Root Access Club

🚨 SubZer0 Alert · 1 new to patch now CVE-2026-61447 — PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets public exploit, EPSS 15% · CVSS 10.0 🌐 SubZer0 · 📣 @RootAccessClub · 🤖 @SubZer0Robot

SubZer0 just leveled up ⚡️ 🗂 121 vendor & product pages Every WordPress, Cisco, Fortinet, Chrome… CVE on one page, ranked by what to patch first 📅 Weekly recaps The CVEs that actually mattered each week: exploited, weaponized, critical 🤖 /week in @SubZer0Robot This week's recap right in your chat. /watch wordpress now links to the product's page too 🖼 Share cards Every patch now CVE gets its own preview card when you share the link 🔗 Browse by vendor 📊 Weekly recaps 🪎@RootAccessClub

Kali Linux 2026.3 Release 💠 🔥 Build-Scripts - Refreshed + build in Docker/Podman 🔥 KDE Plasma 6.7 - Per-screen virtual desktops 🔥 New Icons - Fresh desktop look 🔥 Kernel - Bumped from 6.19 to 7.1.5 🔥 NetHunter - WearHunter, NFC Arsenal, KernelSU 🔥 New Tools - dalfox, katana, rustscan, snaffler-ng & more Using Kali already❓ Update it: ┌──(RootAccessClub㉿kali)-[~] └─$ sudo tee /etc/apt/sources.list.d/kali.sources << 'EOF' Types: deb URIs: http://http.kali.org/kali/ Suites: kali-rolling Components: main contrib non-free non-free-firmware Signed-By: /usr/share/keyrings/kali-archive-keyring.gpg EOF ┌──(RootAccessClub㉿kali)-[~] └─$ sudo apt update && sudo apt -y full-upgrade ┌──(RootAccessClub㉿kali)-[~] └─$ cp -vrbi /etc/skel/. ~/ ┌──(RootAccessClub㉿kali)-[~] └─$ [ -f /var/run/reboot-required ] && sudo reboot -f Read more 🌐 💎 @RootAccessClub

📡 SubZer0 Daily · Mon, Oct 26 258 new CVEs · 4 critical · 0 added to CISA KEV 🎯 Patch now • CVE-2026-116067 8.8 · weaponized GetFile Full list → https://iliya-bashrc.github.io/SubZer0/ 🌐 SubZer0 · 📣 @RootAccessClub · 🤖 @SubZer0Robot

🚨 SubZer0 Alert · 3 new to patch now CVE-2026-102782 — Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0… Metasploit/Nuclei can already hit it · CVSS 9.3 CVE-2026-102878 — mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that… Metasploit/Nuclei can already hit it · CVSS 8.6 CVE-2026-116067 — Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and… Metasploit/Nuclei can already hit it · CVSS 8.8 🌐 SubZer0 · 📣 @RootAccessClub · 🤖 @SubZer0Robot

The RootAccessClub Chat is now open 💬 Discuss CVEs, tools, exploits & everything security – with people who actually get it 🔐 Human verified members only 🚫 Zero ads, zero spam ⚖️ Clear rules, active moderation 👉 Join

🚨 SubZer0 Alert · 4 new to patch now CVE-2026-109619 — PHP has various global state that temporarily points into request memory. public exploit, EPSS 100% · CVSS 9.2 CVE-2026-111497 — A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3… public exploit, EPSS 33% · CVSS 9.2 CVE-2026-97229 — GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before… public exploit, EPSS 18% · CVSS 10.0 CVE-2026-90970 — GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI… public exploit, EPSS 17% · CVSS 9.9 🌐 SubZer0 · 📣 @RootAccessClub · 🤖 @SubZer0Robot

Hey guys, quick heads up. I⁩’⁦ve been dealing with a brutal headache these past few days and it⁩’⁦s literally driving me crazy. If I⁩’⁦m not as active, that's why⁩ 🫩 ⁦On the bright side, I managed to push a nice update to the bot, so it's fully up and running for you guys now. Catch you soon⁩ ❤️‍🔥

Hey guys, quick heads up. I⁩’⁦ve been dealing with a brutal headache these past few days and it⁩’⁦s literally driving me crazy. If I⁩’⁦m not as active or take a bit longer to reply, that's why. Catch you soon 🫩

SubZer0Robot is live ⚡ SubZer0 now lives inside Telegram 🤠 🚨 Early warnings — new exploitation waves, posted the moment they're detected 🔴 Fresh CISA KEV entries — actively exploited CVEs, automatically 📱 Mini App — the full CVE tracker, PoCs and dossiers right inside Telegram 🔄 Live layer refreshed every ~15 min · Ed25519-signed data 🤖 mini app 🔔 Alerts land 🌐 Web by @BugCod3 & @RootAccessClub

✅ SubZer0 Sentinel is connected Live CVE & zero-day alerts will be posted here automatically. https://iliya-bashrc.github.io/SubZer0/

🔴 CVE-2026-115560 — unpatched RCE in PHP ⚡️ Two days after the emergency php2shell fixes (CVE-2026-109618 / 109619), another RCE path dropped. Still no patch 🧩 The bug: session serialize_handler mismatch Write side uses php_serialize, read side switches to the legacy php handler. That handler splits the session file on the first "|", so an attacker-controlled key becomes a serialized value 💉 Injection: session.upload_progress Send PHP_SESSION_UPLOAD_PROGRESS as inj|O:14:"Gadget":... and with cleanup=Off the poisoned key stays in the session file 💥 Result: unserialize → object → __destruct → file_put_contents → webshell → RCE as www-data No LFI, no memory corruption, works on mod_php. ✅ Until the fix: • session.upload_progress.enabled=0 • one handler for the whole app, never two • treat "|" in session keys as invalid 🧪 GitHub @RootAccessClub

