EZ Tools 2026.10 is out, all on .NET 10 (LTS) with 331K more event log records and hive logs replayed as Windows does. It loads every test hive, runs up to 9x faster, gives 2x speed for EvtxECmd and Registry, and uses up to 82% less memory.
Key points
Release: EZ Tools 2026.10 on .NET 10 (LTS)
331K more event log records, hive logs replayed as Windows does, every test hive loads
Up to 9x faster overall; EvtxECmd and Registry 2x faster
Up to 82% less memory usage
Sources
PHP2Shell RCE first publicly documented validation
PHP2Shell RCE is claimed as the first publicly documented, validated remote code execution in the wild. The analyst published the findings in a report under reports/php2shell. A quoted tweet notes a potential RCE was caught and is under investigation.
Key points
First publicly documented, validated PHP2Shell remote code execution.
Analysis published in the repository path reports/php2shell.
Sources
- Original post
- github.com - Linked in the post
Microsoft Defender for Endpoint WSL plug-in – visibility
Microsoft Defender for Endpoint plug-in for Windows Subsystem for Linux provides visibility into WSL instances. Deploy the plug-in to gain telemetry only; it does not provide AV or response capabilities. The plug-in appears in the portal after a few minutes.
Key points
Deploy the Defender for Endpoint plug-in to gain visibility of WSL activity.
The plug-in offers telemetry only and does not include antimalware or response functions.
Sources
Magisk v31.1 adds root and Zygisk injection
Magisk v31.1 adds root access, systemless module installation, boot image unpacking/repacking, and Zygisk runtime code injection. It is an Android customization suite.
Key points
Root access: MagiskSU provides root.
Systemless modules: supports module installation.
Sources
- Original post
- ktp.sh - Linked in the post
mitm-proxy-ja3-ja4 Rust MITM proxy released
mitm-proxy-ja3-ja4 is a Rust HTTP MITM proxy with TLS, HTTP/2 and TCP fingerprint spoofing. It is configurable.
Key points
TLS support
HTTP/2 support
TCP fingerprint spoofing capability
Sources
- Original post
- ktp.sh - Linked in the post
PHP2Shell – conflicting exploitation claims and Sophos corrections
PHP2Shell exploitation claims were issued and later retracted, with Sophos updating its telemetry to show only scanning and failed attempts and no evidence of a successful compromise. Other vendors echoed that public exploits do not work against default PHP installations and that only probing activity has been observed.
Key points
Sophos 16: 18 UTC Oct 22 reported “one successful exploitation,” then 21:21 UTC Oct 22 corrected to “no evidence of a successful compromise.”
Sansec 22 Oct stated “the public exploits do not work against a default PHP installation. You do not need to take your store offline.”
Sources
- Original post
- Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE- - Linked page
- sansec.io - Linked in the post
- patchstack.com - Linked in the post
- mycert.org.my - Linked in the post
- techcrunch.com - Linked in the post
- unit42.paloaltonetworks.com - Linked in the post
osint-brazuca updated repository creation announced
osint-brazuca updated! New repository created to gather information, sources (websites/portals), and OSINT tricks within the Brazilian context.
Key points
Updated: repository created
Purpose: gather information, sources and OSINT tricks
Sources
- Original post
- ktp.sh - Linked in the post
betterleaks Fast configurable secrets scanner released
betterleaks is a fast, configurable secrets scanner for filesystems, git history, containers, and cloud sources. It includes Expr-based filtering, credential validation, and analysis.
Key points
Fast, configurable secrets scanner for filesystems, git history, containers, and cloud sources
Expr-based filtering, credential validation, and analysis
Sources
- Original post
- ktp.sh - Linked in the post
