Sowat @shadowroot23

🚨 850+ compromised GitHub accounts. 13,500+ malicious branches. Researchers uncovered 'Gheist,' an ongoing campaign using stolen tokens to plant GitHub Actions workflows that dump private repo secrets into logs. Attackers download the logs, then delete the runs. Details: thehackernews.com/2026/10/gheist…

今週GitHubで急上昇したAIリポジトリ10選： 1. rea AIエージェントが、アプリの動きから実行ファイルの中身まで解析してくれる。仕組みが見えないソフトの挙動を、追いかけて読み解ける。 github.com/morluto/rea 2. security-audit-skill コーディングエージェントに持たせる、セキュリティ監査用の追加スキル。何段階かに分けて調べ、見つかった問題を機械が読める形で出す。Cloudflare製。 github.com/cloudflare/sec… 3. graphify プログラムのソースやドキュメント、PDFを、検索できる「知識のつながり図」に変換。このうちコードの解析だけは手元で完結し、検索用データベースもいらない。 github.com/Graphify-Labs/… 4. hyperframes HTMLを書くだけで動画ができる。AIエージェントが扱うことを前提に設計されている。HeyGen製。 github.com/heygen-com/hyp… 5. ComfyUI パーツをつないで、画像を作るAIの処理を思いどおりに組み立てられる操作画面。細かい調整を目で見ながら設定できる。 github.com/Comfy-Org/Comf… 6. freellmapi 34個の無料AIモデル提供元を、1つの窓口にまとめて呼び出せる。つながらないときは自動で別の提供元に切り替わる。個人の実験用途向け。 github.com/tashfeenahmed/… 7. ai-memory AIコーディングツールに長期記憶を持たせられる。別のツールに乗り換えても、それまでのやり取りを引き継げる。 github.com/akitaonrails/a… 8. claude-plugins-official Anthropic公式が選んで管理している、Claude Code用プラグインの一覧。外部からの提出分は、品質とセキュリティの基準を満たす必要がある。 github.com/anthropics/cla… 9. claude-howto Claude Codeの使い方を、図と実例で学べるガイド。文字だけの説明より、何をどう動かすかがつかみやすい。 github.com/luongnv89/clau… 10. airllm 大きなAIモデルを、メモリ4GBのGPU1枚でも動かせる。高価な機材をそろえなくても推論を試せる。 github.com/lyogavin/airllm

keyboard_arrow_left Previous keyboard_arrow_right Next

🔥A NEW PowerShell reverse shell in the PSSW100AVB repository ✅ 100% AV bypass (October 2026) ✅ Ready for red team operations (OSCP/OSAI/CRTP) ✅ AI-Evasive Comment to Bypass LLM Detection github.com/tihanyin/PSSW1…

this is where REA × Kimi K3 starts to feel dangerous. reverse engineering normally means one model slowly reading through an app and trying to keep the whole architecture in context. REA changes that first. it breaks the app into smaller pieces that can be investigated separately - functions, dependencies, call paths, state changes, UI behavior. then K3 sends 300 agents across that map at the same time. so instead of: one model → one codebase → one long chain of reasoning you get: one app → hundreds of narrow investigations → one reconstructed system the swarm builds the understanding collectively. that’s what makes REA × K3 powerful: reverse engineering stops being limited by how much of the app one model can hold in context. full course in the article below ↓

Ricker @0xRicker

2 weeks ago

x.com/i/article/2109…

13 22 192 131K 382

Instagram ban method Germany VPN > 2x Self > 1x Hate > 1x Imp @Meta.ai Note: Use VPN for 5 minutes before reporting.

CVE-2025-24071: Simply extracting a .rar archive containing a malicious .library-ms file can cause Windows Explorer to initiate an outbound SMB authentication request, potentially exposing the user's NTLM hash. No further interaction is required after extraction.

Stop searching for AI tools one by one. 👀 This GitHub repo has 340+ AI agent tools across 20+ categories. It covers everything from: → Coding agents → Multi-agent frameworks → Browser and voice agents → AI automation → RAG and agent memory → Open-source and self-hosted AI Whether you're building your first AI agent or scaling a complex workflow, there's something useful here. One repo. Hundreds of tools. Endless ideas. 🔥 Save this for your next AI project. 🔗 github.com/caramaschiHG/a…

