Appsec adventures

Corelight's php2shell-detect repository provides Zeek detections and Suricata rules for HTTP indicators associated with "php2shell," tracked as CVE-2026-109618 and CVE-2026-109619, a potential remote code execution issue in PHP longjmp() memory handling. The Zeek package, which requires Zeek 7.0.0 or later and installs via the Zeek Package Manager, inspects POST field-name lengths, selected serialized-data structures, and repeated MIME headers, correlates related suspicious transactions using configured session cookies, and maintains a separate PHP version inventory from response headers; it raises notices such as PHP_Crash_Sequence, Multipart_Header_Flood, Large_Form_Key, the Serialized_* collision and overflow notices, and Potentially_Affected_PHP_Version, writing results to the standard notice.log. Extensive configuration options cover transaction depth, cookie correlation, POST body inspection budgets, notice sample sizes, and version-notice intervals, with provisiona...

OpenAI's php2shell-checker is a PHP version checker that produces a version-based PHP2Shell warning from a website's PHP headers or a local installation. It offers two skills, phpcheck-server for use when you have server access and phpcheck-url for when you only have a URL, and it can also be run directly with Node. It reports one of three results: OK with exit code 0 if the advertised version meets an upstream fixed release, POTENTIALLY VULNERABLE with exit code 1 if the version is in an affected range, and UNKNOWN with exit code 3 for missing, unrecognized, or prerelease versions or a failed check; JSON output is available via a flag. The upstream fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12 from the October 21 PHP advisory, and versions below a listed fix, including PHP 5.4 through 5.6, 7.0 through 7.4, 8.0 and 8.1, return the vulnerable warning even with higher patch numbers. URL mode reads X-Powered-By and Server headers, sends HEAD with a GET fallback on 405 or 50...

VulnHunter is an open-source agentic AI security tool that applies attacker-first analysis to source code: instead of flagging suspicious patterns like passive SAST scanners, it starts at attacker-accessible entry points and reasons forward to determine whether an attacker can truly break through, then runs a falsification engine designed to disprove its own findings. This maintained fork of Capital One's VulnHunter (Apache-2.0) focuses on harness portability, sandboxed containerized exploit validation, and measured-impact PoCs, replacing Claude Code-specific skills with portable prompt files and adding a no-guess installer and an unattended operator skill. It ships three composable skills—vulnhunt (hunt), vulnhunter-fix (test-first remediation that writes an exploit demo, a failing test, the fix, and a PR), and vulnhunt-fix-verify (a read-only verifier). Benchmarking six scans of one production Go commit across five harness/model stacks showed a 14× spread in confirmed findings, 4...

is the official website for REA (Reverse Engineer Anything), an open-source AI-assisted reverse-engineering toolkit that connects coding agents such as Claude Code, Codex, Cursor, and Gemini CLI to analysis tools via the Model Context Protocol. Instead of guessing, the agent uses REA to inspect software directly on the local machine—native binaries, JavaScript/Electron apps, .NET assemblies, Android packages, firmware, and browser or process captures—and returns structured evidence such as decompiled code, call graphs, and traces that the agent can explain or build from. The site provides setup instructions, illustrated guides, and real case studies, including reconstructing Notion's clipboard behavior and recovering DX-Ball's stereo sound algorithm. REA does not claim to recover original source code or automatically clone applications; analysis runs locally, and results separate observations, inferences, and unknowns. Note: a fake repository was reported distributing malware d...

