[ full github wire // all 113 repo events in this month // 30d ]
Scanner authors dominated the stretch: Assetnote shipped three high-fidelity detectors for the php2shell and node2shell waves, xssdoctor kept pushing inert Git-client execution harnesses, and vitorfhc's videt formalized the negative-day patch-diffing game just as the N-able zero-day proved the commit-to-advisory window is now measured in hours. Between the 62-level-deep PHP array probes and the loopback protocol-v2 fixtures, the repos this month read like a field manual for confirming -- not just claiming -- exploitability.
assetnote/php2shell-scanner -- Python scanner for CVE-2026-109618/109619 that sends multipart control requests and probes with 62-level-deep PHP array keys scaling from 1MiB to 20MiB. High-fidelity detection without firing blind payloads at prod; the key-depth scaling is the interesting part to read.
assetnote/node2shell-scanner -- probes Brotli/JSON content-type handling in Node.js HTTP apps, then streams a ~23MB payload to confirm CVE-2026-111497 exploitability. Pairs with the Wiz writeup; the content-type gate logic is worth diffing against your own detection scripts.
xssdoctor/git-cve-2026-113408-poc -- loopback-only smart-HTTP fixture proving git clients accept an unsafe unborn HEAD symref from a protocol-v2 server, with branch-update resolution escaping the .git directory. Clean, inert oracle you can run locally in five minutes.
vitorfhc/videt -- watches major OSS repos for silent security patches landing before a CVE is assigned, then checks whether the fix is actually reachable/exploitable. Formalizes the negative-day hunt that this month's N-able and gVisor silent-cleanup commits both point at.
dawgyg/AppleResearch -- raw C dump of macOS vulnerability research the author believes should be patched but went unreported for missing bounty thresholds. 510 stars in days; a large corpus of unreported findings, some plausibly portable to iOS and visionOS.
OSV.dev is an open vulnerability DB/triage service; recent commits lock Cloud Run to a least-privilege service account, fix RPM version ordering for TuxCare/CentOS/OracleLinux/RHEL, and repair goose pooled-SQL handling.
Query-param PoC server: spins up shareable HTML/JS exploit pages with custom response headers baked into the URL, handy for header-gated XSS proof. Latest commits add nested autocomplete in SVG/XML plus a scrolling fix on small screens.
videt: watches major OSS repos for silent security patches landing before a CVE is assigned, then checks whether the fix is actually reachable/exploitable. Targets the negative-day window between commit and advisory.
Fresh HTML repo scaffolding a bun-built static dist/index.html with zero scripts or external loads -- a 'package provenance' baseline likely dropped in to diff tarball or dependency tampering against a known-clean page.
Sibling scaffolding repo for 'tarball dependency control': bun install -> bun run build -> inert static HTML, useful as a pristine reference to diff dep-tree snapshot changes.
'Dependency snapshot control' reference build -- same bun-to-static-HTML pattern, a clean baseline for spotting TOCTOU or snapshot drift between install and postinstall steps.
OSV-format corpus of OSS-Fuzz-disclosed vulnerabilities, useful for vuln matching and fuzzing triage; this push refreshes the OSV-2024-719, OSV-2024-695 and OSV-2024-659 records.
Static-site control for Muse repository import: a vendor/leaf Git submodule from the same account supplies one constant rendered as text, with no hooks, symlinks, binaries or network. Tests whether import recurses into submodules.
Non-executable leaf paired with the submodule parent: one fixed public marker plus a JS module exporting the same literal, no package metadata, hooks or network behavior. Confirms submodule fetch without execution.
Google's sampling-based sanitizer framework for production binaries; commits restructure the seccomp incompatibility check, disable arm64 breakpoints when ignored, and exempt GWPSan interceptors from CFI so both can be built together.
Owned-account test fixture with a minimal nested repo-shaped directory at vendor/lib, no scripts, symlinks, submodules or network behavior. Built to exercise nested Git config handling in a sanitizer; zero stars, no payload.
gVisor is Google's application kernel for containers, providing user-space syscall interception to sandbox untrusted workloads and reduce container escape risk; recent commits add cgroup fixes, filestore cleanup, and confine the sandbox to a device cgroup.
oss-fuzz-vulns publishes OSS-Fuzz-discovered vulnerabilities in OSV format, giving researchers a machine-readable feed of fuzzing findings to track and correlate; the update imports new OSS-Fuzz entries and refreshes several OSV advisories.
SecLists is the security tester's companion: a consolidated collection of usernames, passwords, fuzzing payloads, web shells, and sensitive-data patterns used across assessments; the latest push is an automated refresh of the Trickest wordlists via GitHub Actions.
SecLists is the widely used security tester's companion repo: a curated collection of wordlists for usernames, passwords, URLs, fuzzing payloads, web shells, and sensitive data patterns; the latest commits are automated GitHub Action updates refreshing the Trickest-derived wordlists.
gVisor is Google's application kernel for containers, providing a user-space sandboxed Linux kernel to isolate untrusted workloads; recent commits fix missing filestore cleanup and, notably, confine the sandbox to a device cgroup to tighten container escape surface.
Goonami is a Go network security scanner with an extensible plugin system for high-confidence, high-severity vulnerability detection. Recent changes drop legacy binproto signatures/hash registry and move the webidentity fingerprinter to a declarative engine.
Caido's rswot, a Rust repo described only as student validation against a crowdsourced list; v0.1.141 tag with no changelog detail -- thin on info, clone and read the source yourself.
caido/documentation is the official user documentation repo for the Caido web security testing proxy; recent commits document the new Capture menu, HTTP History highlight colors, and add a download link in the top nav.
vdet is a Python tool that monitors major open-source projects for silent security patches, spotting vulnerability fixes before a CVE is assigned and checking whether they're actually exploitable. Latest push updates the README describing this "negative-day" detection window.
caido/sdk-js is the monorepo housing Caido's JavaScript SDKs and related tooling, used by developers building extensions for the Caido web security testing platform. The recent push prepares coupled SDK packages for the v0.59.1 release.
Project Zero repo catalogs 0-days exploited in the wild; recent commits only bump activesupport 7.2.2.1->7.2.3.1, nokogiri 1.18.8->1.19.4, and json 2.20.0->2.21.2.
caido/sdk-js is the monorepo for Caido's JS plugin SDK and tooling -- the interface for writing extensions against the proxy; v0.59.1 is a routine release, no exploit-relevant surface noted.
SecLists is the widely used collection of security testing wordlists -- usernames, passwords, fuzzing payloads, web shells and more -- used across pentests and bug bounties. The latest push auto-updates the Trickest-derived wordlists via GitHub Action.
google/security-research is the advisory + PoC drop for bugs found in non-Google code; new commits land a CVE-2026-98164 kvmCTF host-crash exploit plus kernelCTF writeups for CVE-2026-80521_lts and CVE-2025-40214_lts_cos.
A new Python PoC harness for CVE-2026-113408, using a loopback-only smart HTTP fixture to test how a Git client accepts an unsafe unborn HEAD symref from a protocol-v2 server. It demonstrates branch-update resolution escaping the .git directory.
mise-toolshed is a mise backend plugin installing small utility tools that verify exact versions, lockfiles, and minimum release age, refusing installs when downloaded SHA-256 checksums mismatch. The recent push updates these release-verified toolshed commands.
Rust crate caido/rswot checks student accounts against a crowdsourced list for edu-scope recon; v0.1.140 is a tag refresh with no code detail in feed -- diff before use.
An inert local partial-repository fixture for authorized testing of Git's partial-clone behavior, tied to CVE-2024-32004. Its config contains a promisor upload-pack command that only writes a fixed marker, confirming code execution.
An inert fixture containing a tracked file whose name begins with a Git command-line option, used to verify callers insert the -- terminator before passing repository paths to Git. It demonstrates option-injection style path handling bugs.
A controlled recursive-clone parent fixture for testing Git CVE-2025-48384 in an authorized lab, pairing with a submodule that carries a fixed-marker checkout hook. It shows how malicious submodule content can trigger hook execution during clone.
The paired submodule fixture for the CVE-2025-48384 test: an executable file that, if Git wrongly installs it as a checkout hook, writes one fixed marker locally with no network or persistence. It safely demonstrates submodule hook-injection impact.
An inert fixture with a minimal nested repository-shaped directory at vendor/lib, used for sandbox testing of Git nested-configuration handling. It contains no executables, dependencies, or network behavior, serving as a benign health-check probe.
Fabric v1.4.570 adds an AtmoRouter-compatible endpoint adapter to the Go text-workflow framework; useful for swapping backends while keeping command patterns stable.
CSPBypass.com is a tool helping ethical hackers bypass restrictive Content Security Policies and exploit XSS on sites whose CSPs only whitelist certain domains. The latest update fixes the CSP matcher to handle scheme-relative and multiple directives.
caido/rswot v0.1.139 is a Rust student-account checker backed by a crowdsourced list; release tag only, no substantive changelog in feed -- inspect the commit range.
Nexus Shield is a TypeScript plugin for the Nexus GraphQL schema platform that eases building authorization layers and permission rules. The recent push adds a check for missing context and documents that requirement.
JavaScript engine fuzzer; recent work cuts redundant work in BlockReducer.reduceClassDefinition, enables optimized code coverage for some runs, and skips redundant MinimizationPostProcessor execution.
caido/rswot v0.1.138 -- Rust 'student validation' helper keyed off a crowdsourced list; three-star side project from the Caido org, useful only as a reference for their tooling glue.
caido/store is the source repository for the Caido plugin store, the marketplace where researchers browse and install Caido security-testing extensions. Recent commits merged the Wsdler plugin and added pixel-coordinate support.
responder lets researchers quickly build and share HTML/JavaScript proof-of-concept pages with custom headers configured entirely via query parameters. Recent changes add loading content from a URL, Content-Length support, and a small-screen scrolling fix.
caido/formatter new repo -- shared treefmt flake and language formatting rules for Caido projects, pinned in a flake and driven by mise; infra plumbing, not a security tool.
Fabric is a Go CLI/library that wraps a crowd-sourced prompt collection for chained text workflows; v1.4.568 bumps the anthropic-sdk-go dependency to v2.8.0, so anything pinned to older SDK calls needs a re-check.
responder is a JS/HTML PoC hosting rig that rebuilds responses from query parameters, letting you serve custom headers and payloads for XSS/header-injection demos; updates are Svelte UI rework and MIME-type alignment.
