ParaCyberBellum Security Review

[ARTICLE] Yet another RCE in Gogs, but it's fixed this time!

Jorian Woltjer — Fri, 21 Aug 2026 04:04:15 +0000

[ Exploits & Payloads ] This post will primarily focus on the Remote Code Execution vulnerability (CVE-2026-52813) in Gogs, an open-source Git hosting platform like GitHub or GitLab. But I'll also explain a logic bug to write on read-only repositories (CVE-2026-52810), together with an XSS vulnerability in the Jupyter rendering library Gogs was using

[ARTICLE] BTR Reforged: Weaponizing Defender's Remediation Driver as a Kernel Operation Primitive

Jiri Vinopal — Fri, 21 Aug 2026 04:01:05 +0000

[ Exploits & Payloads - Obfuscation, Evasion & LoL ] In this publication, we present the first full reverse engineering of the Windows Defender Boot-Time Removal driver (BTR.sys) and its proprietary transaction format. We dissect its encrypted configuration mechanism, integrity validation logic, and execution pipeline, and demonstrate how this legitimate remediation component can be transformed into a universal kernel operation engine.

[ARTICLE] Web fuzzing for hackers

Ayoub, Orwa Atyat — Fri, 21 Aug 2026 03:58:26 +0000

[ Application Security - Fuzzing ] In this article, we'll explore web fuzzing from the ground up: what it actually is, the tooling and wordlists that make it work, and how to fuzz to discover more content and find more security vulnerabilities.

[TOOL] LLVM Obfuscator

und3ath — Fri, 21 Aug 2026 03:56:43 +0000

[ Obfuscation, Evasion & LoL ] An in-tree LLVM obfuscation framework integrated into the new pass manager (NPM). Configuration is driven by source-level annotations (llvm.global.annotations) and resolved once per module into a cached, deterministic configuration map.

[ARTICLE] Building an in-tree LLVM obfuscator solo, with an AI pair

Und3Ath — Fri, 21 Aug 2026 03:55:02 +0000

[ Obfuscation, Evasion & LoL - Tooling ] We dive into ollvm, an obfuscation framework fused directly into an LLVM 22 checkout, and detail what obfuscation actually does at each layer.

[ARTICLE] Solar Winds Part 2 Avoided: N-Able Passportal Vault Leak

James Arnott — Fri, 21 Aug 2026 03:52:18 +0000

[ Browser Security - Credentials Dumps, Theft and Cracking - Exploits & Payloads ] N-Able's PassPortal extension, on Chrome and Edge allowed any site or iframe a user is presented with to gain complete, persisted access to the decrypted vault.

[ARTICLE] Breaking secure boot without breaking the crypto

Christopher Krah — Thu, 20 Aug 2026 04:31:37 +0000

[ Exploits & Payloads - Hardware & Bios ] We first review the concepts of hardware boot components security, then detail vulnerabilities affecting them allowing unsigned or malicious code to run despite valid signatures. The impact stems from ignored verification results, incorrect coverage of signed metadata, misuse of authority or rollback policies, and TOCTOU or pointer-swap attacks that break secure-boot enforcement and remote attestation.

[TOOL] AWSHound

Thu, 20 Aug 2026 04:21:18 +0000

[ Enumeration, Reconnaissance & Scanning - Public Cloud ] AWS Bloodhound OpenGraph Connector, collects AWS IAM/authorization data and builds a BloodHound OpenGraph.

[ARTICLE] BOFScale: A CDN-Fronted Tailnet from a BOF-PE

Ceri Coburn — Thu, 20 Aug 2026 04:19:15 +0000

[ C2 & Exfiltration - Tooling ] We explain how we managed to have BOFScale leveraging a modified Tailscale daemon compiled as a BOF-PE to seamlessly hide C2 traffic and DERP relays behind CDNs using standard WebSockets.

