Release v3.6.2 · projectdiscovery/nuclei

https://github.com/projectdiscovery/nuclei/releases/tag/v3.6.2

MongoBleed: CVE-2025-14847 Memory Corruption in MongoDB. Your Database Talks Back

https://phoenix.security/mongobleed-vulnerability-cve-2025-14847/

CVE-2025-61922: Zero-Click Account Takeover on Prestashop

https://dhakal-ananda.com.np/blogs/cve-2025-61922-analysis/

Chronomaly — Android / Linux Kernel LPE exploit (CVE-2025-38352)

The exploit was written specifically for Linux kernel v5.10.157, but should work against all vulnerable v5.10.x kernels, as it does not require any specific kernel text offsets to work.

Blog:
• Part 1 - In-the-wild Android Kernel Vulnerability Analysis + PoC
• Part 2 - Extending The Race Window Without a Kernel Patch
• Part 3 - Uncovering Chronomaly

CVE-2026-21858 + CVE-2025-68613: n8n Ni8mare - Full Chain Exploit (CVSS 10.0)

Unauthenticated to Root RCE:
- LFI via Content-Type confusion
- Read /proc/self/environ to find HOME
- Steal encryption key + database
- Forge admin JWT token
- Expression injection sandbox bypass
- RCE as root

Query:
FOFA: app="n8n"
HUNTER : product.name="N8n"
ZoomEye: app="n8n"

DumpBrowserSecrets

Extracts browser-stored data such as refresh tokens, cookies, saved credentials, credit cards, autofill entries, browsing history, and bookmarks from modern Chromium-based and Gecko-based browsers (Chrome, Microsoft Edge, Firefox, Opera, Opera GX, and Vivaldi).

@news4hack

Strix

Strix are autonomous AI agents that act just like real hackers - they run your code dynamically, find vulnerabilities, and validate them through actual proof-of-concepts. Built for developers and security teams who need fast, accurate security testing without the overhead of manual pentesting or the false positives of static analysis tools.

Key Capabilities:

🔧 Full hacker toolkit out of the box
🤝 Teams of agents that collaborate and scale
✅ Real validation with PoCs, not false positives
💻 Developer‑first CLI with actionable reports
🔄 Auto‑fix & reporting to accelerate remediation

🎯 Use Cases

Application Security Testing - Detect and validate critical vulnerabilities in your applications
Rapid Penetration Testing - Get penetration tests done in hours, not weeks, with compliance reports
Bug Bounty Automation - Automate bug bounty research and generate PoCs for faster reporting
CI/CD Integration - Run tests in CI/CD to block vulnerabilities before reaching production

@news4hack

ConfigManBearPig

PowerShell collector for adding SCCM attack paths to BloodHound with OpenGraph.

Blog: https://specterops.io/blog/2026/01/13/introducing-configmanbearpig-a-bloodhound-opengraph-collector-for-sccm

@news4hack

2026-24061: Telnetd RCE as Root

This flaw allows an attacker to establish a Telnet session without providing valid credentials, granting unauthorized access to the target system. The vulnerability exists all the way up to version 2.7-2 of the GNU telnetd service.

Exploit: https://github.com/SafeBreach-Labs/CVE-2026-24061

Query:
ZoomEye: app="GNU Inetutils telnetd"
Shodan: product:"telnetd"

@news4hack

The Mimikatz Missing Manual

My goal was to create the "Missing Manual" — the documentation that explains not just the commands, but the why and the how of the Windows protocols being manipulated.

Parts:

• Foundations: Setting up your environment and the basic syntax.
• System Internals: How Windows handles tokens, processes, and services.
• LSASS & Credentials: The heart of Mimikatz—extracting secrets from memory.
• Kerberos Deep Dive: Tickets, forgery, and delegation.
• PKI & Certificates: Hardware and software-based identities.
• Domain Persistence: Owning the directory through replication.
•DPAPI: Unlocking the secrets at rest.

Gaining Initial Access and Outsmarting SmartScreen

.zip email attachment that includes a VHDX (Hard Disk Image File) + Mark of the Web and SmartScreen bypass using Trusted Executable Reputation and DLL Sideloading.