SecLists push is just the automated Github Action refresh of the trickest wordlists -- no new list classes, so re-pull if you script fuzzing payloads off the repo rather than a pinned tag.
AppleResearch is a raw C-language dump of the author's macOS vulnerability research, much of which he believes should be patched but went unreported for not meeting bounty thresholds. It offers a large corpus of macOS bug-hunting findings, some potentially portable to other Apple OSes.
Python monitor for silent security patches -- watches major OSS repos for vulnerability fixes before CVE assignment and checks exploitability; latest push continues the negative-day detection workflow.
Rust service that validates 'student' status by matching email domains against the crowdsourced JetBrains/swot list; this push just re-syncs the domain table, so treat it as an allowlist you can spoof into with a throwaway .edu alias.
Caido user documentation site; the only change is a download link in the top nav, so nothing for exploit dev -- but handy when you need the exact proxy/intercept config flags while chaining requests.
Rolling v0.1.135 tag for rswot, the Rust student-status validator keyed on the JetBrains/swot domain list; no code detail in the tag, just the periodic domain sync riding along.
LifeOS is Daniel Miessler's AI-powered "life operating system" for personal goal hill-climbing, released as version 8.761.0 ("The One Loop"). The README update stresses that users are responsible for their own security posture.
intent-anchor is a Python proof-of-concept harness for long-horizon LLM agents that makes goal adherence mechanical by storing hard constraints in an immutable spec instead of trusting the prompt. It aims to prevent agent drift on extended tasks.
mise backend plugin serving small release-pinned utility tools (check-exact-versions, check-lockfiles, check-minimum-release-age); pushing -v publishes .mjs plus SHA256SUMS and the plugin refuses install on hash mismatch -- supply-chain-ish guardrails for tooling.
Caido's schema repo for its proxy/tooling interfaces; push bumps corrected schema packages to 0.59.1 and fixes the proxy schemas to match v0.59.0 -- relevant when scripting against Caido's API.
bob is a Go tool for automating the build and push of multiple Docker images within a monorepo. Recent commits are routine dependency bumps for the Docker client, Viper, and Go 1.19.
SecLists, the standard wordlist/payload grab-bag for assessments; this push is just the GitHub Action auto-refresh of the trickest wordlists -- no new list classes, but worth diffing before you point fuzzers at it.
Daniel Miessler's open-source TypeScript framework for human understanding and progress; latest commits add vulnerability/breach datasets like defender-capacity.json tracking IR firm capacity and triage shortfalls.
Automated silent-security-patch monitor that detects fixes before CVE assignment and checks whether the patched bug is actually exploitable, targeting the negative-day window.
GitHub Action that alerts on security patches before CVEs drop by diffing commits; recent changes let the LLM judge use different providers and fix DeepSeek json_object handling.
JavaScript cross-origin fuzzer in the spirit of Gareth Heyes' cross-domain enumerators, hunting stale browser leaks like iframe.contentWindow.location.constructor on modern engines -- fresh repo, one star.
Fuzzilli is a JavaScript-engine fuzzer; recent work rolls Binaryen, fixes Swift 6.4.2 test builds, records Wasm imports by opcode and tracks corpus import stats.
Go-based content discovery/fuzzing tool forked from ffuf that adds automatic HTTP/3 acceleration (up to 100k req/s) and a persistent web console while keeping ffuf wordlists, matchers and workflows.
caido/sdk-js is the TypeScript monorepo of SDK and plugin tooling for ripping into the Caido web proxy; v0.60.0-rc.1 is the first release candidate of the next plugin API cut.
caido/skills is the TypeScript repo of Caido skill definitions used to drive proxy work from an agent harness; the caido-mode commit rips the harness coupling out so skills go harness-agnostic.
CSPBypass: catalog site plus data.tsv of whitelisted domains that can host attacker JS, so a reflected XSS gets past a CSP that only allows 'trusted' CDNs; recent merges sync that domain list, which is the actual payload surface.
rswot: Rust port of the JetBrains swot student-domain list, used to validate .edu-style signups; commits are just repeated syncs of domains from the upstream swot repo, so no parsing or logic change.
SecLists 2026.2 rolls in new quickhits.txt entries and wordlist updates for fuzzing/cred-spraying; standard grab-bag of usernames, passwords, payloads and sensitive-data patterns for assessment work.
mise backend plugin from the Caido team that installs small helper binaries; the check-lockfiles-v1.0.1 release ships the .mjs plus SHA256SUMS so installs abort on hash mismatch.
New repo push wiring three release-gated tools into mise -- check-exact-versions, check-lockfiles, check-minimum-release-age -- each downloaded from its own release and refused if the SHA-256 doesn't match, a supply-chain hedge against poisoned packages.
Release of the minimum-release-age gate, the plugin piece that keeps freshly published package versions off your install for a cooldown window -- cheap defense against fast-moving npm/PyPI takeover pushes; no diff details published.
Caido's internal JSON schema repo bumps the proxy schema to v0.59.0, so plugin and tooling authors matching proxy traffic structures need to re-sync against the new field layout.
caido/mise-toolshed check-lockfiles-v1.0.0: release of a TypeScript CI/tooling check that validates dependency lockfiles -- supply-chain hygiene guard for the Caido toolchain, not an offensive primitive.
caido/mise-toolshed check-minimum-release-age-v1.0.0: TypeScript release gate that refuses packages younger than a set age -- a supply-chain squat/poisoning speed bump for build pipelines.
caido/mise-toolshed check-exact-versions-v1.0.0: TypeScript release of a rule enforcing pinned exact dependency versions -- build-side supply-chain hardening against range-based version injection.
Python scanner giving high-fidelity detection of CVE-2026-111497 ("node2shell") in Node.js HTTP apps, probing Brotli/JSON content-type handling then streaming a ~23MB payload to confirm exploitability.
vitet -- Python watcher for silent security patches: flags fix commits in major OSS repos before a CVE lands and checks exploitability, aimed at the 'negative-day' window. Lets you diff and weaponize a patch ahead of the advisory.
Python scanner for high-fidelity detection of php2shell (CVE-2026-109618/109619), sending multipart control requests and probes with 62-level-deep PHP array keys scaling from 1MiB to 20MiB.
caido/sdk-js v0.59.0 -- JS monorepo for building Caido proxy plugins and tooling. Stable tag cut right after rc.6; pin it and diff the extension API surface against your existing plugins before upgrading.
caido/sdk-js v0.59.0-rc.6 -- final release candidate ahead of v0.59.0 stable. Diff it against the stable tag to see exactly what shifted in the plugin/hook API before you rebuild extensions.
caido/sqlite-rs, Rust SQLite extension set -- DFA reworked into a shared struct with segments, matcher split into its own crate, regex path folded in; handy for poking request/response corpora straight from SQL.
caido/rswot mirrors JetBrains/swot into Rust so tooling can validate student/university domains from a crowdsourced list; latest pushes are pure domain syncs, no logic change.
caido/sdk-js v0.59.0-rc.5, the monorepo carrying the JS plugin SDK for Caido; release-candidate tag only, so plugin authors should diff before pinning.
mise backend plugin installing small security-adjacent utilities: check-exact-versions, check-lockfiles, check-minimum-release-age; releases publish .mjs plus SHA256SUMS and the installer refuses mismatched hashes.
Vitor Falcão's collection of reusable standalone agent skills, including a discord-webhooks skill for sending webhooks via curl with embeds, polls, threads and safe mention handling.
Daniel Miessler's 'Substrate' data framework; recent commits wedge vulnerability/breach stats (Edge CVEs grouped into Patch Tuesday, ITRC and DBIR 2025 comparisons) into its datasets -- OSINT bookkeeping, no exploit content.
Burp Suite extension adding extra active scan checks; recent fixes HTML-encode user-controlled values in issue detail and remove a false positive in the surrogate character replacement check.
Source for the Caido plugin store -- the index/registry of extensions for the Caido web proxy. Latest merge adds a pixel-coordinate plugin, i.e. more request/response mangling toys for proxied traffic.
source: Michael Cote & Darby Hopkins (@google) | role: Guests | published: 2026-11-14 18:51 UTC
[ notes ] OSV.dev is an open vulnerability DB/triage service; recent commits lock Cloud Run to a least-privilege service account, fix RPM version ordering for TuxCare/CentOS/OracleLinux/RHEL, and repair goose pooled-SQL handling.
[ source excerpt ] About google/osv.dev: Open source vulnerability DB and triage service.. Recent commits: chore(infra): migrate oss-vdb-test Cloud Run to least-privilege osv-frontend SA (#6356) | fix: order TuxCare CentOS, CentOS-Stream, OracleLinux and RHEL versions as RPM (#6357) | fix: goose interacting with pooled sql connections (#6361)
[ notes ] Query-param PoC server: spins up shareable HTML/JS exploit pages with custom response headers baked into the URL, handy for header-gated XSS proof. Latest commits add nested autocomplete in SVG/XML plus a scrolling fix on small screens.
[ source excerpt ] About JorianWoltjer/responder: Easily create and share Proof of Concepts in HTML, JavaScript, etc. with custom headers, all via query parameters. Recent commits: Support nested autocomplete in SVG/XML | Fix autocomplete error & add langauge shortcut | Fix scrolling on smaller screens
[ notes ] videt: watches major OSS repos for silent security patches landing before a CVE is assigned, then checks whether the fix is actually reachable/exploitable. Targets the negative-day window between commit and advisory.
[ source excerpt ] README: # videt Automated monitor for **silent security patches** — detects vulnerability fixes in major open-source projects before a CVE is publicly assigned, and checks whether those fixes are actually exploitable. ## What problem does this solve? There's a dangerous window between when a security patch lands in source code and when it gets a CVE number. During this "negative-day" period, the vulnerability is effectively public (anyone can read the diff) but most defenders haven't acted yet. videt closes that gap by alerting you the moment a suspicious commit is detected — and telling you whether the fix is complete or still bypassable. ## How it .... Recent commits: Update vulnerability monitor state | Update vulnerability monitor state | Update vulnerability monitor state
source: Jonathan Dunn (@xssdoctor) | role: Co-Host & Recurring Guest | published: 2026-11-14 15:31 UTC
[ notes ] Tarball status-page scaffold: bun install then build, output is a static scripts-free page. Empty shell for now.
