From Zero to SYSTEM: Building PrintSpoofer from Scratch #PrintSpoofer #PrivilegeEscalation #WindowsInternals #MalwareDevelopment #EvasionTechniques https://bl4ckarch.github.io/posts/PrintSpoofer_from_scratch/
bl4ckarch
From Zero to SYSTEM: Building PrintSpoofer from Scratch
A complete journey from understanding Named Pipes to building an undetectable PrintSpoofer learning Windows internals, token impersonation, RPC, and evasion techniques along the way.
Attackers are hiding payloads in user-space memory. Enter HeapList: our new open-source Volatility 3 plugin for Windows NT Heap analysis! Attending #DFRWSEU2026 @DFRWS? Come say hi and let's talk memory forensics! 👋
Read the quick 3-min briefing: https://reversea.me/index.php/uncovering-threats-in-the-wwindow-nt-heap-with-volatility-3/
Read the quick 3-min briefing: https://reversea.me/index.php/uncovering-threats-in-the-wwindow-nt-heap-with-volatility-3/
Defending Against L7 DDoS and Web Bots with Tempesta FW #L7DDoS #WebBots #TempestaFW #ClientFingerprinting #FastAnalytics https://tempesta-tech.com/blog/defending-against-l7-ddos-and-web-bots-with-tempesta-fw/
Tempesta Technologies
Defending Against L7 DDoS and Web Bots with Tempesta FW - Tempesta Technologies
Tempesta FW 0.8 introduces a zero-copy per-CPU access logs streaming to a ClickHouse database. This article discusses how to analyse that data for L7 DDoS mitigation and bot management. Finally, we introduce our new open-source project, WebShield, which automatically…
68% Of Phishing Websites Are Protected by CloudFlare #CloudflareAbuse #PhaaS #ModernPhishing #TrustAbuse #CyberDefense https://blog.sicuranext.com/68-of-phishing-websites-are-protected-by-cloudflare/
Sicuranext Blog
68% Of Phishing Websites Are Protected by CloudFlare
Earlier this year, our CTI team set out to build something we'd been thinking about for a while: a phishing intelligence pipeline that could actually keep up with the threat. We combined feeds from hundreds of independent sources with our own real-time hunt…
High Fidelity Detection Mechanism for RSC/Next.js RCE (CVE-2025-55182 & CVE-2025-66478) https://slcyber.io/research-center/high-fidelity-detection-mechanism-for-rsc-next-js-rce-cve-2025-55182-cve-2025-66478/
Searchlight Cyber
High-Fidelity RSC/Next.js RCE Detection (CVE-2025-55182, 66478)
This morning, an advisory was released for Next.js about a vulnerability that leads to RCE in default configurations, with no prerequisites. The root cause of this issue lies in React Server Components, which Next.js utilizes. Over the last day, we have noticed…
CVE PoC Search: Search across CVE identifiers proof-of-concept links #CVESearch #PoCLinks #Vulnerability #SecurityTool #APIAccess https://labs.jamessawyer.co.uk/cves/
JS Labs
CVE PoC Search
CVE PoC Search from James Sawyer's JS Labs indexes GitHub proof-of-concept links for rapid vulnerability exploration.
PromptPwnd: Prompt Injection Vulnerabilities in GitHub Actions Using AI Agents #PromptInjection #GitHubActions #AICICD #SupplyChainAttack #SecretsLeak https://www.aikido.dev/blog/promptpwnd-github-actions-ai-agents
www.aikido.dev
Prompt Injection Inside GitHub Actions: The New Frontier of Supply Chain Attacks
AI-driven GitHub Actions expose new prompt-injection supply chain vulnerabilities.
Scam Telegram: Uncovering a network of groups spreading crypto drainers #TelegramScams #CryptoDrainers #DeFiPhishing #ScamNetwork #Web3Security https://timsh.org/scam-telegram-investigation/
tim.sh
Scam Telegram: Investigation
How I found a large network of fake support groups spreading crypto stealers and drainers.
Privilege escalation with SageMaker and there's more hiding in execution roles #PrivilegeEscalation #SageMaker #ExecutionRoles #CloudSecurity #BootCodeInjection https://www.plerion.com/blog/privilege-escalation-with-sagemaker-and-execution-roles
Plerion
Privilege escalation with SageMaker and there's more hiding in execution roles
A subtle AWS privesc hiding in SageMaker lifecycle configs, and what it reveals about execution roles.
