Talkback

AI Powered Infosec Resource Aggregator to Boost Productivity.

Developed by elttam

Sign in to customize your weekly newsletter.

Resources See all

IBM Db2 Mirror for i: pre-auth RCE and the road to QSECOFR app exp

A vulnerability in Db2 Mirror servlet allows attackers to bypass authentication and validation, enabling arbitrary file reads and writes—including JSP creation and execution—leading to full privilege escalation on IBM i systems.

Mon 14 Sep blog.silentsignal.eu

The V8 JavaScript Runtime Undermined My Constant-Time JavaScript Library crypto app

A JavaScript library's secret-dependent behavior was exploited via V8's boolean and signed-zero handling, prompting a fix that replaced boolean logic with numeric flags and adjusted mask generation to ensure true constant-time execution, highlighting the difficulty of achieving strong guarantees in JS engines.

Sat 12 Sep soatok.blog

CVE-2026-82329: Unauthenticated Administrative Access in JFrog Artifactory via an Empty Cluster Join Key app exp

CVE-2026-82329 is a critical unauthenticated vulnerability in JFrog Artifactory allowing attackers to forge admin tokens via an empty cluster join key, with patches available in recent versions.

Fri 11 Sep bishopfox.com

UK Council Attack Linked to SonicWall SMA 1000 Campaign net app exp

A UK council incident linked to mass SonicWall SMA1000 exploitation via CVE-2026-15409 led to credential theft and AD domain compromises across multiple targets worldwide.

Thu 10 Sep hunt.io

GitHub - S3N4T0R-0X0/BEAR-C2: BEAR-C2 is an adversary simulation and emulation framework built around real-world TTPs inspired by Russian, Chinese, North Korean, and Iranian APT groups. net

BEAR-C2 is a flexible, GUI-based adversary emulation framework featuring multi-protocol C2 listeners, cloud exfiltration, messaging channels, and customizable TTPs for educational and research purposes.

Thu 10 Sep github.com/S3N4T0R-0X0

Mind the Config: Detecting and Weaponizing NetScaler CVE-2026-19490 app net

CVE-2026-19490 is a critical pre-authentication bypass in Citrix NetScaler SAML handling that can lead to DoS, SSRF, or root access, with fixes in specific builds; detection involves testing SAML POST responses, and impact varies based on configuration.

Thu 10 Sep bishopfox.com

Vulnerabilities See all

CVE-2022-42475 9.8

Analyzed

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a rem…

Thai Broadband Provider Targeted via FortiGate SSL-VPN and MeshCentral Persistence
Critical Arista VeloCloud Orchestrator Vulnerability Exploited as Zero-Day
Operation Escaneo Signals Shift in LatAm Threat Landscape
...

CVE-2021-4034 7.8

Analyzed

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec …

Thai Broadband Provider Targeted via FortiGate SSL-VPN and MeshCentral Persistence
PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure
Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry
...

CVE-2021-42287 7.5

Analyzed

Active Directory Domain Services Elevation of Privilege Vulnerability

Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF
AD Research: Two new vulnerabilities could lead to full domain takeover
dMSA Ouroboros: Self-Sustaining Credential Extraction in Windows Server 2025
...

CVE-2021-42278 7.5

Analyzed

Active Directory Domain Services Elevation of Privilege Vulnerability

Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF
AD Research: Two new vulnerabilities could lead to full domain takeover
Active Directory Exploitation with Metasploit
...

CVE-2021-22986 9.8

Analyzed

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated re…

Thai Broadband Provider Targeted via FortiGate SSL-VPN and MeshCentral Persistence
GitHub - ARPSyndicate/cve-scores: EPSS & VEDAS Score Aggregator for CVEs
GitHub - S3cur3Th1sSh1t/My-starred-Repositories: This is my starred repositories including the description for each tool. Makes search/filter over them easier.
...

CVE-2018-13379 9.1

Analyzed

An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows a…

Thai Broadband Provider Targeted via FortiGate SSL-VPN and MeshCentral Persistence
FBI Disrupts China-Linked QTFY Infrastructure Used to Steal Data From U.S. Organizations
Vulnify: Giving Your Agents a CVE Brain
...

Topics See all

RouterOS MikroTik

Network operating system / router firmware

14th September – Threat Intelligence Report
CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV
GitHub - dinosn/mikrotrick-poc: CVE-2026-67276 RouterOS SSH public-key authentication bypass lab PoC
...

Python Python Software Foundation

Programming language

[Op Report] Hands-on-Keyboard Activity from the DPRK "PolinRider" Supply Chain Attack
Exploitation 101: Exploiting a Python eval() Bug for Remote Code Execution
GitHub - moio9/NFS-Online-Server: NFS MW, UG2 and Carbon online server emulator.
...

Kubernetes Kubernetes

Container orchestration platform

The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE
Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution
Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems
...

PowerShell Microsoft

Command-line shell

GitHub - ivancabrera02/HashSiphon
[Op Report] Hands-on-Keyboard Activity from the DPRK "PolinRider" Supply Chain Attack
Unmasking SCCM Application Execution
...

Windows Microsoft

Operating system

PasteSwitch Clickfix Operation Compromises HBO on Reddit
⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits
GitHub - PirusPoker/ghidra-ai-copilot: AI reverse-engineering assistant for Ghidra - analyze functions with Claude, right inside the tool.
...

Google Visualization API Google

Developer API

ClickFix Campaigns Abuse Legitimate Services for Persistent Access
ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2

Indexed Resources