Obfusk8

Obfusk8: C++17-Based Obfuscation Library Obfusk8 is a lightweight, header-only C++17 library designed to significantly enhance the obfuscation of your applications, making reverse engineering a substantially more challenging endeavor. It achieves this through a diverse set of compile-time and...

static_asm

staticasm Una biblioteca C++20 de solo encabezado para codificación de instrucciones x86/x86-64 en tiempo de compilación. Este proyecto tiene doble licencia bajo la Boost Software License 1.0 y la MIT License. Puedes elegir cualquiera de las dos. Propósito Aprender codificación de ensamblador x86...

sbox

sbox - Compile-time AES string obfuscation for C++ Standard solutions rely on length + "" + string. That is trivial to reverse. sbox utilizes a constexpr AES-128 block cipher to mutate strings into high-entropy noise. The Story During the Neetcode "Encode and Decode Strings" challenge, I ported t...

obfus.h

obfus.h obfus.h is a macro-only library for compile-time obfuscating C applications, designed specifically for the Tiny C tcc you can download it here - Tiny-C-Compiler/releases. It is tailored for Windows x86 and x64 platforms and supports almost all versions of the compiler. Very reliable armor...

CVE-2022-24713-POC

POC of CVE-2022-24713 on Ubuntu Install the current rust-regex package on Ubuntu. Then, clone this repo. Then, run cargo build. The regex dependency is set to the /usr/share/cargo/registry folder, so there will be no dependency issues. If the compilation takes an absurdly ridiculous long amount o...

peframe

======= peframe peframe is a open source tool to perform static analysis on Portable Executable malware and generic suspicious file. It can help malware researchers to detect packer, xor, digital signature, mutex, anti debug, anti virtual machine, suspicious sections and functions, macro and much...

WTSRM2

WTSRM2 This is a continuation to my original project WTSRM and the corresponding talk. This project was re-written in order to utilize C++17 in order to create a template that allows us to change the required functionality at compile time with ease! This is implemented as a header only file such...

nimvoke

nimvoke Indirect syscalls + DInvoke made simple. Designed to be imported directly into your own Nim projects, nimvoke uses macros to absract away the details of making indirect system calls and DInvoke-style delegate declarations. This library is meant to be easy to use and relatively op-sec...

CentOS Linux 8 [TuxCare] Security Update: perl / perl-Attribute-Handlers / perl-Devel-Peek / etc (CENTOS-STREAM8:CLSA-2026:1780395563)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1780395563 advisory. - Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling...

[SECURITY] [DSA 6416-2] jq regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-6416-2 [email protected] https://www.debian.org/security/ Aron Xu September 25, 2026 https://www.debian.org/security/faq -...

SindriKit v2.0.0

SindriKit Offensive Development Deserves Better Architecture. A C library for building offensive capabilities. Core Concept Most offensive utilities hardcode their execution mechanics inside the technique's logic. A reflective loader doesn't just map an image; it maps it using a specific, hardcod...

CVE-2026-59989 Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI lead to RCE)

Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression. An attacker who can...

CVE-2026-59989

Phalcon (PHP framework) versions 5.15.0 and earlier are vulnerable to a Server-Side Template Injection (SSTI) in the Volt compiler's join filter. The root cause is in resolveFilter within phalcon/Mvc/View/Engine/Volt/Compiler.zep, which inserts raw separator and array token values directly into g...

Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns

Malicious versions of the arrayref Rust crate and others executed a backdoor at compile time. The campaign's infrastructure overlaps with recent DPRK supply chain attacks, including Mastra and axios...

Script security bypass vulnerability in script-security

script-security 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations such as @CompileStatic and @TypeChecked that carry an extensions member, which causes Groovy to load and execute a script from the classpath at compile time, before the sandbox is applied. This ma...

Exploit for CVE-2026-49757

CVE-2026-49757 — AshAuthentication OAuth2/OIDC Account Takeove...

CVE-2026-44294

A flaw was found in protobufjs. This vulnerability occurs because protobufjs, which compiles protobuf definitions into JavaScript JS functions, does not properly escape certain control characters in field names when generating JavaScript property accessors. A remote attacker could provide a...

EUVD-2026-31772

Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perlstudychunk in regcompstudy.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a lar...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Fortify: Fixed the compiletimestrlen function under UBSANBOUNDSLOCAL conditions. With CONFIGFORTIFY=y and CONFIGUBSANLOCALBOUNDS=y enabled, we observed a runtime panic when running Android’s Compatibility Test Suite CTS. This iss...

Compile-Time Security Analysis and Optimization of Sensitive String Producers

Content composition vulnerabilities remain among the most prevalent and persistent classes of security weakness in deployed software. Prior mitigations, including developer training, static analysis tools, and domain-specific template languages, each face diminishing returns; AI code generation...