[ARTICLE] CRLF-Powered Desync Attacks: Beheading HTTP Streams

Tom Stacey — Thu, 20 Aug 2026 04:13:04 +0000

[ Application Security ] We introduce the CRLF-Powered desync attacks. They exploit HTTP header injection in Nginx (e.g., using $uri in proxy_pass) to achieve request smuggling, response queue poisoning, cache poisoning, XSS, session hijacking and cross-user account takeover, including stealing HTTPOnly cookies and injecting malicious Set-Cookie headers.

[ARTICLE] Git Repo Forensics: My Seven Phases Investigation Process

Denis Rendler — Wed, 19 Aug 2026 03:59:59 +0000

[ DevOps - Incident Response & Forensics ] We provide a structured, seven‑phase workflow for investigating suspicious Git commits - from case registration and evidence preservation, through technical analysis, stakeholder interviews, and credential review, to containment, root‑cause mitigation, and final reporting - emphasizing thorough documentation, hash‑based integrity, and the importance of commit signing and audit‑log retention to reliably attribute and remediate supply‑chain compromises.

[ARTICLE] Hacking your life with AI can get you hacked

Peyton Kennedy — Wed, 19 Aug 2026 03:53:49 +0000

[ Exploits & Payloads - Machine Learning & AI ] I uncovered 14 critical and high severity vulnerabilities, including multiple unauthenticated prompt-injection to RCE chains, across seven AI orchestration platforms.

[ARTICLE] Dissecting House of Apple 2 on modern glibc

Joaquin Pinillos — Wed, 19 Aug 2026 03:51:08 +0000

[ Exploits & Payloads ] A GDB walkthrough of House of Apple 2, from FSOP to stack pivot and ROP on glibc 2.43. This article provides an interactive walkthrough that readers can follow alongside the sandbox to develop a more intuitive understanding of the primitive.

[ARTICLE] How a popular Android image cropping library silently exposed thousands of apps to Arbitrary File Overwrite (AFO)

Ahmed Sabry — Wed, 19 Aug 2026 03:47:56 +0000

[ Exploits & Payloads - Mobile ] This is a story about what happens when a widely-used image cropping library ships android:exported="true" on an Activity and root-scoped on a FileProvider as its defaults.

[ARTICLE] How to Stop AI-Generated Rogue Entra Device Joins

Shahar Dorfman, Sapir Federovsky — Wed, 19 Aug 2026 03:32:22 +0000

[ Intrusion Detection ] Instead of leaving behind recognizable fingerprints from public tooling, adversaries can now generate realistic device names that blend naturally into enterprise environments. This blog explores how that changes Entra ID detection and what are the behavioral signals that still expose these attacks.

[REFERENCE] Anthropic Cybersecurity Skills

Mahipal — Tue, 18 Aug 2026 04:10:24 +0000

[ Machine Learning & AI ] This repo contains 817 structured cybersecurity skills spanning 29 security domains, each following the agentskills.io open standard. The library maps across six industry frameworks - MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, MITRE D3FEND, NIST AI RMF, and the MITRE Fight Fraud Framework (F3) - with each skill mapped to the frameworks relevant to its type (a forensics skill carries ATT&CK + CSF; an AI-security skill adds ATLAS and AI RMF).

[ARTICLE] Breaking the M365 Copilot Sandbox with ChatMate

Ori Lahav — Tue, 18 Aug 2026 04:03:12 +0000

[ Exploits & Payloads - Machine Learning & AI ] ChatMate, the first documented instance of remote prompt execution, shows how a malicious document can lead to sandbox escape.

[TOOL] ShaderGhost

Joe Rutkowski — Tue, 18 Aug 2026 03:57:16 +0000

[ Fingerprinting ] An undeletable supercookie that lives in your GPU's cache

[ARTICLE] Rooting Android 17 with GhostLock

Tue, 18 Aug 2026 03:52:49 +0000

[ Exploits & Payloads - Mobile ] GhostLock (CVE-2026-43499) is a Linux kernel vulnerability that exists in every major distribution since 2011. After turning it into a stable privilege escalation and container escape, we migrated the exploit for Android.

