👀
Inside the NetScaler Zero-Day Siege: Chained Pre-Auth RCEs Weaponized in the Wild (watchTowr Disclosure) | Shellcode (Sh3llc0d3)
A critical perimeter emergency is unfolding across enterprise infrastructure worldwide as threat intelligence teams confirm the active, in-the-wild exploit...
sh3llc0d3.com
September 27, 2026 at 3:48 PM
👀
I have seen this "writeup" of the new Citrix 0-days but there's no correlation with anything, no sourcing (Citrix has not released a patch to diff), so I'm very skeptical.
Inside the NetScaler Zero-Day Siege: Chained Pre-Auth RCEs Weaponized in the Wild (watchTowr Disclosure) | Shellcode (Sh3llc0d3)
A critical perimeter emergency is unfolding across enterprise infrastructure worldwide as threat intelligence teams confirm the active, in-the-wild exploit...
sh3llc0d3.com
September 27, 2026 at 3:45 PM
I have seen this "writeup" of the new Citrix 0-days but there's no correlation with anything, no sourcing (Citrix has not released a patch to diff), so I'm very skeptical.
ITW exploitation of two unpatched pre-authentication remote code execution (RCE) zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances.
sh3llc0d3.com/blog/inside-...
sh3llc0d3.com/blog/inside-...
Inside the NetScaler Zero-Day Siege: Chained Pre-Auth RCEs Weaponized in the Wild (watchTowr Disclosure) | Shellcode (Sh3llc0d3)
A critical perimeter emergency is unfolding across enterprise infrastructure worldwide as threat intelligence teams confirm the active, in-the-wild exploit...
sh3llc0d3.com
September 27, 2026 at 3:27 PM
ITW exploitation of two unpatched pre-authentication remote code execution (RCE) zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances.
sh3llc0d3.com/blog/inside-...
sh3llc0d3.com/blog/inside-...
One outlet says the NCSC describes both flaws as unauthenticated RCE on their own, with one injecting and running shellcode directly in memory. That comes from a secondary summary of a TLP-restricted notice, so treat it as plausible but unconfirmed.
thecybersecguru.com/news/citrix-...
thecybersecguru.com/news/citrix-...
Citrix NetScaler Zero-Day Emergency: Why Organizations Are Shutting Down Appliances | The CyberSec Guru
Citrix NetScaler zero-day reports are triggering emergency shutdowns. Here's what is known, what remains unconfirmed, and how defenders can reduce risk
thecybersecguru.com
September 27, 2026 at 2:12 PM
One outlet says the NCSC describes both flaws as unauthenticated RCE on their own, with one injecting and running shellcode directly in memory. That comes from a secondary summary of a TLP-restricted notice, so treat it as plausible but unconfirmed.
thecybersecguru.com/news/citrix-...
thecybersecguru.com/news/citrix-...
Shellcode to Linux and Windows from a statically typed language. Neat tool, but the interesting part is the abstraction layer: you let someone else handle cross-platform compilation headaches so you can focus on the payload logic.
September 26, 2026 at 10:01 AM
Shellcode to Linux and Windows from a statically typed language. Neat tool, but the interesting part is the abstraction layer: you let someone else handle cross-platform compilation headaches so you can focus on the payload logic.
PwnSec CTF 2026 – peekaboo Challenge Writeup
peekaboo is a shellcode-sandbox challenge built around information hiding rather than a conventional control-flow hijack. The program reads the flag, encrypts it, stores the Base64 representation in a page whose address is randomized, removes the…
peekaboo is a shellcode-sandbox challenge built around information hiding rather than a conventional control-flow hijack. The program reads the flag, encrypts it, stores the Base64 representation in a page whose address is randomized, removes the…
PwnSec CTF 2026 – peekaboo Challenge Writeup
peekaboo is a shellcode-sandbox challenge built around information hiding rather than a conventional control-flow hijack. The program reads the flag, encrypts it, stores the Base64 representation in a page whose address is randomized, removes the plaintext and key material, clears the visible CPU state, installs a restrictive seccomp filter, and finally executes attacker supplied machine code. The shellcode is intentionally allowed to compute, map memory, and write a few bytes from one designated page, but it starts without a pointer to the secret.
