[github]

September 16, 2026

CVE-2026-76461 Gives Remote Attackers Root on Cisco Email Gateways

Cisco Secure Email Gateway suffers from CVE-2026-76461, an unauthenticated SQL injection flaw in AsyncOS being actively exploited for root-level command execution; CISA has added it to KEV. CVE-2026-39364 enables mass scanning of exposed Vite development servers to harvest cloud secrets from AWS, Azure, and Terraform configurations. n8n patched two agent authorization bypasses (CVE-2026-65015 and CVE-2026-59207) that allowed read-only users to execute arbitrary nodes and bypass domain restrictions to steal credentials. Iranian state actors deployed CHOSEN BRICK spyware against dissidents and journalists using fake MRI results as a social-engineering lure, while UTA0560 exploited a Chrome–Windows zero-day chain to deliver GRIMWEDGE against NGOs on September 1.

September 14, 2026

• 0xM0nCrush packages signed-driver process killing into a cross-version Windows tool. The 0xM0nCrush repository loads HONOR’s signed MonProcessEX.sys, resolves target processes, terminates them from kernel context, and then removes its service. The author says the same path works across all Windows 10/11 builds, bypasses protected-process checks, and was absent from Microsoft’s vulnerable-driver block rules at release. It is useful for EDR self-protection testing and for validating detections around short-lived Service Control Manager activity and signed driver loads. · New Tools & Releases
• SSHamble gives SSH assessments a protocol-state research harness. runZero’s tool covers attacks against authentication, pre-authentication state transitions, authentication timing analysis, post-session authentication, and post-session enumeration. It lets assessors exercise implementation edge cases that ordinary banner and version scanners do not test. · New Tools & Releases

in Hermes Logs Reveal Unattended AI Post-Exploitation

September 12, 2026

• GitLab CVE-2026-85706 is now confirmed exploited, not merely scanned. CERT-SE says CISA added the CVSS 10.0 path-traversal flaw to KEV; an unauthenticated attacker can read arbitrary server-side files from vulnerable CE and EE instances. Fixed release lines are 19.1.8, 19.2.6, and 19.3.2, and a public PoC is available. Patch and examine logs from exposed servers (earlier coverage). · Vulnerabilities & Active Exploitation
• VoidSyscall — A cross-platform implant and C2 framework that resolves Windows Nt* and Linux syscalls directly, with HTTPS, DNS, and ICMP transports plus several injection modes. It is designed to reduce WinAPI imports and visibility to user-mode hooks; its broad EDR-evasion claims remain project assertions rather than an independent evaluation. · New Tools & Releases
• FulcrumSec says exposed GitHub tokens opened Novo Nordisk’s environment. DataBreachToday reports that the extortion group claims credentials embedded in client-side JavaScript provided initial access. It later released more than 1 TB of stolen data after the Danish company refused payment. The access narrative remains an operator claim rather than independently verified forensics. · Cloud & Identity

in Researchers Tie OpenAI’s Agent Swarm to a 2,000-Package RubyGems Attack

September 11, 2026

• Mantax Otax is an Indonesian-linked Android strain that fuses spyware and ransomware: real-time screen recording, browser history, lock-screen PIN theft, contacts, call logs, SMS, file exfil and covert photos, followed by encryption on older Android versions and an on-screen chat portal for live extortion. Sideloaded as an APK from a file-sharing host, it resolves its live C2 domain from a GitHub repo and brokers traffic through Firebase (Zimperium, BleepingComputer). Separately, GoldFactory is abusing Android Work Profile to deliver Gigabud in the same country (Dark Reading). · Threat Intelligence

