PHP2Shell and UpdraftCentral Keys: Two PHP Threats to Fix Now
Patch PHP2Shell (CVE-2026-109618, CVE-2026-109619) and remove stolen UpdraftCentral keys. Raxis explains how to check exposure and fix both PHP threats.
Exploits
Discover expert insights on the latest exploits, penetration testing tactics, and real-world vulnerabilities to strengthen your cybersecurity defenses.
Cool Tools: NetExec (NXC) – Modules Deep Dive
Learn how NetExec (NXC) modules speed up internal pentests. Scottie Cole covers GPP passwords, LAPS, Zerologon checks, and coerce_plus with example commands.
French Supermarket Hack: When OT Security Failures Reach the Food Supply
The French supermarket hack exploited unpatched, internet-facing Danfoss controllers. Learn why OT security gaps like this persist and how to close them.
Better API Endpoint Enumeration: Testing for the #1 OWASP Security Vuln
Broken Access Controls is at the top of the OWASP Top 10. The difficulty is finding each instance to test. Learn 3 ways to enumerate API endpoints thoroughly.
We Went on a SharePoint Expedition, and Here’s What We Found
Of the nearly 30,000 public facing SharePoint portals we found, approximately 3,300 are self-hosted meaning they are vulnerable to the critical CVE-2026-50522.
Rooting a Google Pixel 8 for Mobile App Penetration Testing
Principal Penetration Tester Andrew Trexler takes us step-by-step through the process of rooting a Google Pixel for mobile application pentesting.
Cool Tools: The NetExec (NXC) nxcdb Database
Principal Pentester Scottie Cole continues his NetExec series with nxcdb, the database that automatically stores key info like hosts and creds while you hack.
wp2shell: Critical WordPress Unauthenticated to Remote Code Execution Vulnerability
It’s rare for WordPress itself to have CVEs. CVE-2026-63030 and CVE-2026-60137 combine to create the critical unauthenticated to RCE vulnerability wp2shell.
usbliter8 – Apple A12 and A13 SecureROM Exploit
The usbliter8 SecureROM exploit is big news for jailbreaking iPhones. This hardware vulnerability cannot be fixed with a software update.
RoguePlanet: The Defender Zero-day that Survived Microsoft’s June Patch
The new critical Microsoft Defender exploit, RoguePlanet (CVE-2026-50656), is confirmed active in the wild. Learn what it is and how to protect your network.
Building Security Tools from Source to Bypass Endpoint Security
Endpoint security detects many malicious files created with pentest tools, but pentesters can sometimes bypass this by rebuilding source code. Learn how here.
Cool Tools: Bloodhound CE
BloodHound’s Community Edition has everything a penetration tester needs to enumerate relationships in a domain in order to gain more access, even Domain Admin.
80 posts in Exploits.