İbrahim BALOĞLU - Siber Güvenlik Paylaşımları
前往频道在 Telegram
Mevcut grup, Siber Güvenlik alanında paylaşımlar yapmak için oluşturulmuştur.
显示更多1 138
订阅者
无数据24 小时
-27 天
+830 天
帖子存档
#AppSec
#NetSec
1⃣ CVE-2026-97631:
Pre-boot RCE in EDK II PXE driver
https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m
2⃣ Unauthenticated file read leaks master key on Enterprise proxy
https://github.com/BerriAI/litellm/security/advisories/GHSA-w4c7-34wj-hqm8
3⃣ XSS in Cloudflare's /cdn-cgi/image/
https://www.slcyber.io/research/cache-me-if-you-can-xss-in-cloudflares-cdn-cgi-image
#info
#tools
PHP2Shell: 22-24 October 2026
https://gist.github.com/0x4D31/6b1e7b5fb7a10219af187be91335c96f
]-> High Fidelity Detection Mechanism
]-> Analytics Story
Python scanner for CVE-2026-109618, CVE-2026-109619 and the php2shell session chains (handler mismatch + LFI). No external dependencies.
https://github.com/pentestershell/php2shellbt
#Offensive_security
#Malware_analysis
PhantomBuffer:
Effective EDR Evasion Through Stealth Injection
https://www.zerosalarium.com/2026/10/PhantomBuffer-Effective-EDR-Evasion-Stealth-Injection.html
]-> https://github.com/TwoSevenOneT/PhantomBuffer
// The article introduces "PhantomBuffer", a stealth technique that injects payloads into processes via SendMessageW with WM_SETTEXT, avoiding WriteProcessMemory, and leverages cdb.exe for thread hijacking, with recommendations to monitor related API calls and suspicious debugger activity
#AppSec
1⃣ GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)
https://www.rapid7.com/blog/post/ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-97229
2⃣ Plex2Shell:
Unauthenticated RCE in Plex Media Server
https://zmain.info/blog/plex2shell
3⃣ CVE-2026-108097 Deep Dive:
Turning a Drupal Field UI Callback Into RCE
https://fortbridge.co.uk/research/cve-2026-108097-deep-dive-turning-a-drupal-field-ui-callback-into-rce
#AIOps
#Red_Team_Tactics
An agentic AI red team checklist:
222 tests across 20 categories, WSTG-style
https://infosecravi.com/blog/agentic-ai-red-team-checklist
#Analytics
#Threat_Research
An analytical review of the main cybersecurity events (Oct 03-10, 2026)
0⃣ Whatsapp NDay
1⃣ Citrix Netscaler SAML 0-Day Vulnerability (CVE-2026-88779)
]-> Understanding and Addressing
2⃣ DNSSEC Root Key Signing Key Rollover
3⃣ Scans for Atlassian vulnerablity
// CVE-2026-21589
4⃣ Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance
// an example of how an inexperienced "prompt kiddie" uses AI to carry out an attack
5⃣ .gh, .sl and .as ccTLD Compromise
6⃣ OpenSSH 10.6 Released
7⃣ Zammad Session Leak to RCE
// CVE-2026-102489
8⃣ Breaking Discourse's Image Pipeline
9⃣ PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578
// An evolving exploit chain against PaperCut NG 26.0.3 - 26.0.5 combines multiple patch bypasses and vulnerabilities to enable unauthenticated RCE
🔟 LSA secrets extraction, reuse a preexisting VSS shadow copy + inline regf parser + AES-256 LSA decrypt via bcrypt.dll
#Analytics
#Threat_Research
An analytical review of the main cybersecurity events (Sep 26 - Oct 03, 2026)
1⃣ Here We Go Again:
Citrix NetScaler DTLS Preauth Memory Overflow
// CVE-2026-88772
2⃣ A Realistic Code Execution Exploit Chain in OpenBao and Vault
3⃣ Attackers abuse ChatGPT to deliver RAT via ClickFix
4⃣ Poper Blocker: The Adblocker That Spies on You