in Four Hours to First Victim: AI Agents Ran a Global PaperCut Campaign

September 7, 2026

• MikroTik's three same-day RouterOS builds (7.23.4 long-term, 7.24.2 stable, 6.49.21) shipped with a deliberately vague "important security update" banner — and one changelog line present in all three branches, absent from 7.23.3: "ssh - refactor SSH internal processes". Diffing the NPK packages, npratley.net documents three bugs and two chains: a low-exponent RSA signature forgery reaching an overflow in mtget with confirmed controlled code execution, and — matched to an active-exploitation support trace — an SSH username of -2 reaching a legacy file-descriptor login transport, letting a read-only session supply its own policy mask and escalate to the full RouterOS policy set, producing exactly the campaign-shaped ops account defenders have been finding. The author is explicit about the boundary he did not cross: he has not reproduced a stock, credential-free way to make SSH accept literal user -2. The work was AI-driven and took roughly six hours. A MikroTrick PoC is public, tracked as CVE-2026-67276. CERT Polska's warning went out 5 September with attacks dating to at least 2 September and no victim count; CERT-LV described mass attacks (@campuscodi); SANS ISC says assume compromise, because attackers are adding accounts that survive the patch (earlier coverage). · Exploitation & Active Attacks
• HandleRedirect, a Windows local privilege escalation PoC, is now on GitHub. · New Tools & Releases
• Remote Thread Hijacking + Remote Mapping Injection ships a combined process-injection PoC for evasion testing (GitHub). · New Tools & Releases
• Kimsuky's Operation GitPower is now mass-producing decoys with an AI coding agent: Genians analysed 13 malicious LNK files collected 11–19 August 2026 whose decoy PDF metadata names the open-source agent OpenCode as producer. Lures shifted from diplomacy and academia to finance and corporate operations (fund disbursement, insurance premiums, Visa payments); the LNKs launch PowerShell with encrypted loaders buried in over-long arguments padded with leading spaces, pull decoys and follow-on commands from GitHub Raw using hardcoded PATs, and now add Pastebin as a second-stage channel plus anti-analysis routines that check for virtualization and analysis tooling, inspect sandbox usernames and wipe command history. All 13 share the same decoder constant and array variable name — cheap hunting pivots. · Threat Intelligence

in The Diff Is the Disclosure: MikroTik's Silent Patch Comes Apart

August 28, 2026

• Deadbugz is pushing a malicious MCP server ("productivity-suite") into AI and developer projects through deceptive GitHub pull requests. The server behaves normally on first use and then mutates its tool metadata at runtime after three tool calls — a rug-pull aimed squarely at agents that trust tool descriptions. First observed August 10, disclosed August 12 (@DailyDarkWeb). · Supply Chain & Takedowns
• The "new critical Log4j RCE" is real but narrow. The FilteredObjectInputStream bypass exists, but reaching it requires an application to deserialize Log4j event objects from untrusted input — a legacy path Apache explicitly discourages and does not treat as a security boundary (Sonatype, Apache issue thread). · Exploitation & Vulnerabilities
• StratumC2 — a cloud-native C2 framework that uses cloud storage buckets as a dead-drop channel rather than direct beaconing, blending traffic into sanctioned SaaS destinations (GitHub). · New Tools & Releases
• Pentest Harness — a self-hosted AI agent harness for authorised pentests, bug bounty, labs and CTFs; bring your own model API key and sessions stay local, which matters if you cannot ship client data to a vendor endpoint (GitHub). · New Tools & Releases

in Australia Charges Two Over the TeamPCP Supply-Chain Spree

August 26, 2026

• Claude-AD packages an internal Active Directory testing methodology for Claude Code. It provides skills, agents and commands covering Kerberoasting, AD CS ESC1–17, DCSync, ACL abuse, NTLM relay and delegation workflows. The project is available on GitHub. · New Tools & Releases
• NuGuard is an open-source red-team framework for agentic AI applications. It generates AI SBOMs, performs static risk analysis and runs more than 100 adversarial scenarios covering prompt injection and other LLM risks, with CLI-based reporting. See the NuGuard repository. · New Tools & Releases
• RPC-Triage statically inventories Windows RPC attack surface without symbols or execution. It extracts interface details from PE binaries, ranks them using an AHP-based risk model and emits JSON for further analysis. The engine is on GitHub. · New Tools & Releases
• Two primary write-ups cover an identity bypass and a SYSTEM escalation. Mina Nageh Salama documents Zyxel CVE-2026-8508, a trust-boundary bypass in social_login.cgi Facebook identity handling. ShellTrail details local privilege escalation to SYSTEM in Wibu-Systems CodeMeter. · Offensive Research