SAVE THIS: 4 GitHub repos blowing up this week. 1. OpenShell by NVIDIA (19.7K stars) a safe sandbox for AI agents. you write what each agent can touch and it enforces it at the kernel level. agents never see your real credentials. github.com/NVIDIA/OpenShe… 2. Kronos (43.7K stars) an open-source AI model for candlestick charts, trained on data from 45+ exchanges. feed it price history and it forecasts the next bars. has a live BTC/USDT demo. github.com/shiyu-coder/Kr… 3. day-trader-skill (1.2K stars, 5 days old) 11 Claude skills for day trading: chart scanner, news, entries, stops, and a "time machine" that simulates the rest of the session 10,000 times before you trade. paper trading by default. github.com/Jakeschincario… 4. microduck by Pollen Robotics (11K stars) a 25 cm biped duck robot that learned to walk with reinforcement learning. github.com/pollen-robotic…

🔥💀🧪📚 Moodle LMS Remote 0day! School’s in session and the gradebook still has secrets 🔥💀🧪📚 📓🔐✨ 1️⃣ 🔥 High · Remote SQLi enrol_database still slashes and concatenates. auth_db already got a placeholder. An editing teacher sets course idnumber. Cron interpolates it into the external enrolment (sic) database. github.com/abraxas/moodle… abraxaslabs.tech/research/moodl… 2️⃣ 💀 Medium · Remote file read Teacher Blackboard question import. img src is a path. The “image” is config.php copied into the draft area. Students cannot import. github.com/abraxas/moodle… abraxaslabs.tech/research/moodl… 3️⃣ 👀 Medium · Remote IDOR Non-editing teacher. Separate groups. The grader UI learned groups. core_grades_get_feedback did not. Group A AJAX-reads Group B feedback plus email. Not a score write. github.com/abraxas/moodle… abraxaslabs.tech/research/moodl… 4️⃣ 🧪 Medium · Remote IDOR Enrolled student. The student UI hid the extra-credit item. The AJAX catalogue did not. Hidden names leak. github.com/abraxas/moodle… abraxaslabs.tech/research/moodl… 📓🔐✨

dejo esto por aquí: 👇 php2shellbt is a standalone Python scanner that detects the php2shell vulnerability chain in PHP web applications — with zero external dependencies (pure stdlib). github.com/pentestershell… De nada XD

Reversed CVE-2026-109618 using my harness and Deepseek models felt PHP2Shell's leaked UAF writeup dies on contact with real PHP. 8.4.4 built twice with ASAN: stock clean. Delete one line (Z_TRY_ADDREF, session.c:3189) → the exact "verified" stack appears. will update this lab real time as patch is out as well Lab + PoC: github.com/jaiswalakshans…

x.com/i/article/2112…

REA + Opus 5.5 is scary f*cking dangerous... Any closed-source device can now be reverse engineered. Down to the binary, and you can modify it however you want. Send this prompt to Claude and analyse how your PS5 works. Then read the full article below on how to rea any app for Android👇

cabbit @cabbitar

7 days ago

x.com/i/article/2112…

6 35 179 142K 389

:~$ [!WARNING] > So, unauth php2shell (CVSS 9.2); fun as always, but UPDATE 🙇‍♀️ 5.4 <= PHP < 8.2.35, 8.3.36, 8.4.27, 8.5.12 // + also affects WordPress, Drupal, Joomla, ... - calif.io/php2shell - php2shell.com (of course; I love these domains) - wiz.io/blog/php2shell… [🐰] CVE-2026-109618: RCE // OOM corruption github.com/php/php-src/se… TLDR ~1 multipart POST req. to push memory past the default 128M PHP heap limit while staying < 8M POST limit: • no usable length (chunked HTTP/1 || no Content-Length HTTP/2) → bypass post_max_size • lots of headers per part • lots of empty, deeply nested file fields (not counted by max_file_uploads) • OOM leaves a half-built $_FILES/$_POST hash bucket & shutdown frees it → RCE (mod_php); [🐰] CVE-2026-109619: RCE // stale global state github.com/php/php-src/se… TLDR ~2 reqs, same worker: • 1/2 multipart req. with a session ID (PHPSESSID) + an upload-progress field (PHP_SESSION_UPLOAD_PROGRESS) + file part & OOM / fatal error trigger → PS(id) & PS(http_session_vars) stay behind • 2/2 multipart req. same + no file part; cleanup uses the PS(id) → UAF, memory leak via PHPSESSID, RCE; ========= [🌐] Shodan: "X-Powered-By: PHP" "X-Powered-By: PHP/XX" http.component:"php" http.component_version:"XX" [📃] Nuclei / detect PHP: github.com/projectdiscove… [📃] Nuclei / detect vulnerable PHP: github.com/Ademking/php2s… [⚙️] PortSwigger's bambda: github.com/PortSwigger/ba… > please find funny videos from Wiz / Calif attached below > btw websites shutting down waiting for a security update is cute (it's a right thing to do though, why not) (even hacker forums, how cool is that?) :~$ Stay safe! 🐇

