PenTestIT.com

Your source for Detection Engineering, Security Research and Adversary Simulation

Cyber Threat Intelligence

Microsoft Patch Tuesday November 2026: Patch the Outlook zero-day first!

One exploited CVE out of 1,094: CVE-2026-124194, an Outlook NTLMv2 leak, on KEV and due 24 November. Patch prioritized by BOD 26-04.

Posted: by Leave a Comment

Microsoft's November 2026 Patch Tuesday release fixes 1,094 CVEs. Out of those, one is already being exploited: CVE-2026-124194, an Outlook spoofing bug that hands an attacker the user's NTLMv2 hash when a crafted message file is opened. Saving grace that no other vulnerabilities are publicly disclosed. CISA has already added it to KEV, due 24 November, with no forensic triage. Read more about Microsoft Patch Tuesday November 2026: Patch the Outlook zero-day first!

Popular this week

  1. Detection EngineeringCVE-2026-98432: Linux Kernel IPv4 TCP Use-After-Free Root Cause, Detection and Mitigation
  2. Cyber Threat IntelligencePHP2Shell (CVE-2026-109618, CVE-2026-109619): Actively Exploited, Now in CISA KEV
  3. Detection EngineeringNode2Shell/HTTP2Shell (CVE-2026-111497): Detection and Mitigation for Node.js
  4. Cyber Threat IntelligenceClaude Skill: cve-check
  5. Offensive SecurityFinding crown jewels in Nmap scans with Jev!

Detection Engineering

sshole (CVE-2026-123158): OpenSSH musl Password Bypass Root Cause, Detection and Mitigation

On Alpine CVE-2026-12315 allows log into an account that has no password when three conditions are met!

Posted: by Leave a Comment
Updated:

CVE-2026-123158 ("sshole") lets an unauthenticated attacker log into any OpenSSH account whose /etc/shadow password field is exactly * by sending a 257 to 1024 byte password. It only works when sshd is linked against musl libc, runs without PAM, has PasswordAuthentication yes, and at least one other local account holds a $5$ or $6$ hash. Fix: OpenSSH 10.6p2 or your distribution Read more about sshole (CVE-2026-123158): OpenSSH musl Password Bypass Root Cause, Detection and

Detection Engineering

CVE-2026-98432: Linux Kernel IPv4 TCP Use-After-Free Root Cause, Detection and Mitigation

CVE-2026-98432 root cause, fixed builds per distribution, detection-engineering based workaround and validated detections.

Posted: by Leave a Comment

CVE-2026-98432 is a remote, unauthenticated use-after-free vulnerability in the Linux kernel IPv4 TCP handshake mechanism, present in every kernel from 4.4 up to the fixed stable releases. A remote, unauthenticated attacker transmits a TCP SYN packet that carries IPv4 Record Route or Timestamp options to any listening IPv4 TCP port, then sends a retransmitted SYN flag against Read more about CVE-2026-98432: Linux Kernel IPv4 TCP Use-After-Free Root Cause, Detection and

Detection Engineering

Node2Shell/HTTP2Shell (CVE-2026-111497): Detection and Mitigation for Node.js

Detect & mitigate CVE-2026-111497. Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1 or later versions.

Posted: by Leave a Comment

It's now evident that everyone knows - Node2Shell and HTTP2Shell are the same bug: CVE-2026-111497. It is an out-of-bounds write condition in the Brotli decoder that Node.js bundles. CISA added it to the KEV catalog on October 27, 2026, with a federal due date of November 10, 2026. Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1, rebuild your images, and restart every Node Read more about Node2Shell/HTTP2Shell (CVE-2026-111497): Detection and Mitigation for Node.js

Detection Engineering

Quantitative Scoring of GitHub Hosted PoCs: A php2shell Case Study

I graded 1,414 php2shell repositories on GitHub. Only 5 of the 38 scanners I ran differentiate a patched server from a vulnerable one.

Posted: by
Updated:

php2shell is now a thing from the last week as PHP fixed CVE-2026-109618 and CVE-2026-109619 on 21 October. In the days leading upto the weekend, multiple proof-of-concept code were uploaded to GitHub and elsewhere. I'm publishing my algorithm to analyze repositories that are safe to run and which ones do their job. This analysis is based on the 1,414 repositories, uploaded and Read more about Quantitative Scoring of GitHub Hosted PoCs: A php2shell Case Study

Cyber Threat Intelligence

PHP2Shell (CVE-2026-109618, CVE-2026-109619): Actively Exploited, Now in CISA KEV

This post details typical response options for high priority PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619.