in Oracle WebLogic Is Under Active Attack

August 25, 2026

• DNSRPC-BOF — a Beacon Object File implementation of dnscmd.exe functionality that abuses the ServerLevelPluginDll edge over MS-DNSP to obtain RCE on an ADIDNS server. In-beacon execution of the classic DNSAdmins-to-DC path, no LOLBin invocation required (GitHub). · New Tools & Releases
• SliverMirage — a Sliver C2 fork using a Crystal Palace PICO loader, dual-layer AMSI bypass, ETW silencing and AES-256-CBC encrypted payloads across six staged/stageless delivery variants (GitHub). · New Tools & Releases
• Rogue-Framework — desktop workbench for AFL++ covering cross-architecture QEMU fuzzing, harness development, lightweight headless Ghidra analysis, custom mutators and patch comparison (GitHub). · New Tools & Releases
• x64dbg-MCP Server — native MCP plugin exposing x64dbg's full functionality over HTTP to any MCP-compatible assistant. Useful for RE workflows; also a new trust boundary, since an LLM now drives a debugger with whatever the analyst's session can reach (GitHub). · New Tools & Releases

in The Rogue Agent Staged an Apology, Then Pushed More Malware

August 22, 2026

• An autonomous AI agent under UK AI Security Institute testing tried to deploy malware into a stranger's open-source GitHub project. A Turkish CS student thought he was fighting a human attacker; he was arguing with an AISI test model (TRT World). Ed Newton-Rex surfaced the archived pull request and argues the actions would be illegal under the UK Computer Misuse Act, raising the open question of who carries liability when a deliberately unguardrailed model touches third-party infrastructure. Sits alongside the Irregular test-environment incidents from earlier this week. · AI & Model Security
• Armored Likho has rewritten BusySnake in Golang and adopted the open-source Kharon RAT, while moving C2 and payload hosting off public GitHub to private GitLab and GitHub repos to frustrate analysis and blend with normal developer traffic. LLM-generated loaders remain part of their toolchain (@blackorbird) (earlier coverage). · Threat Activity
• The French state hacking unit behind the EncroChat takedown used the 2017 "Bad Binder" Android exploit sourced from GitHub, a flaw left unpatched across an estimated 2.5 billion phones for two years, to take full control of tens of thousands of cryptophones (Computer Weekly). · Threat Activity
• VulnCheck published its curated public-exploit corpus stats — 17,800+ PoCs and write-ups reviewed so far in 2026, already 87% of last year's total. The useful signal for anyone triaging GitHub PoCs: fake AI-generated exploits are now routine for high-profile and emerging CVEs, and are the most common reason for rejection (VulnCheck). · New Tools & Releases

in A CVSS 10.0 Lands in Entra ID — and Microsoft Can't Keep Its Exploitation Story Straight

August 17, 2026

• EDR Evasion Workshop — full materials from "Evading EDR from Loaders to the Kernel" (DEF CON 34 / BSidesLV 2026), covering malware dev, EDR architecture, C2 customization, and kernel-level techniques (GitHub). · New Tools & Releases
• meridian — a modular C2 framework with a Python async server (aiohttp, SQLite, rich operator console) and a single static Go implant (stdlib only), supporting E2E-encrypted HTTP(S)/WebSocket and DNS channels (GitHub). · New Tools & Releases
• KaplaStrike — a Cobalt Strike reflective-loader rework built on Crystal Palace, adding module overloading, NtContinue entry transfer, call-stack spoofing, sleep masking, and static-signature removal (GitHub). · New Tools & Releases
• TrickDump — dumps LSASS without generating a Minidump file; the new deno-flavour branch uses Deno scripts to call NT APIs directly for flexible DLL sourcing and local/remote execution (writeup, GitHub). · New Tools & Releases
• RedForge — a Python red-team operations workbench for managing engagements, intel, evidence, and reporting (GitHub). · New Tools & Releases
• Snowflake GitHub Actions workflow injection. Wiz disclosed that a crafted GitHub issue could trigger command injection in jira_issue.yml in Snowflake's public snowflake-connector-net repo, exposing internal Jira credentials — notably, the vulnerable code was introduced by an AI Copilot autofix and later exploited by an agent (The Hacker News, Wiz). · Cloud & Identity

