Mazáctví nelze vyvážit penězi. Ani fešáctví.

[Dhiyaneshwaran @DhiyaneshDK]

🚨 CVE-2026-18963 - Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass

Nuclei Template - https://t.co/de9imQmMKV

Reference: https://t.co/f5LuvbWdav

#hackwithautomation #bugbounty #keycloak

[Dhiyaneshwaran @DhiyaneshDK]

🚨CVE-2026-19478 - GitLab CE/EE - GraphQL @ gl_introduced Arbitrary Method Invocation

🔍Nuclei Template - https://t.co/xqry5cAmky

🗒️Reference: https://t.co/devJlBeTiG

#hackwithautomation #bugbounty

[V4bel @v4bel]

💥 Introducing "Zapscape" (CVE-2026-64561)

A Guest-to-Host Escape in KVM/x86 exploiting a UAF in the shadow MMU's recursive "ZAP" path. Can escape to the host on x86 public clouds that expose nested virtualization.

A separate vulnerability from Januscape. If you match the vulnerable conditions, apply the patch immediately.

Details: https://t.co/VyNqF8O8AE

[Nicolas Krassas @Dinosn]

CISA KEV Threat Intel Orchestrator https://t.co/g9irFJYPVg

[forefy @forefy]

Another gem from the old EDR-evasion days drawer

Tested on latest mac OS's and apple silicone, still working after all these years

Not signed by any EDR I tested it against, and dumps hashcat-ready password hashes for lateral movement and privilege escalation within macos environments post-compromise

This is obviously shared not for blackhats, but for raising the awareness to EDR and defensive teams that this capability still works, and I encourage defenders to share, post, retweet this until it stops working lol

https://t.co/swp2Gvg5SU

[Aurélien Chalot @Defte_]

I have suspected the klist.exe could be used to dump local tickets but never had time to check that out correctly. This guy did and explains it very well! Only requires local admin rights, no system, to dump all TGT's on the computer

https://t.co/5lYSxQpXq7

[kernullist @kernullist]

Part 3 of the hypervisor based game cheat series is up.
This is where the series starts moving from hypervisor primitives into actual game cheat mechanics.

This part covers EPT hooks, VM exits, VMI, monitoring loops, overlay and input delivery paths, and the point where a low level memory or execution event starts becoming cheat relevant.
Also started touching the actual game cheat side more directly this time, but this is about technical principles and mechanics, not actual code.

Big thanks and credit to @Intel80x86 @HyperDbg for the great HyperDbg work on hardware assisted debugging, EPT hidden hooks, transparent memory hooks, and VM exit based monitoring.
Can't imagine how lost it would've been without HyperDbg. Seriously a lifesaver!
Also grateful to Panicos Karkallis and Jorge Blasco Alís for the VIC research on virtual machine introspection cheats.

For a bit of context, this entire series is originally a single Korean document. Splitting it up due to the length, and it’ll probably be around 8 or 9 parts total.
Translating from the original Korean made the English version feel a bit awkward in earlier parts, so spent some extra time polishing this one. Really hope it’s a much smoother read. 🙏

Please take it as a light read. If anything is wrong or too wordy, feedback is always welcome. 😇

https://t.co/dEUSW1nlbx

[Ionut Popescu @NytroRST]

Factoring "short-sleeve" RSA keys with polynomials https://t.co/7ps7EBcayN

[cr3ghost @cr3ghost]

Phrack 72 published the analysis of an actual North Korean APT workstation dump.

Real Kimsuky source code. A kernel-level remote backdoor. A private Cobalt Strike beacon. Android malware. Stolen South Korean government GPKI certificates. Access to the Defense Counterintelligence Command and Ministry of Foreign Affairs.

A South Korean security firm independently confirmed the findings. They matched the leaked rootkit source code to a rootkit found during a real 2022 incident at a South Korean financial institution. Same code, same encryption keys.

Opens with “Dear Kimsuky, you are no hacker.”

https://t.co/kaMJUzmaLr

https://t.co/YJ7glibYHQ

Authors: Saber + cyb0rg

Published in @phrack Issue 72, 40th Anniversary

Follow-up analysis by ENKI White

#ThreatIntel #Malware #InfoSec

[_SiCk @encrypted_past]

Well, this is why you check for CVE's before you spend two days doing a thing.

https://t.co/yi8aPXaFMB

[Calif @calif_io]

We sent Claude Mythos Preview spelunking through Squid’s guts, and it surfaced clutching a 29-year-old bug.

Meet Squidbleed: a Heartbleed-style vulnerability that leaks internal memory from every version of Squid Proxy, in its default configuration.

