CVE-2026-58025 MediaWiki
*
The deserialization flaw could lead to RCE via malicious log imports.
*
PoC

MariaDB 13.0.1-rc RCE Lab
*
All in ONE

Интересно

ClamAV 1.5.x Memory Corruption Vulnerabilities

#0day

IDA pro 9.4
*
Linux + Windows + Mac + ARM
download
*

tree "/home/data/0x01/IDA/IDA pro 9.4/"
/home/reeves/data/soft/IDA/IDA pro 9.4/
├── ida-pro_94_armlinux.run
├── ida-pro_94_armmac.app.zip
├── ida-pro_94_armwin.exe
├── ida-pro_94_x64linux.run
├── ida-pro_94_x64mac.app.zip
├── ida-pro_94_x64win.exe
├── kg_patch
│   ├── idapro.hexlic
│   ├── keygen.js
│   ├── README
│   ├── x64linux
│   │   ├── libida32.so
│   │   └── libida.so
│   └── x64win
│       ├── ida32.dll
│       └── ida.dll
└── misc
    ├── hexlicsrv94_x64linux.run
    ├── hexvault94_x64linux.run
    ├── idapin94.zip
    └── lumina94_x64linux.run

5 directories, 17 files

defcon 34
*
media server

very good
https://plugandpwn.com/

#defcon34

Продолжаем делиться интересным
*
DEFCON: New Red Team Tactic - EvilFontTool

skitter-creek-bath-salts
*
exploit: “xor dword [0xf80c2094], 1<<22”

Unlocks CPU microcode, the platform security processor, system management mode, and every internal processor register, all at once, on 100 million AMD CPUs. As far as I can tell can’t be fixed.

get

CVE-2026-68138
Linux qdisc rate-table race to local root

PoC

CVE-2026-41452 Krayin CRM
*
Auth Bypass → Admin Takeover

PoC

CVE-2026-20217 File Drop to RCE
*
full WriteUP

+ PoC

Забавнейшая штука ! SSHDESK
пиксели и input идут внутри SSH PTY
Я так подумал, концептуально его можно превратить в HVNC под *nix, большая часть архитектуры то готова:
screen capture
mouse injection
keyboard injection
remote GUI
encrypted transport
управляющий канал !!!
*** осталось сдлеать отдельный desktop в параллель (desk 0 to desk X), user hide, ну и какую никакую persistence модель бы воткнуть

god bless SSH

coming soon ...

#zeronights2026 #прогрев