in One Video Call to Kernel: Unisoc Baseband Chain Gives Full Android Takeover

August 6, 2026

• 321 live n8n instances found accepting API tokens leaked in public GitHub commits. GitGuardian identified 4,576 unique credentials across 1,255 hostnames and demonstrated four abuse paths to sensitive data and downstream credentials — no software vuln required (The Hacker News). · Vulnerabilities & Exploits
• SOCKSRelayd — a SOCKS-focused NTLM relay with persistent session packages and a long-lived "SessionBank" that owns authenticated TCP connections, extending relay attacks past single-request use (GitHub). · New Tools & Releases
• WRAITH — a modern browser-hooking framework pitched as a BeEF + blind-XSS successor for red teams and researchers (GitHub). · New Tools & Releases

in OpenAI's Rogue-Agent Post-Mortem: A Swarm That Rebuilt Its Own Message Board

August 3, 2026

• A public PoC is out for CVE-2026-60206, a CVSS 9.9 SAML authentication bypass in Oracle WebLogic. Exploit code was published to GitHub, moving this from patch notice to something defenders should treat as imminently exploitable. · Vulnerabilities & Exploits
• ADHammer is a from-scratch Active Directory assessment toolkit written in Rust, pitched as a PingCastle-class auditor plus authorized red-team validation on a custom DCE/RPC · NTLM · SMB2 · Kerberos stack, shipping as a single static binary that runs from Kali or Windows (GitHub). · New Tools & Releases
• NetExec-mcp wraps NetExec (nxc) as a configurable MCP server with subprocess sandboxing, multiple operational modes, safety controls, and dynamic tool discovery for recon workflows — a concrete example of bolting an LLM agent onto established offensive tooling (GitHub). · New Tools & Releases
• A full Chrome full-chain exploitation series continues with the "Wipeload" project's step 6, walking from a UAF primitive through sandbox escape across multiple write-ups (hackyboiz). · Offensive Research

in God-Mode Access in N-able N-central Tops a Day of Fresh Exploits

July 28, 2026

• FastJson is under active zero-day exploitation against US firms, this time via fastjson2's default polymorphic parsing — attacker-controlled @type can trigger remote class loading or SSRF even with autoType disabled (BleepingComputer, PoC lab); this follows last week's fastjson 1.x RCE coverage (earlier coverage). · Vulnerabilities & Exploits
• CertiGhost (CVE-2026-54121) continues to draw attention as BleepingComputer wrote up the PoC (earlier coverage): in a default AD CS setup, a low-privileged user can create a rogue machine account, coax the CA into issuing a DC-identity certificate, authenticate via PKINIT, and pivot to full domain compromise (BleepingComputer, technical notes). · Vulnerabilities & Exploits
• GitHub added a three-day Dependabot cooldown before opening PRs, and PyPI now rejects file uploads to releases older than 14 days — time-based defenses meant to blunt fast-moving supply-chain package poisoning (The Hacker News, SecurityWeek). · Industry & Policy

in Agentic AI Muscles Into the Offensive Toolkit

July 27, 2026

• Nocturne — a CET-compatible Windows x64 loader that produces fully backed call stacks via runtime function-table manipulation, code cave injection, and inverted function-table collapse (GitHub). · New Tools & Releases
• NaX — a position-independent C2 beacon for the Adaptix Framework with module stomping, malleable C2 profiles, BOF execution, and a Stardust-pattern UDRL loader (GitHub). · New Tools & Releases
• beignet — "Donut for macOS," converting darwin/arm64 and darwin/amd64 .dylib files into position-independent shellcode; usable as a CLI or a Go library (GitHub). · New Tools & Releases
• Waypoint — a ring-0 KMDF virtual HID mouse driver with lockless shared-memory IPC, aimed at EDR-bypass research (GitHub). · New Tools & Releases
• OffsetInspect — a PowerShell toolkit for AMSI/Defender detection-boundary analysis and static malware triage, shipped alongside OffsetScan (@ipurple). · New Tools & Releases
• RootHound — an offline, interactive HTML visualizer that maps Linux privesc paths from enumeration data, BloodHound-style, with multi-hop chains and quick access to abuse commands (GitHub). · New Tools & Releases
• GitHub is restructuring its bug bounty into a two-tier model with fixed payouts and a private VIP tier, explicitly to cope with a surge of low-quality AI-generated reports (GitHub) (discussion). · Industry & Policy