Posted: by
Updated:

PHP announced fixes for two critical bugs on Wednesday, 21 October 2026 at 14:00 UTC. Why are these important? It's because the vulnerabilities were reportedly leaked before their planned disclosure. I'll update this post as more information is made available and PHP and the distros publish. Until then, treat this post as a speculative and preventive information. All Read more about PHP2Shell (CVE-2026-109618, CVE-2026-109619): Actively Exploited, Now in CISA KEV

Penetration Testing

Auditing Electron Fuses with REA

In this post, I "ab"use REA - (Reverse Engineer Anything) MCP to read Electron fuses out of the app binaries without launching them.

Posted: by

Over the weekend, a reverse-engineering MCP - REA, short for Reverse Engineer Anything was all over my X/Twitter timeline. I wanted to quickly try all that was claimed So, I audited apps installed on my test machine - chat, notes, code editors, password managers. Most of them ended up being Electron applications and Electron ships with build-time switches called fuses. These Read more about Auditing Electron Fuses with REA

Detection Engineering

The OpenAI Sophisticated Recording Device: Detection and Response – Part II

This is a continuation to my older post where I discuss about network and endpoint strategies to detect and respond to hardware implants.

Posted: by

In my last post about the OpenAI sophisticated recording device, I stopped at general detection and response guidelines for covert devices that do not transmit. This post deals with the logical next step when such espionage devices have exfiltration capabilities and are now on your Microsoft Windows/Linux/Apple Mac server endpoints. There can be a variant where some one "pulls" Read more about The OpenAI Sophisticated Recording Device: Detection and Response – Part

Detection Engineering

The OpenAI Sophisticated Recording Device: Detection and Response – Part I

This is my post to help you in detection and response of the OpenAI recording device & similar devices when connected to an endpoint.

Posted: by
Updated:

I came across the now viral OpenAI Newsroom post on X where an OpenAI engineer accused of planting a sophisticated recording device in an executive conference room. The device was a Seeed Studio XIAO ESP32-S3 Sense that was plugged into a USB port on the back of a TV. I missed the "back of a TV" part earlier and wrote this post with a endpoint - Microsoft Windows/Linux/Apple Read more about The OpenAI Sophisticated Recording Device: Detection and Response – Part

Cyber Threat Intelligence

Microsoft Patch Tuesday October 2026 Exploitability and Patching Priority

This blog is my interpretation of the Microsoft Patch Tuesday October 2026 Exploitability and Patching Priority

Posted: by
Updated:

Microsoft released this months bulletin a tad bit late. Nontheless, here it is! I half expected a crazy announcement - but fortunately other than crossing the total number of CVEs mitigated compared to the whole of 2025 - this release is nothing exceptional. This month, Microsoft patched 1,413 CVEs this month, plus one republished Cisco Talos CVE. Microsoft Windows alone Read more about Microsoft Patch Tuesday October 2026 Exploitability and Patching Priority

Offensive Security

Finding crown jewels in Nmap scans with Jev!

This post details a tool I wrote to use the Jev detection model and create attack paths from nmap scans.

Posted: by

Continuing my decision model journey with Jev. We know that an Nmap scan tells you what ports are open. It does not tell you which of these hosts matter. You may find a vCenter console, a Jenkins server, and the company blog can all look the same from the outside: TCP 443 or 8443, a TLS certificate, a web page. Typical attack path tools need a distinction before they can do Read more about Finding crown jewels in Nmap scans with Jev!

Cyber Threat Intelligence

Introduction: Jev From A Security Practioner’s Perspective

This post introduces The TypeSafe AI Jev model and my perspectives as a security practitioner.

Posted: by

I know I'm a tad bit late with this post, but work took over and this post about the introduction to Jev stayed in drafts over two weeks. However, now, we are ready to go! TypeSafe AI released Jev on September 15, 2026. It's the first of what they call "System One" models. You don't chat with it, you just send it a state (text or JSON) and a set of typed questions, and it Read more about Introduction: Jev From A Security Practioner’s Perspective

Client

Agent
—
Platform
—
Language
—
Screen
—
Viewport
—

Session

Local time
—
Timezone
—
Scheme
—
Referrer
—
Cores
—
Memory
—
Network
—
GPU
—

Readout

Every value here is what your browser hands to any site you open. It is read and shown only on your screen; this panel sends nothing back.