Tools: https://github.com/g3tsyst3m/CodefromBlog/tree/main/2026-2-21-Initial%20Access%20and%20Outsmarting%20SmartScreen

VMkatz

Without VMkatz, the traditional workflow looks like this: exfiltrate the entire VM disk or memory snapshot, mount it locally, install a full Windows analysis stack, load the snapshot into a debugger or use mimikatz on a booted copy, and manually piece together credentials from each VM - one at a time. Multiply that by a dozen VMs on the cluster and you are looking at days of bandwidth, tooling, and post-processing.

VMkatz exists because you shouldn't have to exfiltrate what you can read in place. It extracts Windows secrets - NTLM hashes, DPAPI master keys, Kerberos tickets, cached domain credentials, LSA secrets, NTDS.dit - directly from VM memory snapshots and virtual disks, on the NAS, the hypervisor, wherever the VM files are.

CVE-2025-71257 and CVE-2025-71260 BMC FootPrints Pre-Authenticated Remote Code Execution Chain

• Bypass authentication with CVE-2025-71257.
• If it is successful, it tries to verify the CVE-2025-71260 RCE by writing a ranomized .jsp file to the tomcat servers webroot. This .jsp file just enumerates system information.

Blog: https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/

BMC FootPrints is an IT Service Management (ITSM) solution designed to help IT teams manage service requests, incidents, assets, and changes through configurable workflows and an intuitive web interface.

CVE-2026-24291: Windows LPE (RegPwn)

Exploit: https://github.com/mdsecactivebreach/RegPwn

Blog: https://www.mdsec.co.uk/2026/03/rip-regpwn/

BOF: https://github.com/Flangvik/RegPwnBOF

Tested versions:
Windows 11 25h2
Windows 11 24h2
Windows 10 21h2
Windows Servers 2016/2019/2022

Patched: Mar 10, 2026

Release v3.8.0 · projectdiscovery/nuclei

https://github.com/projectdiscovery/nuclei/releases/tag/v3.8.0

Dirty Frag: Universal Linux LPE

Obtain root privileges on major Linux distributions by chaining the xfrm-ESP Page-Cache Write vulnerability and the RxRPC Page-Cache Writevulnerability.
Dirty Frag is a case that extends the bug class to which Dirty Pipe and Copy Fail belong. Because it is a deterministic logic bug that does not depend on a timing window, no race condition is required, the kernel does not panic when the exploit fails, and the success rate is very high.

Tested on the following distribution versions:
• Ubuntu 24.04.4: 6.17.0-23-generic
• RHEL 10.1: 6.12.0-124.49.1.el10_1.x86_64
• openSUSE Tumbleweed: 7.0.2-1-default
• CentOS Stream 10: 6.12.0-224.el10.x86_64
• AlmaLinux 10: 6.12.0-124.52.3.el10_1.x86_64
• Fedora 44: 6.19.14-300.fc44.x86_64

@news4hack

T3MP3ST
A multi-agent offensive-security framework, built to turn the AI coding agent you already run into a zero-day hunter.
Point it at an authorized target and the kill chain runs itself: recon → exploit → report, from a browser War Room or the CLI, driven by the agent you're already signed into — Claude Code, Codex, Hermes — or a model you run fully offline (Ollama, LM Studio, vLLM). No new API keys, no cloud tenant, no second bill. Your agent is the brain; T3MP3ST is the war machine bolted around it. Self-hosted storm. Keyless warfare.

How to use Claude Code for Bug Bounty: find fast, validate manually
https://www.yeswehack.com/learn-bug-bounty/llm-series-claude

A labeled reverse-engineering dataset over 4,598 crackmes from crackmes.one, built for benchmarking automated RE (AI agents + decompilers)

https://github.com/crackmesone/crackmes-re-dataset

Offensive AI Agents Landscape: Projects, Models, Skills, MCP Servers, Papers, Benchmarks & Commercial Solutions

https://github.com/Yeti-791/Awesome-Offensive-AI-Agentic-Landscape