#NGINX Rift is a heap overflow in the rewrite module that may crash workers or enable #RCE under specific configs. Public #PoC exists, so patching and config audits are urgent.
core-jmp.org/2026/05/nginx-…
A trojanized HWMonitor archive abuses DLL sideloading with malicious CRYPTBASE.dll to launch multi-stage in-memory loaders and deploy STX RAT.
core-jmp.org/2026/05/hwmoni…
A practical look at DLL sideloading and proxying: how attackers abuse trusted Windows executables to load malicious DLLs while keeping the app running normally.
core-jmp.org/2026/05/dll-si…
CVE-2026-44578
⚠️ Next.js – WebSocket Upgrade SSRF (CVSS 8.6)
A server-side request forgery vulnerability in Next.js allows unauthenticated attackers to force self-hosted instances to make internal HTTP requests via the WebSocket upgrade handler.
By sending a crafted absolute-form HTTP request with Upgrade: websocket headers, attackers can access internal services, cloud metadata endpoints, admin panels, and internal APIs reachable from the Next.js server on port 80. Successful exploitation may expose cloud credentials, API keys, secrets, and configuration data.
Affected: Next.js 13.4.13+, 14.x, 15.x <15.5.16, 16.0.0–16.2.4
Mitigation: Upgrade immediately to 15.5.16 or 16.2.5.
Modat Magnify Query:
technology="Next.js"
The platform:
magnify.modat.io#threatintel#vulnerability#CVE202644578#Nextjs#SSRF#WebSocket#CloudSecurity#infosec#Critical#ModatMagnify
DLL Sideloading & Proxying for Advance Red Team Engagements
TL;DR: This blog will introduce DLL Sideloading and Proxying for advance red team engagements for starters.
Blog:- zerotracelab.com/blog/dll-sidel…#redteam#windows
🚨 Google Project Zero just published a Pixel 10 zero-click to root exploit chain.
Two vulnerabilities and less than a day of work to weaponize the second one.
Chain:
- Stage 1: same Dolby UDC zero-click (CVE-2025-54957) used against the Pixel 9. Patched in January 2026. Only minor offset updates and a tweak around RET PAC needed to port to Pixel 10
- Stage 2: a brand new local privilege escalation in the VPU driver for the Chips&Media Wave677DV on the Tensor G5
Result: arbitrary kernel read/write in 5 lines of code. Full exploit written in under a day.
‼️ CVE-2026-42945: RCE Proof of concept for CVE-2026-42945, a critical heap buffer overflow in NGINX's ngx_http_rewrite_module introduced in 2008
GitHub: github.com/depthfirstdisc…
Automating MS-RPC vulnerability research
TL;DR: Diving into the MS-RPC protocol and how to automate vulnerability research using a fuzzing approach.
Blog:~ incendium.rocks/posts/Automati…#Fuzzing
Шо опять? 😈
Пару часов назад Уильям Боулинг и команда V12 выложила свежайший эксплойт для повышения привилегий – Fragnesia.
Фикс:
rmmod esp4 esp6 rxrpc
printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf
A LiteLLM 1.83.14 exploit chain leaks the master key through callback metadata, then abuses non-sandboxed Jinja2 GitLab prompts to achieve server-side RCE.
core-jmp.org/2026/05/from-a…
A deep dive into CVE-2026-45185: an unauthenticated Exim RCE where one stale TLS/BDAT ungetc() byte corrupts freed memory and leads to exploitation.
core-jmp.org/2026/05/one-ne…
A Windows kernel research technique that uses Microsoft PDB symbols to resolve offsets dynamically, avoiding hardcoded values and manual WinDBG work across builds.
core-jmp.org/2026/05/no-mor…
A hands-on guide to building a basic Windows EDR with a kernel driver, callbacks, static analysis, DLL injection, and hooks to detect remote shellcode injection.
core-jmp.org/2026/05/buildi…
A Windows injection technique that builds remote read/write/allocation primitives with limited process rights, reducing classic RPM/WPM telemetry and noisy access flags.
core-jmp.org/2026/05/proces…