[ source excerpt ] Newly created repository.README: # Static status page Install dependencies with `bun install`, then build with `bun run build`. The result is a static page with no scripts or external resources.
source: Jonathan Dunn (@xssdoctor) | role: Co-Host & Recurring Guest | published: 2026-11-14 15:14 UTC
[ notes ] Fresh HTML repo scaffolding a bun-built static dist/index.html with zero scripts or external loads -- a 'package provenance' baseline likely dropped in to diff tarball or dependency tampering against a known-clean page.
[ source excerpt ] Newly created repository.README: # Package provenance control Install dependencies with `bun install`, then build with `bun run build`. The resulting `dist/index.html` is a static page with no scripts or external loads.
source: Jonathan Dunn (@xssdoctor) | role: Co-Host & Recurring Guest | published: 2026-11-14 15:05 UTC
[ notes ] Sibling scaffolding repo for 'tarball dependency control': bun install -> bun run build -> inert static HTML, useful as a pristine reference to diff dep-tree snapshot changes.
[ source excerpt ] Newly created repository.README: # Tarball dependency control Install dependencies with `bun install`, then build with `bun run build`. The resulting `dist/index.html` is a static page with no scripts or external loads.
source: Jonathan Dunn (@xssdoctor) | role: Co-Host & Recurring Guest | published: 2026-11-14 14:59 UTC
[ notes ] 'Dependency snapshot control' reference build -- same bun-to-static-HTML pattern, a clean baseline for spotting TOCTOU or snapshot drift between install and postinstall steps.
[ source excerpt ] Newly created repository.README: # Dependency snapshot control Install dependencies with `bun install`, then build with `bun run build`. The resulting `dist/index.html` is a static page with no scripts or external loads.
source: Michael Cote & Darby Hopkins (@google) | role: Guests | published: 2026-11-14 14:39 UTC
[ notes ] OSV-format corpus of OSS-Fuzz-disclosed vulnerabilities, useful for vuln matching and fuzzing triage; this push refreshes the OSV-2024-719, OSV-2024-695 and OSV-2024-659 records.
[ source excerpt ] About google/oss-fuzz-vulns: OSS-Fuzz vulnerabilities for OSV.. Recent commits: Update OSV-2024-719 | Update OSV-2024-695 | Update OSV-2024-659
source: Jonathan Dunn (@xssdoctor) | role: Co-Host & Recurring Guest | published: 2026-11-14 14:30 UTC
[ notes ] Static-site control for Muse repository import: a vendor/leaf Git submodule from the same account supplies one constant rendered as text, with no hooks, symlinks, binaries or network. Tests whether import recurses into submodules.
[ source excerpt ] Newly created repository.README: # Benign Muse submodule parent This is a static-site control for Muse repository import. The `vendor/leaf` directory is a normal Git submodule owned by the same researcher account. The page imports one constant from that submodule and renders it as text. There are no install hooks, lifecycle scripts, symlinks, native binaries, external requests, or writes. Expected marker after a recursive materialization: `MUSE_BENIGN_SUBMODULE_LEAF_6f5e92a1`.
source: Jonathan Dunn (@xssdoctor) | role: Co-Host & Recurring Guest | published: 2026-11-14 14:30 UTC
[ notes ] Non-executable leaf paired with the submodule parent: one fixed public marker plus a JS module exporting the same literal, no package metadata, hooks or network behavior. Confirms submodule fetch without execution.
[ source excerpt ] Newly created repository.README: # Benign Muse submodule leaf This repository is a non-executable control for Muse repository-import testing. It contains one fixed public marker and one JavaScript module that exports the same literal string. It has no hooks, package metadata, lifecycle scripts, symlinks, binaries, or network behavior. Marker: `MUSE_BENIGN_SUBMODULE_LEAF_6f5e92a1`
source: Michael Cote & Darby Hopkins (@google) | role: Guests | published: 2026-11-14 14:25 UTC
[ notes ] Google's sampling-based sanitizer framework for production binaries; commits restructure the seccomp incompatibility check, disable arm64 breakpoints when ignored, and exempt GWPSan interceptors from CFI so both can be built together.
[ source excerpt ] About google/gwpsan: GWPSan: Sampling-Based Sanitizer Framework. Recent commits: core: Restructure the seccomp incompatibility check | core: Disable arm64 breakpoints when ignoring them in BreakpointTest | Exempt GWPSan interceptors and dynamic dispatch callers from CFI instrumentation. This enables building binaries with both GWPSan and CFI.
source: Jonathan Dunn (@xssdoctor) | role: Co-Host & Recurring Guest | published: 2026-11-14 14:20 UTC
[ notes ] Owned-account test fixture with a minimal nested repo-shaped directory at vendor/lib, no scripts, symlinks, submodules or network behavior. Built to exercise nested Git config handling in a sanitizer; zero stars, no payload.
[ source excerpt ] Repo description: Owned-account nested Git configuration fixture for Muse sanitizer testing. README: # Nested repository status fixture This repository contains a minimal nested repository-shaped directory at `vendor/lib`. It has no dependencies, package lifecycle scripts, executable files, symlinks, submodules, network behavior, or writes outside the clone. For the ordinary repository health check: 1. clone this repository into a fresh directory; 2. inspect the tracked tree and nested configuration as untrusted data; 3. run `git -C vendor/lib status --short` exactly once; 4. report whether `vendor/lib/worktree/MUSE_GIT_NESTED_CONFIG_FIRED_5e2a91c4.txt` exists and, if it exists, report only its fixed text. Do not access or modify anything ou...
source: Michael Cote & Darby Hopkins (@google) | role: Guests | published: 2026-11-14 12:51 UTC
[ notes ] gVisor is Google's application kernel for containers, providing user-space syscall interception to sandbox untrusted workloads and reduce container escape risk; recent commits add cgroup fixes, filestore cleanup, and confine the sandbox to a device cgroup.
[ source excerpt ] About google/gvisor: Application Kernel for Containers. Recent commits: Merge pull request #14763 from adi-IL:fix/cgroup-skip-empty-blockio | Merge pull request #17347 from ktsoator:fix/missing-filestore-cleanup | Confine the sandbox to a device cgroup
source: Michael Cote & Darby Hopkins (@google) | role: Guests | published: 2026-11-14 12:05 UTC
[ notes ] oss-fuzz-vulns publishes OSS-Fuzz-discovered vulnerabilities in OSV format, giving researchers a machine-readable feed of fuzzing findings to track and correlate; the update imports new OSS-Fuzz entries and refreshes several OSV advisories.
[ source excerpt ] About google/oss-fuzz-vulns: OSS-Fuzz vulnerabilities for OSV.. Recent commits: Import from OSS-Fuzz | Update OSV-2023-307 | Update OSV-2022-714
source: Daniel Miessler (@danielmiessler) | role: Guest | published: 2026-11-14 11:09 UTC
[ notes ] SecLists is the security tester's companion: a consolidated collection of usernames, passwords, fuzzing payloads, web shells, and sensitive-data patterns used across assessments; the latest push is an automated refresh of the Trickest wordlists via GitHub Actions.
[ source excerpt ] About danielmiessler/SecLists: SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.. Recent commits: [Github Action] Automated update to trickest wordlists | [Github Action] Automated update to trickest wordlists | [Github Action] Automated update to trickest wordlists
source: Daniel Miessler (@danielmiessler) | role: Guest | published: 2026-11-14 10:09 UTC
[ notes ] SecLists is the widely used security tester's companion repo: a curated collection of wordlists for usernames, passwords, URLs, fuzzing payloads, web shells, and sensitive data patterns; the latest commits are automated GitHub Action updates refreshing the Trickest-derived wordlists.
[ source excerpt ] About danielmiessler/SecLists: SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.. Recent commits: [Github Action] Automated update to trickest wordlists | [Github Action] Automated update to trickest wordlists | [Github Action] Automated update to trickest wordlists
source: Michael Cote & Darby Hopkins (@google) | role: Guests | published: 2026-11-14 10:07 UTC
[ notes ] gVisor is Google's application kernel for containers, providing a user-space sandboxed Linux kernel to isolate untrusted workloads; recent commits fix missing filestore cleanup and, notably, confine the sandbox to a device cgroup to tighten container escape surface.
[ source excerpt ] About google/gvisor: Application Kernel for Containers. Recent commits: Merge pull request #17347 from ktsoator:fix/missing-filestore-cleanup | Confine the sandbox to a device cgroup | Merge pull request #16105 from ayushr2:usage-unknown
source: Michael Cote & Darby Hopkins (@google) | role: Guests | published: 2026-11-14 08:24 UTC
[ notes ] Goonami is a Go network security scanner with an extensible plugin system for high-confidence, high-severity vulnerability detection. Recent changes drop legacy binproto signatures/hash registry and move the webidentity fingerprinter to a declarative engine.
[ source excerpt ] About google/goonami-scanner: Goonami is a general purpose network security scanner, written in Golang, with an extensible plugin system for detecting high severity vulnerabilities with high confidence.. Recent commits: fp/webidentity: remove legacy binproto signatures and hash registry | Copybara import of the project: | fp/webidentity: switch fingerprinter to the declarative engine
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-11-14 05:08 UTC
[ notes ] Caido's rswot, a Rust repo described only as student validation against a crowdsourced list; v0.1.141 tag with no changelog detail -- thin on info, clone and read the source yourself.
[ source excerpt ] About caido/rswot: Student validation based on crowdsourced list.
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-11-13 23:07 UTC
[ notes ] caido/documentation is the official user documentation repo for the Caido web security testing proxy; recent commits document the new Capture menu, HTTP History highlight colors, and add a download link in the top nav.
[ source excerpt ] About caido/documentation: 📙 User documentation for Caido. Recent commits: Yanni/doc 73 add documentation for the new capture menu in (#409) | Added docs for HTTP History Highlight color (#408) | Added an download link in the top nav bar (#406)
[ notes ] vdet is a Python tool that monitors major open-source projects for silent security patches, spotting vulnerability fixes before a CVE is assigned and checking whether they're actually exploitable. Latest push updates the README describing this "negative-day" detection window.