SSRF Payload Generator #SSRF #PayloadGenerator #Pentesting #VulnerabilityTesting #SecurityTools https://shelltrail.com/tools/ssrf-payload-generator
Shelltrail
SSRF Payload Generator | Shelltrail - Swedish Experts in Pentesting
Generate HTML/SVG payloads for testing Server-Side Request Forgery vulnerabilities.
Stillepost - Or: How to Proxy your C2s HTTP-Traffic through Chromium #Stillepost #C2Proxy #ChromeDevTools #BrowserEvasion #HTTPTraffic https://x90x90.dev/posts/stillepost/
mischief
Stillepost - Or: How to Proxy your C2s HTTP-Traffic through Chromium
Utilizing the Chrome DevTools Protocol to delegate C2 HTTP-traffic.
Careless Whisper: Exploiting Silent Delivery Receipts to Monitor Users on Mobile Instant Messengers #SilentReceipts #UserMonitoring #PrivacyRisk #MessagingApps #SecurityExploit https://arxiv.org/abs/2411.11194
arXiv.org
Careless Whisper: Exploiting Silent Delivery Receipts to Monitor...
With over 3 billion users globally, mobile instant messaging apps have become indispensable for both personal and professional communication. Besides plain messaging, many services implement...
Compromising Developers with Malicious Extensions - VS Code, Cursor AI, and the Backdoor You Didn't See Coming #MaliciousExtensions #VSCodeSecurity #SupplyChainAttack #DeveloperCompromise #MarketplaceFlaws https://mazinahmed.net/blog/publishing-malicious-vscode-extensions/
Mazin Ahmed
Compromising Developers with Malicious Extensions - VS Code, Cursor AI, and the Backdoor You Didn't See Coming
Compromising Developers with Malicious Extensions - VS Code, Cursor AI, and the Backdoor You Didn't See Coming.
Declarative Binary Parsing for Security Research with Kaitai Struct #KaitaiStruct #BinaryParsing #SecurityResearch #FileFormatAnalysis #DeclarativeParsing https://husseinmuhaisen.com/blog/declarative-binary-parsing-for-security-research-with-kaitai-struct/
Husseinmuhaisen
Declarative Binary Parsing for Security Research with Kaitai Struct
Reverse engineering a dummy KAISTDE format and generating parsers with Kaitai Struct.
Infostealer has entered the chat #AMOSStealer #ChatGPTExploited #macOSThreat #Infostealer #SocialEngineering https://www.kaspersky.com/blog/share-chatgpt-chat-clickfix-macos-amos-infostealer/54928/
Kaspersky official blog
The AMOS infostealer is piggybacking ChatGPT's chat-sharing feature
We break down a new infostealer attack that combines the ClickFix technique with a shared chat containing malicious user guides on the official ChatGPT website.
How widespread is the impact of Critical Security Vulnerability in React Server Components(CVE-2025-55182) #ReactSecurity #CVE202555182 #ServerComponents #VulnerabilityImpact #HelixGuard https://helixguard.ai/blog/CVE-2025-55182/
helixguard.ai
How widespread is the impact of Critical Security Vulnerability in React Server Components(CVE-2025-55182)
React Server Components (RSC) are a new feature in React that allows developers to render React components on the server. However, a critical security vulnerability in RSC could allow an attacker to inject arbitrary commands into the server's command execution…
The FreePBX Rabbit Hole: CVE-2025-66039 and others #FreePBX #Vulnerabilities #CVE202566039 #RCE #SQLInjection https://horizon3.ai/attack-research/the-freepbx-rabbit-hole-cve-2025-66039-and-others/
Horizon3.ai
The FreePBX Rabbit Hole: CVE-2025-66039 & More
Horizon3.ai uncovers FreePBX flaws, including CVE-2025-66039 auth bypass, SQL injection, and file upload RCE—and shows how NodeZero detects them.
The Fragile Lock: Novel Bypasses For SAML Authentication #SAML #AuthBypass #XMLSecurity #ParserFlaws #SignatureWrapping https://portswigger.net/research/the-fragile-lock
PortSwigger Research
The Fragile Lock: Novel Bypasses For SAML Authentication
TLDR This post shows how to achieve a full authentication bypass in the Ruby and PHP SAML ecosystem by exploiting several parser-level inconsistencies: including attribute pollution, namespace confusi
HelioSphere: Concept and Project Presentation https://nextcloud.calzone-rivoluzione.de/s/pLoNrkgrerbSzfx
Nextcloud
concept.pdf
Nextcloud - a safe home for all your data
👍1