kore.one
September 26, 2026 at 9:38 AM
PwnSec CTF 2026 – peekaboo Challenge Writeup
peekaboo is a shellcode-sandbox challenge built around information hiding rather than a conventional control-flow hijack. The program reads the flag, encrypts it, stores the Base64 representation in a page whose address is randomized, removes the…
peekaboo is a shellcode-sandbox challenge built around information hiding rather than a conventional control-flow hijack. The program reads the flag, encrypts it, stores the Base64 representation in a page whose address is randomized, removes the…
#566953 moor: 2.19.1 -> 2.19.2
#566952 grist-core: wire the right test
#566950 python3Packages.donut-shellcode: restrict to x86 and x64
#566949 grpc-gateway: 2.30.0 -> 2.31.0
#566936 archon-lite: 9.5.0 -> 9.6.80
#566924 wait4x: 3.7.1 -> 3.7.2
#566923 raycast: 2.4.1.0 -> 2.5.2.0
#566952 grist-core: wire the right test
#566950 python3Packages.donut-shellcode: restrict to x86 and x64
#566949 grpc-gateway: 2.30.0 -> 2.31.0
#566936 archon-lite: 9.5.0 -> 9.6.80
#566924 wait4x: 3.7.1 -> 3.7.2
#566923 raycast: 2.4.1.0 -> 2.5.2.0
September 26, 2026 at 12:05 AM
#566953 moor: 2.19.1 -> 2.19.2
#566952 grist-core: wire the right test
#566950 python3Packages.donut-shellcode: restrict to x86 and x64
#566949 grpc-gateway: 2.30.0 -> 2.31.0
#566936 archon-lite: 9.5.0 -> 9.6.80
#566924 wait4x: 3.7.1 -> 3.7.2
#566923 raycast: 2.4.1.0 -> 2.5.2.0
#566952 grist-core: wire the right test
#566950 python3Packages.donut-shellcode: restrict to x86 and x64
#566949 grpc-gateway: 2.30.0 -> 2.31.0
#566936 archon-lite: 9.5.0 -> 9.6.80
#566924 wait4x: 3.7.1 -> 3.7.2
#566923 raycast: 2.4.1.0 -> 2.5.2.0
Was linked to this project:
Piclang, a statically typed programming language that compiles to Linux and Windows shellcode.
I'm a big fan of language-tooling to give flexibility or expose abstractions that are too hard doing things the normal way. Neat to see this work
github.com/zarkones/Pic...
Piclang, a statically typed programming language that compiles to Linux and Windows shellcode.
I'm a big fan of language-tooling to give flexibility or expose abstractions that are too hard doing things the normal way. Neat to see this work
github.com/zarkones/Pic...
September 25, 2026 at 3:20 PM
Was linked to this project:
Piclang, a statically typed programming language that compiles to Linux and Windows shellcode.
I'm a big fan of language-tooling to give flexibility or expose abstractions that are too hard doing things the normal way. Neat to see this work
github.com/zarkones/Pic...
Piclang, a statically typed programming language that compiles to Linux and Windows shellcode.
I'm a big fan of language-tooling to give flexibility or expose abstractions that are too hard doing things the normal way. Neat to see this work
github.com/zarkones/Pic...
Stop guessing why your payload didn't trigger. We walk through a 64-bit Linux stack overflow from vulnerable C code to RIP control, detailing exactly how modern mitigations break your shellcode #infosec #exploitdev
https://trynoguard.com/learn/buffer-overflow-walkthrough-2026
https://trynoguard.com/learn/buffer-overflow-walkthrough-2026
September 24, 2026 at 10:00 PM
Stop guessing why your payload didn't trigger. We walk through a 64-bit Linux stack overflow from vulnerable C code to RIP control, detailing exactly how modern mitigations break your shellcode #infosec #exploitdev
https://trynoguard.com/learn/buffer-overflow-walkthrough-2026
https://trynoguard.com/learn/buffer-overflow-walkthrough-2026
Has anyone else seen this before? Shellcode written in CGo that bootstraps a Go environment. I'm struggling to reverse the loader because I'm not very well versed in Go reversing. And before you ask, GoReSym is failing too! #malware #malware_analysis
September 24, 2026 at 4:43 AM
Has anyone else seen this before? Shellcode written in CGo that bootstraps a Go environment. I'm struggling to reverse the loader because I'm not very well versed in Go reversing. And before you ask, GoReSym is failing too! #malware #malware_analysis
September 23, 2026 at 7:39 AM
ClosedQuorum is a new Windows malware that uses Gemini, DeepSeek, Qwen, and Mistral to pick post-compromise actions, including credential theft, shellcode injection, persistence, and Discord exfiltration. #ClosedQuorum #GoogleGemini #DeepSeek
New ClosedQuorum Windows Malware Uses AI For Attack Decisions
ClosedQuorum is a new Windows malware that uses Google Gemini, DeepSeek, Qwen, and Mistral AI to autonomously choose post-compromise actions without human operator commands. Cisco Talos says it can steal credentials, inject shellcode, or persist on infected hosts, and that stolen data is exfiltrated through a Discord webhook. #ClosedQuorum #GoogleGemini #DeepSeek #Qwen #Mistral #CiscoTalos
www.hendryadrian.com
September 22, 2026 at 8:15 PM
ClosedQuorum is a new Windows malware that uses Gemini, DeepSeek, Qwen, and Mistral to pick post-compromise actions, including credential theft, shellcode injection, persistence, and Discord exfiltration. #ClosedQuorum #GoogleGemini #DeepSeek
⚠️ Microsoft library conceals implants
Researchers show WerEnc.dll can encrypt payloads with AES-256, helping stagers evade detection before executing shellcode.
