Thanks fam 🫶
Massive thanks for the reactions and shares, Your support keeps this channel alive

CVE-2026-96889 – Next.js RCE 🫯

Nextjs

GitHub

GitHub

GitHub

⚡️@RootAccessClub

How to use Gemini CLI for Bug Bounty research: analyse evidence, validate manually 🫆

Read 📚

🪎 @RootAccessClub

CVE-2026-89079 – Theme My Login (WordPress multisite) 🧪

Security research tooling for CVE-2026-89079: unauthenticated account takeover on WordPress multisite when Theme My Login ≤ 7.2.1 has network option tml_user_passwords enabled 🧬

🟥 Affected : ≤ 7.2.1
🟩 Fixed : 7.2.2+
♨️ CVSS : 9.8 (Critical)

GitHub 🌐

🔰 @RootAccessClub

CVE-2025-29009 – WordPress Medical Prescription Attachment Plugin for WooCommerce Plugin ☢

Webkul Medical Prescription Attachment — Unrestricted File Upload → Web Shell

🔴 Affected : All versions ≤ 1.2.3

🆘 CVSS : 10

GitHub 🔗

🛡@RootAccessClub

🚀 Gmail Creator Pro v2.1 — Bulk Gmail Account Creator

Python tool with a slick terminal UI 🔥

✅ Anti-detection & random user agents
✅ Phone verification bypass + 5sim API
✅ Proxy rotation
✅ Live stats & auto-save to JSON
✅ Auto-retry on failure

⚙️ Windows • Python 3.8+ • Chrome

🔗 GitHub

⚠️ Educational use only — violates Google ToS.

📢 @RootAccessClub

❄️ SubZer0 – Noise in. Priority out

Thousands of new CVEs every month
Only a few actually matter — SubZer0 shows you which ones to patch first

🔴 KEV · EPSS · PoC · Metasploit · Nuclei — all in one view
🔐 SHA-256 verified · auto-refreshed every 6h
⚡️ Free · no sign-up · no tracking

🌐 iliya-bashrc.github.io/SubZer0
💻 github.com/iliya-bashrc/SubZer0

💎 @RootAccessClub × @BugCod3

Reposted because of some spam bots flooding the last one, Let's keep it real⁩ 🤠

drop your reactions and show some support again⁩ ❤️‍🔥

Detect PHP powered websites & IPs using the updated php-detect nuclei template 💥

GitHub 🌐

@RootAccessClub

PHP2Shell – Critical PHP Core RCE 🚨
CVE-2026-109618 / CVE-2026-109619 | CVSS 9.2 🫨

Two critical memory-safety flaws in PHP Core, reachable through session upload-progress handling, can lead to Remote Code Execution (RCE) on affected web servers 💣

Affected versions span PHP 5.4 → 8.5 🦠

🛡 Fix: Update PHP to the latest patched release for your branch (8.2+ officially supported)

Sansec Advisory 🔗

💎 @RootAccessClub

php2shell – CVE-2026-109618 / CVE-2026-109619 (PoC)

Two critical bugs in PHP core session upload progress mechanism causing a heap use-after-free (UAF) leading to arbitrary code execution (RCE)

• Severity: Critical (CVSS v4.0: 9.2) 🚨
• Impacted Versions: PHP 5, 6, 7, and 8. Official patches are only coming for active PHP 8 branches, leaving EOL versions (5.x, 7.x, 8.0, 8.1) completely exposed🛡

The repository explains how to fix and mitigate it using WAF (ModSecurity) rules and Apache .htaccess configurations to block malicious requests before they even reach PHP 🟢

Github 🌐

⚠️Disclaimer: Our channel is not responsible for any misuse of this information or tool

⭐️@RootAccessClub

🚨 PHP2Shell is live on SubZer0

📂 On the site: 30+ public PoCs (updated every 15 min), scanners, Nuclei templates and official advisories

🔗 https://iliya-bashrc.github.io/SubZer0/

⚠️ Run PoCs only in a test lab

#PHP2Shell #PHP #RCE

@RootAccessClub × @BugCod3

🔴 CVE-2026-115560 — unpatched RCE in PHP

⚡️ Two days after the emergency php2shell fixes (CVE-2026-109618 / 109619), another RCE path dropped. Still no patch

🧩 The bug: session serialize_handler mismatch
Write side uses php_serialize, read side switches to the legacy php handler. That handler splits the session file on the first "|", so an attacker-controlled key becomes a serialized value

💉 Injection: session.upload_progress
Send PHP_SESSION_UPLOAD_PROGRESS as inj|O:14:"Gadget":... and with cleanup=Off the poisoned key stays in the session file

💥 Result: unserialize → object → __destruct → file_put_contents → webshell → RCE as www-data
No LFI, no memory corruption, works on mod_php.

✅ Until the fix:
• session.upload_progress.enabled=0
• one handler for the whole app, never two
• treat "|" in session keys as invalid

🧪 GitHub

@RootAccessClub

SubZer0Robot is live ⚡

SubZer0 now lives inside Telegram 🤠

🚨 Early warnings — new exploitation waves, posted the moment they're detected

🔴 Fresh CISA KEV entries — actively exploited CVEs, automatically

📱 Mini App — the full CVE tracker, PoCs and dossiers right inside Telegram

🔄 Live layer refreshed every ~15 min · Ed25519-signed data

🤖 mini app

🔔 Alerts land

🌐 Web

by @BugCod3 & @RootAccessClub

Hey guys, quick heads up. I⁩’⁦ve been dealing with a brutal headache these past few days and it⁩’⁦s literally driving me crazy. If I⁩’⁦m not as active, that's why⁩ 🫩

⁦On the bright side, I managed to push a nice update to the bot, so it's fully up and running for you guys now. Catch you soon⁩ ❤️‍🔥