News · r/blueteamsec

• 
  r/blueteamsec Sun 25 Oct

  low-int-cert-monitor: Monitor Certificate Transparency logs for certificates with trivially small EC private keys (the eMudhra weak-key class). P-256/384/521.

  r/blueteamsec · github.com
• r/blueteamsec Sat 24 Oct

  I spun up a free, read-only script to check WordPress sites for signs of PHP2Shell compromise. Looking for feedback

  Patching PHP fixes PHP2Shell (CVE-2026-109618 / 109619), but it does nothing about a backdoor someone planted before the patch. Amazon's honeypots caught an exploitation attempt on Oct 17, four days before disclosure, and Amazon's advice is to investigate from at least that date. So I used Claude Code to spin up a bash script to triage WordPress sites. It checks: * PHP CLI version vs. the fixed r…

  CVE-2026-109618
• 
  r/blueteamsec Sat 24 Oct

  CTO at NCSC Summary: week ending October 25th

  r/blueteamsec · ctoatncsc.substack.com
• 
  r/blueteamsec Sat 24 Oct

  PHP2Shell: Obstacles to Weaponizing Likely Constrain Immediate Exploitation

  r/blueteamsec · crowdstrike.com
• r/blueteamsec Sat 24 Oct

  Field Notes: Reconstructing an Attacker’s Workflow

  r/blueteamsec · dfir.ch
• 
  r/blueteamsec Sat 24 Oct

  Incident Response and Threat Landscape Report: Critical Infrastructure Vulnerabilities and Extortion Tactics

  r/blueteamsec · kylesinvestigation.com
• 
  r/blueteamsec Sat 24 Oct

  PHP2Shell: observed exploitation attempts, 22–24 October 2026

  r/blueteamsec · gist.github.com
• 
  r/blueteamsec Sat 24 Oct

  Defeating enforced SMB signing: a note

  r/blueteamsec · blackfield.ch
• 
  r/blueteamsec Sat 24 Oct

  Signet: Mythic Code Signing Wrapper

  r/blueteamsec · github.com
• 
  r/blueteamsec Sat 24 Oct

  brotli-checker: Claude Code and Codex skill for finding potentially vulnerable Brotli copies and guiding updates for CVE-2026-111497.

  r/blueteamsec · github.com

  CVE-2026-111497
• 
  r/blueteamsec Fri 23 Oct

  Red-Teaming OpenAI's Internal Agent Monitoring Systems

  r/blueteamsec · metr.org
• 
  r/blueteamsec Fri 23 Oct

  Inside a Global AI-Assisted Hacking Campaign

  r/blueteamsec · zscaler.com
• 
  r/blueteamsec Fri 23 Oct

  Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 | Ruby

  r/blueteamsec · ruby-lang.org

  CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 +1
• r/blueteamsec Fri 23 Oct

  Recommandations à destination des acteurs du secteur de l’énergie et de l’eau - NSSI) has been receiving numerous reports concerning the targeting of the renewable energy production and water management sector in France by hacktivist groups and actors known to be linked to states

  r/blueteamsec · cert.cyber.gouv.fr
• r/blueteamsec Fri 23 Oct

  win-def-clickfix | a scanner that determines whether windows defender will flag a clickfix command

  github.com/backdoorskid/win-def-clickfix win-def-clickfix is a run-1 detection replica for ClickFix / Win+R command lines, rebuilt by reverse-engineering Microsoft Defender's mpengine.dll. It runs a command line through the recovered normalizer/deobfuscator (FUN_1800a2500) and matches it against the 807 VDM-extracted CMDHSTR_EXT signatures, evaluated with their real condition: logic. It also ship…
• 
  r/blueteamsec Fri 23 Oct

  [2610.30361] The Psychology of an AI Hacker

  r/blueteamsec · arxiv.org
• r/blueteamsec Fri 23 Oct

  The PingCAP TiDB Cloud Leaks - FulcrumSec

  r/blueteamsec · fulcrumsec.vg
• r/blueteamsec Fri 23 Oct

  GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13

  r/blueteamsec · docs.gitlab.com
• r/blueteamsec Fri 23 Oct

  eMudhra to Exit global SSL/TLS Certificate Business

  r/blueteamsec · emudhra.com
• 
  r/blueteamsec Fri 23 Oct

  Dissecting Operation FlashHole, a complex attack by Lazarus

  r/blueteamsec · securelist.com
• 
  r/blueteamsec Fri 23 Oct

  MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC‑0099-Sandworm collaboration

  r/blueteamsec · welivesecurity.com
• 
  r/blueteamsec Fri 23 Oct

  New BlackX UEFI bootkit exploiting Baton Drop

  r/blueteamsec · securelist.com
• 
  r/blueteamsec Fri 23 Oct

  DarkCore: A Data-Theft RAT With a Session-Hijacking Browser

  r/blueteamsec · blackfog.com
• r/blueteamsec Fri 23 Oct

  2083191 - GoDaddy: Delayed Certificate Revocation

  r/blueteamsec · bugzilla.mozilla.org
• 
  r/blueteamsec Fri 23 Oct

  Chrome Now Warns Before Insecure HTTP Connections

  r/blueteamsec · blog.google
• r/blueteamsec Fri 23 Oct

  Protecting NetScaler Management Access from PHP CVE-2026-109618 & CVE 2026-109619

  r/blueteamsec · community.citrix.com

  CVE-2026-109618
• 
  r/blueteamsec Fri 23 Oct

  【重要】[お名前.com デスクトップクラウド]第三者による不正アクセスに関するお詫びとお知らせ（2026年10月21日 4:00時点）｜[Important] Apology and Notice Regarding Unauthorized Access by a Third Party to Onamae.com Desktop Cloud (As of October 21, 2026,

  r/blueteamsec · onamae.com
• 
  r/blueteamsec Fri 23 Oct

  PHP2Shell Patch Uptake Tracker

  r/blueteamsec · php2shell-tracker.com
• r/blueteamsec Thu 22 Oct

  Patch or Pass #1: Plex Media Server exploit chain now in CISA KEV, PAN-OS GlobalProtect (CVE-2026-0257) used by Qilin and Inc ransomware, plus 2 EOL boxes with no patch