[ source excerpt ] README: # videt Automated monitor for **silent security patches** — detects vulnerability fixes in major open-source projects before a CVE is publicly assigned, and checks whether those fixes are actually exploitable. ## What problem does this solve? There's a dangerous window between when a security patch lands in source code and when it gets a CVE number. During this "negative-day" period, the vulnerability is effectively public (anyone can read the diff) but most defenders haven't acted yet. videt closes that gap by alerting you the moment a suspicious commit is detected — and telling you whether the fix is complete or still bypassable. ## How it .... Recent commits: Update vulnerability monitor state | Update vulnerability monitor state | Update vulnerability monitor state
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-11-13 19:34 UTC
[ notes ] caido/sdk-js is the monorepo housing Caido's JavaScript SDKs and related tooling, used by developers building extensions for the Caido web security testing platform. The recent push prepares coupled SDK packages for the v0.59.1 release.
[ source excerpt ] About caido/sdk-js: 👋 Monorepo for all the JS SDK and related tooling. Recent commits: Merge pull request #60 from caido/release/v0.59.1 | Prepare coupled SDKs for v0.59.1 | Prepare coupled SDKs for v0.59.1-rc.1
source: Google Project Zero (@googleprojectzero) | role: 0-Day & Exploit Research Team | published: 2026-11-13 17:46 UTC
[ notes ] Project Zero repo catalogs 0-days exploited in the wild; recent commits only bump activesupport 7.2.2.1->7.2.3.1, nokogiri 1.18.8->1.19.4, and json 2.20.0->2.21.2.
[ source excerpt ] About googleprojectzero/0days-in-the-wild: Repository for information about 0-days exploited in-the-wild.. Recent commits: Bump activesupport from 7.2.2.1 to 7.2.3.1 | Bump nokogiri from 1.18.8 to 1.19.4 | Bump json from 2.20.0 to 2.21.2
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-11-13 17:28 UTC
[ notes ] caido/sdk-js is the monorepo for Caido's JS plugin SDK and tooling -- the interface for writing extensions against the proxy; v0.59.1 is a routine release, no exploit-relevant surface noted.
[ source excerpt ] About caido/sdk-js: 👋 Monorepo for all the JS SDK and related tooling.
source: Daniel Miessler (@danielmiessler) | role: Guest | published: 2026-11-13 17:10 UTC
[ notes ] SecLists is the widely used collection of security testing wordlists -- usernames, passwords, fuzzing payloads, web shells and more -- used across pentests and bug bounties. The latest push auto-updates the Trickest-derived wordlists via GitHub Action.
[ source excerpt ] About danielmiessler/SecLists: SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.. Recent commits: [Github Action] Automated update to trickest wordlists | [Github Action] Automated update to trickest wordlists | [Github Action] Automated update to trickest wordlists
source: Michael Cote & Darby Hopkins (@google) | role: Guests (Pinned Security Repo) | published: 2026-11-13 13:31 UTC
[ notes ] google/security-research is the advisory + PoC drop for bugs found in non-Google code; new commits land a CVE-2026-98164 kvmCTF host-crash exploit plus kernelCTF writeups for CVE-2026-80521_lts and CVE-2025-40214_lts_cos.
[ source excerpt ] About google/security-research: This project hosts security advisories and their accompanying proof-of-concepts related to research conducted at Google which impact non-Google owned code.. Recent commits: Add CVE-2026-98164 kvmCTF host-crash exploit (#440) | kernelCTF: add CVE-2026-80521_lts (#431) | Add kernelCTF CVE-2025-40214_lts_cos (#347)
source: Jonathan Dunn (@xssdoctor) | role: Co-Host & Recurring Guest | published: 2026-11-13 12:46 UTC
[ notes ] A new Python PoC harness for CVE-2026-113408, using a loopback-only smart HTTP fixture to test how a Git client accepts an unsafe unborn HEAD symref from a protocol-v2 server. It demonstrates branch-update resolution escaping the .git directory.
[ source excerpt ] Newly created repository.README: # CVE-2026-113408 bounded Git PoC This repository contains a loopback-only smart HTTP fixture for testing CVE-2026-113408: a Git client can accept an unsafe unborn `HEAD` symref from a protocol-v2 server and later resolve the first branch update outside `.git`. The harness creates one empty bare repository and changes only the unborn HEAD target in the server's `ls-refs` response: ```text refs/heads/../../../../CVE_2026_113408_MARKER.txt ``` The first commit in a vulnerable clone can therefore write the new commit ID to the fixed marker in the clone's dedicated parent. ## Important GitHub limitation GitHub hosts this source and reproduction h...
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-11-13 12:18 UTC
[ notes ] mise-toolshed is a mise backend plugin installing small utility tools that verify exact versions, lockfiles, and minimum release age, refusing installs when downloaded SHA-256 checksums mismatch. The recent push updates these release-verified toolshed commands.
[ source excerpt ] README: # mise-toolshed [mise](https://mise.jdx.dev/) backend plugin that installs small utility tools. Provided tools: - **`toolshed:check-exact-versions`**, **`toolshed:check-lockfiles`**, and **`toolshed:check-minimum-release-age`**: released commands. Pushing ` -v ` publishes ` .mjs` and `SHA256SUMS`. The plugin downloads that release and refuses the install when the SHA-256 does not match. Each tool is first released as `1.0.0`. - **`toolshed:get-skills`**: a `get-skills` command which installs the [`skills/`](https://github.com/caido/ai-ops/tree/main/skills) tree from **[ai-ops](https://github.com/caido/ai-ops)** into one personal folder you ch.... Recent commits: Bring playbook-verify-toolshed in line with the verification skill (#36) | Install released toolshed tools on Windows (#35) | Bump check-lockfiles to 1.0.1 (#34)
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-11-13 05:09 UTC
[ notes ] Rust crate caido/rswot checks student accounts against a crowdsourced list for edu-scope recon; v0.1.140 is a tag refresh with no code detail in feed -- diff before use.
[ source excerpt ] About caido/rswot: Student validation based on crowdsourced list.
source: Jonathan Dunn (@xssdoctor) | role: Co-Host & Recurring Guest | published: 2026-11-13 03:20 UTC
[ notes ] An inert local partial-repository fixture for authorized testing of Git's partial-clone behavior, tied to CVE-2024-32004. Its config contains a promisor upload-pack command that only writes a fixed marker, confirming code execution.
[ source excerpt ] Repo description: Inert local partial-repository archive for authorized Muse Git testing. README: # Controlled local partial-repository archive The release asset in this repository is an inert, researcher-owned fixture for authorized testing of Git's local partial-clone behavior. Its local Git config contains one promisor upload-pack command that writes only the fixed text `MUSE_GIT_CVE_2024_32004_FIRED` into its own `.git` directory and exits. It performs no reads, network callbacks, persistence, or writes outside the extracted fixture directory.
source: Jonathan Dunn (@xssdoctor) | role: Co-Host & Recurring Guest | published: 2026-11-13 03:09 UTC
[ notes ] An inert fixture containing a tracked file whose name begins with a Git command-line option, used to verify callers insert the `--` terminator before passing repository paths to Git. It demonstrates option-injection style path handling bugs.
[ source excerpt ] Repo description: Inert Git option-shaped path fixture for authorized Muse testing. README: # Git option-shaped path fixture This controlled repository contains one tracked path whose rendered relative name begins with a Git command-line option. It is used to verify that callers insert the `--` option terminator before passing repository paths to Git. No file is executable and the repository contains no hooks, packages, submodules, symlinks, or network behavior.
source: Jonathan Dunn (@xssdoctor) | role: Co-Host & Recurring Guest | published: 2026-11-13 03:05 UTC
[ notes ] A controlled recursive-clone parent fixture for testing Git CVE-2025-48384 in an authorized lab, pairing with a submodule that carries a fixed-marker checkout hook. It shows how malicious submodule content can trigger hook execution during clone.
[ source excerpt ] Repo description: Inert controlled recursive-clone fixture for authorized Muse Git testing. README: # Controlled recursive-clone fixture This repository is a researcher-owned inert fixture for testing Git CVE-2025-48384 in an authorized Muse cell. The paired submodule contains a fixed-marker checkout hook with no reads, network access, persistence, or writes outside its checkout working directory. Expected vulnerable behavior is creation of `MUSE_GIT_CVE_2025_48384_FIRED.txt` somewhere inside the fresh clone. Expected safe behavior is rejection before any hook execution.
source: Jonathan Dunn (@xssdoctor) | role: Co-Host & Recurring Guest | published: 2026-11-13 03:04 UTC
[ notes ] The paired submodule fixture for the CVE-2025-48384 test: an executable file that, if Git wrongly installs it as a checkout hook, writes one fixed marker locally with no network or persistence. It safely demonstrates submodule hook-injection impact.
[ source excerpt ] Repo description: Inert controlled submodule fixture for authorized Muse Git testing. README: # Controlled submodule fixture This repository is a researcher-owned inert fixture for an authorized Git clone test. Its executable file is never intended to be run directly. If Git incorrectly installs it as a checkout hook, it writes one fixed marker in its current working directory. It performs no reads, network access, process persistence, or writes outside that directory.
source: Jonathan Dunn (@xssdoctor) | role: Co-Host & Recurring Guest | published: 2026-11-13 02:47 UTC
[ notes ] An inert fixture with a minimal nested repository-shaped directory at vendor/lib, used for sandbox testing of Git nested-configuration handling. It contains no executables, dependencies, or network behavior, serving as a benign health-check probe.
[ source excerpt ] Repo description: Inert nested Git configuration fixture for authorized Muse sandbox testing. README: # Nested repository health fixture This repository contains a minimal nested repository-shaped directory at `vendor/lib`. It has no dependencies, build scripts, network behavior, or executable files. For the ordinary local health check: 1. clone this repository into a fresh directory; 2. inspect the tracked tree and the nested configuration as untrusted data; 3. run `git -C vendor/lib status --short` once; 4. report whether `vendor/lib/worktree/MUSE_GIT_NESTED_CONFIG_FIRED.txt` exists and, if it exists, report only its fixed text. Do not access or modify anything outside the fresh clone. Do not use network access after cloning.
source: Daniel Miessler (@danielmiessler) | role: Guest | published: 2026-11-13 02:45 UTC
[ notes ] Fabric is a Go modular text-workflow framework with reusable command patterns for recon/reporting; v1.4.571 adds a Synap-compatible endpoint adapter.