5⃣ PoC for macOS CoreServices Priv. Escalation
// CVE-2026-43786
6⃣ PaperCut MF Zero-Day Intrusion: Java Loader, Web Shell, and AdaptixC2 via CVE-2026-82078 and CVE-2026-81578
7⃣ CVE-2026-86950: The Great Glyph Grift
// An in-the-wild iOS bug with a possible WhatsApp zero-click path
8⃣ Stopping a coordinated campaign to distill models
9⃣ nDPI TCP Fingerprint: A Stable, Patent-Free Way to Fingerprint TCP Stacks
#Malware_analysis
1⃣ SparroWock: The backdoor that bites, the commands that catch
https://www.welivesecurity.com/en/eset-research/beware-sparrowock-backdoor-bites-commands-catch
2⃣ New Settra Ransomware Variant Deploys MeshAgent RMM
https://www.huntress.com/blog/new-settra-ransomware-variant
3⃣ HEAVYGRAM: A Telegram-based Surveillance Backdoor Linked to Handala Hack
https://www.group-ib.com/blog/heavygram-handala-hack-telegram-c2
4⃣ Neural Override - AI-Orchestrated RAT With SCADA Tasking
https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-09-15-Neural-Override-AI-Orchestrated-RAT.txt
#Analytics
#Threat_Research
An analytical review of the main cybersecurity events (Sep 12-19, 2026)
1⃣ Thai Broadband Provider Targeted via FortiGate SSL-VPN and MeshCentral Persistence
2⃣ CISA to Sunset Weekly Vulnerability Bulletin on September 28, 2026
3⃣ Cisco Identity Services Engine Authentication Bypass Vulnerability
// CVE-2026-76460
4⃣ PolarProxy 2.0.2 Released
// PolarProxy can now tunnel outgoing connections through SOCKS proxies and supports environment variables as an alternative to CLI arguments
5⃣ Acronis LPE due to insecure file permissions
// CVE-2026-87886
6⃣ Click2Shell: Preauth WP Core Theme Preview Injection to RCE Chain
7⃣ Attackers exploited MikroTik RouterOS vulnerabilities to perform an unauthenticated "MikroTik" administration takeover
8⃣ StyleSmuggler Attacks (Magento/Adobe Commerce)
// CVE-2026-75650
9⃣ A 32-Year-Old Bug Walks Into A Telnet Server (GNU inetutils Telnetd CVE-2026-32746 Pre-Auth RCE)
🔟 Pipelock v.3.5.0 - Firewall for AI agents
// DLP scanning, SSRF protection, bidirectional MCP scanning, tool poisoning detection, and workspace integrity monitoring
#tools
#Malware_analysis
#Blue_Team_Techniques
RuleAutoPilot: Synthesizing Deployable Suricata Rules from Network Traffic", Sep 2026.
// RuleAutoPilot - end-to-end agentic framework that generates deployable Suricata rules directly from malware network traffic, with no prior threat intelligence required. A key challenge is noise: network traffic captures often contain a small amount of security-relevant traffic mixed with large volumes of background traffic, which reduces LLM reasoning quality and increases cost. RuleAutoPilot addresses this challenge with a Benign Traffic Fingerprinting stage that removes known benign background flows before LLM processing
#Malware_analysis
1⃣ "Eye" spy: Cyclops Blink returns with extended capabilities
https://www.sophos.com/en-gb/blog/-eye-spy-cyclops-blink-returns-with-extended-capabilities
2⃣ Angry Birds: Toy Ghouls’ new toys
https://securelist.com/toy-ghouls-new-hivemq-and-element-backdoors/121270
3⃣ REVSTEALER: analysis of up-and-coming infostealer
https://www.elastic.co/security-labs/threat-command/revstealer-credential-harvesting-infostealer
#AppSec
#Research
#WebApp_Security
"IDORacle: Template-Guided SQL-Sink Mediation for Object-Level Authorization in Java Applications", Sep 2026.
