Pentest-Tools.com

#WordPress admins - we got you covered! 🫡 → We've just shipped detection for #wp2shell through our Network Scanner. ⚡️ The fastest way to use it is to:

◉ run a single-CVE scan for CVE-2026-63030 - which also covers CVE-2026-60137 - the SQL injection flaw that chains to give attackers RCE
◉ Based on your scan results, either patch or confirm you're already on 6.8.6, 6.9.5, or 7.0.2.
◉ Re-scan to confirm remediation and rule out residual exposure across your other assets.

Remember: updating your main install doesn't cover *every* WP instance you own. Using Pentest-Tools.com means you can expand visibility across your wider attack surface, not just the site you remember exists.

Technical CVE details below. ↘︎↘︎↘︎

See why an estimated 500+ million websites running WP are vulnerable to this critical vulnerability: https://pentest-tools.com/vulnerabilities-exploits/wordpress-core-69-701-pre-auth-blind-sql-injection-batch-route-confusion_29451

#vulnerabilityassessment #ethicalhacking #offensivesecurity

🏴‍☠️ Least privilege? FuelCMS didn't get the memo.

Any authenticated user (regardless of role) can call the Blocks module endpoint. Pair that with PTT-2025-026 and a low privilege (one could even say zero-permission) account becomes full RCE. CVSSv3 goes from 5.4 to 8.8 faster than you can say "access denied."

No patch. ~4 years of unmaintained software. You know the drill.

Matei "Mal" Bădănoiu and Raul Bledea found the gap. Full PoC can be found in our Offensive Security Research Hub: https://pentest-tools.com/research

#offensivesecurity #vulnerabilityresearch #infosec #RCE

Knowing you're exposed to a new CVE, with proof, before anyone has to ask. That's the moment that matters.

NIS2 gives you 24 hours to raise the alarm once you know something's live. Get it wrong or too slow, and fines run into the millions, with leadership personally on the hook.
Here's where Pentest-Tools.com does the lifting, so the answer is ready before the clock starts:

✅ Detection: every scan logs the CVE, severity, and timestamp
✅ Validation: confirmed findings come with proof, not just a score
✅ Remediation: retests show the before and after
✅ Monitoring: scheduled rescans keep the record current, not annual

When the next CVE lands, you're not racing the clock. You already know.

Full NIS2 evidence chain: https://pentest-tools.com/usage/compliance/nis2

#NIS2 #offensivesecurity #infosec

👂 There's a lot of noise out there. The good stuff comes from a handful of people you've learned to trust.

We've all got that short list. Vote below, then share it in the comments: who's the one you'd tell someone just starting out to follow? 👇

Who do you actually trust most for cybersecurity insights?

A public PoC called LegacyHive targets the Windows User Profile Service. It lets a standard user mount another user's registry hive, potentially an admin's, under their own classes root. No CVE, no Microsoft advisory, no patch.

The researcher behind it has released a run of uncoordinated zero-days since April. Several past drops got weaponized within days and landed on CISA's KEV catalog. This one lands the same week as a record 622-flaw Patch Tuesday.

Matei Badanoiu, our lead security researcher, told The Register the PoC is a "genuinely useful primitive" for an attacker who already has a foothold, but turning that into a full compromise still needs credential access and persistence the released code doesn't provide.
Interim steps: restrict local standard-user account creation, monitor ProfSvc for unexpected hive loads, watch NTUSER.DAT/UsrClass.dat activity, and patch once Microsoft ships one.

theregister.com/security/2026/07/15/microsofts-serial-tormentor-drops-legacyhive-0-day/5271723

#cybersecurity #informationsecurity

Zero CVEs doesn't mean zero risk. XZ had zero CVEs too, right up until v5.6.0 shipped a backdoor.

RapidFort and ReversingLabs just launched a hardened OSS library catalog for that exact gap: checking what a package contains, not matching it to a CVE list.