AVE is an open standard for classifying and scoring behavioral vulnerabilities in agentic AI components, including skill files, MCP servers, and agent plugins. It provides stable vulnerability IDs, behavioral fingerprints, AIVSS-based severity scores, detection guidance, and mappings to frameworks such as OWASP MCP Top 10, OWASP Agentic AI Top 10, and MITRE ATLAS. The standard is designed to make findings interoperable and comparable across different security scanners and implementations. https://aveproject.org/

Suzaku is an open-source tool, written in memory-safe Rust, designed for threat hunting and generating forensic timelines from cloud logs, with a primary focus on AWS CloudTrail (with Azure and GCP planned). It uses native Sigma detection rules to identify malicious activity among thousands of cloud API calls, filtering out noise to produce a concise, attack-relevant timeline. The output includes attacker activity summaries with key details like source IPs, geolocation, regions, and user agents to aid investigation and pivoting. Created by Yamato Security, Suzaku is positioned as a cloud-centric counterpart to Hayabusa (a Windows event log analyzer) and is available under the GNU AGPLv3 license, with comprehensive multi-language documentation and binaries available on its releases page.  https://github.com/Yamato-Security/suzaku

nono is a tool that creates instant, zero-latency sandboxes for AI agents like Claude Code, Codex, and Copilot on macOS, Linux, and Windows (WSL2) without requiring daemons, containers, VMs, or disk space. It enforces a least-privilege policy by default, granting agents read/write access only to the current directory and isolating them from SSH keys, cloud credentials, and the rest of the system. Its advanced feature allows granular control over tools called by agents (e.g., `git`, `gh`, `curl`), where each tool can run in its own isolated child sandbox with separate filesystem grants, network rules, and credentials, preventing an agent from widening its own privileges. Profiles for popular agents are available through a registry and can be customized using a composable JSON policy system. The project, built by the team behind Sigstore, provides FFI bindings for Rust, Python, TypeScript, and Go, and is used by large technology companies to operationalize agent security in production wo...

This GitHub project presents a zero-touch automation pipeline that transforms newly added, weaponized CVEs from the CISA Known Exploited Vulnerabilities (KEV) catalog into production-ready Sigma detection rules. The workflow, scheduled to run weekly, pulls the live CISA KEV catalog, filters for new entries, and uses Google Gemini with structured prompts to generate tailored Sigma rules (including specific product targeting, appropriate Sysmon EventIDs, and MITRE ATT&CK mapping). It then logs each processed CVE to a Google Sheet for audit purposes and emails an analyst briefing. The author reports this reduces manual effort from 4-6 hours per CVE to zero minutes. The repository includes the n8n workflow, prompt templates, and sample outputs. Future plans include auto-deploying rules to SIEMs and automated testing.  https://github.com/manishrawat21/Cisa-KEV-Threat-Intel-Orchestrator

This working paper introduces "context bombs"—short strings hidden in decoy resources (canaries) that are designed to trigger safety guardrails in offensive AI agents, thereby stopping autonomous cyberattacks. The research tested five leading AI models in a realistic AWS environment and found that planting a single context bomb reduced agent success rates by approximately 90%, with the most capable models (Opus 4.8 and Gemini 3.1 Pro) dropping from 93% to 0% in achieving full account admin access. The effectiveness depends on tailoring the topic to the model: sensitive biological content works best for Western models, while politically sensitive topics in Chinese are effective against Chinese models. Unlike traditional canaries that only detect intrusions, context bombs actively halt attacks while simultaneously raising alerts. The authors have published their context bomb strings on GitHub for defensive use, and the technique is being integrated into their Tracebit product. ...

AgentDojo is an open-source benchmarking framework developed by ETH Zurich researchers to evaluate the security of LLM-based agents against prompt injection attacks and various defense mechanisms. It provides a dynamic environment where agents perform tasks across different suites while being subjected to attacks (e.g., malicious instructions hidden in tool outputs or web content). The framework supports testing multiple defenses, such as tool filtering or input sanitization, and includes a benchmark script for running evaluations with different LLM models. Results are published in a dedicated registry. The project is designed to be extensible and is accompanied by a research paper presented at NeurIPS 2024. It can be installed via pip and includes documentation for setup and usage.  https://github.com/ethz-spylab/agentdojo

Wanaku is an open-source router that standardizes how AI applications connect to tools and data using the Model Context Protocol (MCP). It provides unified access, acts as a bridge between MCP servers, and leverages 400+ Apache Camel components for extensive integrations. Designed for Kubernetes, it offers built-in security, multi-namespace support, and extensible architecture for enterprise-grade AI agent deployments.  https://github.com/wanaku-ai/wanaku

