Zero Hunt

🤖 The autonomous AI red team that never sleeps. On-prem generative pentest, wire-speed traffic ML & continuous NIS2/DORA compliance.

[Zero Hunt @zerohuntai]

You can't send a takedown request to a blockchain.

Microsoft caught ACR Stealer resolving its C2 from a smart contract. eth_call = no transaction, no trace. Burn the address, the operator re-points it for $1.37.

https://t.co/r1gk6qZRlY

#EtherHiding #Infostealer

[Zero Hunt @zerohuntai]

Can't patch tonight?

Block POST to BOTH /wp-json/batch/v1 and /?rest_route=/batch/v1 at the edge — blocking one form leaves the fallback open.

Hunt (T1190 → T1505.003): new .php files in wp-content/uploads, plugins, themes. Run wp core verify-checksums.

[Zero Hunt @zerohuntai]

wp2shell (CVE-2026-63030): unauthenticated RCE in WordPress Core — not a plugin.

A REST batch route-confusion bug chained to a WP_Query SQL injection. Patched 7/17, public PoC 7/18. WordPress runs ~40% of the web.

The actual fix 🧵

[Zero Hunt @zerohuntai]

The fix — exact versions:

7.0.x → 7.0.2
6.9.x → 6.9.5
6.8.x → 6.8.6
7.1 beta → 7.1 Beta 2

A persistent object cache (Redis/Memcached) makes the SQLi→RCE step much harder, but does NOT close the injection. Patch anyway.

[Zero Hunt @zerohuntai]

Patching is the easy half. The hard part is knowing which box is actually exploitable vs which the CMDB just calls patched — and that a compromised sandbox can flip verdicts to launder malware clean.

Full runbook: https://t.co/zh9pEvpYW9

[Zero Hunt @zerohuntai]

FortiSandbox has two unauthenticated command-injection RCEs — CVE-2026-25089 & CVE-2026-39808, CVSS 9.8. Both on CISA KEV, exploited in the wild, federal patch deadline Jul 19.

The catch: it's the box your Fortinet fabric asks whether a file is malware. Runbook 🧵

[Zero Hunt @zerohuntai]

Can't patch tonight?

• Pull the mgmt/web UI off internet-facing interfaces — mgmt VLAN + jump host
• ACL service ports to fabric devices only

Hunt (T1190): malformed HTTP to the web UI / JRPC API + any outbound the sandbox opens. It ingests — it shouldn't beacon.

[Zero Hunt @zerohuntai]

Am I exposed?

Get-WindowsFeature ADFS-Federation | Where-Object Installed

Then the command that sets your real severity:

Get-AdfsRelyingPartyTrust | Select Name, Identifier

Every app on that list trusts this box to vouch for identity. That's the blast radius — not the 7.8.

[Zero Hunt @zerohuntai]

CVE-2026-56155: AD FS zero-day. Patched Jul 14, in CISA KEV the same day, exploited in the wild. Credited to Microsoft's own IR team — DART finds bugs in victim networks, not labs.

Rated 7.8. "Local privilege escalation."

That score measures the wrong object. Runbook 🧵

[Zero Hunt @zerohuntai]

Am I exposed?

Get-WindowsFeature ADFS-Federation | Where-Object Installed

Then the command that sets your real severity:

Get-AdfsRelyingPartyTrust | Select Name, Identifier

Every app on that list trusts this box to vouch for identity. That's the blast radius — not the 7.8.

[Zero Hunt @zerohuntai]

CVE-2026-56155: AD FS zero-day. Patched Jul 14, in CISA KEV the same day, exploited in the wild. Credited to Microsoft's own IR team — DART finds bugs in victim networks, not labs.

Rated 7.8. "Local privilege escalation."

That score measures the wrong object. Runbook 🧵

[Zero Hunt @zerohuntai]

Patching evicts the bug, not the intruder. Attackers pulled session DBs + TOTP seeds and pivoted VPN-less into AD — so re-image and rotate creds/MFA.

Full runbook — exposure check, IOCs, ATT&CK, eradication:
https://t.co/FRIdqykNLt

[Zero Hunt @zerohuntai]

SonicWall SMA1000 is under active attack.

CVE-2026-15409 — an unauthenticated SSRF (CVSS 10.0) — chains with CVE-2026-15410 to reach root. Both added to CISA KEV on Jul 14; federal deadline Jul 17.

The "authenticated" RCE never needed a login. Runbook 🧵

[Zero Hunt @zerohuntai]

Can't patch tonight? Take it offline (BOD 26-04). Interim: keep the mgmt plane (port 8188) off the internet; WAF-drop /wsproxy requests whose host resolves to loopback.

Hunt: extraweb_access.log for wsproxy + "=-3389" + HTTP 101; ctrl-service.log remove_hotfix path traversal.

[Zero Hunt @zerohuntai]

Qualys just shipped an AI agent that exploits your findings — admitting the CVSS score was always a guess.

Evidence beats estimate. But whose cloud computes the proof?

https://t.co/ovXtKCcWkJ

#ExploitValidation #SovereignAI