Our lead researcher Matei Badanoiu told The New Stack it's real progress. The call between feature, vulnerability, and backdoor still needs a human.

https://thenewstack.io/zero-cve-supply-chain-risk/
#offensivesecurity #cybersecurity

GhostLock (CVE-2026-43499): a use-after-free in the Linux kernel, shipped by default since 2011 and disclosed this week. Any logged-in user gets full root in about five seconds, and it escapes containers.
The story isn't that it exists, it's how reliable it is. Daniel Bechenea, security manager at Pentest-Tools.com:
"An exploit reported at 97% reliable, with public code anyone can run, changes that math."
Kernel privesc used to be the exploit you thought twice about firing. A near-deterministic one with public code removes the hesitation.
Patch to a fixed kernel now. Until it reaches every host, treat any code execution on an unpatched box as root and verify the kernel version per system. Don't assume the April fix propagated.
Full breakdown by Emma Woollacott at ITPro: https://www.itpro.com/software/linux/cyber-researchers-sound-alarm-over-a-15-year-old-linux-kernel-flaw-ghostlock-could-let-hackers-seize-unpatched-machines-in-just-five-seconds
#offensivesecurity #penetrationtesting #cybersecurity

We all watch the patch timer.
When you're still working out what the new CVE actually touches, things can feel slooooow.

Critical CVE drops. What slows your "are we exposed?" answer most?

You think it's closed, but it's actually reachable. 😬
That "temporary" rule from your last migration? Probably still open, and better you find it than your auditor does.

Scan your own perimeter from outside before the audit: open TCP and UDP ports, the services behind them, their versions. Close what shouldn't be there, re-scan, confirm. Then nothing in the audit is a surprise.

Nmap does this, or our hosted Port Scanner gives you an exportable report: https://pentest-tools.com/network-vulnerability-scanning/port-scanner-online-nmap
#offensivesecurity #pentesting

Turns out 210,000+ people didn't have to survive a sales pitch to experience how our product works. They just started using our Free Edition!

That's the whole idea:
✅ Real offsec tools you can use every day (with limits, ofc)
✅ Real vulnerability scans on targets you're cleared to test & monitor
✅ Results you can export as PDF, HTML, CSV, or XLSX

Don't take our word for it. Sign up for free ⬇️

https://pentest-tools.com/usage/pricing/free
#offensivesecurity #vulnerabilityassessment #cybersecurity

Remember the phpBB authentication bypass our research team found? We said the proof was coming. 💥 It's here.

Two working PoCs, one for each vulnerability, are now live in the research:

👉 PTT-2026-004 (CVE-2026-48611, 9.4): the PoC shows the full path from a single crafted request to a valid admin session. No credentials that work, no prior access, no user interaction. Just the request and the session cookie that _shouldn't_ exist.

👉 PTT-2026-005 (CVE-2026-48612, 8.3): the PoC walks through the silent OAuth account takeover, including the case where the victim only has to load a forum post for the chain to fire.

Talk is cheap in this line of work, so check out both PoCs, plus the mitigation steps: https://pentest-tools.com/research/phpbb-authentication-bypass

phpBB 3.3.17 fixes both. If you haven't patched, the PoCs are a good reason to move today.

#offensivesecurity #vulnerabilityresearch #infosec

Halfway through 2026 is a good time to run a diff on your own year.

Back in January you had a plan. Six months of real engagements later, some of it held and some of it you _quietly_ 🫢 rewrote.

So what actually changed in how you work?

If you run a security services practice, this number from our 2026 survey is worth a minute:

51% of developers see vulnerabilities surface in AI-assisted code after deployment. Roughly one in three say code sometimes ships before review is complete.

Your clients are shipping more code, faster, with the same review capacity they had a year ago. The exposure window between deploy and validation is widening on every engagement you scope.

A few things this changes for service delivery:

▸ Quarterly snapshots stop matching how the client's attack surface actually moves

▸ "We detected this" without exploit confirmation gets harder to defend in client escalations

▸ Audit evidence has to be a by-product of testing, not a separate prep cycle per client

The teams retaining clients well are the ones whose findings come with request and response data, exploit traces, and retest artifacts attached. That's what holds up when a client questions a report.

Full survey report can be found here (no account needed): https://pentest-tools.com/insights

We have an XSS Scanner. It doesn't DO maybes, and on top of that, it's free to try.

Here's what it ACTUALLY does:
✅ Fires real JavaScript payloads, not pattern matches
✅ Flags a parameter only when the payload runs
✅ Catches reflected and stored XSS, logged in or out
✅ Gives you the request, payload, and response as proof

Try it as a test, no account needed. https://pentest-tools.com/website-vulnerability-scanning/xss-scanner-online

#offensivesecurity #penetrationtesting #ethicalhacking

We have 3 reasons for building AI Pentests - the autonomous web app pentesting capability we're launching at DEF CON next week:

1. Doing a successful pentest with AI needs a lot more than good prompts.
2. Your team deserves more than a wrapper around an LLM.
3. AI is only as good as the #offensivesecurity knowledge behind it.

We explain what it does, why we named it Specter, and how to get early access right here: https://pentest-tools.com/features/ai-pentests