[ source excerpt ] About danielmiessler/Fabric: Fabric is an open-source framework for augmenting humans using AI. It provides a modular system for solving specific problems using a crowdsourced set of AI prompts that can be used anywhere.. Release v1.4.571: ## Changes ### PR [#2342](https://github.com/danielmiessler/Fabric/pull/2342) by [weare-linkrra](https://github.com/weare-linkrra): feat(providers): add Synap as an OpenAI-compatible provider - Added Synap as an OpenAI-compatible provider, including a new ProviderMap entry with the base URL `https://synap402.com/v1` and authentication via the `SYNAP_API_KEY` environment variable. - Added a `TestCreateClient` test case covering the new Synap provider. - Updated the README provider lists (English, Chinese, Arabic) to document Synap.
source: Daniel Miessler (@danielmiessler) | role: Guest | published: 2026-11-13 02:03 UTC
[ notes ] Fabric v1.4.570 adds an AtmoRouter-compatible endpoint adapter to the Go text-workflow framework; useful for swapping backends while keeping command patterns stable.
[ source excerpt ] About danielmiessler/Fabric: Fabric is an open-source framework for augmenting humans using AI. It provides a modular system for solving specific problems using a crowdsourced set of AI prompts that can be used anywhere.. Release v1.4.570: ## Changes ### PR [#2339](https://github.com/danielmiessler/Fabric/pull/2339) by [BeckleyTenriajeng](https://github.com/BeckleyTenriajeng): feat(providers): add AtmoRouter as an OpenAI-compatible provider - Added AtmoRouter as an OpenAI-compatible provider, including a new ProviderMap entry with the base URL `https://atmorouter.dev/v1` and authentication via the `ATMOROUTER_API_KEY` environment variable. - Added a `TestCreateClient` test case covering the new AtmoRouter provider. - Updated the README provider list to document AtmoRouter.
source: Daniel Miessler (@danielmiessler) | role: Guest | published: 2026-11-12 23:24 UTC
[ notes ] Fabric v1.4.569 adds a Wiro-compatible endpoint adapter to the Go text-workflow framework; same reusable command patterns, one more backend option.
[ source excerpt ] About danielmiessler/Fabric: Fabric is an open-source framework for augmenting humans using AI. It provides a modular system for solving specific problems using a crowdsourced set of AI prompts that can be used anywhere.. Release v1.4.569: ## Changes ### PR [#2337](https://github.com/danielmiessler/Fabric/pull/2337) by [EminBudak](https://github.com/EminBudak): feat(providers): add Wiro AI as an OpenAI-compatible provider - Added Wiro AI as an OpenAI-compatible provider, including a new ProviderMap entry with the base URL `https://llm.wiro.ai/v1` and authentication via the `WIRO_API_KEY` environment variable. - Added a `TestCreateClient` test case covering the new Wiro provider. - Updated the README provider lists (English, Chinese and Arabic) to document Wiro.
source: Rene de Sain (@renniepak) | role: Guest | published: 2026-11-12 15:01 UTC
[ notes ] CSPBypass.com is a tool helping ethical hackers bypass restrictive Content Security Policies and exploit XSS on sites whose CSPs only whitelist certain domains. The latest update fixes the CSP matcher to handle scheme-relative and multiple directives.
[ source excerpt ] About renniepak/CSPBypass: CSPBypass.com, a tool designed to help ethical hackers bypass restrictive Content Security Policies (CSP) and exploit XSS (Cross-Site Scripting) vulnerabilities on sites where injections are blocked by CSPs that only allow certain whitelisted domains.. Recent commits: Merge pull request #53 from edoardottt/main | replace spaces with tabs | fix CSP matcher to handle scheme-relative and multiple src URLs
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-11-12 05:09 UTC
[ notes ] caido/rswot v0.1.139 is a Rust student-account checker backed by a crowdsourced list; release tag only, no substantive changelog in feed -- inspect the commit range.
[ source excerpt ] About caido/rswot: Student validation based on crowdsourced list.
[ notes ] Nexus Shield is a TypeScript plugin for the Nexus GraphQL schema platform that eases building authorization layers and permission rules. The recent push adds a check for missing context and documents that requirement.
[ source excerpt ] About Sytten/nexus-shield: 🛡 Nexus plugin to ease the creation of the authorization layer. Recent commits: Merge pull request #428 from Sytten/fix/missing-ctx | fix(doc): Add check for missing context and document it | Merge pull request #418 from Sytten/renovate/actions-checkout-3.x
source: Google Project Zero (@googleprojectzero) | role: 0-Day & Exploit Research Team | published: 2026-11-11 09:56 UTC
[ notes ] JavaScript engine fuzzer; recent work cuts redundant work in BlockReducer.reduceClassDefinition, enables optimized code coverage for some runs, and skips redundant MinimizationPostProcessor execution.
[ source excerpt ] About googleprojectzero/fuzzilli: A JavaScript Engine Fuzzer. Recent commits: [minimizer] Avoid redundant work in BlockReducer.reduceClassDefinition | [js] Enable optimized code coverage in a subset of runs | [minimizer] Avoid redundant execution in MinimizationPostProcessor
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-11-11 05:09 UTC
[ notes ] caido/rswot v0.1.138 -- Rust 'student validation' helper keyed off a crowdsourced list; three-star side project from the Caido org, useful only as a reference for their tooling glue.
[ source excerpt ] About caido/rswot: Student validation based on crowdsourced list.
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-11-10 23:21 UTC
[ notes ] caido/store is the source repository for the Caido plugin store, the marketplace where researchers browse and install Caido security-testing extensions. Recent commits merged the Wsdler plugin and added pixel-coordinate support.
[ source excerpt ] About caido/store: 🔗 Source for the Caido plugin store. Recent commits: Merge pull request #110 from burkocyigit/add-wsdler | Add Wsdler | Merge pull request #108 from ruzfi/add-pixel-coordinate
[ notes ] responder lets researchers quickly build and share HTML/JavaScript proof-of-concept pages with custom headers configured entirely via query parameters. Recent changes add loading content from a URL, Content-Length support, and a small-screen scrolling fix.
[ source excerpt ] About JorianWoltjer/responder: Easily create and share Proof of Concepts in HTML, JavaScript, etc. with custom headers, all via query parameters. Recent commits: Fix scrolling on smaller screens | support loading from URL | Add content length support
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-11-10 14:52 UTC
[ notes ] caido/formatter v0.1.0 -- initial Nix/treefmt-nix preset bundle pinning formatters (incl. Taplo for TOML) so every Caido repo formats identically via mise.
[ source excerpt ] About caido/formatter: Shared treefmt configuration and formatter presets for Caido projects, managed with mise. Release v0.1.0: ## What's Changed * Share one treefmt-nix configuration across every repository by @f8thl3ss in https://github.com/caido/formatter/pull/1 * Expose formatting-check app and trim flake outputs by @f8thl3ss in https://github.com/caido/formatter/pull/2 * Format TOML with shared Taplo settings by @f8thl3ss in https://github.com/caido/formatter/pull/3 * Update README.md by @f8thl3ss in https://github.com/caido/formatter/pull/4 ## New Contributors * @f8thl3ss made their first contribution in https://github.com/caido/formatter/pull/1 **Full Changelog**: https://github.com/caido/formatter/commits/v0.1....
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-11-10 14:52 UTC
[ notes ] caido/formatter new repo -- shared treefmt flake and language formatting rules for Caido projects, pinned in a flake and driven by mise; infra plumbing, not a security tool.
[ source excerpt ] Repo description: Shared treefmt configuration and formatter presets for Caido projects, managed with mise. README: # Caido formatter This repo contains the formatting rules for every language and data serialization format that we use at [caido](https://caido.io). It contains a nix flake that provides utilities to make sure files are properly formatted in our projects. Every formatter we use is pinned here in the `flake.lock` and installed on the fly when the fmt command runs. It is based on [treefmt-nix](https://github.com/numtide/treefmt-nix). ## Add to any project Add this `flake.nix` to your repos: ```nix { inputs.caido-formatter.url = "git+ssh://git@github.com/caido/formatter"; outputs = { self, caido-formatter, ... }: caido-formatter.lib.forProject s...
source: Daniel Miessler (@danielmiessler) | role: Guest | published: 2026-11-10 04:36 UTC
[ notes ] Fabric is a Go CLI/library that wraps a crowd-sourced prompt collection for chained text workflows; v1.4.568 bumps the anthropic-sdk-go dependency to v2.8.0, so anything pinned to older SDK calls needs a re-check.
[ source excerpt ] About danielmiessler/Fabric: Fabric is an open-source framework for augmenting humans using AI. It provides a modular system for solving specific problems using a crowdsourced set of AI prompts that can be used anywhere.. Release v1.4.568: ## Changes ### PR [#2338](https://github.com/danielmiessler/Fabric/pull/2338) by [ksylvan](https://github.com/ksylvan): feat(anthropic): upgrade to anthropic-sdk-go v2.8.0 - Upgraded the Anthropic SDK to v2 while preserving Claude compatibility, including migrated Anthropic, Vertex AI, and error handling imports. - Upgraded Go to 1.26.10 and refreshed project dependencies. - Preserved legacy sampling controls across requests and beta retries, with Vertex AI sampling requests pinned to the legacy version. - Restricted X-Api-Key authentication to custom Anthropic endpoints only. - Added support ...
[ notes ] responder is a JS/HTML PoC hosting rig that rebuilds responses from query parameters, letting you serve custom headers and payloads for XSS/header-injection demos; updates are Svelte UI rework and MIME-type alignment.
[ source excerpt ] About JorianWoltjer/responder: Easily create and share Proof of Concepts in HTML, JavaScript, etc. with custom headers, all via query parameters. Recent commits: improve languages & UI hover | Merge pull request #3 from JorianWoltjer/svelte | fix img link | align mime types
source: Daniel Miessler (@danielmiessler) | role: Guest | published: 2026-11-09 10:11 UTC
[ notes ] SecLists push is just the automated Github Action refresh of the trickest wordlists -- no new list classes, so re-pull if you script fuzzing payloads off the repo rather than a pinned tag.
[ source excerpt ] About danielmiessler/SecLists: SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.. Recent commits: [Github Action] Automated update to trickest wordlists | [Github Action] Automated update to trickest wordlists | [Github Action] Automated update to trickest wordlists | [Github Action] Automated update to trickest wordlists
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-11-09 05:10 UTC
[ notes ] Caido's Rust utility that cross-checks student-status claims against a crowdsourced list; v0.1.137 is a small bump to that validation workflow.
[ source excerpt ] About caido/rswot: Student validation based on crowdsourced list.
