MIDA-Multitool

MIDA - Multitool システム列挙、脆弱性識別、特権昇格を目的としたBashスクリプト。 MIDA Multitoolは、以前のスクリプトであるSysEnumとRootHelperから機能を引き継いでおり、ある意味ではRootHelperの後継、あるいは少なくとも姉妹スクリプトです。 これらの2つの以前のスクリプトの機能に加えて、独自の機能も組み込んでおり、システム列挙、脆弱性識別、エクスプロイト、特権昇格に関連する操作やユーティリティのための包括的なアシスタントを目指しています。 使用方法...

cpanel-cve-41940-detector

CVE-2026-41940 向け cPanel IOC 検出器 CVE-2026-41940 および関連する侵害後アクティビティの影響を受けた可能性がある cPanel/WHM サーバー向けの読み取り専用 IOC 検出器です。 このスクリプトは、運用担当者が .sorry ランサムウェアの指標、MrRot13 Filemanager バックドアの痕跡、不審な cron エントリ、SSH キーの変更、コールバックの痕跡、cPanel ログの異常を確認するのに役立ちます。 はじめに Ping7 リソース すべての GitHub ツール:...

MAAD-AF

MAAD攻撃フレームワーク MAAD-AFは、Microsoft 365およびEntra ID Azure AD環境向けのオープンソースのクラウド攻撃ツールです。 MAAD-AFは、シンプルで高速かつ効果的なセキュリティテストを提供します。ほぼゼロセットアップのプロセスでMicrosoftクラウドの制御を検証し、完全にインタラクティブなワークフローでエミュレートされた攻撃を実行して検出・対応能力をテストできます。 MAAD-AFは、PowerShellでネイティブに開発されています。 使用方法 1. GitHubからMAAD-AFをクローンまたはダウンロード 2...

brawl-public-game-001

BRAWL One of the challenging problems for cyber security researchers developing detection and response capabilities is finding a realistic environment in which to test their hypothesis and capabilities. The cheapest method is to test capabilities on a small lab network. But this environment is...

PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution

Cybersecurity researchers have disclosed details of a complex Chromium-based post-exploitation toolkit called PEEP that masquerades as a bookmarks extension for the web browser. "Requiring prior administrative or code execution access, its installer injects the extension directly into Chrome/Edge...

Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft

A new phishing-as-a-service PhaaS operation called Forg365 is using a combination of device code phishing, adversary-in-the-middle AitM tactics, antibot evasion, artificial intelligence AI-assisted lure creation, and post-compromise mailbox operations targeting Microsoft 365 accounts. Distributed...

PT-2026-56921

Name of the Vulnerable Software and Affected Versions OpenPLC Runtime version 3 Description An authenticated arbitrary file write exists in the legacy web UI program-upload workflow. The application stores an attacker-supplied filename prog file into the Programs.File database field and uses this...

How Storm-2949 turned a compromised identity into a cloud-wide breach

In this article 1. Attack chain overview 1. Cloud compromise: Microsoft Entra ID and Microsoft 365 2. Initial access and persistence through targeted social engineering and SSPR abuse 3. Directory discovery and persistence 4. Microsoft 365 discovery and exfiltration 5. Cloud compromise: Microsoft...

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

Cisco Talos is tracking the active exploitation of CVE-2026-20182, an authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage. Successful exploitation of CVE-2026-20182 allows an unauthenticated,...

Active attack: Dirty Frag Linux vulnerability expands post-compromise risk

In this article 1. Why Dirty Frag matters 2. Technical overview 3. Exploitation scenarios 4. Mitigation guidance 5. Post-mitigation integrity verification 6. References A newly disclosed Linux local privilege escalation vulnerability known as “Dirty Frag” enables escalation from an unprivileged...

Active attack: Dirty Frag Linux vulnerability expands post-compromise risk

In this article 1. Why Dirty Frag matters 2. Technical overview 3. Exploitation scenarios 4. Mitigation guidance 5. Post-mitigation integrity verification 6. References A newly disclosed Linux local privilege escalation vulnerability known as “Dirty Frag” enables escalation from an unprivileged...

CVE-2026-33727

Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Version 6.4 has a local privilege-escalation vulnerability allows code execution as root from the low-privilege pihole account. Important context: the pihole account uses nologin, so this is not a direct...

CVE-2026-33727 Pi-hole has a Local Privilege Escalation (post-compromise, pihole -> root).

Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Version 6.4 has a local privilege-escalation vulnerability allows code execution as root from the low-privilege pihole account. Important context: the pihole account uses nologin, so this is not a direct...

CVE-2026-33727

Pi-hole 6.4 contains a local privilege escalation: attacker-controlled content in /etc/pihole/versions can be sourced by root-run Pi-hole scripts, enabling root code execution from the pihole user (nologin but not preventing code execution). The issue arises in a post-compromise scenario and is f...

CVE-2026-33727 Pi-hole has a Local Privilege Escalation (post-compromise, pihole -> root).

Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Version 6.4 has a local privilege-escalation vulnerability allows code execution as root from the low-privilege pihole account. Important context: the pihole account uses nologin, so this is not a direct...

Threat actor abuse of AI accelerates from tool to cyberattack surface

For the last year, one word has represented the conversation living at the intersection of AI and cybersecurity: speed. Speed matters, but it’s not the most important shift we are observing across the threat landscape today. Now, threat actors from nation states to cybercrime groups are embedding...

Threat actor abuse of AI accelerates from tool to cyberattack surface

For the last year, one word has represented the conversation living at the intersection of AI and cybersecurity: speed. Speed matters, but it’s not the most important shift we are observing across the threat landscape today. Now, threat actors from nation states to cybercrime groups are embedding...

Cookie-controlled PHP webshells: A stealthy tradecraft in Linux hosting environments

In this article 1. Cookie-controlled execution behavior 2. Observed variants of cookie-controlled PHP web shells 3. Mitigation and protection guidance 4. Microsoft Defender XDR detections 5. Microsoft Security Copilot prompts 6. Microsoft Defender XDR threat analytics 7. MITRE ATT&CK™ Techniques...

Tracking TeamPCP: Investigating Post-Compromise Attacks Seen in the Wild

How TeamPCP are leveraging stolen secrets from the recent supply chain attacks to compromise cloud environments...

AI as tradecraft: How threat actors operationalize AI

In this article 1. AI as an enabler for cyberattacks 2. Post-compromise misuse of AI 3. Emerging trends 4. Mitigation guidance for AI-enabled threats 5. Microsoft Defender detections Threat actors are operationalizing AI along the cyberattack lifecycle to accelerate tradecraft, abusing both...