Netsec
@RNetsec
7.86K subscribers
23.5K links
This channel posts the feed from r/netsec.
For any suggestions dm @streaak
Donate to keep the bot running https://www.paypal.me/akhilgv
Download Telegram
About
Blog
Apps
Platform
Join
Netsec
7.86K subscribers
Netsec
Unauthenticated remote uninstall in my own EDR agent, and the four other auth bugs that turned out to be the same bug
https://d3vhex.github.io/2026-08-25-unauthenticated-remote-uninstall/

Submitted 2026-08-25T19:26:25Z by RevolutionaryPie4948
via reddit https://ift.tt/HkE01nL
Oğuz
Unauthenticated remote uninstall in my own EDR agent, and the four other auth bugs that turned out to be the same bug
A postmortem on my own EDR: no auth on self-destruct, permissive agent keys, forged automation results, LDAP injection, and 8 routes with no authorization check.
565 views
Netsec
Ruby Marshal Kick-off Gadgets - elttam
https://ift.tt/p7CsYTS

Submitted 2026-08-26T06:06:26Z by AnimalStrange
via reddit https://ift.tt/R1LDOEp
Elttam
Ruby Marshal Kick-off Gadgets - elttam
This post surveys everything Marshal.load calls on its own, on Ruby 4.0.6, and finds six kick-off gadgets, hash, eql?, <=>, to_str, to_s and respond_to?, that were never written for deserialisation and can't be hardened away like marshal_load.
537 views
Netsec
How Arena.ai can potentially leak your PII
https://ift.tt/WO2mNvX

Submitted 2026-08-26T06:51:50Z by Top_Dinner_9121
via reddit https://ift.tt/bkut1Hq
Cjeremy
Arena PII Exfiltration: The agent who leaks your data · CJeremy
Well, this sounds awkward.
480 views
Netsec
☢️ Philippine Nuclear Agency and Naval Contractor Targeted by Suspected Chinese-Speaking Operator
https://ift.tt/65TJSm9

Submitted 2026-08-26T13:59:47Z by Straight-Practice-99
via reddit https://ift.tt/f5aDA7r
hunt.io
Philippine Nuclear Agency and Naval Contractor Targeted by Suspected Chinese-Speaking Operator Using Known Vulnerabilities
An exposed staging server reveals ownCloud pre-signed URL abuse against a Philippine nuclear agency and exploitation of a naval contractor's WordPress website.
482 views
Netsec
Chaining three public V8 bugs to escape the V8 sandbox and recover a real Google v8CTF flag
https://ift.tt/eFZrqPc

Submitted 2026-08-26T15:09:44Z by unknownhad
via reddit https://ift.tt/0PMCnYm
Himanshu Anand :: Security & Other Notes
I had some free time, so I tried to pwn V8
How I chained three public V8 bugs against Google's v8CTF, escaped the V8 sandbox, printed a real flag, and still received no bounty.
450 views
Netsec
Minimus is shutting down after raising $51M, Twistlock founders returning cash to investors
https://ift.tt/NUSxyHj

Submitted 2026-08-26T17:55:39Z by DakPrescottQBDraw
via reddit https://ift.tt/7oV1rSB
ctech
After raising $51 million, Minimus shuts down as Twistlock founders return remaining cash to investors
The cybersecurity startup failed to gain enough commercial momentum to continue operating. Customers will have 60 days to migrate before the company's registry is switched off. 
489 views
Netsec
PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure
https://ift.tt/i2Bc59t

Submitted 2026-08-26T18:50:56Z by acronis
via reddit https://ift.tt/ALowWvy
Acronis
PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure
Acronis Threat Research Unit (TRU) has identified an ongoing campaign delivering a previously undocumented custom backdoor against Afghan telecom providers and South Asian critical infrastructure organizations. The backdoor, tracked as PATCHCORD, is a compiled…
481 views
Netsec
LLM-Driven Reverse Engineering vs Iterative LLM Obfuscation
https://ift.tt/mhjQyWV

Submitted 2026-08-27T15:21:53Z by AvenueJay
via reddit https://ift.tt/SOfXlHb
www.elastic.co
The Cost of Understanding: LLM-Driven Reverse Engineering vs Iterative LLM Obfuscation
Elastic Security Labs explores the ongoing arms race between LLM-driven reverse engineering and obfuscation.
502 views
Netsec
A fake resume invoked China’s defence tech elite, then installed VShell
https://ift.tt/tFvIMur

Submitted 2026-08-27T15:43:21Z by unknownhad
via reddit https://ift.tt/uX4N1L6
Himanshu Anand :: Security & Other Notes
a fake resume invoked China's defence-tech elite, then installed VShell
A fake resume claimed an applicant from one of China's Seven Sons of National Defence, then delivered a Go loader, SNOWLIGHT and a 4.65 MB fileless VShell payload.
510 views
Netsec
UniBLEed: Unauthenticated Root RCE on Any Unitree G1 Humanoid Robot Within Bluetooth Range
https://ift.tt/0rpcB8Z

Submitted 2026-08-27T20:44:41Z by WiseTuna
via reddit https://ift.tt/tRI2JFf
Boschko Security Blog
UniBLEed: Unauthenticated Root RCE on Any Unitree G1 Humanoid Robot Within Bluetooth Range
Root on a $20,000 humanoid robot from Bluetooth range. One chain crossing Bluetooth, Unitree’s cloud, mobile, and the firmware running the G1 itself. Here’s the complete technical breakdown of the $6,700 bounty and two CVEs it produced: CVE-2026-76639 / CVE…
593 views
Netsec
One Resident Login, an Entire Apartment Complex: The Master PIN in Rently's API (CVE-2026-75960)
https://ift.tt/gDIABjt