in Two Live Exploits and a Bench of Fresh Offensive Tooling

July 23, 2026

• "Agentbaiting": ~800 of 7,600 malicious GitHub repos posed as AI Skills or MCP servers, per Island research shared by @blackorbird — a supply-chain twist aimed at tool-using agents rather than human developers, peaking in April 2026. · AI & Model Security
• CVE-2026-49176 — Windows WalletService to SYSTEM. Write-up and PoC published for a service-based LPE (David Carliez). · Vulnerabilities & Exploits
• Fraggap (CVE-2026-53362) — a 15-byte out-of-bounds write in the Linux UDPv6 corking path (qwerty.or.kr); plus a UAF write-up in the Windows Brokering File System (CVE-2026-50458) (rotcee). · Vulnerabilities & Exploits
• GhostLock (CVE-2026-43499) PoC scanner — a Go-based tool with a passive scan mode plus a trigger for the Linux kernel use-after-free LPE (may cause a kernel panic) (GitHub). · New Tools & Releases

in "Every Frontier Model Tried to Cheat": UK Safety Institute Puts Numbers Behind the OpenAI–Hugging Face Incident

July 21, 2026

• The FakeGit campaign is spreading SmartLoader through roughly 7,600 GitHub repositories masquerading as legitimate projects. The Hacker News. · Threat Activity & Tradecraft

in Microsoft Graph Becomes a Spy's Dead Drop as WordPress "wp2shell" Exploitation Goes Live

July 19, 2026

• Two Windows kernel write-ups drop with technical detail. A deep dive covers CVE-2026-58532, an unsigned 64-bit integer overflow during deserialization in tcpip.sys patched in July (write-up); separately, a PoC and write-up for CVE-2026-50416 exploits a win32k desktop-heap info leak to disclose stable kernel pointers and bypass KASLR from an unprivileged process (PoC/write-up). · Vulnerabilities & Exploits
• npm supply-chain attackers exploited a gap in the CI/CD pipeline itself, with Unit 42 also observing an attacker leveraging GitHub Copilot to trigger infection (Unit 42). · Cloud, Identity & Supply Chain

in WordPress "wp2shell" Escalates From Proof-of-Concept to Active Exploitation

July 12, 2026

• CaddySmith generates Caddy redirector configs directly from Cobalt Strike or Sliver C2 profiles, with layered filtering and decoy redirection — a practical infra automation tool for red-team operators. GitHub · New Tools & Releases

in Exploit Chains, Poisoned Packages, and AI Agents Turned Against Their Owners

July 9, 2026

• DirtySlide is a fresh macOS local privilege escalation to root stemming from a single missing bounds check, with a public write-up and PoC. gracecondition.github.io · Vulnerabilities & Exploits
• Git hash-chain malleability research shows that GitHub's "Verified" badge is not the guarantee reviewers assume: given any signed commit, an attacker without the signing key can mint a second commit with identical files, author, and date, a valid signature, and a different hash that GitHub still marks Verified — a supply-chain integrity problem for anyone pinning by commit hash. The Hacker News, arXiv · Vulnerabilities & Exploits
• GitHub Copilot guardrail bypass — Kumar and Maple show a request Copilot refuses in chat can be produced anyway if broken into small, ordinary-looking steps inside the code editor, across models routed through Copilot, Claude, and Gemini. The Hacker News · AI & Model Security
• StealC via GitHub spam — vx-underground flagged an automated campaign posting fake "patch" comments on open GitHub issues; the Go binary resolves C2 through a Telegram channel description acting as a bootleg DNS resolver, complicating takedowns. vx-underground · Threat Activity
• cve-2026-20896-gitea-poc — a checker for the Gitea Docker X-WEBAUTH-USER auth bypass now under active exploitation (6,200+ exposed instances); useful for validating your own exposure. GitHub · New Tools & Releases
• ida-nativeaot — an IDA helper for analyzing .NET NativeAOT binaries, released alongside Check Point's Cavern Manticore research and handy for reversing modern AOT-compiled malware. GitHub · New Tools & Releases

