🧑‍🚒 Our researcher Mikhail Sukhov shares his knowledge and experience in analyzing FreeIPA environments.

He also introduces his new tool, IPAHound 💪

Go ’n see the details ➡️ https://swarm.ptsecurity.com/thinking-in-graphs-with-ipahound/

ssh-keysign-pwn — CVE-2026-46333

A critical race condition flaw in pre-31e62c2ebbfd Linux kernels. Due to a window during process exit where the memory management structure is cleared before file descriptors are closed, an unprivileged user can use pidfd_getfd(2) to steal open file descriptors of privileged processes, enabling unauthorized reading of root-owned files.

🔗 Exploit:
https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn

🔗 Source:
https://blog.qualys.com/vulnerabilities-threat-research/2026/05/20/cve-2026-46333-local-root-privilege-escalation-and-credential-disclosure-in-the-linux-kernel-ptrace-path

#linux #kernel #privesc #racecondition #pidfd

DirtyClone — CVE-2026-43503

A Linux kernel local privilege escalation and page-cache write. DirtyClone is the fourth public member of the DirtyPipe / DirtyFrag family: it forces the kernel to run an in-place ESP (IPsec) decrypt over a file-backed page-cache page the attacker only has read access to, mutating that page in RAM. With the AES-CBC key/IV chosen so the decrypt writes attacker-controlled bytes, /usr/bin/su is rewritten with a tiny setuid(0)+execve("/bin/sh") ELF and invoking it yields root.

🔗 Research:
https://research.jfrog.com/post/dissecting-and-exploiting-linux-lpe-variant-dirtyclone-cve-2026-43503/

🔗 Exploit:
https://github.com/rafaeldtinoco/security/tree/main/exploits/dirtyclone

#linux #lpe #kernel #dirty

Pentest award 2026 ждет твою заявку!

Меньше двух недель остается чтобы отправить заявки на «хакерский оскар». Не упускайте шанс получить признание отрасли, классные призы и просто провести время на закрытой церемонии награждения вместе с лучшими представителями отрасли. Вручении состоится в зале на «Красном Октябре» с панорамной террасой с видом на набережную и город.

Чтобы подать заявку достаточно обезличенного рассказа про свой лучший проект в свободной форме.

Участие бесплатное. Больше информации на сайте — award.awillix.ru

🛠 Всем привет.
Выкатил небольшой “living off the land” для кред с не самым креативным названием LOLCreds - Living Off the Land Credentials.

Это каталог публичных кред по умолчанию и мест где они обитают.
Что-то для ответа на вопросы какие пароли идут статичными из коробки, генерятся на этапе установки, а какие задает сам пользователь, где в каких конфигах и переменных окружения они обычно хранятся и тому подобное.

Пока ранняя версия, но пользоваться можно.

Живет эта штука тут:
https://lolcreds.haxx.it

🔗 Где исходники, Билли?
https://github.com/haxxm0nkey/lolcreds-data

GhostLock — CVE-2026-43499

This is a Linux kernel vulnerability found by VEGA that exists in every major distribution since 2011. Triggering the bug does not require any special kernel config or privilege. By turning it into a 97% stable privilege escalation and container escape, Google has rewarded us $92,337 in kernelCTF. This writeup covers the technical details of the exploit.

🔗 Research:
https://nebusec.ai/research/ionstack-part-2/

🔗 Exploit:
https://github.com/NebuSec/CyberMeowfia/tree/main/IonStack/CVE-2026-43499

#linux #kernel #lpe #container #escape

💉 P³ — Shellcode Loader: Process Parameter Poisoning

This loader implements a code injection technique that leverages the Windows Process Parameters structure (PEB) as a staging and execution location for remote shellcode injection.

By passing payload data implicitly through standard parameters like CommandLine, Environment, or ShellInfo, it bypasses EDR detection because it doesn't touch heavily monitored APIs like VirtualAllocEx, WriteProcessMemory, or CreateRemoteThread. Since it runs without spawning suspended processes or relying on process hollowing, it leaves virtually no obvious footprint in the system.

🔗 Research:
https://sensepost.com/blog/2026/process-parameter-poisoning/

🔗 Source:
https://github.com/Orange-Cyberdefense/p3-loader/

#maldev #injection #edr #bypass #windows #peb

🔒 Certighost (CVE-2026-54121) — AD CS Domain Controller Impersonation

Low-privileged domain user can impersonate a Domain Controller via an AD CS enrollment chase fallback. By supplying cdc (Client DC) and rmd (Remote Domain) request attributes, an attacker forces the Enterprise CA to query an attacker-controlled host over SMB and LDAP.

The CA then blindly trusts the returned directory objects (objectSid + dNSHostName of a real DC) and issues a certificate containing strong identity mapping for the Domain Controller. This allows successful PKINIT authentication as the DC.

🔗 Research:
https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26

🔗 Source:
https://github.com/aniqfakhrul/CVE-2026-54121

#ad #adcs #pkinit #machineaccountquota

ResetNightmare

ResetNightmare (CVE-2026-27912) is a validation flaw in the Kerberos Change Password protocol that allows for resetting the password of any target user/computer account, without knowing the current one. The attack requires an unpatched domain controller, and the ability to write a userPrincipalName (UPN) on any account you control. Alternatively, the vulnerability can also be abused by an attacker having the ability to create new users/computers in any OU, as creating a user/computer allows you to get GenericWrite permissions over it.

Blog: Identity Crisis: Novel Vulnerabilities Leading to Kerberos Downgrade, DoS, and Full Domain Takeover