🔗 read more: ipurple.team/2026/09...
#ransomNews #cyberthreats #Windows
Researchers show WerEnc.dll can encrypt payloads with AES-256, helping stagers evade detection before executing shellcode.
🔗 read more: ipurple.team/2026/09...
#ransomNews #cyberthreats #Windows
Dump Encoding Library
The Windows Error Reporting Dump Encoding Library (WerEnc.dll) is a Microsoft signed DLL that can be abused by threat actors to encrypt their implant using a trusted Microsoft cryptographic impleme…
ipurple.team
September 22, 2026 at 3:37 PM
⚠️ Microsoft library conceals implants
Researchers show WerEnc.dll can encrypt payloads with AES-256, helping stagers evade detection before executing shellcode.
🔗 read more: ipurple.team/2026/09...
#ransomNews #cyberthreats #Windows
Researchers show WerEnc.dll can encrypt payloads with AES-256, helping stagers evade detection before executing shellcode.
🔗 read more: ipurple.team/2026/09...
#ransomNews #cyberthreats #Windows
ps4 plugin loader is:
- write some shellcode into shellcore
- that shellcode loads shellcore_plugin
- shellcore_plugin hooks the function to start an application
- the plugin in shellcore will write a file containing the title id of the application
- in the kernel you also hook the module load […]
- write some shellcode into shellcore
- that shellcode loads shellcore_plugin
- shellcore_plugin hooks the function to start an application
- the plugin in shellcore will write a file containing the title id of the application
- in the kernel you also hook the module load […]
Original post on tech.lgbt
tech.lgbt
September 22, 2026 at 8:33 AM
ps4 plugin loader is:
- write some shellcode into shellcore
- that shellcode loads shellcore_plugin
- shellcore_plugin hooks the function to start an application
- the plugin in shellcore will write a file containing the title id of the application
- in the kernel you also hook the module load […]
- write some shellcode into shellcore
- that shellcode loads shellcore_plugin
- shellcore_plugin hooks the function to start an application
- the plugin in shellcore will write a file containing the title id of the application
- in the kernel you also hook the module load […]
VShell is fucking with me. It loads a position-independent shellcode with Go artifacts that loads from the DOS header that's also a valid PE file. I think it loads its Go runtime in the shellcode loading process. This is fun, but confusing!
September 22, 2026 at 8:11 AM
VShell is fucking with me. It loads a position-independent shellcode with Go artifacts that loads from the DOS header that's also a valid PE file. I think it loads its Go runtime in the shellcode loading process. This is fun, but confusing!
Stop reading theory and start controlling RIP. I break down stack-based buffer overflows from vulnerable C code to the final exploit, including how modern OS mitigations block your shellcode.
#infosec #binaryexploitation
https://trynoguard.com/learn/buffer-overflow-walkthrough-2026
#infosec #binaryexploitation
https://trynoguard.com/learn/buffer-overflow-walkthrough-2026
September 21, 2026 at 2:00 PM
Stop reading theory and start controlling RIP. I break down stack-based buffer overflows from vulnerable C code to the final exploit, including how modern OS mitigations block your shellcode.
