CVE-2026-22738 — SpEL Injection RCE in Spring AI SimpleVectorStore
*
PoC

Хорошее.
The Cisco Blackout: Inside the ShinyHunters Breach and the Trivy Supply Chain Collapse

Burp Bounty Pro v3.1.0 supports 5 providers

пора выкачивать

Blinding the Defenders: Inside Qilin’s EDR-Killer Malware

Original text by Takahiro Takeda, Holger Unterbrink

The article provides a technical analysis of a malware component used in Qilin ransomware attacks that is specifically designed to disable endpoint security products. Researchers describe a multi-stage infection chain centered around a malicious msimg32.dll library that ultimately deploys an EDR-killer payload. The loader executes several stages of…

https://core-jmp.org/2026/04/blinding-the-defenders-inside-qilins-edr-killer-malware/

METATRON
*
AI-powered penetration testing assistant using local LLM on linux (Parrot OS)
Ну, этого стоило ожидать
Link

Чутка движемся к финалу 😁

Run Linux containers on Android — no root required.
*
PodRoid

API keys
может еще живы

OPENAI_API_KEY=sk-proj-q9F2mYxK8D4sLZ0a7HcE3R6NwP1U5tJb
OPENAI_ORG_ID=org-4k9D2sQeP8WZJtL0mXcA
OPENAI_PROJECT_ID=proj-8W3mP2RZk0sQJc9D4tL

ANTHROPIC_API_KEY=sk-ant-api03-2m9QF4RkZJ8W0X6L3PAsHcE
GEMINI_API_KEY=AIzaSyC3nP9R2sZ0Lk4QFJ8WmXH

AWS_ACCESS_KEY_ID=AKIA4M7Q2Z9KXW8R
AWS_SECRET_ACCESS_KEY=JrU3n8WkL4X0mPZ2s9QH7A5R

STRIPE_API_KEY=sk_test_51QH2Z9KXWmP0L4R8sJcA7nE
STRIPE_WEBHOOK_SECRET=whsec_9mZ0KX4Q2R8sW7PJLcA

GITHUB_TOKEN=ghp_9WZ0KX4Q2R8sJcA7nEmPLH

Escaping the VM: From Guest Code to Host Compromise in VMware Workstation

Original text by r0keb

The article presents a technical walkthrough of developing a VMware guest-to-host escape exploit, demonstrating how vulnerabilities in virtualization software can break the isolation between a virtual machine and its host system. The research focuses on flaws affecting VMware Workstation, where bugs in virtual device handling and host-side processing logic allow a…

https://core-jmp.org/2026/04/escaping-the-vm-from-guest-code-to-host-compromise-in-vmware-workstation/

Signed to Kill: Reverse Engineering a 0-Day Used to Disable CrowdStrike EDR

Original text by Jehad Abudagga

The article presents a reverse-engineering analysis of a kernel driver used in a BYOVD (Bring Your Own Vulnerable Driver) attack to disable security software, including CrowdStrike Falcon EDR. The researcher discovered multiple variants of a Microsoft-signed driver that expose a dangerous IOCTL interface capable of terminating arbitrary processes. Because the…

https://core-jmp.org/2026/04/signed-to-kill-reverse-engineering-a-0-day-used-to-disable-crowdstrike-edr/

Windows Defender 0-Day Exploit
*
Allowing Attackers to Gain Full Access

Full PoC

lilu dallas multipass

COMouflage: Stealthy DLL Surrogate Injection for Process Tree Evasion

Original text by S12 – 0x12Dark Development

The article introduces COMouflage, a stealthy Windows process-injection technique that abuses the legitimate COM DLL Surrogate mechanism to execute malicious code inside trusted system processes. Instead of directly injecting into a target process, the attacker registers a fake COM object in the Windows registry under HKEY_CURRENT_USER, which does…

https://core-jmp.org/2026/04/comouflage-stealthy-dll-surrogate-injection-for-process-tree-evasion/

Recovery Mode Breakdown: Turning macOS Recovery Safari into Root Persistence

Original text by Yaseen Ghanem

The article describes a vulnerability discovered in macOS Recovery Mode Safari that allows an attacker with physical access to gain unrestricted write access to system partitions and achieve persistent root-level execution. While exploring Safari inside the macOS Recovery environment, the researcher discovered that downloaded files could be saved to arbitrary…

https://core-jmp.org/2026/04/recovery-mode-breakdown-turning-macos-recovery-safari-into-root-persistence/

И так сойдет ))
https://github.com/apache/httpd/commit/3ad6cba4b484b166fd3b1c6272e383052bc95624