SubZer0Robot is live ⚡

SubZer0 now lives inside Telegram 🤠

🚨 Early warnings — new exploitation waves, posted the moment they're detected

🔴 Fresh CISA KEV entries — actively exploited CVEs, automatically

📱 Mini App — the full CVE tracker, PoCs and dossiers right inside Telegram

🔄 Live layer refreshed every ~15 min · Ed25519-signed data

🤖 mini app

🔔 Alerts land

🌐 Web

by @BugCod3 & @RootAccessClub

🔑 Clavis — JWT Attack Multitool

Stop juggling half a dozen scripts to test one token. Clavis runs the full JWT attack chain from a single binary — zero dependencies, works on Linux, macOS & Windows.

⚔️ What it does
• decode & audit — instantly flags weak configs
• crack weak HMAC secrets with a wordlist
• alg:none signature bypass
• RS256 → HS256 algorithm confusion
• kid header injection — path traversal / SQLi
• jwk & jku header injection — self-signed keys
• forge any token on the fly
• scan — extract JWTs from HAR files, logs & JS

⚡ Install
go install github.com/MRvirusIR/clavis/cmd/clavis@latest
(or grab a prebuilt binary from Releases)

🔗 Links
GitHub → https://github.com/MRvirusIR/clavis
Write-up → https://bugcod3.com/p/jwt-attack-playbook-weak-secret-to-account-takeover

Free & open source. Built for bug bounty. 🐛

#bugbounty #JWT #appsec #pentest #infosec #BugCod3

🚨 PHP2Shell — when the bug is in PHP itself

Not a plugin. Not a framework. The interpreter behind most of the web got hit with pre-auth RCE — and AI helped find it (WSJ & NYT covered it).

🧠 The two bugs
• CVE-2026-109618 — RCE via out-of-memory corruption
• CVE-2026-109619 — use-after-free via stale request state (session.upload_progress)
• CVSS 9.2 · no auth · fires before your app code even runs
• Highest risk on Apache mod_php — also FPM, php-cgi, FrankenPHP, LiteSpeed

🎯 The twist nobody mentions
Mass scanning was instant (millions of hits within a day). But a reliable, universal exploit is HARD — memory_limit, same-worker races, and ASLR all get in the way. We break down exactly why.

🛡 What to do
• Patch: PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 — the only real fix
• Affected from PHP 5.4.0 onward → on CISA KEV, exploited in the wild

📖 Full write-up — source-level breakdown + what it means for bug hunters:
bugcod3.com/p/php2shell-preauth-rce-cve-2026-109618-109619

🛠 open-sesame

An AI web-pentest skill for Claude Code. Point it at a site you're authorized to test — it maps the attack surface, works through the OWASP WSTG, validates findings, and writes…

git clone https://github.com/hassan-algo/open-sesame

⭐️ 96 · 🧬 HTML

🔗 GitHub
#Recon #WebSecurity #ActiveDirectory #Pentest

🤝 @RootAccessClub × @BugCod3

What do you think would be the right response?🤔

To submit your answer, visit the link below: https://bugcod3.com/quiz

Your X links are snitching on you.

https://x.com/BugCod3/status/2115837807537299777

SubZer0 just passed 2,700+ visits 🔥

When I started SubZer0, I just wanted a simple place to see which CVEs actually matter and what to patch first. Seeing people come back to it every day honestly means a lot to me. Thank you 🤍

Now I want to build the next part with you 🫵

What's missing? What would make SubZer0 more useful for YOU?
A feature, a page, a tool, a small fix, anything🤔

📩 Send your idea straight to this channel's Direct Messages

I read every message, and the good ideas will be built into the site, with credit to you if you want it 🙌

🌐 iliya-bashrc.github.io/SubZer0
⚡️ @RootAccessClub

⚡ THE ART OF RECONNAISSANCE

Every successful Bug Bounty hunt starts with one essential skill: Reconnaissance.

Finding vulnerabilities isn't always about having the most advanced tools. It's about understanding the target, discovering its attack surface, and knowing where to look.

We've published a new article covering:

🔹 Passive vs. Active Reconnaissance
🔹 Essential Recon Tools
🔹 Building an Effective Recon Workflow
🔹 Attack Surface Discovery
🔹 Common Recon Mistakes
🔹 The Future of Reconnaissance

Whether you're starting your Bug Bounty journey or looking to improve your methodology, this guide is worth exploring.

📖 Read the full article:
🔗 https://bugcod3.com/p/art-of-reconnaissance?utm_campaign=telegram

━━━━━━━━━━━━━━━━━━

BugCod3 — From Shadows To Shells.

🌐 https://bugcod3.com

OpenSSH flaw lets attackers log into password-disabled Linux accounts

📰 Reading:
https://bugcod3.com/news?tag=linux

Wraith is out: BugCod3's toolkit for the AI attack surface.

Your agent reads every MCP tool description with the same authority as your prompt.
Nobody reviews that text. One sentence is enough to make the model read ~/.aws/credentials and send it out. No exploit, no auth, no click.
What it finds:

⚡️ hidden instructions aimed at the model
⚡️ invisible unicode, decoded to plaintext
⚡️ credential paths and exfil sinks
⚡️ "read-only" tools that take a path
⚡️ lying annotations: readOnlyHint on a tool that deletes accounts
⚡️ definition drift after review

Evidence bundle + report with CVSS, CWE and a replayable curl.

Zero dependencies, MIT.

pipx install git+https://github.com/MRvirusIR/wraith
wraith demo

Full writeup: bugcod3.com/p/wraith
Repo: github.com/MRvirusIR/wraith

#BugBounty #MCP #AIAgents
━━━━━━━━━━━━━━━━━━

BugCod3 — From Shadows To Shells.

🌐 https://bugcod3.com

🚨 When a WordPress update becomes an attack window

What if the few seconds spent updating your website were enough to expose it to an attacker?

CVE-2026-119977 is a race condition in WordPress Core that can lead to unauthenticated remote code execution under specific conditions. CISA has confirmed active exploitation. [^https://www.cisa.gov/news-events/alerts/2026/11/03/cisa-adds-one-known-exploited-vulnerability-catalog]

In our latest BugCod3 write-up, we break down:

🔍 How the vulnerability works
🎯 What conditions an attacker needs
🛡 Which versions are patched and how to investigate suspicious activity
🧠 What bug bounty hunters can learn from this attack surface

📖 Read the full write-up:
https://bugcod3.com/p/wordpress-cve-2026-119977-update-rce

Know someone who manages a WordPress site? Share this with them.

#WordPress #CVE #BugBounty #CyberSecurity #RCE

━━━━━━━━━━━━━━━━━━

BugCod3 — From Shadows To Shells.

🌐 https://bugcod3.com

Most AI bug bounty reports fail for one reason:

They confuse a possible vulnerability with proven impact.

📰 Read:
https://x.com/BugCod3/status/2119473099640910296

🌐 BugCod3.com