Submitted 2026-08-28T09:12:16Z by starsstripesfreedom
via reddit https://ift.tt/uYR7Fkj
Planck Proof
One Resident Login, an Entire Apartment Complex: The Master PIN in Rently's API (CVE-2026-75960)
The app showed two codes. The API returned all of them, master PIN included. The Planck Proof team's coordinated disclosure of CVE-2026-75960.
553 views
Netsec
Slack will not patch this: one link opens a debugging port in the desktop app
https://ift.tt/TLHcIYm

Submitted 2026-08-28T10:04:02Z by trustsigRobert
via reddit https://ift.tt/ajZRG7r
trustsig.eu
Slack will not patch this: one link opens a debugging port in the desktop app
A link containing devEnv=dev1 makes the Slack desktop client relaunch itself into developer mode with --remote-debugging-port=8315. Anything that reaches that port drives the app. Slack's security team calls it not a security risk.
574 views
Netsec
AI Agent Authentication in 2026: Web Bot Auth, ARD & OAuth
https://ift.tt/NXKnoQ8

Submitted 2026-08-30T15:10:36Z by cport1
via reddit https://ift.tt/4ZG2zWs
WebDecoy
AI Agent Authentication in 2026: Web Bot Auth, ARD & OAuth
How Web Bot Auth, ARD, OAuth, and workload identity fit together to authenticate AI agents, preserve user delegation, and create auditable access.
591 views
Netsec
Anatomy of a ServiceNow Red Team
https://ift.tt/qYZROTG

Submitted 2026-08-30T16:46:45Z by gid0rah
via reddit https://ift.tt/WsjbdYE
MDSec
When it Snows it Pours - Anatomy of a ServiceNow Red Team - MDSec
Introduction What if I told you six thousand of your employees were two steps removed from gaining full control over your IT infrastructure. If we told you this was related...
597 views
Netsec
Privilege escalation from IIS AppPool to NT Authority/SYSTEM via AD CS RPC endpoint
https://ift.tt/JgfehrS

Submitted 2026-08-31T07:40:42Z by 1046ica
via reddit https://ift.tt/gjdM23w
www.mannulinux.org
Privilege escalation from IIS AppPool to NT Authority/SYSTEM via AD CS RPC endpoint
Learn Basic Concepts of Linux. Best site to learn Linux from beginner to Advanced.
517 views
Netsec
Don’t Let Abliteration Abliterate Your Bug Hunting: Discovering Verdict Bias in Uncensored Models
https://clearbluejar.github.io/posts/does-abliteration-skew-your-bug-hunting/

Submitted 2026-09-01T05:08:07Z by onlinereadme
via reddit https://ift.tt/ygTvz2e
clearbluejar
Don’t Let Abliteration Abliterate Your Bug Hunting: Discovering Verdict Bias in Uncensored Models
Abliterated models never refuse, which makes them tempting for bug hunting. But on the same kernel source, they graduate three to four times as many findings to VALID, including false positives the base correctly rejects, and across a 28-file scan of FreeBSD’s…
448 views
Netsec
GeoNetwork - Pre-Auth RCE via Unauthenticated File Upload and Unsafe XSLT Processor (4 CVEs, 121 government deployments, all patched)
https://ift.tt/hEAWIg4

Submitted 2026-09-01T09:29:24Z by ZealousidealHunter80
via reddit https://ift.tt/cLrHQxJ
Ethiack
GeoNetwork - PreAuth Remote Code Execution | Ethiack — Autonomous Ethical Hacking for continuous security
How a missing @PreAuthorize line in GeoNetwork led to unauthenticated Remote Code Execution across government geospatial infrastructure in 39 countries.
474 views
Netsec
Authentication bypass in EOL Proxmox VE 7 release
https://ift.tt/aZcbB5P

Submitted 2026-09-01T12:25:06Z by WiuEmPe
via reddit https://ift.tt/0nzUdJw
Proxmox Support Forum
Proxmox Virtual Environment - Security Advisories
Subject: PSA-2026-00037-1: SCTPhantom Local Privilege Escalation issue

Advisory date: 2026-08-10

Packages: proxmox-kernel-*

Details:

A use-after-free issue in the Linux kernels SCTP code...
417 views
Netsec
Off the Hook: Discovering and Observing Active Exploitation of Sangoma Switchvox CVE-2026-9586
https://ift.tt/aUCQNxg

Submitted 2026-09-01T12:28:03Z by scopedsecurity
via reddit https://ift.tt/s9GdHog
Horizon3
CVE-2026-9586: Sangoma Switchvox RCE
Horizon3 researchers detail CVE-2026-9586, a critical Switchvox SQL injection leading to RCE, with active exploitation observed in the wild.
461 views
Netsec
r/netsec monthly discussion & tool thread
Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.Rules & GuidelinesAlways maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.Avoid use of memes. If you have something to say, say it with real words.All discussions and questions should directly relate to netsec.No tech support is to be requested or provided on r/netsec.As always, the content & discussion guidelines should also be observed on r/netsec.FeedbackFeedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.

Submitted 2026-09-01T13:29:15Z by albinowax
via reddit https://ift.tt/4WBL89j
Reddit
From the netsec community on Reddit
Explore this post and more from the netsec community
567 views
Netsec
From Patch to Exploit; Using Claude Code to reverse engineer an n-day in Papercut NG
https://ift.tt/ZkBITpJ

Submitted 2026-09-01T14:39:16Z by kev-thehermit
via reddit https://ift.tt/j4yfFe7
566 views