🇵🇹✈️ Next stop: Portugal I’m honoured to be delivering a workshop-style talk on DNS-based OSINT techniques at BSides Porto this Saturday, 29 November! If you’re attending, I’d love to meet up and discuss all things cyber! Looking forward to seeing you there 👋

Is your AI coding agent a security expert? 20+ Claude Code skills: SAST • DAST • SCA • Secrets • Containers • Policy • Offensive Security - and more! Looking for testers and contributors 👀 github.com/AgentSecOps/... #DevSecOps #AI #Security #OpenSource #ClaudeCodeSkills #AgentSecOps #Claude

🚨 Active Exploitation of Gladinet CentreStack and Triofox Local File Inclusion Flaw (CVE-2025-11371) I've created a vulnerability detection script here: github.com/rxerium/CVE-... As reported by Huntress this is an unauthenticated Local File Inclusion flaw in Gladinet CentreStack and Triofox.

🚨 Critical zero-day tagged as CVE-2025-61882 (CVSS 9.8) affecting Oracle E-Business Suite I've created a vulnerability detection script here: github.com/rxerium/CVE-... This vulnerability is remotely exploitable without authentication.

Solarwinds critical vuln - CVE-2025-26399 "Given SolarWinds’ past, in-the-wild exploitation is highly likely" as being reported by WatchTowr Labs I've created a detection script for this vuln: github.com/rxerium/CVE-... 128 currently vulnerable across 22 countries / 90 cities:

🚨 Critical — CVE-2025-10035 (CVSS 10.0): Fortra has disclosed a deserialization flaw in the GoAnywhere MFT License Servlet that can allow remote command-injection. I've created a #nuclei script to detect vulnerable instances at scale: github.com/rxerium/CVE-...

Detection for critical SAP Netweaver vulnerability (CVE-2025-42944): github.com/rxerium/CVE-...

🕵️‍♂️ New OSINT training drop: Learn how to use X (Twitter) Advanced Search to trace usernames, map networks & uncover hidden accounts. Presented by @rxerium.com for the UK OSINT Community. 🎥 Watch here: www.youtube.com/watch?v=Yj2m...

🚨 New zero day added to the CISA KEV under an hour ago and is actively being exploited in the wild - CVE-2025-53690; CVSS 9.0 (Critical) Check to see if you're vulnerable: github.com/rxerium/CVE-... Patches / workarounds are available: support.sitecore.com/kb?id=kb_art...

🚨 Undiscolsed zero day affecting FreePBX servers: - No patches are available at the time of this post. - Workarounds are to limit access to your FreePBX instance - I've created a detection template here to check if you're vulnerable: github.com/rxerium/free... #freepbx #zeroday #cybersecurity

I've created a vulnerability script for CVE-2025-8875 and CVE-2025-8876 - both currently being actively exploited in the wild as reported by @cisacyber. Detection script: github.com/rxerium/CVE-... Patches are available: status.n-able.com/2025/08/13/a...

Catch me at #BSidesVegas or #DEFCON - I’ll be handing out exclusive UK OSINT swag. Come say hi and snag some before its all gone! 👋

Detection script for Micollab SQL injection vulnerability, tagged CVE-2025-52914 (high severity): github.com/rxerium/CVE-... www.mitel.com/support/secu...

I’m thrilled to be speaking at DEFCON in Las Vegas this year! I’ll be sharing insights from my recent contributions to the OWASP Amass project and Project Discovery’s Nuclei, focusing on DNS-based techniques for Product and Service Discovery. More details below:

🚨 new zero day affecting crushFTP instances (CVE-2025-54309) being exploited in the wild: ~291,903 exposed devices running crushFTP (as of 19.07.25) according to @shodanhq: `http.html:"crushftp"` Patch now: www.crushftp.com/crush11wiki/...