Full story: https://t.co/xQLKqaSmTn

[Marty @KutilDomaci]

NASA zveřejnila na svém githubu slušnou porci STL pro 3D tisk, mimo jiné i legendární Saturn V, který vynesl astronauty na misi Apollo 11 k Měsíci.
Jaký model si vytisknete jako první? 😉
#3Dprinting #NASA

[chompie @chompie1337]

i love this exploit! universal SELinux bypass still works to this day. I released it for Qualcomm based processors and just realized I never released the Exynos version so here it is unprivated: https://t.co/rW1Kr8CLva

[International Cyber Digest @IntCyberDigest]

🚨 BrEaKiNg: Splunk, a security product, has zero authentication in its built-in database service and accepts any credentials, according to the security researchers who just dropped a full pre-auth RCE chain for Splunk Enterprise (CVE-2026-20253, CVSS 9.8).

Splunk Enterprise on AWS is vulnerable out of the box.

[Ladislav Hagara @x14c3]

Soutěže jsou různé. Sportovní, hudební, filmové, … a programátorské. 😀
Byly vyhlášeni vítězové 🏅 a zveřejněny vítězné zdrojové kódy 29. ročníku soutěže International Obfuscated C Code Contest (IOCCC), tj. soutěže o nejnepřehlednější (nejobfuskovanější) zdrojový kód v jazyce C.

[BSidesVienna.at @BSidesVienna]

This is not a drill: you have two more days until the call for papers for #BSidesVienna closes. Submit your talk or workshop by Sunday at 11 pm, 59 minutes and 59 seconds. This is also your reminder to get your tickets at 6 pm today.

[Vašek Lorenc @valorcz]

@kasikp Asi se to nechová úplně deterministicky, já dostal rozumnou odpověď. Navíc se v mém vyhledávání liší, jestli zadám "define disregard", nebo v opačném pořadí.

[haroon meer @haroonmeer]

I’ve mentioned this before: this is one of the oncoming trains for corp-security. We’ve long failed at least-privilege, but weren’t often punished for it.

Helen in HR (or Bob in accounts) didn’t know what to do with the extra perms they didn’t know they had.

Their agents will.

[vx-underground @vxunderground]

Yesterday I got a funny DM. @s00pcan said some AI slop is automatically forking his Linux open-source projects and adding goofy ass ReadMe files to look all fancy. The primary difference though is the ReadMe includes a "download here" link which delivers a .zip file.

The .zip file contains cool and badass malware. The malware is also free. Yay

This is a campaign which has been identified by various AV vendors since April, 2026. It is attributed to StealC.

In this particular instance though it is very, very silly. The exact mechanic in which this StealC group is using to automagically fork projects on GitHub, insert bogus ReadMe files, etc. is unknown. Clearly it is AI generated. However, this group failed to account for all edge cases because ... this is malware developed for Windows ... but it is from a Linux audio driver fork.

This yet again however a use case of AI in malware campaigns. StealC has been around forever and clearly isn't AI slop. However, Threat Actors are using AI to generate fancy schmancy ReadMe files. Very cool. Thank you, Mr. Smart GPU-thingy.

The following GitHub I'll be linking is giving FREE malware. Visiting the page won't give you the free malware. At the top of the ReadMe is a "Download" section with a hyperlink to "pcie_dante_snd_v1.4".

If you care what this payload does:
Inside this .zip file is "Application.cmd", "dir-dot-cc", "lua51.dll", and "loader.exe".

Application.cmd is a command line file, it launches loader.exe. Loader.exe is responsible for loading the "dir" file. Loader.exe is dependent on lua51.dll because the "dir" file is a GIANT obfuscated Lua file.

I hate Lua and I hate dealing with obfuscated Lua, I refuse to be a victim of Lua, so instead of trying to bonk it with a stick I emulated it. Unsurprisingly, the malicious Lua file tries to harvest credentials from Chrome and exfiltrate them to a remote host.

Free malware: github-dot-com/mbyington67-prog/snd-dante-pcie/tree/master

tl;dr ai slopping and forking github, delivers malware that uses obfuscated lua, i like cats a lot

[Florian Roth ⚡️ @cyb3rops]

I don’t know what happened between Microsoft and #NightmareEclipse behind closed doors

Maybe Nightmare Eclipse was unreasonable. Maybe Microsoft was. Maybe both.

But I think Microsoft badly misjudged this situation.

When you’re the largest software vendor on the planet, you don’t get to behave like an angry individual in an internet argument.

You have to be the adult in the room.

Deleting repositories, talking about criminal investigations and turning the whole thing into a public fight was a mistake. The damage from that goes far beyond this one researcher.

What surprised me most is how quickly people started sharing their own MSRC stories afterwards.

- Months without responses
- “Working as intended”
- Bounty disputes
- Reports that went nowhere

People don’t suddenly start telling those stories for no reason. I think Microsoft broke a lot of porcelain here.

And for what exactly?
I don’t see much upside.