[ARTICLE] How Codex Hacked EggGame Into a Legendary Roc

Shmulik Cohen — Tue, 18 Aug 2026 03:48:37 +0000

[ Games ] In this article, I detail how Codex found authorization and replay flaws plus a race condition in EggGame - and used them to turn a simple browser egg into a legendary Roc.

[ARTICLE] Bypassing Android Hardware Attestation from the Analyst's Chair

Eric Le Guevel — Tue, 18 Aug 2026 03:40:10 +0000

[ Mobile - Reverse Engineering ] Hardware key attestation lets an Android app prove to its backend that a key lives in secure hardware on a locked, verified device. This article opens the mechanism from the analyst's chair, from the certificate chain and the attestation extension down to the root of trust, then shows a simple bypass that never touches the secure hardware.

[ARTICLE] Turning a TURN server into an evil proxy

Marsel Shagiev — Tue, 18 Aug 2026 03:36:47 +0000

[ C2 & Exfiltration ] We explain how TURN (Traversal Using Relays around NAT) servers, a video conferencing relay host, can redirect traffic to C2.

[ARTICLE] C2Looper Backdoor Uses GitHub for C2

Tue, 18 Aug 2026 03:34:49 +0000

[ Malware Analysis ] We analyze C2Looper, a new backdoor likely affiliated with an initial access broker for ransomware that uses GitHub for C2 communications.

[ARTICLE] Unauthenticated RCE in CircleCI MCP Server Explained

Omri Dar — Tue, 18 Aug 2026 03:31:57 +0000

[ Exploits & Payloads ] We discovered an unauthenticated RCE flaw in CircleCI's MCP server allowing for full pipeline takeover. The flaw lies in sending Host: localhost header with no Origin that results in passing security checks.

[ARTICLE] ARM64 stack internals and obfuscation on Apple Silicon

Anandeshwar Unnikrishnan — Mon, 17 Aug 2026 04:51:49 +0000

[ EDR - Obfuscation, Evasion & LoL ] This post explains how macOS EDR tools (via the built‑in spindump utility) unwind ARM64 call stacks, details the ARM64 stack layout, compact‑unwind recipes, and pointer‑authentication (PAC) that protect return addresses, and then shows how to craft PAC‑aware synthetic frames and a trampoline gadget to obfuscate a stack trace and evade detection on Apple‑Silicon systems.

[ARTICLE] Understanding safeguards/guardrails for cybersecurity work to not get blocked

Remco Van Der Meer — Mon, 17 Aug 2026 04:44:36 +0000

[ Machine Learning & AI - Obfuscation, Evasion & LoL ] Hitting AI guardrails on frontier models is annoying, therefore this blog explains them and describes how to work around them.

[ARTICLE] SysReptor: chaining a Host header injection to application-user RCE

Hippolyte Quere — Mon, 17 Aug 2026 04:41:16 +0000

[ Exploits & Payloads ] How I chained a conditional SysReptor Host header account takeover with Ghostscript and GnuPG behaviours to achieve application-user RCE.

[ARTICLE] Bring Your Own EDR: How to Turn a Commercial EDR into a Trojan Horse

Shahak Morag — Mon, 17 Aug 2026 04:36:53 +0000

[ EDR - Keyloggers, Backdoors & Rootkits ] We detail how legitimate SentinelOne installers and accessible COM interfaces can be abused to bypass Protected Process Light (PPL) protections and execute unsigned code - completely bypassing the need for kernel vulnerabilities or traditional exploits.

[ARTICLE] Citrix NetScaler Pre-Auth RCE CVE-2026-8452

Sina Kheirkhah — Mon, 17 Aug 2026 04:34:48 +0000

[ Exploits & Payloads ] In this post, we’re going to walk through a vulnerability a Heap Overflow vulnerability in Citrix NetScaler and show how it can be used to achieve Remote Code Execution.

[ARTICLE] CVE-2026-33696: From a Schema Name to RCE in n8n

Simon Koeck — Mon, 17 Aug 2026 04:31:52 +0000

[ Exploits & Payloads ] n8n uses a user-supplied schema name as a bare object key. Set it to __proto__, pollute the prototype, chain into RCE via the Git node. One request, full shell.

