Tools

withsecurelabs/amsidetection

Proof-of-concept tool for detecting AMSI (Antimalware Scan Interface) bypasses and malicious in-memory script activity on Windows endpoints.

davidcarliez/trustmebro

Bypass llm guardrails by confusing it with fabricated tool output.

lakr233/vphone-cli

Boot and manage virtual iPhones on Apple Silicon with firmware patching, jailbreak variants, and security research features for iOS testing and…

accuknox/agentz

Zero-trust agentic AI platform. Supports SaaS and OnPrem (airgapped) deployments.

spensercai/copy_fail

Rust exploit PoC for Linux kernel LPE CVE-2026-31431 (AF_ALG page-cache write) plus eBPF runtime defense blocking AF_ALG socket creation via LSM or…

mrunalp/block-copyfail

BPF LSM blocker for CVE-2026-31431 (Copy Fail) - zero-reboot remediation for OpenShift 4

vatson112/deny-af-alg-bpf

eBPF LSM program that blocks AF_ALG socket creation to mitigate CVE-2026-31431, with userspace daemon logging denied attempts via ring buffer.

wgnet/wg.copyfail.patch

eBPF-based workaround for CVE-2026-31431 (Copy.Fail) that filters or kills AF_ALG socket creation to prevent local privilege escalation and container…

siyad01/agentbox

Open-source sandboxed runtime for AI agents — gVisor/Docker isolation, credential vault, immutable audit log. Built after CVE-2026-25253.

atiilla/cve-2026-2441_poc

Proof-of-concept exploit for CVE-2026-2441, demonstrating the vulnerability and providing a working exploit for security testing and validation.

phalanx-ccs/copy-fail

Passive diagnostic tool that checks if a Linux system is vulnerable to CVE-2026-31431 by testing AF_ALG socket reachability, providing mitigation…

pauldechassey/cve-2026-21636

Proof-of-concept demonstrating a Node.js permission model bypass (CVE-2026-21636) that allows network access via undici/fetch to local services,…

linux-zs/cve-2026-31431-mitigation

Seccomp-based mitigation for CVE-2026-31431, a Linux kernel LPE. Blocks AF_ALG socket via PAM module and standalone wrapper, with auto-detection of…

getkern/kern

Rootless container runtime and sandbox that launches kernel-enforced OCI images in milliseconds with no daemon, featuring resource profiles, seccomp…

cert-ee/cuckoo3

Open-source automated malware analysis sandbox that runs suspicious files and URLs in isolated VMs and generates detailed behavioral reports.

containers/bubblewrap

Low-level unprivileged sandboxing tool used by Flatpak and similar projects

scy-phy/minicps

Real-time simulation framework for cyber-physical systems with physical process/control device models and Mininet-based network emulation, built for…

firecracker-microvm/firecracker

Secure and fast microVMs for serverless computing.