🤫 حرفایی که رو در رو بهت نمی‌گن… اینجا ناشناس به دستت می‌رسه! با WhisperTopic یه لینک اختصاصی می‌سازی، می‌ذاری تو بیو یا استوری، و هر کی بخواد بدون اینکه بشناسی‌اش بهت پیام می‌ده 👀 ✨ چی داره که بقیه ندارن؟ 🗂 برای هر ناشناس یه تاپیک جدا، دیگه پیام‌ها قاطی نمی‌شن 🎯 به هر کسی که بخوای ناشناس پیام بده 👀 تیک دیده‌شد، بفهم پیامت خونده شده یا نه ✏️ ویرایش و ❤️ ری‌اکشن، همه‌چی همگام می‌شه 🛡 فیلتر فحش و بلاک مزاحم 🎭 هویتت فقط با رضایت خودت معرفی می‌شه 🎲 سوال‌های آماده برای استوری 🔒 هویتت هیچ‌وقت فاش نمی‌شه. 👇 همین الان رایگان لینکتو بساز: 🤖 @WhisperTopicBot https://t.me/WhisperTopicBot ⚡️ Powered by @BugCod3

🤫 حرفایی که رو در رو بهت نمی‌گن… اینجا ناشناس به دستت می‌رسه! با WhisperTopic یه لینک اختصاصی می‌سازی، می‌ذاری تو بیو یا استوری، و هر کی بخواد بدون اینکه بشناسی‌اش بهت پیام می‌ده 👀 ✨ چی داره که بقیه ندارن؟ 🗂 برای هر ناشناس یه تاپیک جدا، دیگه پیام‌ها قاطی نمی‌شن 🎯 به هر کسی که بخوای ناشناس پیام بده 👀 تیک دیده‌شد، بفهم پیامت خونده شده یا نه ✏️ ویرایش و ❤️ ری‌اکشن، همه‌چی همگام می‌شه 🛡 فیلتر فحش و بلاک مزاحم 🎭 هویتت فقط با رضایت خودت معرفی می‌شه 🎲 سوال‌های آماده برای استوری 🔒 هویتت هیچ‌وقت فاش نمی‌شه. 👇 همین الان رایگان لینکتو بساز: 🤖 @WhisperTopicBot https://t.me/WhisperTopicBot ⚡️ Powered by @BugCod3

🚨 PHP2Shell is live on SubZer0 Two critical PHP core flaws, CVSS 9.2: CVE-2026-109618 + CVE-2026-109619 One unauthenticated request can lead to remote code execution. ✅ Fixed in: PHP 8.5.12 · 8.4.27 · 8.3.36 · 8.2.35 📂 On the site: 30+ public PoCs (updated every 15 min), scanners, Nuclei templates and official advisories. 🔗 https://iliya-bashrc.github.io/SubZer0/ ⚠️ Run PoCs only in a test lab. #PHP2Shell #PHP #RCE @RootAccessClub × @BugCod3

php2shell – CVE-2026-109618 / CVE-2026-109619 (PoC) Two critical bugs in PHP core session upload progress mechanism causing a heap use-after-free (UAF) leading to arbitrary code execution (RCE) • Severity: Critical (CVSS v4.0: 9.2) 🚨 • Impacted Versions: PHP 5, 6, 7, and 8. Official patches are only coming for active PHP 8 branches, leaving EOL versions (5.x, 7.x, 8.0, 8.1) completely exposed🛡 The repository explains how to fix and mitigate it using WAF (ModSecurity) rules and Apache .htaccess configurations to block malicious requests before they even reach PHP 🟢 Github 🌐 ⚠️Disclaimer: Our channel is not responsible for any misuse of this information or tool ⭐️@RootAccessClub

PHP2Shell – Critical PHP Core RCE 🚨 CVE-2026-109618 / CVE-2026-109619 | CVSS 9.2 🫨 Two critical memory-safety flaws in PHP Core, reachable through session upload-progress handling, can lead to Remote Code Execution (RCE) on affected web servers 💣 Affected versions span PHP 5.4 → 8.5 🦠 🛡 Fix: Update PHP to the latest patched release for your branch (8.2+ officially supported) Sansec Advisory 🔗 💎 @RootAccessClub

Detect PHP powered websites & IPs using the updated php-detect nuclei template 💥 GitHub 🌐 @RootAccessClub

Reposted because of some spam bots flooding the last one, Let's keep it real⁩ 🤠 drop your reactions and show some support again⁩ ❤️‍🔥

❄️ SubZer0 – Noise in. Priority out Thousands of new CVEs every month Only a few actually matter — SubZer0 shows you which ones to patch first 🔴 KEV · EPSS · PoC · Metasploit · Nuclei — all in one view 🔐 SHA-256 verified · auto-refreshed every 6h ⚡️ Free · no sign-up · no tracking 🌐 iliya-bashrc.github.io/SubZer0 💻 github.com/iliya-bashrc/SubZer0 💎 @RootAccessClub × @BugCod3