[TOOL] Ping 007

Franck FERMAN — Mon, 17 Aug 2026 04:31:07 +0000

[ C2 & Exfiltration ] Covert ICMP C2 framework - AES-256-GCM stealth exfil, OS ping mimicry (Linux/Windows), multi-packet reassembly & anti-SOC evasion. Written in Go.

[REFERENCE] HackTheBox Cheatsheets

Frey — Mon, 17 Aug 2026 04:30:07 +0000

[ Labs & Simulation - Pentests & Red Teams ] Cheatsheets for Hack the Box challenges

[ARTICLE] CVE-2026-6837

Mina Zekry — Mon, 17 Aug 2026 04:28:01 +0000

[ Exploits & Payloads ] Technical writeup for CVE-2026-6837, a post-authentication command injection vulnerability in Zyxel export-cgi PKCS#12 export handling.

[TOOL] PhantomTap

Krishita Sanjay Choksi — Mon, 17 Aug 2026 04:26:23 +0000

[ Hardware & Bios ] A Flipper Zero that stops guessing and starts reasoning: ML-guided RFID/NFC fuzzing & access-control auditing that turns raw card reads into a prioritized, explainable security assessment. Defensive-use only.

[ARTICLE] Entry, Escalation, Persistence: Taking Apart Frappe's Document Follow

Robin Roy — Fri, 14 Aug 2026 05:39:25 +0000

[ Authentication - Exploits & Payloads ] Write-up on three authorization failures in Frappe - one at the object level, one at the field level, and one in the lifetime of the grant itself - that allowed an attacker to access data they aren't authorized to.

[ARTICLE] I found a KVM guest-to-host heap corruption bug and someone else got there first

Himasnhu Anand — Fri, 14 Aug 2026 05:37:48 +0000

[ Exploits & Payloads - Virtualization ] I found a heap out-of-bounds read/write in KVM';s SEV-SNP Page State Change handler. A malicious guest VM can corrupt host kernel heap memory and leak its layout, across the VM boundary, as many times as it wants.

[ARTICLE] Blacklight: Illuminating AI Agent Artifacts for Attackers and Defenders

Gavin Kramer — Fri, 14 Aug 2026 05:33:08 +0000

[ Machine Learning & AI - Tooling ] A review of Blacklight, an open-source security research toolkit for discovering and analyzing AI agent artifacts that reside on endpoints. It helps authorized security teams assess exposure, guide next decisions, and develop detection and hardening guidance

[TOOL] Blacklight

Fri, 14 Aug 2026 05:32:10 +0000

[ Machine Learning & AI - Vulnerability Analysis & Scanning ] Blacklight is a cross-platform toolkit for mapping, analyzing, and understanding the local AI agent attack surface across Windows, macOS, and Linux.

[ARTICLE] Turning Enterprise Update Servers Into Backdoor Factories - Part 2

Beyviel David — Fri, 14 Aug 2026 05:27:15 +0000

[ Keyloggers, Backdoors & Rootkits - Relay ] In this second part we detail how to bypass WSUS signature checks using .esd or .txt file extensions and deploy unsigned payloads via BITS for stealthy C2 persistence.

[ARTICLE] Turning Enterprise Update Servers Into Backdoor Factories - Part 1

Beyviel David — Fri, 14 Aug 2026 05:26:28 +0000

[ Keyloggers, Backdoors & Rootkits - Relay ] A deep dive into WSUS exploitation, showing how NTLM relay grants SQL database access and lets attackers push malicious updates to targets.

[ARTICLE] AmnesiaStealer: macOS Infostealer That Hijacks Browsers

Fri, 14 Aug 2026 05:24:17 +0000

[ Malware Analysis ] A technical analysis of AmnesiaStealer, a multi-stage Rust-based macOS infostealer spread through a counterfeit GitHub download page that captures the login password, reaches for macOS bypasses Apple has already patched, and can hand the operator live, hidden control of the victim's Chromium browser to steal authenticated sessions.