I've created a passive detection script to detect instances that are vulnerable to critical RCE tagged as CVE-2025-47812: github.com/rxerium/CVE-... Around ~4000 instances exposed to the internet as of 25.07.16 `http.favicon.hash:963565804`

Want to detect the internal security posture of an organisation without contacting them or installing agents on their local network? I created a detection script in my spare time which takes advantage of exposed Safebase portals github.com/rxerium/inte... #osint #nuclei

I've created a passive detection script for this Wazuh vulnerability. It is currently being exploited in the wild (as reported by CISA). The script can be found here: github.com/rxerium/CVE-... Original article: thehackernews.com/2025/06/botn...

Hey Bluesky! I’m less active here but more engaged on Twitter and GitHub. My socials can be found on my website: rxerium.com 🤝

I've created a script to detect CVE-2025-49113 based on versions exposed in the html body: github.com/rxerium/CVE-... Use at your own risk.

🔍 Swipe a stranger’s selfie—are you already over the ethical line? In the latest article from the UK OSINT Community, Rishi Chudasama shows why “public” doesn’t mean “permissible,” urging OSINT pros to match technical skill with empathy and respect for privacy. 📖 Read: www.osint.uk/content/ethi...

🚨 New Zero-Day Vulnerability (CVE-2025-31324) Exploited in the wild CVSS10.0 NetWeaver VCM Uploader lacks proper authorization, allowing unauthenticated users to upload malicious executable binaries, potentially harming the host system and affecting all components of the CIA triad Detection in 🧵

🚨Critical remote code execution zero-day (CVSS 10.0) vulnerability CVE-2025-32433 affecting the Erlang/OTP SSH service allows an attacker with network access to an Erlang/OTP SSH server to execute arbitrary code without prior authentication

Scan infrastructure for websites that support the .onion service with Nuclei:

i've created 2 detection scripts to check if websites have been seized by the #fbi - the first looks at the html body for common phrases and the other looks at nameservers. nameserver detection: github.com/projectdisco... word matching: github.com/projectdisco... #security #CyberSecurity

The tj-actions supply chain attack (CVE-2025-30066) currently affects ~14.5 public repos running a vulnerable version. Custom GitHub query to detect exposure for this vulnerability: github.com/search?q=pat... www.sweet.security/blog/cve-202...

CISA reports 3 actively exploited vulnerabilities in Ivanti products: - CVE-2024-10811 - CVE-2024-13161 - CVE-2024-13160 - CVE-2024-13159 Horizon3AI PoC: github.com/horizon3ai/I...

I’m delighted to join OSINTUK as a member and attend their event on May 1st. Very excited to contribute towards the open source intelligence community in the near and long term future #osint #osintuk 🤝

VMware vulnerabilities being actively exploited in the wild as reported by CISA: - CVE-2025-22224 - CVE-2025-22225 - CVE-2025-22226 Broadcom have released patches; details here: buff.ly/HPUi7Je

2 new MiTM vulns (CVE-2025-26465 + CVE-2025-26466) affecting openssh, i've created 2 custom detection scripts for scanning for these vulns at scale: https://github.com/rxerium/CVE-2025-26465 https://github.com/rxerium/CVE-2025-26466

i've created a detection script to scan your infra for CVE-2025-0994 amid active exploitation attempts reported by CISA: https://cisa.gov/news-events/ics-advisories/icsa-25-037-04 only scan infra you own/have permission to scan https://github.com/rxerium/CVE-2025-0994

anyone attending Cloud and Cyber Expo next Wed/Thurs? Would love to connect 👋 https://buff.ly/2QRnNRr

~1500 instances vulnerable to new zero day (CVE-2024-40891) affecting all Zyxel CPE devices It is recommended that you filter traffic for unusual Telnet requests, monitor Zyxel’s advisories for updates + restrict admin interface access to trusted IPs

508k instances still possibly vulnerable to CVE-2024-12084 we can't detect versions of rsync over the internet but we can extract protocols from which we can map to versions vulnerable: <= 3.2.7 - protocol 31 unaffected: < 3.4.0 - protocol 32 https://buff.ly/4hx8udb

looks like the British Museum was hit by an "IT attack" by a former employee...

Hey BlueSky 👋