ulexecve

Quick Start Execute dynamic or statically compiled ELF Linux binaries without ever calling execve. cat /bin/echo | ulexecve - hello hello Introduction This Python tool is called ulexecve and it stands for userland execve. It helps you execute arbitrary ELF binaries on Linux systems from userland...

UBUNTU-CVE-2026-99254

In the Linux kernel, the following vulnerability has been resolved: iouring: don't flood a cancelling task with taskwork ioringexitwork asks each task which has used the ring to remove its tctx node, by taskwork, and repeats that until the list is empty. iotctxexitcb doesn't touch the node while...

UBUNTU-CVE-2026-99253

In the Linux kernel, the following vulnerability has been resolved: iouring/cancel: rearm local work wake up before sleep iouringtrycancelrequests sets -cqwaitnr to 1 so that the next ioreqlocalworkadd wakes the cancelling task. The add that takes the count to zero is the only one that wakes, lat...

Exploit for CVE-2026-98260

Determination of Kernel CVE Applicability on Locked Devices...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

Wazuh and Sigma detections for PHP2Shell CVE-2026-109618 / CV...

experiments

Experiments Repository of various experiments / PoC. debugging-secure-kernel: PoC gdb debugging the Windows 10 secure kernel, on top of QEMU KVM dns: Experiments regarding DNS / Certificate transparency / Homoglyphs Attack Surface Reduction: Demystifying Windows Attack Surface Reduction internals...

userland-exec

Userland Exec Userland exec replaces the existing process image within the current address space with a new one. It mimics the behavior of the system call execve, but the process structures describing the process image remain unchanged. In other words, the process name reported by system utilitie...

SLAE

SLAE Securitytube Linux Assembly Expert SLAE SLAE-721 Build + Assembling ... + Linking ... + Extract Shellcode from binary ... "\x31\xc0\x50\x68\x2f\x2f\x73\x68" "\x68\x2f\x62\x69\x6e\x89\xe3\x89" "\xc1\xb0\x0b\xcd\x80" + Create C-Header file ... + Compile PoC ... + Run PoC ... + Shellcode Length...

shellcode

shellcode “A vulnerability provides an assembly language for a computer that has never been programmed before, and that was not designed with programmability in mind.” -- Halvar Flake A collection of new and old shellcode samples. Article https://hnsecurity.it/blog/new-and-old-shellcode-samples/...

Linux_X86_Reverse_TCP_Alphanumeric_Staged_Shellcode_Execve-bin-bash

This repository does not have a README...

Exploit for CVE-2026-98260

CVE-2026-98260 — Triggers only a PoC POSIX-CPU-TIMERS UAF...

Webmin_Exploit_reverse_shell

ntroduction: The Webmin Exploit is a targeted exploit for the Webmin service, which can be exploited on older versions of Webmin. This exploit uses various techniques to execute malicious code and gain unauthorized access to the target system. It involves: Using both C and Assembly code to execut...

cse509-hw2

CSE 509 — Computer System Security, Assignment 2 Coursework f...

Exploit for CVE-2026-98260

Kernel LPE study notes — the POSIX CPU timer bug A slow, from...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: exec: Force a single empty string when argv is empty Quoting 1 Ariadne Conill: “In several other operating systems, it is a hard requirement that the second argument to execve2 be the name of a program. This prevents scenarios...

blackhat-mea-quals-2026

BlackHat MEA Qualification CTF 2026 Solutions, exploits, and...

SUSE CVE-2026-98260

In the Linux kernel, the following vulnerability has been resolved: exec: Cleanup POSIX timers right after dethread A per-thread CPU timer holds a reference to the PID of the thread it is attached to and, while it is armed, its node is queued in that thread's posixcputimers. The task is looked up...

CVE-2026-98260

In the Linux kernel, the following vulnerability has been resolved: exec: Cleanup POSIX timers right after dethread A per-thread CPU timer holds a reference to the PID of the thread it is attached to and, while it is armed, its node is queued in that thread's posixcputimers. The task is looked up...

UBUNTU-CVE-2026-98260

In the Linux kernel, the following vulnerability has been resolved: exec: Cleanup POSIX timers right after dethread A per-thread CPU timer holds a reference to the PID of the thread it is attached to and, while it is armed, its node is queued in that thread's posixcputimers. The task is looked up...

CVE-2026-98260

The Linux kernel is vulnerable to a use-after-free condition during the execve() system call. The issue occurs when a non-leader thread executes; while de_thread() changes the PID ownership, a per-thread CPU timer node remains queued on the original thread's posix_cputimers. If subsequent operati...