[ARTICLE] From Unauthenticated API to Grid Risk: A Hybrid Inverter Vulnerability Explained

Itai Shmueli — Fri, 14 Aug 2026 05:22:09 +0000

[ IoT & ICS ] A single misconfigured listening socket on FIMER's React 2 hybrid inverter lets an unauthenticated attacker send commands straight to the Supervisor MCU that governs the device's grid protections.

[ARTICLE] Return of the Cookie Monster

Andrew Gomez — Fri, 14 Aug 2026 05:20:07 +0000

[ Browser Security - Post-Exploitation & Lateral Movement ] Cookie protections have made traditional session theft harder, but they do not eliminate the value of an authenticated browser session to adversaries. This post explores enabling the Chrome DevTools Protocol (CDP) inside a running Chromium browser to perform post-ex activities such as browser enumeration, cookie theft, and browser takeover.

[ARTICLE] XSS2Shell: WordPress Preauth XSS to RCE Chain (CVE-2026-64638)

Nigusu Kasahun — Fri, 14 Aug 2026 05:18:43 +0000

[ Application Security - Exploits & Payloads ] A pre-authentication XSS to RCE chain in WordPress Core that allows unauthenticated attackers to achieve remote code execution on any default WordPress installation through the login page.

[ARTICLE] Spaghettifying DRAM

Christopher Domas — Fri, 14 Aug 2026 05:14:01 +0000

[ Hardware & Bios ] By modifying the bottom layers of the memory hierarchy to rewire the physical DRAM address translations, we scramble platform memory, exposing protected regions of DRAM - carveouts invisible even to the kernel. When the address translations break, so do the security primitives built on them, and we unlock everything.

[ARTICLE] When You Pay the Ransom - Taking Apart an Interlock ESXi Decryptor

Ian French — Fri, 14 Aug 2026 05:06:55 +0000

[ Malware Analysis - Reverse Engineering ] We dissect an Interlock ransomware ESXi decryptor - revealing it embeds the victim's RSA‑4096 private key, uses AES‑256‑GCM (with the authentication tag ignored) in a progressive, in‑place "strided" decryption that overwrites data without integrity checks, and includes several design flaws that can silently destroy files.

[TOOL] Dark-Agent

Fri, 14 Aug 2026 05:02:14 +0000

[ C2 & Exfiltration ] Dark Agent is a fully-featured Mythic C2 Agent for Linux and macOS environments. Built in Crystal with statically-linked OpenSSL, it provides comprehensive post-exploitation capabilities through COFF/BOF loading, extensive system commands, SOCKS proxy support, and flexible communication profiles.

[ARTICLE] Attack of The Extensions

Andrew Gomez — Fri, 14 Aug 2026 04:57:18 +0000

[ Browser Security - C2 & Exfiltration ] Browser extensions can turn Chromium into a persistent foothold. This post introduces a way to silently install extensions turning Chromium browsers into a command and control (C2) platform for persistent cookie theft.

[ARTICLE] Beats Studio Buds: Insecure Pairing Window

Dennis Heinze — Fri, 14 Aug 2026 04:56:16 +0000

[ Bluetooth - Exploits & Payloads ] We found a security vulnerability in Apple's Beats Studio Buds' pairing mechanism. The devices were found vulnerable to an insecure Bluetooth pairing window in which an attacker could pair with the earbuds without user interaction and establish a valid Bluetooth bonding. This would allow an attacker to eavesdrop on the victim through the earbuds' microphone, play audio on the device, or track the device via Bluetooth Low Energy.

[ARTICLE] Ruby 4.0 Universal RCE Deserialization Gadget Chain

Luke Jahnke — Fri, 14 Aug 2026 04:51:53 +0000

[ Exploits & Payloads ] This post releases a new universal chain that turns a single Marshal.load into command execution on Ruby, built with new gadgets from untapped sources as well as old gadgets put to new use.