| Website | https://rxerium.com |
π¨ CVE-2026-10520, a critical (CVSS 10.0) OS Command Injection vulnerability in Ivanti Sentry is now under active exploitation as reported by Defused
Scan infrastructure to see if you're vulnerable:
https://github.com/rxerium/rxerium-templates/blob/main/2026/CVE-2026-10520.yaml
Patches are available as per Ivanti's advisory:
https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US
RE: https://infosec.exchange/@BSidesLuxembourg/116420285582471119
looking forward to presenting, see you in a few weeks ππ±πΊ
π Inside the Tech: New Talk Added to BSides Luxembourg
ππ‘ π§ππ ππ’π₯ππ’π§π§ππ‘ πππ‘πππ₯π£π₯ππ‘π§: ππ‘π¦ πππ¦ππ π’π¦ππ‘π§ π§ππππ‘ππ€π¨ππ¦ ππ’π₯ π£π₯π’ππ¨ππ§ & π¦ππ₯π©πππ πππ¦ππ’π©ππ₯π¬ β Rishi ( @rxerium )
β‘ Reveal hidden infrastructure in a Talk (40 min) using DNS TXT records to map technologies, dependencies, and external services at scale.
DNS is often treated as infrastructure plumbing, but TXT records quietly expose far more than most defenders realize. This session introduces a DNS-based OSINT methodology that leverages large-scale TXT record analysis to uncover embedded service dependencies such as cloud platforms, SaaS integrations, and identity providers.
By programmatically scanning DNS zones and integrating the technique into tools like Nuclei and OWASP Amass, this approach enables security teams to build detailed maps of organizational technology stacks and attack surfaces. A real-world case study from the Salesloft breach demonstrates how these signals translate into actionable intelligence for both offensive and defensive use cases.
Rishi ( @rxerium ) is a London-based security researcher focused on vulnerability research, threat intelligence, and OSINT-driven attack surface discovery. He contributes to open-source security tooling, supports the UK OSINT community, and focuses on building scalable reconnaissance and detection methodologies.
π
Conference Dates: 6β8 May 2026 | 09:00β18:00
π 14, Porte de France, Esch-sur-Alzette, Luxembourg
ποΈ Tickets: https://2026.bsides.lu/tickets/
π Schedule Link: https://pretalx.com/bsidesluxembourg-2026/schedule/
π² View full schedule & build your agenda: https://hackertracker.app/schedule?conf=BSIDESLUX2026
#BSidesLuxembourg2026 #OSINT #DNS #AttackSurface #ThreatIntelligence #CyberSecurity
π¨ Fortinet just disclosed CVE-2026-39808 and CVE-2026-39813 - 2 critical vulnerabilities affecting FortiSandbox. No active exploitation itw reported as of yet.
Scan your infrastructure to find vulnerable instances:
CVE-2026-39808: https://github.com/rxerium/rxerium-templates/blob/main/2026/CVE-2026-39808.yaml
CVE-2026-39813: https://github.com/rxerium/rxerium-templates/blob/main/2026/CVE-2026-39813.yaml
CVE-2026-39808 (CVSS 9.1):
An Improper Neutralization of Special Elements used in an OS Command ('OS command injection') vulnerability [CWE-78] in FortiSandbox may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.
CVE-2026-39813 (CVSS 9.1):
A Path Traversal vulnerability [CWE-24] in FortiSandbox JRPC API may allow an unauthenticated attacker to bypass authentication via specially crafted HTTP requests.
Patches are available as per vendor advisories:
https://fortiguard.fortinet.com/psirt/FG-IR-26-112
https://fortiguard.fortinet.com/psirt/FG-IR-26-100
π¨ Pre-Auth RCE vuln tagged as CVE-2026-39987 (CVSS 9.3) seeing active exploitation in the wild as reported by Vulncheck and Bleeping Computer.
Passively scan infrastructure to find potentially vulnerable instances:
https://github.com/rxerium/rxerium-templates/blob/main/2026/CVE-2026-39987.yaml
An unauthenticated attacker can obtain a full interactive root shell on the server via a single WebSocket connection. No user interaction or authentication token is required, even when authentication is enabled on the marimo instance
https://github.com/marimo-team/marimo/security/advisories/GHSA-2679-6mx9-h9xc
Another talk announcement for BSides Luxembourg!
π£β‘ ππ₯π’π π ππ‘π¨ππ ππ¨π‘π§ π§π’ π ππ¦π¦ πππ§πππ§ππ’π‘: πͺπππ£π’π‘ππ¦ππ‘π π‘π¨ππππ πππππ‘π¦π§ π£πππ¦πππ‘π β Rishi @rxerium
Phishing isnβt slowing downβbut your detection can scale.
This talk shows how open-source automation with Nuclei transforms phishing detection from manual investigation into a fast, proactive, and scalable process. Learn how hundreds of templates can identify malicious sites across thousands of targets in seconds.
Rishi (@rxerium) is a security researcher focused on vulnerability research, threat intelligence, and large-scale detection techniques, contributing extensively to open-source security tooling.
π
Conference Dates: 6β8 May 2026 | 09:00β18:00
π 14, Porte de France, Esch-sur-Alzette, Luxembourg
ποΈ Tickets: https://2026.bsides.lu/tickets/
π Schedule Link: https://pretalx.com/bsidesluxembourg-2026/schedule/
#BSidesLuxembourg2026 #Phishing #ThreatIntel #OSINT #CyberSecurity #Automation
π¨ Forticlient EMS Zero Day disclosed minutes ago actively being exploited in the wild as being report by @DefusedCyber & @fortinet
I've created a vulnerability detection script to check for vulnerable instances:
https://github.com/rxerium/rxerium-templates/blob/main/2026/CVE-2026-35616.yaml
Fortinet recommends that you install hotfixes for EMS 7.4.5 / 7.4.6 as per their advisory:
https://www.fortiguard.com/psirt/FG-IR-26-099
π¨ Axios was hit by a supply chain attack as of the early hours of this morning.
I'm currently hunting affected repos on GitHub, here is what I have so far:
Vulnerable versions (via package.json):
https://github.com/search?q=%2F%5C%22axios%5C%22%3A%5Cs*%5C%22%281%5C.14%5C.1%7C0%5C.30%5C.4%29%5C%22%2F+path%3Apackage.json&type=code
Presence of plain-crypto-js:
https://github.com/search?q=plain-crypto-js+path%3Apackage-lock.json&type=code
Full technical analysis from StepSecurity:
https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
BSidesLuxembourg