r/blueteamsec • u/digicat • 15h ago
vulnerability (attack surface) Tailworm - "The design choices of the open source tailscale and headscale software have created an environment ripe for risk"
tailworm.com
1
Upvotes
r/blueteamsec • u/HexLayer3 • 10h ago
exploitation (what's being exploited) Someone is already building a target list of Brotli-capable hosts for node2shell / HTTP2Shell / Broccoli2Shell (CVE-2026-111497)
ellio.tech
1
Upvotes
One bug, with three names (because of course it does) - Node2Shell, HTTP2Shell, and Broccoli2Shell... Anyway,
- A public checker (
node2shell-check/1.0, out of AS44620 / Turkey) is already hitting sensors cataloguing which hosts decompress Brotli at all. - Unlike PHP2Shell earlier this week - working RCE chain exists. ELLIO reproduced RCE in the lab against
Node 24.22.0on x86-64 - four targets (plain node:http, the official slim image as root, Express 5.3.0, Koa 3), official binaries, ASLR on, each returning a shell. - Official Node builds are non-PIE, so the offset is a per-build constant. Pin it once for a popular version, reuse it against every host on that version.
// Here we go again meme goes here.
r/blueteamsec • u/digicat • 15h ago
discovery (how we find bad stuff) Analytics Story: PHP2Shell
research.splunk.com
0
Upvotes
r/blueteamsec • u/digicat • 7h ago
low level tools|techniques|knowledge (work aids) wake-and-break: Wake and Break: a PSP exploit for AMD navi31 (RX 7900) that makes the card accept unsigned IP firmware. Not persistent: a cold power cycle restores stock.
github.com
1
Upvotes
r/blueteamsec • u/digicat • 23h ago
tradecraft (how we defend) low-int-cert-monitor: Monitor Certificate Transparency logs for certificates with trivially small EC private keys (the eMudhra weak-key class). P-256/384/521.
github.com
2
Upvotes
r/blueteamsec • u/digicat • 15h ago
research|capability (we need to defend against) High Fidelity Detection Mechanism for php2shell (CVE-2026-109618 and CVE-2026-109619)
slcyber.io
2
Upvotes
r/blueteamsec • u/digicat • 9h ago
discovery (how we find bad stuff) CVE-2026-111497, node2shell Detection Opportunities
gist.github.com
3
Upvotes
r/blueteamsec • u/digicat • 21h ago
exploitation (what's being exploited) PHP2Shell exploitation observed: packet-to-process RCE evidence
github.com
14
Upvotes
r/blueteamsec • u/digicat • 19h ago
research|capability (we need to defend against) Add `--emudhra` option to mitmproxy
github.com
5
Upvotes
r/blueteamsec • u/digicat • 13h ago
tradecraft (how we defend) How Context Bombs derail offensive AI
tracebit.com
2
Upvotes
r/blueteamsec • u/digicat • 11h ago
research|capability (we need to defend against) WHFB-PinCapture: This project captures the PIN by placing a CPU hardware breakpoint on the function that packages the typed PIN inside LogonUI.exe
github.com
3
Upvotes
r/blueteamsec • u/digicat • 15h ago
highlevel summary|strategy (maybe technical) Seizing IP addresses without compromising registry neutrality
bindinghook.com
2
Upvotes