Just published “Vulnerability Analysis of CVE 2025 22226 Information Disclosure Due to OOB Read in VMwares HGFS” by Alex Zaviyalov the first vulnerability in an ITW VMWare guest to host escape chain 👇

https://www.nccgroup.com/media/1mzfvyzl/nccgroup_cve-2025-22226.pdf

We have achieved kernel code execution via the IDT under Windows 11 with VBS/HVCI/kCET enabled.

Read the technical write-up here: https://exploitpack.com/blogs/news/idt-table-hijacking-under-vbs-hvci-kcet-in-windows-11

#Windows11 #KernelExploit #IDT #VBS #HVCI #kCET #DataOnly #RedTeam #ExploitResearch #WindowsSecurity #infosec #pentest

If I gambled on both NFTs and the metaverse to the tune of millions and millions of dollars and even renamed my company accordingly I would be so canceled I’d be farming potatoes, but people are still quoting Zuck AI predictions on my daily news feed.

Doing a presentation tomorrow on our utter dependence on US technology and specifically how we 100% picked US tools/support for cybersecurity as well. We are SO fucking fucked. #sentinel

Can someone explain to me why AI companies are not being investigated for hacking other companies?

In the country I am living in, authorities HAVE TO investigate when they get to know about a crime - even without a criminal complaint (because generally people who were e.g. murdered cannot complain any more...).

Is the US justice system already so broken that this doesn't work any more?

ASCII Art Farts had the slop era pegged in 2004

The Palo Alto Networks firewall Master Key is p1a2l3o4a5l6t7o8 and it is well past time you changed it!

If you have never changed it, your LDAP service account password is sitting in your firewall config encrypted with a key the whole internet has known since 2016 [1]. So are your API keys, certificate private keys, RADIUS secrets and IPSec pre-shared keys.

And that config is on someone's laptop. In SharePoint. In a ticket you raised with Palo support three years ago.

Public tools [2] will decrypt anything encrypted with the default key. Any threat actor who gets one of those files gets your LDAP service account and walks straight off the firewall into your AD.

This is not theoretical.

Palo's own Unit 42 [3] documented attackers copying running-config.xml to a web-accessible path and retrieving it after exploiting CVE-2024-3400.

Fortinet has had two mass events on exactly this pattern: the Belsen Group dump of ~15,000 FortiGate configs and VPN credentials in January 2025 [4], and FortiBleed in June 2026, where configs from ~75,000 firewalls were cracked offline into working admin credentials [5].

You have always been able to change the Master Key. In my experience nobody ever does as it hasn't been without risk. If you forget to rotate the key before it expires then you risk bricking your firewall.

In PAN-OS 12.2.2, Palo Alto Networks have finally started forcing the issue. It enforces replacement of the default master key within a grace period of 60 days after which the firewall blocks all commits and HA synchronisation. This is a significant operational change and it is not in the release notes but is buried in the admin guide [6].

Three things to do in the next few weeks:

1. Check your config backups are automated and actually working. You want a known-good backup before you touch the key.

2. Change the Master Key. Do it on your schedule, not on Palo's.

3. Rotate the secrets. Changing the key re-encrypts the secret on the box; every copy already out there is still decryptable with the default key.

For more depth see my research [7] and conference talk [8].

[1] @felix "Attacking Next-Generation Firewalls: Breaking PAN-OS", TROOPERS16 — https://troopers.de/media/filer_public/a5/4d/a54da07e-3780-4f83-b4ac-8c620666a60a/paloalto_troopers.pdf
[2] https://github.com/cybliminal/palo-secret-decryptor
[3] https://unit42.paloaltonetworks.com/cve-2024-3400/
[4] https://censys.com/blog/fortigate-config-leak-impact/
[5] https://www.picussecurity.com/resource/blog/fortibleed-inside-the-campaign-that-cracked-75000-fortinet-firewalls
[6] https://docs.paloaltonetworks.com/ngfw/administration/certificate-management/master-key-encryption/configure-master-key
[7] https://cybliminal.com/pdf/Panning_for_Gold.pdf
[8] https://www.youtube.com/watch?v=2PF4aSY1gVo

Frequently Asked Questions

1. what the fuck

and here's our poc for postgres server RCE: https://github.com/v12-security/pocs/tree/main/postgresql/server

CVE-2026-14669. patched postgreSQL 18.6.

poc for client RCE 🔜
https://bird.makeup/users/v12sec/statuses/2073174525496459565

And right on schedule (after the Patch Tuesday release), we have ShieldBreak from Nightmare Eclipse. Which is reportedly an insufficient fix for RoguePlanet.

In my brief testing, Defender needs to be enabled for the exploit to work.

We placed a tracking device in a shipment of rare books to see which AI company was buying it, and found an Amazon facility where Amazon scans and destroys books.

https://www.404media.co/we-tracked-a-shipment-of-rare-books-it-ended-at-an-amazon-ai-training-facility/

Dear EU, don't listen to #Google, kill the cookie banner now!

Readeck 0.23.1 was released with some frontend fixes and improvements, as well as a fix for some OIDC providers.

https://readeck.org/en/blog/202608-readeck-23/