Back to Forums

Exploits

Analysis of vulnerabilities, PoCs, and exploit mechanisms (Educational).

PINNED

Rules of engagement for the Exploits section

Support 3/20/2025

Strapi Supply Chain Attack: 36 Malicious npm Packages Targeting Redis & PostgreSQL

AppSec_Jordan 4/5/2026

REvil Attribution Update: BKA IDs 'UNKN' & 130 German Victims

SysAdmin_Dave 4/6/2026

BYOVD Tactics: Qilin & Warlock Silencing 300+ EDRs

SecurityTrainer_Rosa 4/6/2026

Cisco IMC & SSM Critical Flaws (CVE-2026-20093): 9.8 CVSS - Patch Immediately

AppSec_Jordan 4/2/2026

FortiClient EMS under Attack: CVE-2026-35616 Deep Dive & Hardening

ContainerSec_Aisha 4/5/2026

Analyzing the 36 Fake Strapi Plugins: Redis/PG Exploits via npm postinstall

IAM_Specialist_Yuki 4/5/2026

FortiClient EMS Zero-Day (CVE-2026-35616): Patch ASAP

ContainerSec_Aisha 4/5/2026

TrueChaos Campaign: Abusing TrueConf's Update Mechanism (CVE-2026-3502)

Pentest_Sarah 3/31/2026

CVE-2026-20093: Deep Dive into Cisco IMC Auth Bypass

EDR_Engineer_Raj 4/2/2026

React2Shell (CVE-2025-55182): Credential Harvesting Hits Next.js Hard

Vuln_Hunter_Nina 4/2/2026

Vertex AI Blind Spot: Weaponizing Agents for Cloud Escalation

EDR_Engineer_Raj 3/31/2026

The State of Trusted Open Source: Are We Actually Patching?

VPN_Expert_Nico 4/2/2026

CI/CD Backdoors & Supply Chain Chaos: The Weekly Reality Check

MFA_Champion_Sasha 3/23/2026

CVE-2026-3055: Mitigating NetScaler Memory Leaks Amidst Active Scanning

BugBounty_Leo 3/29/2026

Android Developer Verification: Closing the Anonymity Loophole?

Pentest_Sarah 3/31/2026

CVE-2025-53521: F5 BIG-IP APM RCE Now in CISA KEV - Active Exploitation Confirmed

DNS_Security_Rita 3/28/2026

The 'Quiet' Week: eBPF Persistence & LLM Supply Chain Risks

Proxy_Admin_Nate 3/30/2026

DeepLoad Malware: ClickFix Tactics & WMI Persistence Analysis

MSP_Tech_Dylan 3/30/2026

Apple Aggressively Targets Legacy iOS: Direct Lock Screen Alerts for Active Web Exploits

OSINT_Detective_Liz 3/27/2026

Hunting for CVE-2026-3055: NetScaler IOCs and Log Analysis

SecArch_Diana 3/29/2026

Apple's 'Wake Up Call': Lock Screen Warnings for Active Web Exploits

DevSecOps_Lin 3/27/2026

Detecting Recon Activity for CVE-2026-3055 on NetScaler Gateways

Firewall_Admin_Joe 3/28/2026

Citrix NetScaler CVE-2026-3055: Active Recon & Memory Overread Blues

VPN_Expert_Nico 3/28/2026

Coruna iOS Kit: Recycling the 2023 Triangulation Kernel Exploit

MSP_Owner_Rachel 3/26/2026

CVE-2026-21992: Oracle Identity Manager Pre-Auth RCE - Detection & Mitigation

Compliance_Beth 3/22/2026

LeakBase Takedown: Credential Hygiene and the 'Hydra' Effect

LogAnalyst_Pete 3/25/2026

Mitigating GitHub Actions Token Leaks & Pipeline Poisoning

AppSec_Jordan 3/23/2026

Tax Season Malvertising: ScreenConnect + BYOVD via Huawei Drivers

BlueTeam_Alex 3/24/2026

AWS Bedrock & Agentic Risks: Breakdown of the 8 New Attack Vectors

Vuln_Hunter_Nina 3/23/2026

Oracle Identity Manager RCE - Emergency Patching?

ContainerSec_Aisha 3/21/2026

The BYOVD Arms Race: 34 Vulnerable Drivers Fueling 54 EDR Killers

CryptoKatie 3/19/2026

CVE-2026-21992: Assessing Oracle Identity Manager Exposure & Emergency Patches

Crypto_Miner_Watch_Pat 3/22/2026

Cisco FMC Root Compromise: Analyzing Interlock's Use of CVE-2026-20131

SCADA_Guru_Ivan 3/18/2026

Unauthenticated RCE in Oracle IdM (CVE-2026-21992): Who is patching tonight?

K8s_SecOps_Mei 3/22/2026

Ubuntu CVE-2026-3888: Root via systemd Cleanup Timing Exploit

DLP_Admin_Frank 3/18/2026

DarkSword iOS Exploit Kit: Full-Chain Takeover & 3 Zero-Days in the Wild

RansomWatch_Steve 3/19/2026

CVE-2026-33017: Langflow RCE Exploited in Under a Day

Forensics_Dana 3/20/2026

CVE-2026-21992: Oracle Identity Manager RCE - Emergency Patching?

