Concryptor

Concryptor Un motor de cifrado AEAD multi-hilo escrito en Rust. Cifra y descifra archivos a un rendimiento de gigabytes por segundo utilizando un pipeline de iouring con triple búfer, procesamiento paralelo de fragmentos mediante Rayon y cifrados optimizados en ensamblador a través de ring. ⚠️...

java-remote-class-loader

Esta herramienta te permite enviar bytecode de Java en forma de archivos de clase a tus clientes o potenciales objetivos para cargarlos y ejecutarlos usando ClassLoader de Java junto con la API Reflect. El cliente recibe el archivo de clase del servidor y devuelve la salida de ejecución...

java-remote-class-loader

This tool allows you to send Java bytecode in the form of class files to your clients or potential targets to load and execute using Java ClassLoader together with Reflect API. The client receives the class file from the server and return the respective execution output. Payloads must be written ...

Tourmaline

Tourmaline I recently stumbled upon a piece of cleverly designed malware that calls itself "Tourmaline". This README is very kindly written by Claude as I was super busy with exams at the time of this repository's inception. Exploiting and decrypting this malware took a huge chunk of my time from...

torchat

TorChat - Anonymous P2P Chat Secure, private, and anonymous peer-to-peer chat over the Tor network. What is TorChat? its a lightweight, privacy-first messaging tool that lets you communicate directly with others over the Tor network—without any central servers. It's designed for those who care...

CESS

CESS — Cryptologically Enchanted Shamir's Secret Is this AI bullshit or slop? A cryptographer or serious implementer reviewing CESS will typically open vectors/ and testdata/ before reading prose. The test suite is the proof of work: it encodes domain knowledge that cannot be substituted with...

EphemeralNet

EphemeralNet A secure P2P network with custom Relay for hostile NATs, built in C++20. Programmable forgetting for high-assurance peer-to-peer storage. Why EphemeralNet? Shardian designs infrastructure for teams that take deletion guarantees as seriously as confidentiality. EphemeralNet is our C++...

sorry-ransomware-analysis

Sorry Ransomware Analysis CVE-2026-41940 cPanel Campaign Public IOC pack, YARA rules, forensic scripts and analysis methodology for the "Sorry" ransomware .sorry extension family that emerged in late April 2026, spread via the cPanel/WHM authentication bypass CVE-2026-41940. ⚠️ Files encrypted by...

CVE-2026-15890: Reusing a Nonce, Key Pair in Encryption

The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, securestorageitstransformaeadgetnonce in subsys/securestorage/src/its/transform/aeadget.c, stores its nonce counter in unsynchronized function-local static variables snonce and snonceinitialized. Every ITS writ...

Astra Linux – Vulnerability in nss

A flaw was discovered in the implementation of CHACHA20-POLY1305 in NSS versions prior to 3.55. When using multi-part Chacha20, it could lead to out-of-bounds reads. This issue was addressed by explicitly disabling multi-part ChaCha20 which was not functioning correctly and enforcing strict tag...

Astra Linux – Vulnerability in Firefox, NSS

Calling PK11Encrypt in NSS using CKMCHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge processor. In Firefox, this only affects the QUIC header protection feature when the connection uses the ChaCha20-Poly1305 cipher suite. The most likely outcome i...

pingtunnel master-d7cd0d6ab5f18e7d8d050385e8d240b3b2f41e6c

Pingtunnel Pingtunnel is a tool that sends TCP/UDP traffic over ICMP. Note: This tool is only to be used for study and research, do not use it for illegal purposes Usage & Detailed Documentation 📖 For detailed documentation, seeUSAGE.md: includes complete command-line parameters, configuration fi...

DEBIAN-CVE-2026-87732

An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticatedecryptinto and Chacha20.authenticatedecryptinto functions write the decrypted plaintext into a caller-provided buffer and only then compares the tag. On a forged tag, the functions returns false,...

CVE-2026-87732

CVE-2026-87732 affects the mirage-crypto OCaml package before 2.2.0 . The AES.GCM.authenticate_decrypt_into and Chacha20.authenticate_decrypt_into functions write the decrypted plaintext into a caller-provided buffer before comparing the authentication tag. On a forged tag the function correctly ...

CVE-2026-87732

An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticatedecryptinto and Chacha20.authenticatedecryptinto functions write the decrypted plaintext into a caller-provided buffer and only then compares the tag. On a forged tag, the functions returns false,...

Linux Distros Unpatched Vulnerability : CVE-2026-87732

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticatedecryptinto and Chacha20.authenticatedecryptinto functions...

PT-2026-88811

An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticate decrypt into and Chacha20.authenticate decrypt into functions write the decrypted plaintext into a caller-provided buffer and only then compares the tag. On a forged tag, the functions returns...

CVE-2026-87732: Improper Verification of Cryptographic Signature

An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticatedecryptinto and Chacha20.authenticatedecryptinto functions write the decrypted plaintext into a caller-provided buffer and only then compares the tag. On a forged tag, the functions returns false,...

openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()

A flaw in OpenSSL causes EVPCipher to skip AEAD tag verification for ChaCha20-Poly1305 and AES-OCB ciphers when decrypting empty ciphertexts. This allows remote attackers to submit forged messages that affected applications incorrectly accept as valid...

SUSE CVE-2026-75803

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...