Forwarded from CVE Notify
🚨 CVE-2026-59309
VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system.
🎖@cveNotify
VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system.
🎖@cveNotify
Forwarded from CVE Notify
🚨 CVE-2026-59310
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.
🎖@cveNotify
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.
🎖@cveNotify
NeverSight/NeverC: The AI-friendly C23 compiler for security research, built on LLVM
https://github.com/NeverSight/NeverC
🎖@malwr
https://github.com/NeverSight/NeverC
🎖@malwr
GitHub
GitHub - NeverSight/NeverC: The AI-friendly C23 compiler for security research, built on LLVM [WIP]
The AI-friendly C23 compiler for security research, built on LLVM [WIP] - NeverSight/NeverC
CILFI: Automatic Function Identification in .NET Binaries
There is a specific stage of grief every .NET reverse-engineer goes through when writing the next .NET deobfuscator or config extractor. It is the realization you have to write yet another ugly pattern-matching algorithm to find the exact same string decryptor, VM opcode handler, or C2 connection initializer functions to extract obfuscator configurations or IoCs.
https://blog.washi.dev/posts/cilfi/
🎖@malwr
There is a specific stage of grief every .NET reverse-engineer goes through when writing the next .NET deobfuscator or config extractor. It is the realization you have to write yet another ugly pattern-matching algorithm to find the exact same string decryptor, VM opcode handler, or C2 connection initializer functions to extract obfuscator configurations or IoCs.
https://blog.washi.dev/posts/cilfi/
🎖@malwr
Washi
CILFI: Automatic Function Identification in .NET Binaries
There is a specific stage of grief every .NET reverse-engineer goes through when writing the next .NET deobfuscator or config extractor. It is the realization you have to write yet another ugly pattern-matching algorithm to find the exact same string decryptor…
Malware Development Essentials for Operators
Today’s post is a full pipeline walkthrough from a MessageBoxA call all the way to a kernel rootkit doing DKOM process hiding and callback abuse. Dynamic function loading, PEB walking, IAT hooking, process hollowing, DLL injection, shellcode encryption, APC injection all of it, with code.
https://f00crew.org/0x33
🎖@malwr
Today’s post is a full pipeline walkthrough from a MessageBoxA call all the way to a kernel rootkit doing DKOM process hiding and callback abuse. Dynamic function loading, PEB walking, IAT hooking, process hollowing, DLL injection, shellcode encryption, APC injection all of it, with code.
https://f00crew.org/0x33
🎖@malwr
samugit83/redamon: An AI-powered agentic red team framework that automates offensive security operations, from reconnaissance to exploitation to post-exploitation, with zero human intervention.
https://github.com/samugit83/redamon
🎖@malwr
https://github.com/samugit83/redamon
🎖@malwr
GitHub
GitHub - samugit83/redamon: An AI-powered agentic red team framework that automates offensive security operations, from reconnaissance…
An AI-powered agentic red team framework that automates offensive security operations, from reconnaissance to exploitation to post-exploitation, with zero human intervention. - samugit83/redamon
Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution Ecosystem
https://research.checkpoint.com/2026/impersonation-click-hijacking-and-tds-inside-a-malware-distribution-ecosystem/
🎖@malwr
https://research.checkpoint.com/2026/impersonation-click-hijacking-and-tds-inside-a-malware-distribution-ecosystem/
🎖@malwr
Check Point Research
Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution Ecosystem - Check Point Research
Research by: Alexey Bukhteyev Key Takeaways Introduction When we search Google for a popular piece of software, we usually click the first result, sometimes without even looking at the rest, because official project sites tend to rank highest and appear near…