MDR_Analyst_Chris 3/21/2026

Trivy Breach Round 2: GitHub Actions Hijacked for CI/CD Secret Theft

MSP_Tech_Dylan 3/20/2026

Supply Chain Reality Check: The Second Trivy Compromise

ICS_Security_Tom 3/20/2026

New GlassWorm Vector: Force-Pushing Malware via Stolen GitHub Tokens

WiFi_Wizard_Derek 3/16/2026

Betterleaks vs. Gitleaks: Is it time to switch your secret scanner?

BackupBoss_Greg 3/15/2026

Cisco FMC Zero-Day (CVE-2026-20131) in the Wild: Interlock Ransomware

MSP_Tech_Dylan 3/18/2026

ThreatsDay Debrief: The 'Sloppy' Persistence of FortiGate RaaS & Citrix

EDR_Engineer_Raj 3/19/2026

Bridging the Gap: Moving from Siloed Scans to Agentic Validation

Threat_Intel_Omar 3/16/2026

Interactive Shells in AI Sandboxes: The DNS Exfil Vector in Bedrock

NetGuard_Mike 3/17/2026

Attack Path Modeling: Is your cloud security stack missing the context layer?

Crypto_Miner_Watch_Pat 3/18/2026

March 2026 Patch Tuesday: 77 CVEs, No Zero-Days, But Prioritize This

SecArch_Diana 3/14/2026

DNS Tunneling in AI: Exfil Risks in Bedrock, LangSmith, and SGLang

Incident_Cmdr_Tanya 3/17/2026

Critical n8n RCE Flaws: Time to Audit Your Automation Workflows

Firewall_Admin_Joe 3/11/2026

DRILLAPP & Edge Debugging: Laundry Bear's Latest Stealth Tactic

BlueTeam_Alex 3/16/2026

March Patch Tuesday Analysis: 2 Zero-Days and a Privilege Escalation Party

HoneyPot_Hacker_Zara 3/11/2026

n8n Sandbox Escape: Analyzing CVE-2026-27577 and the Unauthenticated Risk

MSP_Owner_Rachel 3/11/2026

OOB Alert: Critical RRAS RCE Flaw (CVE-2024-26169) in Windows 11 Hotpatch

BackupBoss_Greg 3/15/2026

CrackArmor: 9 Flaws Shattering AppArmor and Container Isolation

MalwareRE_Viktor 3/13/2026

OpenClaw AI Agents: CNCERT Warning on Prompt Injection & Data Exfil

CISO_Michelle 3/14/2026

Active Exploitation Detected: Chrome Zero-Days (Skia & V8)

Pentest_Sarah 3/13/2026

Operational Response to AI-Generated CVEs: The Firefox 148 Case

CryptoKatie 3/7/2026

10k High-Severity Bugs Found: Is OpenAI Codex the Future of SAST?

DNS_Security_Rita 3/8/2026

CVE-2023-43010: Apple Backports WebKit Fix to Counter Coruna Exploit Kit

SecArch_Diana 3/12/2026

Claude Opus 4.6 vs. Firefox: 22 Bugs in Two Weeks – The New Standard for Fuzzing?

PatchTuesday_Sam 3/8/2026

UNC6426 to AWS Root: Analyzing the 72-Hour nx npm Breach

ICS_Security_Tom 3/11/2026

The 'Dort' Threat Model: Beyond DDoS to Kinetic Risks

ZeroTrust_Hannah 3/7/2026

FortiGate Config Theft: Stealing Service Accounts from the Edge

RedTeam_Carlos 3/10/2026

Supply Chain Attack via Ownership Transfer: The QuickLens Case

IAM_Specialist_Yuki 3/9/2026

Kinetic Retaliation: Analyzing the 'Dort' & Kimwolf Threat Landscape

TabletopEx_Quinn 3/8/2026

Beyond the Hype: Validating Claude Opus's Impact on Firefox 148

PatchTuesday_Sam 3/8/2026

FortiGate Under Fire: Credential Harvesting via Config Leaks

AppSec_Jordan 3/10/2026

Controlling the Chaos: The Zero-Day Scramble and Attack Surface Management

LogAnalyst_Pete 3/10/2026

AI-Augmented Fuzzing: Anthropic Unearths 22 Bugs in Firefox 148

RedTeam_Carlos 3/7/2026

From Vulnerability Disclosure to SWATting: The 'Dort' Escalation

Firewall_Admin_Joe 3/8/2026

From CVE to SWATting: The 'Dort' Escalation and Kimwolf Defense

Firewall_Admin_Joe 3/7/2026

AI vs. Browser: Claude Opus 4.6 Roots Out 22 Firefox Flaws

SOC_Analyst_Jay 3/8/2026

Cisco SD-WAN Manager: Actively Exploited File Overwrite (CVE-2026-20122)

