PenTestIT.com

Your source for Detection Engineering, Security Research and Adversary Simulation

Cyber Threat Intelligence

Analysis: CVE-2026-88771 and CVE-2026-88772

This is my analysis of the Citrix NetScaler ADC/Gateway CVE-2026-88771 & CVE-2026-88772 vulnerabilities along with hunting & detection guide

Posted: by Leave a Comment
Updated:

Citrix published fixes for eight NetScaler ADC and Gateway CVEs today - September 27, 2026, in bulletin CTX697096. Two of them, CVE-2026-88771 and CVE-2026-88772, were exploited before the bulletin went out. As a result, CISA added both to KEV the same day. This is my analysis of the two vulnerabilities, collation of data from multiple sources and the steps you can take to Read more about Analysis: CVE-2026-88771 and CVE-2026-88772

Offensive Security

Analysing BigDiskBuster, the Microsoft Defender Update Blocker

This is my analysis of the BigDiskBuster - the open source Microsoft Defender Update Blocker.

Posted: by Leave a Comment

Last week Nightmare Eclipse open sourced BigDiskBuster - although I can see that now all the repositories have been made private. This post is my analysis of this tool that many news outlets called a "0day" initially. In reality, it is a class of defense-evasion tools that never touches a security product - Windows Defender in this case. It does not involve a driver unload, or Read more about Analysing BigDiskBuster, the Microsoft Defender Update Blocker

Cyber Threat Intelligence

Claude Skill: threat-report-killchain

This post documents the features and working of a Claude skill that helps you automatically triage evidence backed threat intel reports.

Posted: by Leave a Comment
Updated:

Everyday when I come across a threat intelligence report, I have to sift through a lot of data to get to the gist of it. Hence, I created this "threat-report-killchain" Claude skill to automate the process of CTI report triage for me. It does so completely, well 80% to be precise. Since, it helped me a lot, I thought of open sourcing it for the community. This post describes Read more about Claude Skill: threat-report-killchain

Cyber Threat Intelligence

Microsoft Patch Tuesday September 2026 Exploitability and Patching Priority

This blog is my interpretation of the Microsoft Patch Tuesday September 2026 Exploitability and Patching Priority

Posted: by
Updated:

Back after a hiatus the Microsoft Patch Tuesday September 2026 Exploitability and Patching Priority blog. Last time I did this was Microsoft Patch Tuesday March 2026 Exploitability and Patching Priority. This time around, I am doing two things differently. I am ranking every priority against CISA BOD 26-04. Interested? Read on! Read more about Microsoft Patch Tuesday September 2026 Exploitability and Patching Priority

Cyber Threat Intelligence

Claude Skill: cve-check

This post describes a Claude Skill named cve-check that I wrote to enrich CVE information for threat intelligence collection

Posted: by

If you follow me on LinkedIn, I released this skill there first. Resharing here if you don't. I created the cve-check Claude Skill to resolve multiple searches to begin my vulnerability mitigation research . The skill automates and presents multiple prerequisites that help you prioritize your threat detection backlog. Read on for more details. Read more about Claude Skill: cve-check