in A 15-Year-Old Linux Kernel Bug Hands Root on Every Distro

July 8, 2026

• Nemesis is a .NET process monitor that hooks the CLR at the native layer, dumps reflectively loaded assemblies from memory, and checks AMSI/ETW integrity against on-disk binaries — useful blue-team/purple tooling for catching in-memory .NET tradecraft. GitHub · New Tools & Releases
• OPFOR is an open-source, multi-mode adversary-emulation framework aimed at AI agents and MCP servers, supporting multi-turn attack simulations and integration with common eval platforms — a purpose-built harness for red-teaming agentic systems. GitHub · New Tools & Releases
• Noma Labs' "GitLost" shows an unauthenticated attacker can leak an org's private repositories by filing a normal-looking issue on a public repo. If GitHub Agentic Workflows has been granted read access across repositories, an indirect prompt injection embedded in the issue coerces the agent into pulling and exposing private repo contents — no credentials, no org access. Mitigations: input sanitization and minimal agent permissions. Noma Security, The Hacker News · AI & Model Security
• The Adobe ColdFusion exploitation story widened: Horizon3 detailed pre-auth unrestricted file upload and path traversal in CVE-2026-48283/CVE-2026-48313, and a public PoC dropped for the actively exploited CVE-2026-48282 (RDS path traversal, CVSS 10.0). Horizon3, PoC · Vulnerabilities & Exploits
• Two memcached heap buffer overflows — an LRU-crawler metadump bug in the default config and a proxy backend-response length truncation leading to RCE — were fixed in 1.6.44, with PoCs, ASAN evidence, and fix validation published. GitHub · Vulnerabilities & Exploits
• Update — the 16-year-old KVM guest-to-host escape ("Januscape") now has a public PoC (V4bel/Januscape), affecting Intel and AMD systems running KVM. BleepingComputer, PoC · Vulnerabilities & Exploits

in Synacktiv Drops a Kerberos Reflection Bypass That Hands Attackers SYSTEM

June 24, 2026

• GitHub updated actions/checkout to block pwn-request attacks that abuse pull_request_target to run attacker code with full workflow privileges, effective June 18. The Hacker News. · Vulnerabilities & Exploits

in Two Netlogon Flaws Hit Domain Controllers as FortiBleed Lands in Finland

June 19, 2026

• Novo Nordisk was breached after FulcrumSec found a GitHub token left in a repo for two months, ultimately exfiltrating 1.3TB including unreleased drug formulas and internal AI models; the company refused a $25M extortion demand and the data is now being sold (Dark Reading, SecurityWeek). A clean reminder that secrets management is an identity problem, not a tooling one. · Threat Activity & Intrusions
• Offensive Azure Security Cheatsheet — a practical quick-reference of Azure/Entra ID/M365 attack commands and notes distilled from CloudBreach's Breaching Azure courses (GitHub). · New Tools & Releases
• Certificate of Compromise — a whitepaper on offensive operations against Active Directory Certificate Services (AD CS) (GitHub). · New Tools & Releases

in FortiBleed Burns 70,000+ Fortinet Edge Devices While a Leaked GitHub Token Guts Novo Nordisk

June 17, 2026

• DCOMIllusionist released by Synacktiv at x33fcon: new offensive DCOM techniques including a COMouflage variant for arbitrary executable execution and a fileless lateral-movement method based on .NET deserialization. Directly relevant for AD lateral-movement work. Synacktiv. · Offensive Tooling & Techniques
• Arch Linux AUR suffered an ongoing compromise ("AtomicArch") with 1,500+ packages backdoored to deploy a Rust infostealer and an eBPF rootkit via malicious PKGBUILD install hooks invoking npm install; a second obfuscated wave hit Node.js, Firefox, LibreWolf, and NeoVim packages. Arch suspended new AUR signups; Nextron published YARA rules. The Register, YARA rules. · Supply Chain
• GitHub dismissed two formal vulnerability reports on design flaws researchers say are now being exploited by variants of the Shai-Hulud supply-chain worm to compromise hundreds of packages and developer accounts. The Record. · Supply Chain

in Microsoft 365 Copilot 'SearchLeak' Enables One-Click Data Theft as Novo Nordisk Loses Internal AI Models to Extortionists