██████╗  ██████╗  ██████╗ ████████╗███████╗██╗  ██╗███████╗██╗     ██╗     
   ██╔══██╗██╔═══██╗██╔═══██╗╚══██╔══╝██╔════╝██║  ██║██╔════╝██║     ██║     
   ██████╔╝██║   ██║██║   ██║   ██║   ███████╗███████║█████╗  ██║     ██║     
   ██╔══██╗██║   ██║██║   ██║   ██║   ╚════██║██╔══██║██╔══╝  ██║     ██║     
   ██║  ██║╚██████╔╝╚██████╔╝   ██║   ███████║██║  ██║███████╗███████╗███████╗
   ╚═╝  ╚═╝ ╚═════╝  ╚═════╝    ╚═╝   ╚══════╝╚═╝  ╚═╝╚══════╝╚══════╝╚══════╝

Welcome to RootShell

Hardcore cybersecurity deep dives & breaking security news

289
Posts
154
Studies
135
News

📚 ~/study - Cyber Deep Dives

154 postsView all →
studyOct 7, 202615 min read

RCE via PHP __autoload() Hijacking in Modern Frameworks

Master the advanced exploitation of PHP's legacy __autoload() to achieve remote code execution in today’s frameworks. Learn the magic method, craft malicious payloads, and defend against class injection attacks.

phprceautoloadsecurity
studyOct 7, 202615 min read

RCE via PHP GD Library Vulnerability (CVE-2024-xxxx): Advanced Exploitation Guide

This guide provides a deep dive into the CVE-2024-xxxx RCE vulnerability in the PHP GD Library, covering the flaw’s mechanics, proof-of-concept exploitation, payload construction, and comprehensive mitigation tactics for seasoned security professionals.

phpgd-libraryrcecve-2024-xxxx
studyOct 5, 202615 min read

Container Escape via containerd Vulnerability (CVE-2024-xxxx)

Learn the full exploit chain of the containerd CVE-2024-xxxx vulnerability, how attackers evade defenses, and how to harden your environment. Includes code examples, tool commands, and real-world impact analysis.

container-securitycontainerdcve-2024-xxxxprivilege-escalation
studySep 16, 202615 min read

Crafting CL.TE Smuggling Payloads: A Step‑by‑Step Guide

Crafting CL.TE Smuggling Payloads: Step-by-Step Guide

http-smugglingcl-tedesyncweb-security
studySep 13, 202615 min read

Historical DNS Records Enumeration 101: Fundamentals and Tools

Learn the basics of historical DNS enumeration, why past DNS data matters to attackers, and how to leverage public services and scripts safely and effectively.

dnsenumerationhistorical-recordsreconnaissance
studyAug 11, 202615 min read

Pass-the-Hash Fundamentals: Theory, Tools, and Defensive Strategies

Learn the inner workings of NTLM hashes, why Pass-the-Hash works, common tooling, attack scenarios, and how to detect and mitigate PTHT in Windows environments.

pass-the-hashntlmlateral-movementdefense

📡 ~/news - Security News

135 postsView all →
newsOct 11, 20268 min read

CVE-2026-18397: Thales SConnect RCE Threatens SWIFT & Gov Systems

A critical remote code execution flaw in Thales SConnect, the browser extension securing SWIFT and government portals, lets attackers load malicious DLLs via drive-by visits. With CVSS 9.4 and confirmed in-the-wild exploitation, it threatens global financial transfers and national security infrastructure.

cybersecuritythalesswiftrce
newsOct 5, 20268 min read

ZITADEL 10-CVE Authentication Bypass Cluster: A Self-Hosted IdP Catastrophe

A coordinated disclosure on October 4, 2026 exposed a critical authentication bypass cluster in ZITADEL’s open-source IdP. Ten CVEs, spanning authentication, MFA, and cross-organization passkey enrollment, allow unauthenticated actors to hijack accounts and move laterally across organizations. Immediate patching or migration to 4.x is mandatory.

ZITADELAuthentication BypassIdentity ProviderCybersecurity
newsOct 5, 20268 min read

Citrix NetScaler Zero-Day: CVE-2026-88772 Lets Hackers Deploy Web Shells

Citrix NetScaler ADC and Gateway appliances are hit by a critical zero-day (CVE-2026-88772) that lets attackers bypass authentication, crash the Packet Processing Engine, and install custom web shells with root privileges. The attack is already spreading credentials and enabling lateral movement across SAML-configured networks.

CitrixNetScalerZero-DayWeb Shell
newsOct 2, 20268 min read

Encrypted Reasoning Traces: How a Moonshot AI Distillation Attack Exposed OpenAI’s Core Security

OpenAI uncovered a coordinated distillation campaign that leveraged fully compatible encrypted reasoning traces to siphon private data across models. Attackers injected traces from a powerful model into weaker ones, forcing plaintext outputs and bypassing anti-distillation safeguards. OpenAI has since tightened controls and banned the malicious accounts.

OpenAIAI SecurityDistillation AttackEncrypted Reasoning
newsSep 17, 20268 min read

GitSpawn: Critical Supply-Chain Flaw Hijacks Seven AI Coding Agents

Manifold Security uncovered GitSpawn, a supply-chain vulnerability that lets a malicious line in a Git config execute arbitrary code when AI coding assistants start. Eight flaws across seven popular agents affect developer workstations and CI/CD pipelines, with four still unpatched.

AI securitySupply ChainGitVulnerability
newsSep 16, 20268 min read

Critical Cisco Secure Email Gateway Zero-Day (CVE-2026-76461) Enables Unauthenticated Root RCE

Cisco Secure Email Gateway appliances are vulnerable to a critical zero-day (CVE-2026-76461) that allows unauthenticated attackers to inject SQL and execute commands as root. Active exploitation has been confirmed by Cisco PSIRT and multiple vendors, and CISA added the flaw to its KEV catalog with a remediation deadline of Sep 17 2026.

CiscoZero-DayRCEEmail Security

contact

Feel free to reach out for collaboration, security consulting, or just to say hello.

[email protected]