Sikkerhed

php2shell scanner

A high-fidelity scanner for the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619.

Node.js security releases - 21 October 2026

Node.js security updates for the 26.x, 24.x and 22.x release lines, covering high and medium severity vulnerabilities and dependency updates.

MCP Game Hacking

An MCP server and structured knowledge base for game hacking and reverse engineering, with specialized agents and workflow tools.

Cloudflare Security Audit Skill

A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings.

trailofbits/skills

Agent skills from Trail of Bits for security analysis, vulnerability research and audit workflows.

morluto/rea

An MCP tool for investigating application behaviour, binaries and runtime activity with coding agents.

aquasecurity/trivy

A security scanner for vulnerabilities, exposed secrets and configuration problems across containers, infrastructure and repositories.

bridgecrewio/checkov

Checks infrastructure definitions, container images and dependencies for security weaknesses before deployment.

ossf/scorecard

Automated checks that help assess the security practices of open-source projects.

Kobra / React Input OTP component

A React component for entering one-time verification codes, with segmented fields and styled interaction states.

Cloud FAQ - Codex Security | ChatGPT Learn

Documentation about Codex Security Cloud repository scans, findings and remediation workflows.

Secret scanning coverage updates - GitHub Changelog

GitHub describes additions to secret detection, push protection and security alert metadata.

CLI quickstart - Codex Security | ChatGPT Learn

Instructions for running local Codex Security scans and reviewing vulnerability reports and coverage.

‘Vibecoding’ Privacy Risks Require Keeping Humans in the Loop

An article examining privacy risks in AI-generated applications and the role of human security review.

August 2026 Security Release

Release notes for Next.js security updates, including affected versions and upgrade guidance.

Securing your API | Supabase Docs

A guide to securing Supabase's Data API with database grants, row-level security and request checks.

Catch security issues as Claude writes code - Claude Code Docs

Documentation for a Claude Code plugin that reviews generated changes for common security vulnerabilities during development.

openai.com/index/hugging-face-incident-and-the-road-ahead/

Scan your codebase for vulnerabilities - Claude Code Docs

Instructions for using Claude Security to scan a codebase, review vulnerability findings and prepare fixes.

Critical remote code execution in Serena, a popular MCP coding agent

GitLab's analysis of a remote-code-execution vulnerability in the Serena coding agent and its remediation.

privacypolicies.com/

dani-garcia/vaultwarden

An independently developed Rust server compatible with Bitwarden password-manager clients.

shaurya-007/NSA-Linux-Hardening-docs

A repository collecting documents about strengthening Linux system security.

PSA: upgrade your LUKS key derivation function

Here's an article from a French anarchist describing how his (encrypted) laptop was seized after he was arrested, and material from the encrypted partit.

Infosec Exchange

A Mastodon instance for info/cyber security-minded people

Build software better, together

Google’s security-research advisory listing on GitHub. The fetched page exposed only generic site metadata.

Security | Purelymail

Purelymail’s documentation explaining security practices for its email service.

Let's Encrypt wildcard certificate with acme.sh and Cloudflare DNS

New JavaScript malware works as a "RAT dispenser"

Cybersecurity experts from HP said they discovered a new strain of JavaScript malware that criminals are using as a way to infect systems and then deploy much dangerous remote access trojans (RATs)

lc/gau

A reconnaissance utility that gathers previously indexed URLs from public archival and threat-intelligence sources.

crowdsecurity/crowdsec

Security software combining intrusion detection, web protection and a shared malicious-IP blocklist.

stackrox/Kubernetes_Security_Specialist_Study_Guide

Study material for the Certified Kubernetes Security Specialist examination.

tsoungui.fr/ebooks/Hardening%20Linux.pdf

A downloadable book about strengthening the security of Linux systems. Full PDF contents were not summarised.

GrapheneOS: the private and secure mobile OS

A mobile operating system focused on privacy and security while retaining Android application compatibility.

harsh-bothra/Bheem

A security-assessment framework that coordinates reconnaissance tools and organises their results.

GitHub - mafintosh/hyperphone: A telephone over Hyperbeam

A telephone over Hyperbeam

WPScan CLI Scanner Install + User Guide

Installation and usage documentation for WPScan’s command-line WordPress security scanner.

Let's Encrypt TLS with HAProxy Kubernetes Ingress

A video showing how to configure Let's Encrypt TLS certificates for the HAProxy Kubernetes Ingress Controller.

medium.com/@OliverPifferi/nextcloud-releases-forms-to-protect-privacy-sensitive-survey-data-c780b5e1d4cd

Git All The Payloads! A Collection Of Web Attack Payloads - PentestTools

A reference collection of web-security testing payloads.

Emil Stahl

The personal website of cybersecurity specialist Emil Stahl.

GreyNoise | Real-Time Network Threat Intelligence

A threat-intelligence service for interpreting network scanning activity and identifying active exploitation.