🚨 PHP2Shell detection is now available in Burp Suite Professional & Burp Suite DAST. Most of the web is powered by PHP, which means most of the web is vulnerable to these critical unauthenticated remote code execution flaws (CVE-2026-109618 / 109619). You can already detect it in Burp Suite using: 🟧 ActiveScan++ v2.0.13 (portswigger.net/bappstore/3123…) 🟧 Bambda scan checks (github.com/PortSwigger/ba…) 🟧 BChecks (github.com/PortSwigger/bc…) Start scanning for the vulnerability now → portswigger.net/bappstore/3123…

PHP2Shell explained. @wiz_io @galnagli @calif_io

📢PHP is compromised 🚨 Here’s a video of the php2shell exploit that demonstrates a hack of the latest WordPress, as well as phpBB, Drupal, and other popular PHP projects Update emergency patches Today! 14:00 UTC 10:00 AM Eastern Time (ET) 16:00 CEST 23:00 JST

Y sí, ya hay "sitio oficial" y videítos de #php2shell php2shell.com Info actualizada, parches y mitigación: blog.segu-info.com.ar/2026/10/vulner…

50 USEFUL GITHUB REPOS 1. iFixAi — AI misalignment testing → github.com/ifixai-ai/iFix 2. public-apis — free APIs for everything → github.com/public-apis/pu… 3. build-your-own-x — learn by building → github.com/codecrafters-i… 4. developer-roadmap — learn any tech skill → github.com/kamranahmedse/… 5. free-programming-books — thousands of free books → github.com/EbookFoundatio… 6. system-design-primer → github.com/donnemartin/sy… 7. coding-interview-university → github.com/jwasham/coding… 8. the-art-of-command-line → github.com/jlevy/the-art-… 9. project-based-learning → github.com/practical-tuto… 10. you-dont-know-js → github.com/getify/You-Don… 11. the-book-of-secret-knowledge → github.com/trimstray/the-… 12. tech-interview-handbook → github.com/yangshun/tech-… 13. awesome-selfhosted → github.com/awesome-selfho… 14. javascript-algorithms → github.com/trekhleb/javas… 15. 30-seconds-of-code → github.com/Chalarangelo/3… 16. github gitignore templates → github.com/github/gitigno… 17. ollama — run LLMs locally → github.com/ollama/ollama 18. langchain → github.com/langchain-ai/l… 19. n8n automation → github.com/n8n-io/n8n 20. openclaw — local AI assistant → github.com/openclaw/openc… 21. dify — AI app builder → github.com/langgenius/dify 22. langflow → github.com/langflow-ai/la… 23. mem0 — AI memory layer → github.com/mem0ai/mem0 24. browser-use → github.com/browser-use/br… 25. crewAI → github.com/crewAIInc/crew… 26. MetaGPT → github.com/geekan/MetaGPT 27. AutoGen (Microsoft) → github.com/microsoft/auto… 28. aider — AI coding assistant → github.com/Aider-AI/aider 29. markitdown (Microsoft) → github.com/microsoft/mark… 30. open-webui → github.com/open-webui/ope… 31. maigret — OSINT tool → github.com/soxoj/maigret 32. TradingAgents → github.com/TauricResearch… 33. stagehand → github.com/browserbase/st… 34. firecrawl → github.com/mendableai/fir… 35. transformers (HuggingFace) → github.com/huggingface/tr… 36. vLLM → github.com/vllm-project/v… 37. llama.cpp → github.com/ggml-org/llama… 38. llama_index → github.com/run-llama/llam… 39. nanoGPT (Karpathy) → github.com/karpathy/nanoG… 40. RAGFlow → github.com/infiniflow/rag… 41. supermemory → github.com/supermemoryai/… 42. awesome-claude-skills → github.com/ComposioHQ/awe… 43. Bumblebee (Perplexity AI security tool) → github.com/perplexityai/b… 44. ComfyUI → github.com/comfyanonymous… 45. DeepSeek (official repo varies by model release) → github.com/deepseek-ai 46. Lobe Chat → github.com/lobehub/lobe-c… 47. freeCodeCamp → github.com/freeCodeCamp/f… 48. system design + interview prep extras (bonus) → github.com/jwasham/coding… 49. AI agents ecosystem (extra) → github.com/langchain-ai/l… 50. automation + AI workflows (extra) → github.com/n8n-io/n8n Save this before you forget it exists. If you want to get more AI post then follow @Arina_sharmi

‼️ BREAKING - PHP releases emergency patches for two critical #PHP2Shell RCE flaws (CVSS 9.2) as early exploit attempts emerge. The flaws can enable unauthenticated code execution and expose server memory. 👉 PATCH NOW (CVE-2026-109618, CVE-2026-109619) Details ➜ thehackernews.com/2026/10/php-is…