10 + crucial tools for post-exploitation

A simple case of WebSocket message manipulation

Learn how YARA rules can be used to detect anomalies.

Continue your Advent of Cyber journey and learn about container security.

Lab Overview

19 malicious VS Code extensions bypassed detection by hiding a Rust trojan in tampered node_modules and a fake banner.png using steganography. The attack uses cmstp.exe (LOLBIN) for execution.

In late 2025, I used GitHound to uncover a high severity security issue involving leaked Snowflake tokens and sensitive information on a…

In my OSCP learning journey, I got hands-on experience with the most common misconfiguration that happens amongst developers related to…

ECB mode is simple but dangerously predictable: identical plaintext blocks always yield identical ciphertext. When exposed through an…

Hello, fellow nerds!

Summary

NVIDIA patched High-severity (CVSS 8.8) deserialization flaws in Merlin's NVTabular and Transformers4Rec on Linux. Exploitation risks RCE, DoS, and data tampering in AI recommendation pipelines.

0patch found an unpatched flaw in Windows RasMan that allows any user to crash the service on demand. This unprivileged crash is the necessary step to exploit the CVE-2025-59230 LPE flaw. Micropatch is available.

A critical RCE flaw (CVSS 9.1) in pgAdmin bypasses security via a UTF-8 BOM parsing mismatch. It allows attackers to execute root commands during a database restore operation. Update immediately.

NANOREMOTE, a new Windows backdoor, leverages the Google Drive API for covert C2 and data exfiltration using OAuth 2.0 tokens. The malware shares a hard-coded AES key with the FINALDRAFT family, linking it to seasoned espionage actors.

SHADOW-VOID-042 impersonated Trend Micro via fake security advisories to breach defense, energy, and chemical firms. Tactics align with Void Rabisu (ROMCOM), using HR lures and targeted exploits.

A critical LPE flaw (CVSS 9.1) in Plesk's Password-Protected Directories allows Apache configuration injection. Any Plesk user can execute root commands and achieve full server takeover. Update immediately.

Ashen Lepus (Hamas-APT) significantly evolved during the conflict, deploying the AshTag modular .NET malware suite. It uses in-memory execution and Rclone for stealthy cyber-espionage against diplomatic targets in the Middle East.

GOLD SALEM (Storm-2603) is exploiting SharePoint via ToolShell then abusing the Velociraptor DFIR tool as a ransomware precursor. The group deploys Warlock and LockBit 3.0 variants, often targeting critical infra.

A critical flaw in Apache StreamPark uses a hard-coded encryption key and the insecure AES ECB mode, risking data decryption and JWT authentication token forgery. Update to v2.1.7 immediately.

Storm-0249 IAB abuses the SentinelOne EDR process via DLL sideloading to evade detection. The group uses LoLBin tools for fileless execution and sells access to ransomware groups like LockBit.