Tools

shahidmallaofficial/cpanel-cve-2026-41940-fix

One-shot detection and remediation for cPanel/WHM servers compromised via CVE-2026-41940, including IOC checks, malware cleanup, C2 blocking, and…

mahdi13830510/cve-2026-31431-mitigation-suite

Kernel-runtime defense framework for AF_ALG vulnerabilities, featuring eBPF socket tracing, Ansible hardening, and a crypto auditor for drift…

h4wkst3r/dop2mop

OpenGraph collector for BloodHound that maps attack paths from DevOps to MLOps infrastructure, collecting CI/CD pipeline, service principal, and ML…

0xblackash/cve-2026-64531

Reference analysis of a Linux kernel Open vSwitch memory-corruption vulnerability, covering root cause, impact, detection commands, and mitigation…

george0papasotiriou/cve-2026-21008-kubernetes-service-account-token-mounted-in-hostpath

Proof-of-concept exploit for Kubernetes service-account token disclosure via hostPath mounts; includes vulnerable pod YAML and Python token-theft…

george0papasotiriou/cve-2026-9999-serverless-event-injection-to-code-overwrite

Proof-of-concept exploit for CVE-2026-9999, demonstrating path traversal in serverless object storage events that overwrites function source code to…

george0papasotiriou/cve-2026-5556-kubernetes-admission-controller-bypass-via-case-sensitivity

Exploit PoC and vulnerable admission webhook for CVE-2026-5556, demonstrating Kubernetes admission controller bypass via case-sensitive pod name…

george0papasotiriou/cve-2026-21002-serverless-cold-start-credential-leakage-via-reused-tmp

PoC exploit for CVE-2026-21002 serverless cold-start credential leakage, demonstrating how reused Lambda /tmp directories expose AWS secrets to other…

george0papasotiriou/cve-2026-22008-aws-lambda-layer-injection-via-shared-layer-arn

Proof-of-concept for CVE-2026-22008 demonstrating AWS Lambda layer injection via untrusted ARNs, enabling arbitrary code execution and credential…

aestechno/cve-2026-31431-ansible

Ansible playbook to detect and apply kernel cmdline mitigation for CVE-2026-31431 (Copy Fail) across Debian/Ubuntu/RHEL fleets, with read-only…

devstuff/harden-docker-seccomp

Docker mitigation for CVE-2026-31431 ('Copy Fail'). Includes Kubernetes templates as well.

disqualifier/psa-2026-00043-recovery

Recovery notes for proxmox advisory ID: PSA-2026-00043-1 (CVE-2023-54391)

roxanne_ardary/aurea

Aurea is an open-source, AI-powered platform that secures infrastructure-as-code (IaC) across Terraform, Kubernetes, Docker, and Ansible. It…

offsecpierogi/azure

Bash and PowerShell scripts for Azure security assessments, covering IAM privilege escalation, container registry exploitation, Key Vault exposure,…

ziad-hsn/cpra

CPRA is a high-performance infrastructure monitoring system designed for platform teams managing large-scale microservice architectures. Built on…

leitwacht/leitwacht-agent

eBPF + nftables + DNS proxy egress enforcement for GitLab Runner CI/CD job containers — community edition data plane https://leitwacht.eu/

nserser/lr-webpki

Reference implementation of LR+ post-quantum authentication over WebPKI CA context, with corpus pipeline, reconstruction, evaluation, and provenance…