APT: Public Chat

GhostLock — CVE-2026-43499 This is a Linux kernel vulnerability found by VEGA that exists in every major distribution since 2011. Triggering the bug does not require any special kernel config or privilege. By turning it into a 97% stable privilege escalation and container escape, Google has rewarded us $92,337 in kernelCTF. This writeup covers the technical details of the exploit. 🔗 Research: https://nebusec.ai/research/ionstack-part-2/ 🔗 Exploit: https://github.com/NebuSec/CyberMeowfia/tree/main/IonStack/CVE-2026-43499 #linux #kernel #lpe #container #escape

💉 P³ — Shellcode Loader: Process Parameter Poisoning This loader implements a code injection technique that leverages the Windows Process Parameters structure (PEB) as a staging and execution location for remote shellcode injection. By passing payload data implicitly through standard parameters like CommandLine, Environment, or ShellInfo, it bypasses EDR detection because it doesn't touch heavily monitored APIs like VirtualAllocEx, WriteProcessMemory, or CreateRemoteThread. Since it runs without spawning suspended processes or relying on process hollowing, it leaves virtually no obvious footprint in the system. 🔗 Research: https://sensepost.com/blog/2026/process-parameter-poisoning/ 🔗 Source: https://github.com/Orange-Cyberdefense/p3-loader/ #maldev #injection #edr #bypass #windows #peb

🔒 Certighost (CVE-2026-54121) — AD CS Domain Controller Impersonation Low-privileged domain user can impersonate a Domain Controller via an AD CS enrollment chase fallback. By supplying cdc (Client DC) and rmd (Remote Domain) request attributes, an attacker forces the Enterprise CA to query an attacker-controlled host over SMB and LDAP. The CA then blindly trusts the returned directory objects (objectSid + dNSHostName of a real DC) and issues a certificate containing strong identity mapping for the Domain Controller. This allows successful PKINIT authentication as the DC. 🔗 Research: https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26 🔗 Source: https://github.com/aniqfakhrul/CVE-2026-54121 #ad #adcs #pkinit #machineaccountquota

ResetNightmare ResetNightmare (CVE-2026-27912) is a validation flaw in the Kerberos Change Password protocol that allows for resetting the password of any target user/computer account, without knowing the current one. The attack requires an unpatched domain controller, and the ability to write a userPrincipalName (UPN) on any account you control. Alternatively, the vulnerability can also be abused by an attacker having the ability to create new users/computers in any OU, as creating a user/computer allows you to get GenericWrite permissions over it. Blog: Identity Crisis: Novel Vulnerabilities Leading to Kerberos Downgrade, DoS, and Full Domain Takeover

🔒 Citrix NetScaler Pre-Auth RCE (CVE-2026-8452) Unauthenticated heap overflow in SAML signature canonicalization. An oversized PrefixList inside the <ds:SignedInfo> InclusiveNamespaces element overflows a fixed-size buffer, corrupting adjacent nsb chunk metadata. This yields a write-what-where primitive (controlled memcpy src/dst), allowing overwrite of tx_pkt_complete_fptr and jump to attacker shellcode on the executable heap. Results in root RCE when NetScaler is configured as SAML SP or IdP. Affected: NetScaler ADC/Gateway 14.1 < 14.1-72.61 and 13.1 < 13.1-63.18 🔗 Research: https://labs.watchtowr.com/youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452/ 🔗 Source: https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452 #citrix #netscaler #rce #preauth #saml #heapoverflow

🔒 Certi-Bhai — IIS AppPool → NT AUTHORITY\SYSTEM via AD CS RPC A webshell under IIS AppPool\DefaultAppPool can enroll against the ADCS RPC endpoint and come back with a certificate for the host machine account. Outbound domain traffic from a virtual AppPool identity is authenticated as HOST$, so the default Machine template treats the CSR as a legitimate computer enrollment. The issued cert produces a PKINIT TGT for that machine account. S4U2Self turns it into an Administrator CIFS ticket on the same box, which is local SYSTEM-equivalent access and a path to hash dump. Potato-family impersonation is not part of the chain. 🔗 Research: https://www.mannulinux.org/2026/08/Privilege-escalation-from-IIS-AppPool-to-NT-AuthoritySYSTEM-via-AD-CS-RPC-endpoint.html 🔗 Source: https://github.com/incredibleindishell/Certi-Bhai #ad #adcs #iis #privesc #pkinit #s4u2self #windows