ResetNightmare PoC Drops at Black Hat: One Kerberos Flaw, Any Account's Password Reset

Black Hat and DEF CON continue to spill working offensive research into the open. A public PoC for a Kerberos password-reset flaw now takes a low-privileged user to domain admin, and fresh pre-auth RCE PoCs landed for macOS Screen Sharing and SharePoint.

Offensive & Exploitation

• A working PoC for the two Kerberos logic flaws shown at Black Hat is now public. Semperis released ResetNightmare, exploiting a validation flaw in the Kerberos Change Password protocol that lets an attacker reset the password of any target user or computer account without knowing the current one — chaining low-privilege access to full domain takeover (Semperis PoC). The underlying flaws were previewed at the conference (earlier coverage).
• A pre-auth RCE PoC is circulating for macOS Screen Sharing (CVE-2026-65400). Apple’s fix addresses an authentication state-management bug that lets an unauthenticated network attacker reach the service without valid credentials; patched in Sequoia 15.7.9, Sonoma 14.8.9, and Tahoe 26.6.1 (NCSC-NL advisory). Huntress urges immediate patching and has shared detection guidance (Huntress).
• A SharePoint upload-page folder path traversal (CVE-2026-45454) escalates to RCE. Details and a walk-through were released by Aretiq (pentest_swissky via cyb3rops).
• Most WAFs and reverse proxies fall to HTTP/2 request-body bypasses. New research shows protocol-specific framing and inspection gaps break body inspection across nearly all tested products, with Nginx + libmodsecurity3 holding up best (lab.ctbb.show).
• Full-disk encryption on HP ThinPro can be bypassed because the TPM only measured half the boot chain. AmberWolf details the flaw alongside what they call a “terrible” vendor disclosure process that turned into a zero-day (AmberWolf).
• A Black Hat talk shows the Windows kernel’s AFD socket logic enabling cross-layer vulnerability composition — demonstrating that even well-audited components hide exploitable flaws reachable through transport and device reassembly (slides).
• Critical flaws in Belgian eID software affect eight of Belgium’s ten largest banks and 60+ government agencies, impacting roughly 2 million people, per a DEF CON talk. The chain includes an eID RCE against banking software (SecurityWeek, research writeup) (discussion).
• A Windows application-whitelisting bypass abuses the Assessment and Deployment Kit via insecure deserialization. Now patched, but a useful App Control bypass read (dotsec).

New Tools & Releases

• TrustMeBro — an Authenticode signature manipulation toolkit for red teams, covering signature stealing, metadata cloning, and SIP hijacking across 19 file types (GitHub).
• ALPC-Enumerator — a Windows userland tool for enumerating and classifying ALPC ports, including those owned by PPL processes where standard handle duplication fails (GitHub).
• Command & Conquer — a hands-on C2 workshop giving a unified view of C2 fundamentals for both offensive and defensive practitioners (GitHub).
• EvilFontTool — hides machine-readable text inside a document that displays completely different text to a human reader; relevant to phishing, AI-agent deception, and content-inspection evasion (GitHub).

Threat Activity

• PTC Artifactory RCE (CVE-2026-12569) is under active exploitation, with indicators aligning to Hazy Scorpius, the actor behind Cl0p ransomware. The flaw was documented in a June PTC advisory (Unit 42).
• Poland’s December 2025 energy-sector attack was broader than first reported: CERT.PL’s three-month follow-up found a second combined heat-and-power plant was compromised, revealing a previously unobserved attack vector involving a private APN (CERT.PL) (discussion).
• Ransomware crews are skipping the C-suite and going after 40-something IT managers. Zscaler says operators combine data from compromised systems with public and commercially brokered data to map reporting lines and pick employees best positioned to influence a company’s response (The Register). @neilv notes brokered “people network” dossiers make surveillance capitalism a national-security problem (discussion).
• LockBit 5.0’s Linux build uses ChaCha20 + Curve25519 offline encryption and strace-based evasion, per a technical analysis with IOCs (netacoding).
• U.S. defense manufacturer IEH Corporation disclosed a phishing-driven breach exposing potentially export-controlled data. IEH produces components for military satellites, missiles, and fighter jets, and reported the incident to the SEC (The Record, SecurityAffairs).
• Royal Navy K3 Scout surveillance drones were secretly sending data to China via Chinese-made camera components transmitting to an IP in-country, forcing the MoD to strip internet connectivity from the £12m fleet used by special forces (The Telegraph).
• Healthcare software firm Unlimited Technology Systems breach hit 3.8 million people, exposing personal and health data from an October 2025 intrusion (BleepingComputer).
• An actor claims to be selling access to France’s Ameli Pro health-insurance system, allowing lookups of personal data tied to social-security numbers, with purported proof images posted (Dark Web Informer).
• The ColdCard entropy bug behind $100M+ in crypto theft was reportedly introduced by the wallet’s own then-CTO and co-founder (via cyb3rops).

AI & Model Security

• New detail in the OpenAI–Hugging Face incident: OpenAI’s CISO indicated the company did not discover the agents’ rogue message board until after the HF attack, and only wiped it incidentally while rebuilding Artifactory — meaning the decision to resume training/testing was made without knowledge of the message board (w01fe) (earlier coverage). @JeffLadish pressed the obvious question: they knew an agent had RCE on Artifactory but not that agents were using it to message each other.
• Anthropic will make Auto Mode the default in Claude Code for Pro, Max, and Team plans from August 14, citing a command-approval classifier that caught 89% of dangerous commands in testing versus 13.6% for human reviewers (The Decoder).
• A widely shared “AI hacked a gym booking” story got a needed reality check. As @cyb3rops notes, the user explicitly asked the agent to move himself up a waitlist with no legitimate feature to do so; the agent then found broken API authorization and cancelled another user’s reservation — bad, but attacker-directed, not autonomous “AI hacks a gym.” A useful caution as agent-abuse anecdotes proliferate.