Fragnesia
*
Универсальный exploit для повышения локальных привилегий в Linux.
Относится к классу уязвимостей Dirty Frag (поверхность та же), но таки отдельный !
Да, опять )))
*
Exploit

CVE-2026-42945 RIFT - RCE NGINX
*
PoC

Когда "за жёппу кусь !"
*
В середине апреля 2026 года протёк DarkForums. Примерно 312 600 записей и 79 900 уникальных IP-адресов .
Кто то без VPN\socks\tor\etc посещал форум, у кого то печальный был ProtonVPN, в общем палево господа !
Ну и понеслась.
Так вот, один мексиканский Ванька, взял да и навалил по взрослому эту инфу на интерактивную карту !
*
Посмотреть себя:

SHA-256-хеш JSON:  
`77E12E11465CDAC07F3F24B968FD1EA2B089BCA01208510DD380FF9C07E0B33D`  

3000 запросов в день. Да и ссылка временная
https://osint29.pythonanywhere.com

ssh-keysign-pwn
*
Праздник и не думал заканчиваться

Steal SSH host private keys and /etc/shadow via the ptrace_may_access mm-NULL bypass + pidfd_getfd. Pre-31e62c2ebbfd kernels.
*
GET him

#ssh #vuln #linux

fragnesia NEW version
*
Была fragnesia , но в V12 никак не уймутся, и, выкатили новую версию fragnesia-5db89c99566fc
Баг в skb_segment() в net/core/skbuff.c
На 15.05.2026 в 18:00 UTC - NO PATCH
*
exploit


#linux #LPE

Хорошее

#Jian-Yang

По следам Dirty Frag, Fragnesia и Copy Fail
*
Теперь DirtyDecrypt / DirtyCBC, Проблема в записи в pagecache rxgk из-за отсутствия COW guard в rxgk_decrypt_skb.
*
exploit

Слишком грязный hack
*
No cable, no USB, no NETWORK, но файлы передать нужно !
😆😆😆
Что то отдаленно похожее

Drupal SA-CORE-2026-004
*
PostgreSQL Entity Query SQLi via JSON:API filter array keys
*
Lab, PoC, and Post-mortem

О !
Generate polymorphic, position-independent virtual machines (PIVMs) from arbitrary x86/x64 shellcode.

GhostTree: The NTFS Trick That Can Make Malware Disappear from EDR Scans

Original text by Dolev Taler

Varonis Threat Labs describes GhostTree, a Windows path-manipulation technique that abuses NTFS junctions to create recursive directory structures and disrupt security scanning. NTFS junctions are legitimate reparse points that redirect one folder to another, and ordinary users can create them if they have write access. The simpler GhostBranch variant points…

https://core-jmp.org/2026/05/ghosttree-the-ntfs-trick-that-can-make-malware-disappear-from-edr-scans/

CVE-2026-45250 - FreeBSD 14.x LPE
*
writeUP
*
exploit

Рубрика "культурный движ"
*
Примите таблетки от эпилепсии и сходите в The Virtual OS Museum

CVE-2026-20182 Cisco Catalyst SD-WAN
MetaSploit bypass module
*
CVE-2026-0300 PAN-OS 12.1, 11.2, 11.1, 10.2
RCE PoC
*

#network

TR-069 😡

test 123

test 123

https://core-jmp.org/2026/05/test-123/

mov ax, bx drama story – for fun and fasm

; build:
; fasm love_registers.asm love_registers.exe

format PE GUI 4.0
entry start

include ‘win32a.inc’

section ‘.data’ data readable writeable
title db ‘Register Drama’, 0
msg db ‘BX whispered: “take my value…”‘, 13, 10
db ‘AX blushed and replied: mov ax, bx’, 13, 10, 13, 10
db ‘Now AX and BX are in a serious relationship.’,…

https://core-jmp.org/2026/05/mov-ax-bx-drama-story-for-fun-and-fasm/

Essential iOS Hardening: A Practical Guide to Defending iPhones Against Modern Spyware

Original source: Essential iOS Hardening Steps by Officer’s Notes, published on Medium — Technology Hits.

This article is an original English rewrite based on the source above. It is not a verbatim republication. Full credit for the underlying recommendations and threat-model framing goes to the original author. Please read the original article for the author’s…

https://core-jmp.org/2026/05/essential-ios-hardening-guide/

Fundamentals of Virtual Memory: A Deep Dive into Paging, Page Tables, and Process Address Spaces

Original source: Fundamental of Virtual Memory — author not clearly listed (site: Melatoni, contact nghiant3223@gmail.com), published 2025-05-29.

This article is an original English rewrite of the topic, not a verbatim republication. Full credit for the underlying explanation, structure, and diagrams goes to the original author. Diagrams below are reproduced from the source article with attribution.…

https://core-jmp.org/2026/05/fundamentals-of-virtual-memory/

APC Tandem: A Primitive-Chaining Process Injection That Slips Past Common EDR Triggers

Original source: Primitive Process Injection: APC Tandem by S12 — 0x12Dark Development, published on Medium in May 2026.

This article is an original English rewrite of the technique walkthrough. Code blocks, the PoC screenshot, the Kleenscan scan output and the YARA rule are reproduced verbatim from the source with attribution. Full credit for the technique,…

https://core-jmp.org/2026/05/apc-tandem-primitive-process-injection/

CVE-2025-54539: Apache.NMS.AMQP Deserialization Policy Bypass to Unauthenticated RCE in .NET

Attribution. This is an original English rewrite based on the SecureLayer7 Blog post “CVE-2025-54539: Apache ActiveMQ NMS AMQP Deserialization Policy Bypass to RCE” (SecureLayer7 Blog, 19 May 2026). Author not clearly listed (site: SecureLayer7 Blog). All credit for the original research, lab setup, code listings and diagrams belongs to SecureLayer7. The post you are reading…

https://core-jmp.org/2026/05/cve-2025-54539-apache-nms-amqp-deserialization-policy-bypass-rce/