Malware-Research-Hub/README.en.md at main · darama22/Malware-Research-Hub
https://github.com/darama22/Malware-Research-Hub/blob/main/README.en.md
🎖@malwr
https://github.com/darama22/Malware-Research-Hub/blob/main/README.en.md
🎖@malwr
GitHub
Malware-Research-Hub/README.en.md at main · darama22/Malware-Research-Hub
Self-contained malware research hub: curated catalog of 80 families (1971-2024) + 2,764 real encrypted samples, indexed and searchable. Local Flask app, bilingual. - darama22/Malware-Research-Hub
When Agentic Glue Melts: Exploiting Cloudflare Code Mode and Workers
https://research.checkpoint.com/2026/when-agentic-glue-melts/
🎖@malwr
https://research.checkpoint.com/2026/when-agentic-glue-melts/
🎖@malwr
Check Point Research
When Agentic Glue Melts: Exploiting Cloudflare Code Mode and Workers - Check Point Research
By Yarden Porat, Check Point Research Key Points The short version We set out to break Cloudflare Code Mode, and ended up breaking Cloudflare Workers too. We did both by targeting workerd, the runtime beneath both: an in-process sandbox that relies entirely…
Windows tcpip.sys ICMP Timestamp Bug: EnableICMPTimestampRep=0 Registry Bypass & RFC 792 Violation | Kernel RE
EnableICMPTimestampRep=0 does not suppress ICMP Timestamp Replies (Type 14) on Windows 11. Ghidra RE of tcpip.sys 10.0.26100.8457 confirms Ipv4pHandleTimestampRequest generates T14 unconditionally, plus a second bug: Receive/Transmit timestamps written little-endian in violation of RFC 792. Only effective mitigation: WFP firewall rule.
https://netacoding.com/posts/windows-icmp-timestamp-bugs/
🎖@malwr
EnableICMPTimestampRep=0 does not suppress ICMP Timestamp Replies (Type 14) on Windows 11. Ghidra RE of tcpip.sys 10.0.26100.8457 confirms Ipv4pHandleTimestampRequest generates T14 unconditionally, plus a second bug: Receive/Transmit timestamps written little-endian in violation of RFC 792. Only effective mitigation: WFP firewall rule.
https://netacoding.com/posts/windows-icmp-timestamp-bugs/
🎖@malwr
Netacoding | Cybersecurity, Assembly & Network Research
Windows tcpip.sys ICMP Timestamp Bug: EnableICMPTimestampRep=0 Registry Bypass & RFC 792 Violation | Kernel RE
EnableICMPTimestampRep=0 does not suppress ICMP Timestamp Replies (Type 14) on Windows 11. Ghidra RE of tcpip.sys 10.0.26100.8457 confirms Ipv4pHandleTimestampRequest generates T14 unconditionally, plus a second bug: Receive/Transmit timestamps written little…
LockBit 5.0 Linux Malware Analysis: ChaCha20 + Curve25519 Offline Encryption, strace Evasion & IOCs
Full reverse engineering of LockBit 5.0 Linux (LINUX Locker v1.01 amd64): offline-capable ChaCha20+Curve25519 encryption, strace anti-analysis evasion, aggressive free space wiping, and zero network activity during encryption. eBPF dynamic tracing, Ghidra static RE, triple-confirmed network behavior, and complete IOC list.
https://netacoding.com/posts/lockbit5-analysis/
🎖@malwr
Full reverse engineering of LockBit 5.0 Linux (LINUX Locker v1.01 amd64): offline-capable ChaCha20+Curve25519 encryption, strace anti-analysis evasion, aggressive free space wiping, and zero network activity during encryption. eBPF dynamic tracing, Ghidra static RE, triple-confirmed network behavior, and complete IOC list.
https://netacoding.com/posts/lockbit5-analysis/
🎖@malwr
Netacoding | Cybersecurity, Assembly & Network Research
LockBit 5.0 Linux Malware Analysis: ChaCha20 + Curve25519 Offline Encryption, strace Evasion & IOCs
Full reverse engineering of LockBit 5.0 Linux (LINUX Locker v1.01 amd64): offline-capable ChaCha20+Curve25519 encryption, strace anti-analysis evasion, aggressive free space wiping, and zero network activity during encryption. eBPF dynamic tracing, Ghidra…
bl4ckr0ss3/knife: A reverse engineer's binary Swiss-army knife in Rust: triage, disassembly, function/CFG recovery, crypto-constant + YARA scanning for PE/ELF/Mach-O. Installs as 'knife'.