#infosec #binaryexploitation
https://trynoguard.com/learn/buffer-overflow-walkthrough-2026
#infosec #binaryexploitation
https://trynoguard.com/learn/buffer-overflow-walkthrough-2026
speakeasy v2.0.0b8 — Windows malware emulation framework that executes binaries, drivers, and shellcode in a modeled runtime, emulating APIs, process/thread behavior,... https://kitploit.com/tools/github/mandiant/speakeasy?utm_source=bluesky&utm_medium=social&utm_campaign=kitploit&utm_content=362517
September 20, 2026 at 2:50 AM
speakeasy v2.0.0b8 — Windows malware emulation framework that executes binaries, drivers, and shellcode in a modeled runtime, emulating APIs, process/thread behavior,... https://kitploit.com/tools/github/mandiant/speakeasy?utm_source=bluesky&utm_medium=social&utm_campaign=kitploit&utm_content=362517
GitHub - SnailSploit/Claude-Red: claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface
GitHub - SnailSploit/Claude-Red: claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a s...
github.com
September 17, 2026 at 4:30 PM
GitHub - SnailSploit/Claude-Red: claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface
🎉 Celebrating！ 🎉 (500+ new stars)
📦 SnailSploit / Claude-Red
⭐ 5,572 (+699)
🗒 Python
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a spe...
📦 SnailSploit / Claude-Red
⭐ 5,572 (+699)
🗒 Python
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a spe...
GitHub - SnailSploit/Claude-Red: claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a s...
github.com
September 17, 2026 at 3:17 AM
🎉 Celebrating！ 🎉 (500+ new stars)
📦 SnailSploit / Claude-Red
⭐ 5,572 (+699)
🗒 Python
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a spe...
📦 SnailSploit / Claude-Red
⭐ 5,572 (+699)
🗒 Python
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a spe...
Generated your shellcode. Now what? In Modern Shellcode Obfuscation, Principal Security Consultant Mike Saunders digs into practical techniques, detection tradeoffs, and what actually gets noticed.
🔗 redsiege.com/modsho
#hacking #infosec #cybersecurity #training
🔗 redsiege.com/modsho
#hacking #infosec #cybersecurity #training
September 15, 2026 at 5:33 PM
Generated your shellcode. Now what? In Modern Shellcode Obfuscation, Principal Security Consultant Mike Saunders digs into practical techniques, detection tradeoffs, and what actually gets noticed.
🔗 redsiege.com/modsho
#hacking #infosec #cybersecurity #training
🔗 redsiege.com/modsho
#hacking #infosec #cybersecurity #training
md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development. #devopsish
GitHub - SnailSploit/Claude-Red: claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a s...
github.com
September 15, 2026 at 5:30 PM
md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development. #devopsish
Original text: "A 0-click exploit chain for the Pixel 9 Part 1: Decoding Dolby" — Natalie Silvanovich, Google Project Zero (14 January 2026). Bug: CVE-2025-54957. Part 2: Big Wave. Part 3: lessons.
https://core-jmp.org/2026/09/pixel-9-0-click-part-1-decoding-dolby-cve-2025-54957/
https://core-jmp.org/2026/09/pixel-9-0-click-part-1-decoding-dolby-cve-2025-54957/
A 0-click Exploit Chain for the Pixel 9, Part 1: Decoding Dolby (CVE-2025-54957)
Project Zero’s Natalie Silvanovich turns CVE-2025-54957 in the Dolby Unified Decoder into mediacodec code execution on a Pixel 9 with no tap: Google Messages transcribes RCS audio, an evo-heap pad wraps, scudo secondary headers slide, and /proc/self/mem plus a 0x157 gadget write shellcode over __stack_chk_fail. Fixed 5 January 2026.
core-jmp.org
September 15, 2026 at 8:29 AM
Original text: "A 0-click exploit chain for the Pixel 9 Part 1: Decoding Dolby" — Natalie Silvanovich, Google Project Zero (14 January 2026). Bug: CVE-2025-54957. Part 2: Big Wave. Part 3: lessons.
https://core-jmp.org/2026/09/pixel-9-0-click-part-1-decoding-dolby-cve-2025-54957/
https://core-jmp.org/2026/09/pixel-9-0-click-part-1-decoding-dolby-cve-2025-54957/
📦 SnailSploit / Claude-Red
⭐ 3,354 (+99)
🗒 Python
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to sh...
⭐ 3,354 (+99)
🗒 Python
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to sh...
GitHub - SnailSploit/Claude-Red: claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a s...
github.com
September 12, 2026 at 3:17 PM
📦 SnailSploit / Claude-Red
⭐ 3,354 (+99)
🗒 Python
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to sh...
⭐ 3,354 (+99)
🗒 Python
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to sh...