Shodan

A search service for discovering internet-connected devices and the services they expose.

TryCatchHCF/PacketWhisper

A security-research tool exploring covert data transfer through DNS queries and text encoding.

lesnuages/hershell

A cross-platform reverse-shell generator intended for security testing.

Cryptic Rumblings Ahead of First 2020 Patch Tuesday - Krebs on Security

Historical reporting on security concerns preceding Microsoft’s first monthly patch release of 2020.

Pickfordmatt/SharpLocker

A security-testing demonstration of a counterfeit Windows lock screen, illustrating the risk of credential phishing.

JWT Tool documentation

Documentation for a toolkit that inspects and tests JSON Web Tokens.

AlisamTechnology/ATSCAN

A security-testing utility for search-based discovery and automated vulnerability scanning.

s0md3v/Arjun

A security-testing utility for discovering HTTP request parameters.

Image-to-Image Translation with Conditional Adversarial Networks

The pix2pix paper investigates learning mappings between images, with applications including colourisation and generating pictures from edge or label maps. Summary based on its abstract.

A Cybersecurity Firm’s Sharp Rise and Stunning Collapse

Raffi Khatchadourian on Tiversa, which dominated an emerging online market before it was accused of fraud, extortion, and manipulating the federal government

belane/CloudHunter

A security-auditing tool for discovering storage buckets across major cloud providers.

raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh

The downloadable LinEnum shell script for enumerating Linux system configuration during security assessments.

OJ/gobuster

A Go utility for discovering web paths, virtual hosts and DNS names during authorised testing.

malwoverview : Malwoverview is a first response tool for threat hunting across VirusTotal, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, Thr

An overview of a threat-investigation tool that queries multiple public malware and intelligence services.

rada.re/r/

The Radare project’s entry page for its reverse-engineering tools and releases.

Apktool | Apktool

A utility for decoding and inspecting Android application packages during reverse engineering.

SEKTOR7 Research Blog

A SEKTOR7 research article about in-memory techniques on Linux, within its security-research blog.

emotet_research/doc/EN_emotet_packer_analysis_and_config_extraction_v1.pdf at master · d00rt/emotet_research

A downloadable security-research report on Emotet packing and configuration extraction. The PDF was not fully analysed.

Encryption New on Minds | Minds

A historical Minds announcement introducing encrypted messaging.

Initial Server Setup with Ubuntu 16.04 | DigitalOcean

A historical checklist for initial Ubuntu 16.04 server configuration and basic access security.

mushorg/glutton

A low-interaction honeypot for observing unsolicited connections and suspicious network behaviour.

The command-line, for cybersec

An article discussing command-line skills relevant to cybersecurity work.

Kendt dansk sikkerhedsmand advarer mod salgs-gas: "Jeg er meget bekymret over, at virksomheder kommer til at tro, de er compliant med GDPR, fordi de har købt en dims hos et sikkerh

A Danish interview warning against treating security-product purchases as proof of GDPR compliance.

DMARC dot DK

Danish information about DMARC email authentication and its role in reducing impersonation.

TFHE Fast Fully Homomorphic Encryption over the Torus

A fast open-source library for fully homomorphic encryption

Upgrading Simple Shells to Fully Interactive TTYs

A security-testing reference explaining the differences between basic remote shells and interactive terminals.

0x4D31/honeyLambda

A serverless monitoring project that creates decoy HTTP endpoints to detect suspicious access.

Exploiting an integer overflow with array spreading (WebKit) - phoenhex team

This article is about CVE-2017-2536 / ZDI-17-358 , a classic integer overflow while computing an allocation size, leading to a heap-based buffer overflow. It was introduced in 99ed479 , which improved the way JavaScriptCore handled.

Exploitation Chronomancy: Temporal Return Addresses

ToorCon 2005 presentation slides on temporal return addresses and exploitation techniques.

When You Accidentally Break Your School Network in 1995

In my last post, I reminisced about my bbs software that I wrote and sold in 1993. In 1995, I was a senior in high school, and my school had just purchased a 76 computer Novell network for the 900

GitHub - Choudai/R10: Lightweight Ransomware @Choudai

Lightweight Ransomware @Choudai

Create a temporary random filename in Bash

CAA checking becomes mandatory for SSL/TLS certificates

A look at the CAA DNS record (Certificate Authority Authorization), what it does, and why Certificate Authorities are now required to check it before issuing an ….

Deception: turning the tables on your adversaries

Hacker OPSEC

Think of Mujahideen Secrets as a branded promotional tool, sort of like if Manchester United released a branded fan chat app. Although there has been ….

Grean easyID and Auth0

Dedup Est Machina

A 2016 security paper examining how memory deduplication can become a timing side channel and aid Rowhammer exploitation.

express-brute

Middleware that rate-limits Express routes to help protect against brute-force requests.