  This week's actively exploited flaws, sorted by urgency: - **Plex Media Server CVE-2026-96652/96654/96655/96656** (added to CISA's KEV on Oct 20): a chain that gives unauthenticated code execution on servers older than 1.43.3.10861. Plex says it's being widely exploited for crypto miners and proxy software. Update, then check the Codecs folder and running processes. - **PAN-OS GlobalProtect CVE-2…

  CVE-2026-0257, CVE-2026-96652
• 
  r/blueteamsec Thu 22 Oct

  CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability

  r/blueteamsec · zscaler.com

  CVE-2026-88771
• r/blueteamsec Thu 22 Oct

  We attacked our own agent guard with a base64 exfiltration. Here's what happened.

  Scenario: an agent processes a PDF invoice. Buried in it, an instruction to read .env, base64-encode the contents, and email it out. The resulting email has no red flags at all — no "password", no "api key", just a base64 blob. This is exactly the case where keyword/regex filtering fails. Our guard still blocks it, because it doesn't inspect the text — it tracks the data flow: label secrets by or…
• 
  r/blueteamsec Thu 22 Oct

  PHP2Shell detection: attempt signatures and IOCs from live open-dir tracking

  r/blueteamsec · hunt.io
• 
  r/blueteamsec Thu 22 Oct

  Prince of Persia: A Threat Group Hiding in Plain Sight | Semperis Research

  r/blueteamsec · semperis.com
• 
  r/blueteamsec Thu 22 Oct

  PHP2Shell Exposure Hunting - Do you have it across your estate and where?? An Advanced Hunting pack for Defender XDR

  r/blueteamsec · github.com
• 
  r/blueteamsec Thu 22 Oct

  KeyStealth: A $10,000 PhaaS Kit caught in the wild

  r/blueteamsec · adamnet.works
• 
  r/blueteamsec Thu 22 Oct

  Custom Extensions for SmartScreen and Email Filtering Evasion

  r/blueteamsec · ipurple.team
• 
  r/blueteamsec Thu 22 Oct

  PHP2Shell exploitation prior to public disclosure in MadPot

  r/blueteamsec · aws.amazon.com
• r/blueteamsec Thu 22 Oct

  eMudhra intermediate CA keys exposed (weak P-384 generation). Browsers blocked the chains, but check your non-browser trust stores

  8 intermediate CA private keys from eMudhra were exposed because of critically weak P-384 key generation. 6 of them were used for TLS and 2 for code signing. Browsers have already blocked the affected chains, so most people will never notice. The less obvious exposure is anywhere that ships its own CA bundle: → Non-browser clients (curl, language runtimes, Java keystores) → CI/CD runners and buil…
• 
  r/blueteamsec Thu 22 Oct

  Header Accordions: QPACK amplification attacks against HTTP/3 servers

  r/blueteamsec · foxio.io
• 
  r/blueteamsec Thu 22 Oct

  Security Disclosure: Wednesday October 21st

  r/blueteamsec · blog.railway.com
• r/blueteamsec Thu 22 Oct

  eMudhra Statement on Recent Certificate Security Incident

  r/blueteamsec · emudhra.com
• 
  r/blueteamsec Thu 22 Oct

  I let my plant model bend, and it got worse at catching attacks

  r/blueteamsec · github.com
• 
  r/blueteamsec Wed 21 Oct

  PHP2Shell disclosure-day telemetry: scanners that double as droppers, a second stage not in public malware feeds, and IOCs (user agents, boundary strings, hashes)

  r/blueteamsec · ellio.tech
• 
  r/blueteamsec Wed 21 Oct

  Recent AI-Assisted Cyber Attacks in Japan: Investigating Attack Infrastructure and Techniques - JPCERT/CC Eyes

  r/blueteamsec · blogs.jpcert.or.jp
• 
  r/blueteamsec Wed 21 Oct

  AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise

  r/blueteamsec · microsoft.com
• r/blueteamsec 21 Oct

  Dissecting Operation FlashHole, a complex attack by Lazarus

  r/blueteamsec · securelist.com
• 
  r/blueteamsec 21 Oct

  Inside CARLIY0S: How CyberCartel Used Multiple AI Models to Attack 400+ Latin American Banks and Financial Institutions

  r/blueteamsec · straiker.ai
• 
  r/blueteamsec 21 Oct

  [SECURITY] litellm 1.107.0 compromised (PyPI removed; Docker latest/main-stable STILL infected): cook.pth credential stealer + sitecustomize RCE loader, built from lookalike repo Berri-AI/litellm

  r/blueteamsec · github.com
• 
  r/blueteamsec 21 Oct

  PHP2Shell — AI uncovers critical vulnerabilities in the backbone of the web

  r/blueteamsec · php2shell.com
• 
  r/blueteamsec 21 Oct

  Watching PHP with process-watcher: quick start

  r/blueteamsec · github.com

Older