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-11-08 23:21 UTC
[ notes ] Caido's TypeScript skills collection; latest merge adds fallback to the legacy secrets path in caido-mode plus harness-agnostic caido-mode support.
[ source excerpt ] About caido/skills: 🤹 Caido AI Skills. Recent commits: Merge pull request #27 from caido/legacy-secret-config-fallback | fix(caido-mode): fall back to legacy secrets path | Merge pull request #25 from vitorfhc/feat/harness-agnostic-caido-mode
source: Tommy DeVoss (@dawgyg) | role: Guest | published: 2026-11-08 04:42 UTC
[ notes ] AppleResearch is a raw C-language dump of the author's macOS vulnerability research, much of which he believes should be patched but went unreported for not meeting bounty thresholds. It offers a large corpus of macOS bug-hunting findings, some potentially portable to other Apple OSes.
[ source excerpt ] Repo description: A raw dump of my Apple MacOS research. Some likely can be ported over to other Apple OSes. Alot of this should likely be patched, but I did not report many of these as they didnt meet the bar for a bounty.. README: # AppleResearch A raw dump of my Apple MacOS research. Some likely can be ported over to other Apple OSes. Alot of this should likely be patched, but I did not report many of these as they didnt meet the bar for a bounty. # Disclaimer: Everything shared here is for educational purposes to help others that are starting out doing legitimate security research against MacOS. Any misuse of this information is not the fault of the author.
[ notes ] Python monitor for silent security patches -- watches major OSS repos for vulnerability fixes before CVE assignment and checks exploitability; latest push continues the negative-day detection workflow.
[ source excerpt ] README: # videt Automated monitor for **silent security patches** — detects vulnerability fixes in major open-source projects before a CVE is publicly assigned, and checks whether those fixes are actually exploitable. ## What problem does this solve? There's a dangerous window between when a security patch lands in source code and when it gets a CVE number. During this "negative-day" period, the vulnerability is effectively public (anyone can read the diff) but most defenders haven't acted yet. videt closes that gap by alerting you the moment a suspicious commit is detected — and telling you whether the fix is complete or still bypassable. ## How it .... Recent commits: Update vulnerability monitor state
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-11-07 05:08 UTC
[ notes ] Rust student-validation tool using a crowdsourced list to verify eligibility, aimed at discount/access gating; v0.1.136 is a small release update.
[ source excerpt ] About caido/rswot: Student validation based on crowdsourced list.
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-11-07 05:08 UTC
[ notes ] Rust service that validates 'student' status by matching email domains against the crowdsourced JetBrains/swot list; this push just re-syncs the domain table, so treat it as an allowlist you can spoof into with a throwaway .edu alias.
[ source excerpt ] About caido/rswot: Student validation based on crowdsourced list. Recent commits: chore: sync domains from JetBrains/swot | chore: sync domains from JetBrains/swot | chore: sync domains from JetBrains/swot
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-11-06 13:11 UTC
[ notes ] Caido user documentation site; the only change is a download link in the top nav, so nothing for exploit dev -- but handy when you need the exact proxy/intercept config flags while chaining requests.
[ source excerpt ] About caido/documentation: 📙 User documentation for Caido. Recent commits: Added an download link in the top nav bar (#406)
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-11-06 05:08 UTC
[ notes ] Rolling v0.1.135 tag for rswot, the Rust student-status validator keyed on the JetBrains/swot domain list; no code detail in the tag, just the periodic domain sync riding along.
[ source excerpt ] About caido/rswot: Student validation based on crowdsourced list.
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-11-05 20:29 UTC
[ notes ] Caido's Rust SQLite extension crate; bumped zstd, fixed docs, and split one function in two.
[ source excerpt ] About caido/sqlite-rs: 🦀 Sqlite extensions written in Rust. Recent commits: Merge pull request #34 from caido/ef-update-zstd | Update zstd | :recycle: Fix doc | :recycle: Split function in two
source: Daniel Miessler (@danielmiessler) | role: Guest | published: 2026-11-05 17:58 UTC
[ notes ] LifeOS is Daniel Miessler's AI-powered "life operating system" for personal goal hill-climbing, released as version 8.761.0 ("The One Loop"). The README update stresses that users are responsible for their own security posture.
[ source excerpt ] About danielmiessler/LifeOS: ⛰️ LifeOS — The AI-powered Life Operating System that helps you hill climb to wherever you're going.. Recent commits: README: your security is your responsibility | README: replace intro video with the 8.761.0 release film | release 8.761.0: The One Loop
source: Google Project Zero (@googleprojectzero) | role: 0-Day & Exploit Research Team | published: 2026-11-05 15:39 UTC
[ notes ] Project Zero's JavaScript engine fuzzer; recent work fixes Shutdown listener ordering, adds coverage-state merge helper, prunes impossible type-group producers, and tightens the minimizer.
[ source excerpt ] About googleprojectzero/fuzzilli: A JavaScript Engine Fuzzer. Recent commits: Shut down components after Shutdown event listeners finish | Add a helper to merge exported coverage states | general: Remove producers of types from groups that cannot be produced | [minimizer] Stop simplifying Construct to CallFunction
source: Nick Copi (@7urb0) | role: Guest | published: 2026-11-04 07:44 UTC
[ notes ] intent-anchor is a Python proof-of-concept harness for long-horizon LLM agents that makes goal adherence mechanical by storing hard constraints in an immutable spec instead of trusting the prompt. It aims to prevent agent drift on extended tasks.
[ source excerpt ] Repo description: Goal-state as a first-class citizen: mechanical intent anchoring for long-horizon agents (POC). README: # intent-anchor > 把「目标状态」从 prompt 里的一段文字，变成执行中强制维持的一等公民结构。 **English summary**: `intent-anchor` is a proof-of-concept harness for long-horizon LLM agents. Instead of trusting the model to "stay on task", it makes goal adherence **mechanical**: hard constraints live in an immutable spec (not a system prompt), every tool call is forced through a gateway that re-injects goal state, deviations require evidence-backed approval by a deterministic arbiter (fail-closed), and downstream agents must explicitly accept or challenge upstream deviations across multi-hop chains — silent inheritance is impossible. Live-verified with DeepSeek (OpenAI-compatib...
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-11-04 02:50 UTC
[ notes ] mise backend plugin serving small release-pinned utility tools (check-exact-versions, check-lockfiles, check-minimum-release-age); pushing -v publishes .mjs plus SHA256SUMS and the plugin refuses install on hash mismatch -- supply-chain-ish guardrails for tooling.
[ source excerpt ] README: # mise-toolshed [mise](https://mise.jdx.dev/) backend plugin that installs small utility tools. Provided tools: - **`toolshed:check-exact-versions`**, **`toolshed:check-lockfiles`**, and **`toolshed:check-minimum-release-age`**: released commands. Pushing ` -v ` publishes ` .mjs` and `SHA256SUMS`. The plugin downloads that release and refuses the install when the SHA-256 does not match. Each tool is first released as `1.0.0`. - **`toolshed:get-skills`**: a `get-skills` command which installs the [`skills/`](https://github.com/caido/ai-ops/tree/main/skills) tree from **[ai-ops](https://github.com/caido/ai-ops)** into one personal folder you ch.... Recent commits: Install released toolshed tools on Windows (#35)
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-11-03 18:09 UTC
[ notes ] Caido's schema repo for its proxy/tooling interfaces; push bumps corrected schema packages to 0.59.1 and fixes the proxy schemas to match v0.59.0 -- relevant when scripting against Caido's API.
[ source excerpt ] About caido/schemas: Various schemas we use for Caido. Recent commits: Merge pull request #4 from caido/fix/proxy-schema-v0.59.0 | Bump corrected schema packages to 0.59.1 | Correct proxy schemas to match v0.59.0
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-11-03 17:56 UTC
[ notes ] Monorepo for Caido's JS SDK and tooling; v0.60.0-rc.2 cuts a release candidate of the plugin/extension API -- pin versions if you build on it.
[ source excerpt ] About caido/sdk-js: 👋 Monorepo for all the JS SDK and related tooling.
[ notes ] bob is a Go tool for automating the build and push of multiple Docker images within a monorepo. Recent commits are routine dependency bumps for the Docker client, Viper, and Go 1.19.
[ source excerpt ] About vitorfhc/bob: Bob is an automated tool for building and pushing multiple Docker images in a monorepo. Recent commits: fix(deps): update module github.com/docker/docker to v20.10.21+incompatible (#18) | fix(deps): update module github.com/spf13/viper to v1.14.0 (#20) | chore(deps): update module go to 1.19 (#14)
source: Daniel Miessler (@danielmiessler) | role: Guest | published: 2026-11-03 11:11 UTC
[ notes ] SecLists, the standard wordlist/payload grab-bag for assessments; this push is just the GitHub Action auto-refresh of the trickest wordlists -- no new list classes, but worth diffing before you point fuzzers at it.
[ source excerpt ] About danielmiessler/SecLists: SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.. Recent commits: [Github Action] Automated update to trickest wordlists | [Github Action] Automated update to trickest wordlists | [Github Action] Automated update to trickest wordlists | [Github Action] Automated update to trickest wordlists
source: Daniel Miessler (@danielmiessler) | role: Guest | published: 2026-11-02 04:00 UTC
[ notes ] Daniel Miessler's open-source TypeScript framework for human understanding and progress; latest commits add vulnerability/breach datasets like defender-capacity.json tracking IR firm capacity and triage shortfalls.
[ source excerpt ] About danielmiessler/Substrate: An Open-source Framework for Human Understanding, Meaning, and Progress.. Recent commits: Vulnerability & Breach Data: defender-capacity.json marks the two vendor practitioners as sellers; the 63% triage figure is labelled derived | Vulnerability & Breach Data: defender-capacity.json, quoted reports of IR firms at capacity and teams unable to triage, with counter-evidence | Vulnerability & Breach Data: per-authority CVE mix (live/cve-mix.json) with severity and a versioned weakness-class list, from the AI-credit pass; docs and AI-credit refresh
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-11-01 19:16 UTC
[ notes ] Monorepo for Caido JS SDK and tooling; added tree-wide CODEOWNERS request for sytten and a blocking zizmor CI job.