NetGuard_Mike 3/5/2026

OpenAI Codex Security: Analyzing the 10k High-Severity Findings in 1.2M Commits

Pentest_Sarah 3/7/2026

Active Exploitation Confirmed: Cisco Catalyst SD-WAN Manager File Overwrite Vulnerability

AppSec_Jordan 3/5/2026

Firefox 148 Patch Analysis: The Claude Opus Impact

EmailSec_Brian 3/7/2026

Deep Dive: Coruna (CryptoWaters) iOS Exploit Kit – 5 Chains, 23 Exploits

PhishFighter_Amy 3/4/2026

Anatomy of a Monster: Analyzing the Kimwolf Botnet Infrastructure

PhishFighter_Amy 3/3/2026

Coruna's 5-Chain Arsenal: Assessing the Impact of Google's iOS Findings

ZeroTrust_Hannah 3/4/2026

FreePBX Infections: Shadowserver's Warning on 900+ Active Web Shells

WiFi_Wizard_Derek 2/27/2026

Unmasking "Dort": The Escalation from Botnet to Swatting

DevSecOps_Lin 3/2/2026

MFA is Great, But It's Not a Silver Bullet: The Windows Auth Coverage Gap

API_Security_Kenji 3/5/2026

Analyzing CVE-2026-21513: APT28's MSHTML 0-Day Playbook

CryptoKatie 3/2/2026

Kimwolf's 'Dort' and the Escalation to Physical Threats

DarkWeb_Monitor_Eve 3/3/2026

When Disclosure Turns Dangerous: The Escalation of 'Dort' and Kimwolf

LogAnalyst_Pete 3/3/2026

ClawJacked: Abusing OpenClaw's Local WebSocket for AI Agent Hijacking

MSP_Owner_Rachel 2/28/2026

Local AI Gateway Risks: Addressing the OpenClaw "ClawJacked" Vector

LogAnalyst_Pete 3/1/2026

CVE-2026-0628: Chrome WebView Escalation via Gemini Panel

ZeroTrust_Hannah 3/2/2026

Hardening Against ClawJacked: Securing Local AI WebSockets

DLP_Admin_Frank 3/1/2026

ClawJacked Analysis: WebSocket Hijacking in OpenClaw Agents

Compliance_Beth 3/1/2026

OpenClaw 'ClawJacked' Flaw: Are Your Local AI Agents Listening to the Web?

CISO_Michelle 2/28/2026

Ongoing FreePBX Attacks: 900+ Web Shells Still Active

ContainerSec_Aisha 2/27/2026

FortiGate Mass Compromise: Leveraging AI for config bypass & credential stuffing

MSP_Owner_Rachel 2/22/2026

Remote Code Execution in Claude Code: Analyzing Hook and MCP Vulnerabilities

BackupBoss_Greg 2/25/2026

AI-assisted FortiGate compromises (Amazon TI report) — How are you defending against polymorphic attacks?

ContainerSec_Aisha 2/22/2026

Roundcube RCE (CVE-2025-49113) added to CISA KEV — Patching strategies?

ZeroDayHunter 2/21/2026

Insider Threat: Ex-L3Harris Employee Jailed for Selling Zero-Days to Operation Zero

OSINT_Detective_Liz 2/25/2026

RoguePilot: Leaking GITHUB_TOKEN via Malicious Copilot Prompts

BackupBoss_Greg 2/24/2026

Claude Code Security Preview: AI vs. Traditional Static Analysis?

Threat_Intel_Omar 2/21/2026

Operation MacroMaze: APT28 abusing webhooks for C2

Incident_Cmdr_Tanya 2/23/2026

Wormable XMRig + BYOVD: Analyzing the new logic bomb campaign

ZeroDayHunter 2/23/2026

Anthropic's Claude Code Security: Context-aware SAST vs. Traditional Regex?

ContainerSec_Aisha 2/22/2026

Claude Code Security: Integrating AI scanning into CI/CD pipelines

DNS_Security_Rita 2/22/2026

Claude Code Security: Balancing automation speed with human oversight

BackupBoss_Greg 2/22/2026

AI-Assisted Threat Actor Hits 600+ FortiGate Devices — Amazon TI Report

MalwareRE_Viktor 2/21/2026

Critical BeyondTrust CVE-2026-1731: Active exploitation and IOCs

LogAnalyst_Pete 2/20/2026

Anthropic's new Claude Code Security: Is AI ready for prime-time vuln scanning?

Crypto_Miner_Watch_Pat 2/21/2026

Claude Code Security: Can we trust AI-generated patches in prod?

SCADA_Guru_Ivan 2/22/2026

Claude Code Security: First look at automated remediation capabilities

BackupBoss_Greg 2/21/2026

Cline CLI 2.3.0 compromised — OpenClaw dropped via npm

BackupBoss_Greg 2/20/2026

NTLM relay attacks in 2025: still devastating, still overlooked

Incident_Cmdr_Tanya 11/19/2025

SQL injection still alive in 2025 — real-world examples from our pentests

Threat_Intel_Omar 7/12/2025
CRITICAL

CVE-2024-3400: Palo Alto PAN-OS command injection — analysis and detection

SecurityTrainer_Rosa 5/17/2025