https://github.com/bl4ckr0ss3/knife
🎖@malwr
https://github.com/bl4ckr0ss3/knife
🎖@malwr
GitHub
GitHub - bl4ckr0ss3/knife: A reverse engineer's binary Swiss-army knife in Rust: triage, disassembly, function/CFG recovery, crypto…
A reverse engineer's binary Swiss-army knife in Rust: triage, disassembly, function/CFG recovery, crypto-constant + YARA scanning for PE/ELF/Mach-O. Installs as 'knife'. - bl4ckr0ss3/knife
Dopamine
An iOS 15.0 - 18.7.1 / 26.0 - 26.0.1 jailbreak for A8 - A17 and M1 - M2 devices
https://ellekit.space/dopamine/
🎖@malwr
An iOS 15.0 - 18.7.1 / 26.0 - 26.0.1 jailbreak for A8 - A17 and M1 - M2 devices
https://ellekit.space/dopamine/
🎖@malwr
ellekit.space
Dopamine
An iOS 15.0 - 18.7.1 / 26.0 - 26.0.1 jailbreak for A8 - A17 and M1 - M2 devices
llnl/OGhidra: OGhidra bridges Large Language Models (LLMs) via Ollama with the Ghidra reverse engineering platform, enabling AI-driven binary analysis through natural language. Interact with Ghidra using conversational queries and automate complex reverse engineering workflows.
https://github.com/llnl/OGhidra
🎖@malwr
https://github.com/llnl/OGhidra
🎖@malwr
GitHub
GitHub - llnl/OGhidra: OGhidra bridges Large Language Models (LLMs) via Ollama with the Ghidra reverse engineering platform, enabling…
OGhidra bridges Large Language Models (LLMs) via Ollama with the Ghidra reverse engineering platform, enabling AI-driven binary analysis through natural language. Interact with Ghidra using convers...
2026-08-09: Traffic Analysis Exercise - First to Last
https://www.malware-traffic-analysis.net/2026/08/09/index.html
🎖@malwr
https://www.malware-traffic-analysis.net/2026/08/09/index.html
🎖@malwr
alpha-omega-security/threat-model: Agent skill for producing threat models for open-source projects
https://github.com/alpha-omega-security/threat-model
🎖@malwr
https://github.com/alpha-omega-security/threat-model
🎖@malwr
GitHub
GitHub - alpha-omega-security/threat-model: Agent skill for producing threat models for open-source projects
Agent skill for producing threat models for open-source projects - alpha-omega-security/threat-model
Poly0n/WinGuard: WinGuard
https://github.com/Poly0n/WinGuard
🎖@malwr
https://github.com/Poly0n/WinGuard
A User-Mode Windows Threat Detection Tool Inspired by EDR Techniques, To Help Monitor And Log Any Suspicious Activity On Your PC.
🎖@malwr
GitHub
GitHub - Poly0n/WinGuard: WinGuard - User-Mode Windows Threat Detection Tool
WinGuard - User-Mode Windows Threat Detection Tool - Poly0n/WinGuard
DosX-dev/obfus.h: Macro-header for compile-time C obfuscation (tcc, win x86/x64)
https://github.com/DosX-dev/obfus.h
🎖@malwr
https://github.com/DosX-dev/obfus.h
🎖@malwr
GitHub
GitHub - DosX-dev/obfus.h: Macro-header for compile-time C obfuscation (tcc, win x86/x64)
Macro-header for compile-time C obfuscation (tcc, win x86/x64) - DosX-dev/obfus.h
Osxninja/cybersecurity-projects: This repository contains the complete record of my three-year research journey, covering the project from foundational concepts to advanced-level development. It brings together the research, experiments, implementations, findings, and progress made throughout the project, providing a structured overview of the work from basic to advanced stages.
https://github.com/Osxninja/cybersecurity-projects
🎖@malwr
https://github.com/Osxninja/cybersecurity-projects
🎖@malwr
GitHub
GitHub - Osxninja/cybersecurity-projects: This repository contains the complete record of my three-year research journey, covering…
This repository contains the complete record of my three-year research journey, covering the project from foundational concepts to advanced-level development. It brings together the research, exper...