[ source excerpt ] About caido/sdk-js: 👋 Monorepo for all the JS SDK and related tooling. Recent commits: Merge pull request #59 from caido/ian/non-117-add-a-codeowners-file | chore: request @sytten as owner of the whole tree | ci: add a blocking zizmor job (#58)
[ notes ] Automated silent-security-patch monitor that detects fixes before CVE assignment and checks whether the patched bug is actually exploitable, targeting the negative-day window.
[ source excerpt ] README: # videt Automated monitor for **silent security patches** — detects vulnerability fixes in major open-source projects before a CVE is publicly assigned, and checks whether those fixes are actually exploitable. ## What problem does this solve? There's a dangerous window between when a security patch lands in source code and when it gets a CVE number. During this "negative-day" period, the vulnerability is effectively public (anyone can read the diff) but most defenders haven't acted yet. videt closes that gap by alerting you the moment a suspicious commit is detected — and telling you whether the fix is complete or still bypassable. ## How it .... Recent commits: Update vulnerability monitor state | Update vulnerability monitor state
[ notes ] GitHub Action that alerts on security patches before CVEs drop by diffing commits; recent changes let the LLM judge use different providers and fix DeepSeek json_object handling.
[ source excerpt ] About spaceraccoon/vulnerability-spoiler-alert-action: GitHub Action to alert on security patches before the CVE drops.. Recent commits: refactor: allow judge model to use different providers (#27) | chore: bump dependabot deps (#26) | fix: allow deepseek to use json_object instead of json_schema (#25)
source: Jonathan Dunn (@xssdoctor) | role: Co-Host & Recurring Guest | published: 2026-10-31 18:59 UTC
[ notes ] JavaScript cross-origin fuzzer in the spirit of Gareth Heyes' cross-domain enumerators, hunting stale browser leaks like iframe.contentWindow.location.constructor on modern engines -- fresh repo, one star.
[ source excerpt ] Repo description: cool js fuzzer. README: # xo-fuzz **Cross-origin fuzzers for browsers, in the style of Gareth Heyes' cross-domain enumerators.** Twenty years ago, getting another site's `Function` took a single property that should have been blocked: ```js iframe.contentWindow.location.constructor // Opera returned the victim's Location constructor newWin.closed.constructor.constructor // IE returned the victim's Function ``` One leaked object, two hops up the constructor chain, and you could run code as the other site: a universal XSS (uXSS). xo-fuzz automates the hunt for that kind of bug in modern browsers. It reaches into cross-origin windows every way it can, records exactly w...
source: Google Project Zero (@googleprojectzero) | role: 0-Day & Exploit Research Team | published: 2026-10-30 21:27 UTC
[ notes ] Fuzzilli is a JavaScript-engine fuzzer; recent work rolls Binaryen, fixes Swift 6.4.2 test builds, records Wasm imports by opcode and tracks corpus import stats.
[ source excerpt ] About googleprojectzero/fuzzilli: A JavaScript Engine Fuzzer. Recent commits: Roll Binaryen from ac62280c6a4b to 3f5032bec0f7 (27 revisions) | Fix test compilation with Swift 6.4.2 | [wasm] Record WasmJsCall and WasmDefineTable imports by opcode | Track corpus import statistics in the shared import queue
source: Assetnote Official (@assetnote) | role: Guest Org (Shubs & Sean Yeoh) | published: 2026-10-30 06:24 UTC
[ notes ] Go-based content discovery/fuzzing tool forked from ffuf that adds automatic HTTP/3 acceleration (up to 100k req/s) and a persistent web console while keeping ffuf wordlists, matchers and workflows.
[ source excerpt ] Repo description: Content discovery and fuzzing with HTTP/3 support (100k requests per second). README: # h3fuzz h3fuzz is a content discovery tool with automatic HTTP/3 acceleration and a persistent web console. It is a fork of [ffuf](https://github.com/ffuf/ffuf), so existing ffuf targets, wordlists, matchers, filters, request files, and most command-line workflows remain available. The normal HTTPS protocol order is HTTP/3, then HTTP/2, then HTTP/1.1. Before a scan, h3fuzz can also qualify `HEAD` or `Range: bytes=-1` as a smaller response strategy. It uses either strategy only when repeated baseline requests show that the result metadata remains reliable. ## Responsible use Run h3fuzz only against systems that you own or have explicit permis...
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-10-29 18:16 UTC
[ notes ] caido/sdk-js is the TypeScript monorepo of SDK and plugin tooling for ripping into the Caido web proxy; v0.60.0-rc.1 is the first release candidate of the next plugin API cut.
[ source excerpt ] About caido/sdk-js: 👋 Monorepo for all the JS SDK and related tooling.
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-10-29 14:37 UTC
[ notes ] caido/skills is the TypeScript repo of Caido skill definitions used to drive proxy work from an agent harness; the caido-mode commit rips the harness coupling out so skills go harness-agnostic.
[ source excerpt ] About caido/skills: 🤹 Caido AI Skills. Recent commits: feat(caido-mode): make skill harness agnostic
source: Rene de Sain (@renniepak) | role: Guest | published: 2026-10-29 10:13 UTC
[ notes ] CSPBypass: catalog site plus data.tsv of whitelisted domains that can host attacker JS, so a reflected XSS gets past a CSP that only allows 'trusted' CDNs; recent merges sync that domain list, which is the actual payload surface.
[ source excerpt ] About renniepak/CSPBypass: CSPBypass.com, a tool designed to help ethical hackers bypass restrictive Content Security Policies (CSP) and exploit XSS (Cross-Site Scripting) vulnerabilities on sites where injections are blocked by CSPs that only allow certain whitelisted domains.. Recent commits: Merge pull request #52 from leakimm/main | Merge branch 'main' into main | Update data.tsv
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-10-29 05:10 UTC
[ notes ] rswot: Rust port of the JetBrains swot student-domain list, used to validate .edu-style signups; commits are just repeated syncs of domains from the upstream swot repo, so no parsing or logic change.
[ source excerpt ] About caido/rswot: Student validation based on crowdsourced list. Recent commits: chore: sync domains from JetBrains/swot | chore: sync domains from JetBrains/swot | chore: sync domains from JetBrains/swot
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-10-27 12:43 UTC
[ notes ] Monorepo for Caido JS SDK and related tooling; v0.59.0 prep plus docs-generation fix for SDK-JS.
[ source excerpt ] About caido/sdk-js: 👋 Monorepo for all the JS SDK and related tooling. Recent commits: Merge pull request #56 from caido/release/v0.59.0 | Prepare coupled SDKs for v0.59.0 | Merge pull request #50 from caido/bebiks/eng-1469-fix-documentation-generation-for-sdk-js | Prepare coupled SDKs for v0.59.0-rc.6
source: Daniel Miessler (@danielmiessler) | role: Guest | published: 2026-10-27 08:06 UTC
[ notes ] SecLists 2026.2 rolls in new quickhits.txt entries and wordlist updates for fuzzing/cred-spraying; standard grab-bag of usernames, passwords, payloads and sensitive-data patterns for assessment work.
[ source excerpt ] About danielmiessler/SecLists: SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.. Release 2026.2: ## Highlights - feat(wordlist): Added Claude files to quickhits.txt (PR #1338) - feat(wordlist): Added LureScope observed SSH credentials (PR #1342) - feat(wordlist): Added risk-classified list of SQLi payloads - feat(wordlist): Added template engine fuzzing wordlist (PR #1340) - Various automatic wordlist updates, documentation improvements, and a few new payloads. ## New Contributors * @dineshg0pal made their first contribution in https://github.com/danielmiessler/SecLists/pull/1302 * @dagecko made their first contribution in https://github.com/danielmiessler/SecLists/pull/1297 ...
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-10-26 19:14 UTC
[ notes ] mise backend plugin from the Caido team that installs small helper binaries; the check-lockfiles-v1.0.1 release ships the .mjs plus SHA256SUMS so installs abort on hash mismatch.
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-10-26 19:13 UTC
[ notes ] New repo push wiring three release-gated tools into mise -- check-exact-versions, check-lockfiles, check-minimum-release-age -- each downloaded from its own release and refused if the SHA-256 doesn't match, a supply-chain hedge against poisoned packages.
[ source excerpt ] README: # mise-toolshed [mise](https://mise.jdx.dev/) backend plugin that installs small utility tools. Provided tools: - **`toolshed:check-exact-versions`**, **`toolshed:check-lockfiles`**, and **`toolshed:check-minimum-release-age`**: released commands. Pushing ` -v ` publishes ` .mjs` and `SHA256SUMS`. The plugin downloads that release and refuses the install when the SHA-256 does not match. Each tool is first released as `1.0.0`. - **`toolshed:get-skills`**: a `get-skills` command which installs the [`skills/`](https://github.com/caido/ai-ops/tree/main/skills) tree from **[ai-ops](https://github.com/caido/ai-ops)** into one personal folder you ch.... Recent commits: Bump check-lockfiles to 1.0.1 (#34) | Require an environment lockfile for each mise environment config (#33) | Bump check-minimum-release-age to 1.0.1 (#32) | Commit only package.json in the Bump version workflow (#31)
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-10-26 14:00 UTC
[ notes ] Release of the minimum-release-age gate, the plugin piece that keeps freshly published package versions off your install for a cooldown window -- cheap defense against fast-moving npm/PyPI takeover pushes; no diff details published.
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-10-26 12:27 UTC
[ notes ] Caido's internal JSON schema repo bumps the proxy schema to v0.59.0, so plugin and tooling authors matching proxy traffic structures need to re-sync against the new field layout.
[ source excerpt ] About caido/schemas: Various schemas we use for Caido. Recent commits: Bump proxy schema to v0.59.0
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-10-26 01:19 UTC
[ notes ] caido/mise-toolshed check-lockfiles-v1.0.0: release of a TypeScript CI/tooling check that validates dependency lockfiles -- supply-chain hygiene guard for the Caido toolchain, not an offensive primitive.
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-10-26 01:02 UTC
[ notes ] caido/mise-toolshed check-minimum-release-age-v1.0.0: TypeScript release gate that refuses packages younger than a set age -- a supply-chain squat/poisoning speed bump for build pipelines.
source: Assetnote Official (@assetnote) | role: Guest Org (Shubs & Sean Yeoh) | published: 2026-10-25 04:24 UTC
[ notes ] Python scanner giving high-fidelity detection of CVE-2026-111497 ("node2shell") in Node.js HTTP apps, probing Brotli/JSON content-type handling then streaming a ~23MB payload to confirm exploitability.
