Toxssin – An XSS exploitation command line interface and payload generator 🫯

toxssin is an open source penetration testing tool that automates the process of exploiting Cross-Site Scripting (XSS) vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool (toxin.js) 🦠

GitHub 🌐

💎 @RootAccessClub

Claude Kit 🛡️

A powerful open-source toolkit for bug bounty hunters, built to improve vulnerability reporting with Claude Code 🤖

Write better reports. Validate findings. Avoid common mistakes ⚡

GitHub 🌐

@RootAccessClub ⭐️

SSRF ☄

payload:
[](http://metadata+url)

🌊 @RootAccessClub

🔹 pfSense Firewall 0day — 5 RCEs

▫️Exploit :

1⃣ Link

2⃣ Link

3⃣ Link

4⃣ Link

5⃣ Link


▪️Writeups :

1⃣ Link

2⃣ Link

3⃣ Link

4⃣ Link

5⃣ Link

⚠️ For educational and authorized security research purposes only

🆒 @RootAccessClub

Thanks fam 🫶
Massive thanks for the reactions and shares, Your support keeps this channel alive

CVE-2026-96889 – Next.js RCE 🫯

Nextjs

GitHub

GitHub

GitHub

⚡️@RootAccessClub

How to use Gemini CLI for Bug Bounty research: analyse evidence, validate manually 🫆

Read 📚

🪎 @RootAccessClub

CVE-2026-89079 – Theme My Login (WordPress multisite) 🧪

Security research tooling for CVE-2026-89079: unauthenticated account takeover on WordPress multisite when Theme My Login ≤ 7.2.1 has network option tml_user_passwords enabled 🧬

🟥 Affected : ≤ 7.2.1
🟩 Fixed : 7.2.2+
♨️ CVSS : 9.8 (Critical)

GitHub 🌐

🔰 @RootAccessClub

CVE-2025-29009 – WordPress Medical Prescription Attachment Plugin for WooCommerce Plugin ☢

Webkul Medical Prescription Attachment — Unrestricted File Upload → Web Shell

🔴 Affected : All versions ≤ 1.2.3

🆘 CVSS : 10

GitHub 🔗

🛡@RootAccessClub

🚀 Gmail Creator Pro v2.1 — Bulk Gmail Account Creator

Python tool with a slick terminal UI 🔥

✅ Anti-detection & random user agents
✅ Phone verification bypass + 5sim API
✅ Proxy rotation
✅ Live stats & auto-save to JSON
✅ Auto-retry on failure

⚙️ Windows • Python 3.8+ • Chrome

🔗 GitHub

⚠️ Educational use only — violates Google ToS.

📢 @RootAccessClub

❄️ SubZer0 – Noise in. Priority out

Thousands of new CVEs every month
Only a few actually matter — SubZer0 shows you which ones to patch first

🔴 KEV · EPSS · PoC · Metasploit · Nuclei — all in one view
🔐 SHA-256 verified · auto-refreshed every 6h
⚡️ Free · no sign-up · no tracking

🌐 iliya-bashrc.github.io/SubZer0
💻 github.com/iliya-bashrc/SubZer0

💎 @RootAccessClub × @BugCod3

Reposted because of some spam bots flooding the last one, Let's keep it real⁩ 🤠

drop your reactions and show some support again⁩ ❤️‍🔥

Detect PHP powered websites & IPs using the updated php-detect nuclei template 💥

GitHub 🌐

@RootAccessClub

PHP2Shell – Critical PHP Core RCE 🚨
CVE-2026-109618 / CVE-2026-109619 | CVSS 9.2 🫨

Two critical memory-safety flaws in PHP Core, reachable through session upload-progress handling, can lead to Remote Code Execution (RCE) on affected web servers 💣

Affected versions span PHP 5.4 → 8.5 🦠

🛡 Fix: Update PHP to the latest patched release for your branch (8.2+ officially supported)

Sansec Advisory 🔗

💎 @RootAccessClub

php2shell – CVE-2026-109618 / CVE-2026-109619 (PoC)

Two critical bugs in PHP core session upload progress mechanism causing a heap use-after-free (UAF) leading to arbitrary code execution (RCE)

• Severity: Critical (CVSS v4.0: 9.2) 🚨
• Impacted Versions: PHP 5, 6, 7, and 8. Official patches are only coming for active PHP 8 branches, leaving EOL versions (5.x, 7.x, 8.0, 8.1) completely exposed🛡

The repository explains how to fix and mitigate it using WAF (ModSecurity) rules and Apache .htaccess configurations to block malicious requests before they even reach PHP 🟢

Github 🌐

⚠️Disclaimer: Our channel is not responsible for any misuse of this information or tool

⭐️@RootAccessClub

🚨 PHP2Shell is live on SubZer0

📂 On the site: 30+ public PoCs (updated every 15 min), scanners, Nuclei templates and official advisories

🔗 https://iliya-bashrc.github.io/SubZer0/

⚠️ Run PoCs only in a test lab

#PHP2Shell #PHP #RCE

@RootAccessClub × @BugCod3

🔴 CVE-2026-115560 — unpatched RCE in PHP

⚡️ Two days after the emergency php2shell fixes (CVE-2026-109618 / 109619), another RCE path dropped. Still no patch

🧩 The bug: session serialize_handler mismatch
Write side uses php_serialize, read side switches to the legacy php handler. That handler splits the session file on the first "|", so an attacker-controlled key becomes a serialized value

💉 Injection: session.upload_progress
Send PHP_SESSION_UPLOAD_PROGRESS as inj|O:14:"Gadget":... and with cleanup=Off the poisoned key stays in the session file

💥 Result: unserialize → object → __destruct → file_put_contents → webshell → RCE as www-data
No LFI, no memory corruption, works on mod_php.

✅ Until the fix:
• session.upload_progress.enabled=0
• one handler for the whole app, never two
• treat "|" in session keys as invalid

🧪 GitHub

@RootAccessClub

SubZer0Robot is live ⚡

SubZer0 now lives inside Telegram 🤠

🚨 Early warnings — new exploitation waves, posted the moment they're detected

🔴 Fresh CISA KEV entries — actively exploited CVEs, automatically

📱 Mini App — the full CVE tracker, PoCs and dossiers right inside Telegram

🔄 Live layer refreshed every ~15 min · Ed25519-signed data

🤖 mini app

🔔 Alerts land

🌐 Web

by @BugCod3 & @RootAccessClub

Hey guys, quick heads up. I⁩’⁦ve been dealing with a brutal headache these past few days and it⁩’⁦s literally driving me crazy. If I⁩’⁦m not as active, that's why⁩ 🫩

⁦On the bright side, I managed to push a nice update to the bot, so it's fully up and running for you guys now. Catch you soon⁩ ❤️‍🔥

🚨 SubZer0 Alert · 4 new to patch now

CVE-2026-109619 — PHP has various global state that temporarily points into request memory.
public exploit, EPSS 100% · CVSS 9.2

CVE-2026-111497 — A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3…
public exploit, EPSS 33% · CVSS 9.2

CVE-2026-97229 — GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before…
public exploit, EPSS 18% · CVSS 10.0

CVE-2026-90970 — GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI…
public exploit, EPSS 17% · CVSS 9.9

🌐 SubZer0 · 📣 @RootAccessClub · 🤖 @SubZer0Robot