]-> https://github.com/GuanhangShiFDU/IDOR-GUARD
// Cross-language IDOR reproduction and defense demo for Java, Python, Go, and PHP applications. Evaluated applications include XXL-Job, RuoYi, BootDo, wger, Gitea, Krayin, and Langflow
#Analytics
#Threat_Research
An analytical review of the main cybersecurity events (Sep 05-12, 2026)
1⃣ Sonicwall SMA1000 Attack
// CVE-2026-15409
2⃣ Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability
3⃣ Next Nightmare Eclipse Vulnerability
// Microsoft has failed to properly patch ShieldBreak CVE-2026-69414..
4⃣ FortiPAM Vulnerability
// CVE-2026-84388
5⃣ Researchers from Nebula Security have disclosed 18 vulnerabilities in the Linux kernel
// CVE-2026-80714, CVE-2026-74597, CVE-2026-74581, CVE-2026-74480, CVE-2026-72255, CVE-2026-72137, CVE-2026-68376, CVE-2026-68162, CVE-2026-64560, CVE-2026-63834, CVE-2026-52933, CVE-2026-52929, CVE-2026-52924, CVE-2026-52923, CVE-2026-52912, CVE-2026-43501, CVE-2026-43502, CVE-2026-43074, CVE-2026-43042, CVE-2026-31678, CVE-2026-31659, CVE-2026-23274
6⃣ Netscaler ADC Exploit
7⃣ Critical vulnerabilities in MikroTik RouterOS
8⃣ GRAYRABBIT One-click backdoor
// One click. Three critical failures. One backdoor
9⃣ Attacks using browser-in-browser (BiTB) phishing techniques
🔟 Beltdown: Escaping the Claude Code sandbox
// An untrusted repository opened in Claude Code can escape the macOS sandbox and run commands on your computer as your privileged user
#reversing
#Malware_analysis
Malware Analysis Series (MAS):
Article 10 - Linux, 2025.
]-> Article 09 - Shellcode (.pdf)
]-> Articles 01 - 08
// last article of MAS series.
#Threat_Research
#Malware_analysis
1⃣ Robobox: Self driven malware creation and execution
https://netaskari.substack.com/p/robobox-self-driven-malware-creation
2⃣ UpdraftPlus: PHP backdoor delivery attempts via CVE-2026-10795
https://offseq.com/en/research/the-backdoor-inside-the-backup-request
3⃣ Tengu: Reverse Engineering a Mirai-Style Linux/IoT Botnet
https://app.reverser.space/p/duckie/tengu-reverse-engineering-a-mirai-style-linux-iot
4⃣ PEEP: A Chrome Extension RAT
https://socradar.io/blog/peep-browser-rat-chrome-extension
#Analytics
#Threat_Research
An analytical review of the main cybersecurity events (Aug 15 - Sep 05, 2026)
0⃣ nDPI 6.0 (Aug 2026)
1⃣ Attackers used BGP to spoof the Virtualizor update server and the Softaculous website
2⃣ Sleepwalker Malware
3⃣ Sangoma Switchvox Exploit
4⃣ Fronics Deploy Abuse
5⃣ Escaping Google Cloud Application Integration Sandbox: Straight into Borg
6⃣ VMware threat emulation techniques
// A reproducible catalogue of 86 atomic actions against vCenter, ESXi, SDDC Manager, and the wider VCF ecosystem
7⃣ Log4J FilteredObjectInputStream Vulnerability
// Research
8⃣ FTP Banners The New Dead Drop Resolver Delivering Novel RATs
9⃣ Android Car Malware
🔟 AliExpress WebAudio fingerprinting
#exploit
#AppSec
1⃣ FalconFlank - Crowdstrike Falcon 0day Privilege Escalation Vulnerability
https://github.com/MSNightmare/FalconFlank
2⃣ Chamilo LMS... It's raining 0days, hallelujah, it's raining 0days
https://blog.quarkslab.com/chamilo-lms-its-raining-0days-hallelujah-its-raining-0days.html
3⃣ Privilege escalation from IIS AppPool to NT Authority/SYSTEM via AD CS RPC endpoint
https://www.mannulinux.org/2026/08/Privilege-escalation-from-IIS-AppPool-to-NT-AuthoritySYSTEM-via-AD-CS-RPC-endpoint.html
]-> Certi-Bhai - AD CS Exploitation Toolkit