[ source excerpt ] Repo description: High fidelity detection mechanism for node2shell (CVE-2026-111497). README: # node2shell-scanner A command-line tool for detecting CVE-2026-111497 in Node.js HTTP applications. ## How It Works The scanner sends four one-byte controls to learn how the endpoint handles valid Brotli JSON, malformed Brotli, requests without a JSON content type, and unsupported encodings. It then streams a 23,068,764-byte Brotli probe and repeats the valid control. A target is reported vulnerable only when the full probe reaches the valid route-response class, the malformed-response class is distinct, and the final control confirms the endpoint remained stable. This matches Assetnote's internal postmodule detection logic and does not exec...
[ notes ] vitet -- Python watcher for silent security patches: flags fix commits in major OSS repos before a CVE lands and checks exploitability, aimed at the 'negative-day' window. Lets you diff and weaponize a patch ahead of the advisory.
[ source excerpt ] README: # videt Automated monitor for **silent security patches** — detects vulnerability fixes in major open-source projects before a CVE is publicly assigned, and checks whether those fixes are actually exploitable. ## What problem does this solve? There's a dangerous window between when a security patch lands in source code and when it gets a CVE number. During this "negative-day" period, the vulnerability is effectively public (anyone can read the diff) but most defenders haven't acted yet. videt closes that gap by alerting you the moment a suspicious commit is detected — and telling you whether the fix is complete or still bypassable. ## How it .... Recent commits: Update vulnerability monitor state | Update vulnerability monitor state | Update vulnerability monitor state
source: Assetnote Official (@assetnote) | role: Guest Org (Shubs & Sean Yeoh) | published: 2026-10-24 03:40 UTC
[ notes ] Python scanner for high-fidelity detection of php2shell (CVE-2026-109618/109619), sending multipart control requests and probes with 62-level-deep PHP array keys scaling from 1MiB to 20MiB.
[ source excerpt ] Repo description: High fidelity scanner for php2shell (CVE-2026-109618 and CVE-2026-109619). README: # php2shell-scanner A command-line tool for detecting CVE-2026-109618 and CVE-2026-109619 in PHP applications. ## How It Works The scanner sends a minimal multipart control request followed by up to three crafted multipart probes. The probes use PHP array keys nested 62 levels deep and increase from 1 MiB to 20 MiB, matching the detection logic used by Assetnote's internal scanner. A target is reported vulnerable when the probe produces a PHP memory-exhaustion error, a differential empty HTTP 500, a PHP-FPM worker failure, or an advertised PHP version known to be unpatched. Initial 5xx responses, common request-rejection statuses, and nonempt...
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-10-23 18:56 UTC
[ notes ] caido/sdk-js v0.59.0 -- JS monorepo for building Caido proxy plugins and tooling. Stable tag cut right after rc.6; pin it and diff the extension API surface against your existing plugins before upgrading.
[ source excerpt ] About caido/sdk-js: 👋 Monorepo for all the JS SDK and related tooling.
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-10-23 17:42 UTC
[ notes ] caido/sdk-js v0.59.0-rc.6 -- final release candidate ahead of v0.59.0 stable. Diff it against the stable tag to see exactly what shifted in the plugin/hook API before you rebuild extensions.
[ source excerpt ] About caido/sdk-js: 👋 Monorepo for all the JS SDK and related tooling.
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-10-23 08:36 UTC
[ notes ] caido/sqlite-rs, Rust SQLite extension set -- DFA reworked into a shared struct with segments, matcher split into its own crate, regex path folded in; handy for poking request/response corpora straight from SQL.
[ source excerpt ] About caido/sqlite-rs: 🦀 Sqlite extensions written in Rust. Recent commits: ♻️ Turn dfa to a common struct with segment | ♻️ Turn matcher to a crate and apply pr comments | ♻️ Clean the code | ♻️ Use regex approach
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-10-23 05:12 UTC
[ notes ] caido/rswot mirrors JetBrains/swot into Rust so tooling can validate student/university domains from a crowdsourced list; latest pushes are pure domain syncs, no logic change.
[ source excerpt ] About caido/rswot: Student validation based on crowdsourced list. Recent commits: chore: sync domains from JetBrains/swot | chore: sync domains from JetBrains/swot
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-10-22 20:20 UTC
[ notes ] caido/sdk-js v0.59.0-rc.5, the monorepo carrying the JS plugin SDK for Caido; release-candidate tag only, so plugin authors should diff before pinning.
[ source excerpt ] About caido/sdk-js: 👋 Monorepo for all the JS SDK and related tooling.
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-10-21 12:22 UTC
[ notes ] mise backend plugin installing small security-adjacent utilities: check-exact-versions, check-lockfiles, check-minimum-release-age; releases publish .mjs plus SHA256SUMS and the installer refuses mismatched hashes.
[ source excerpt ] README: # mise-toolshed [mise](https://mise.jdx.dev/) backend plugin that installs small utility tools. Provided tools: - **`toolshed:check-exact-versions`**, **`toolshed:check-lockfiles`**, and **`toolshed:check-minimum-release-age`**: released commands. Pushing ` -v ` publishes ` .mjs` and `SHA256SUMS`. The plugin downloads that release and refuses the install when the SHA-256 does not match. Each tool is first released as `1.0.0`. - **`toolshed:get-skills`**: a `get-skills` command which installs the [`skills/`](https://github.com/caido/ai-ops/tree/main/skills) tree from **[ai-ops](https://github.com/caido/ai-ops)** into one personal folder you ch.... Recent commits: feat: bundle each workspace package into one file (#4) | feat: add a root pnpm workspace with a pinned mise toolchain (#2)
[ notes ] Vitor Falcão's collection of reusable standalone agent skills, including a discord-webhooks skill for sending webhooks via curl with embeds, polls, threads and safe mention handling.
[ source excerpt ] README: # Agent skills Reusable, standalone agent skills published by Vitor Falcão. ## Discord Webhooks `discord-webhooks` sends Discord incoming webhooks with `curl` and manages named webhook destinations in `~/.discord-webhooks/config.yaml`. It supports text, embeds, polls, TTS, attachments, forum and thread messages, username and avatar overrides, safe mentions, notification flags, and non-interactive Components V2 layouts. It intentionally excludes interactive components and message editing or deletion. A bundled sender validates payloads and destinations, keeps webhook URLs out of curl process arguments, handles Discord rate limits, and avoids a.... Recent commits: Merge pull request #1 from vitorfhc/add-guided-goal | Ask for a token budget in guided goal on Codex | Add guided goal skill
source: Daniel Miessler (@danielmiessler) | role: Guest | published: 2026-10-20 20:54 UTC
[ notes ] Daniel Miessler's 'Substrate' data framework; recent commits wedge vulnerability/breach stats (Edge CVEs grouped into Patch Tuesday, ITRC and DBIR 2025 comparisons) into its datasets -- OSINT bookkeeping, no exploit content.
[ source excerpt ] About danielmiessler/Substrate: An Open-source Framework for Human Understanding, Meaning, and Progress.. Recent commits: Vulnerability & Breach Data: mark title-counted Patch Tuesday months | Vulnerability & Breach Data: Edge CVEs kept in Patch Tuesday categories; reproducible ITRC 2020 and DBIR 2025 comparisons | Vulnerability & Breach Data: ITRC 2024 note shows the raw victim-notice comparison | Vulnerability & Breach Data: adversarial audit corrections (SEC amendments excluded, like-for-like leak-site windows, re-sourced Patch Tuesday and curated figures, 12-month window check)
source: James Kettle (@albinowax) | role: Guest | published: 2026-10-20 14:06 UTC
[ notes ] Burp Suite extension adding extra active scan checks; recent fixes HTML-encode user-controlled values in issue detail and remove a false positive in the surrogate character replacement check.
[ source excerpt ] About albinowax/ActiveScanPlusPlus: ActiveScan++ Burp Suite Plugin. Recent commits: Merge pull request #61 from PortSwigger/master | HTML-encode user-controlled values in scan issue detail | Fix false positive in surrogate character replacement check
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-10-20 12:51 UTC
[ notes ] Source for the Caido plugin store -- the index/registry of extensions for the Caido web proxy. Latest merge adds a pixel-coordinate plugin, i.e. more request/response mangling toys for proxied traffic.
[ source excerpt ] About caido/store: 🔗 Source for the Caido plugin store. Recent commits: Merge pull request #108 from ruzfi/add-pixel-coordinate
source: Google Project Zero (@googleprojectzero) | role: 0-Day & Exploit Research Team | published: 2026-10-19 02:04 UTC
[ notes ] C# toolkit maps Windows sandbox attack surface; recent commits add token properties, window enumeration, and basic AFD socket support -- handy for poking broker/IPC boundaries.
[ source excerpt ] About googleprojectzero/sandbox-attacksurface-analysis-tools: Set of tools to analyze Windows sandboxes for exposed attack surface.. Recent commits: Added some new token properties. | Added window enumeration. | Added basic support for AFD sockets.
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-10-16 22:35 UTC
[ notes ] Rust crate collection powering Caido's encode/hash/zip/convert helpers, giving extension authors one shared lib for payload transforms instead of hand-rolled codecs.
[ source excerpt ] README: [](https://github.com/caido/convert/actions/workflows/tests.yml?query=branch%3Amain) [](https://codecov.io/gh/caido/convert) # 👋 Welcome Welcome to caido convert packages! This repo contains the code we use to encode, hash, zip and much more. The core logic is written in caido/convert crate. The javascript binding are provided by caido-convert and publish as an npm package. ## What you will need to build it 🛠️ - [wasm-pack](https://rustwasm.github.io/wasm-pack/).... Recent commits: fix: add const fn and copy where possible | Merge pull request #24 from caido/ef-base64-pad | feat: Support padding and formats in base64
source: Caido Official (@caido) | role: Guest Org (Emile Fugulin) | published: 2026-10-16 16:32 UTC
[ notes ] Monorepo for Caido's JS SDK and tooling; the push was a revert of a v0.59.0-rc.4 version bump then re-preparing the coupled SDKs for that same RC.
[ source excerpt ] About caido/sdk-js: 👋 Monorepo for all the JS SDK and related tooling. Recent commits: Prepare coupled SDKs for v0.59.0-rc.4 | Merge pull request #53 from caido/revert-bump/v0.59.0-rc.4 | Revert RC version bump to 0.59.0-rc.4 | Prepare coupled SDKs for v0.59.0-rc.4