Destructive Command Guard (dcg) is an open-source security hook that protects AI coding agents from executing harmful shell and Git commands. It intercepts commands before execution and blocks risky actions such as deleting files, resetting repositories, dropping databases, or modifying cloud resources. The tool addresses emerging risks in agentic software development by adding guardrails that help prevent accidental or unauthorized destructive actions by AI assistants operating with elevated privileges.  https://github.com/Dicklesworthstone/destructive_command_guard

maSSO is an open-source security testing tool from Doyensec that acts as a malicious but standards-compliant OIDC and SAML 2.0 Identity Provider. It enables security testers to intercept, modify, and re-sign authentication messages, claims, and tokens, making it easier to assess trust boundaries, validate authentication logic, and identify vulnerabilities in Single Sign-On implementations that are difficult to test with conventional IdPs.  https://github.com/doyensec/maSSO

A GitHub Action that integrates with container security scanners (Trivy/Grype) and uses AI/LLMs to re-score CVEs based on your specific project context (exposure, data sensitivity, controls). It generates a CycloneDX VEX (Vulnerability Exploitability eXchange) file and can enforce security gates based on real risk rather than just CVSS scores. https://github.com/venslabs/vens-action

This repository hosts Mantis, a modular and stack-agnostic toolkit developed by Google, designed for AI coding agents to autonomously find, reproduce, and patch vulnerabilities. It provides a sequential set of skills (e.g., `/mantis-plan`, `/mantis-researcher`, `/mantis-reproduce`, `/mantis-patch`) that can be adapted to various domains like hardware, infrastructure as code, or ML pipelines. The toolkit emphasizes a structured pipeline including repository history analysis, architecture summarization, threat modeling, multi-threaded security scanning, deduplication, review, critic validation, crash reproduction in sandboxes, exploit chaining, patching, risk calibration, reflection, and report generation. It comes with strong safety warnings, recommending use only in isolated environments and requiring manual verification of all findings. The project is not an official Google product and is intended for demonstration and adaptation, with future plans for skill self-improvement and integ...

This repository hosts datadog-saist, an AI-native Static Application Security Testing tool developed by Datadog. Unlike traditional SAST tools that rely on parsing and rule-based analysis, it uses large language models from Anthropic, OpenAI, or Google to detect security vulnerabilities in source code. Currently in preview, it supports Go, Java, Python, C#, JavaScript, TypeScript, and Kotlin. The tool can be used standalone on a laptop and requires an API key for one of the supported LLM providers, but does not require a Datadog account. It generates industry-standard SARIF reports, builds project context for accurate analysis, and offers features like cross-file indexing and configurable concurrency. The project is written in Go, uses Tree-sitter for parsing, and is available under an open-source license.  https://github.com/DataDog/datadog-saist

This repository hosts the darknet-mcp-server, a Model Context Protocol server that unifies dark web and threat intelligence into a single platform for AI agents. It provides 66 tools across 16 data sources for breach data lookup, ransomware tracking, Tor .onion access, malware analysis, blockchain intelligence, exploit searching, and stealer log analysis. The server allows AI agents to query all sources in parallel and correlate data, replacing manual workflows across multiple platforms. It can be run with no install using npx, requires optional API keys for premium sources, and includes per-provider rate limiting and TTL caching. The project is part of a broader MCP security suite and is available under an MIT License.  https://github.com/badchars/darknet-mcp-server

Cloudflare's security-audit-skill is an open-source skill for AI coding agents that performs structured, multi-phase security assessments of software repositories. Rather than relying on ad hoc vulnerability searches, it guides the agent through a six-phase workflow consisting of reconnaissance, parallel vulnerability hunting across multiple attack classes, adversarial validation by independent agents, deduplication, machine-readable report generation, and schema validation. The methodology emphasizes reporting only demonstrably exploitable vulnerabilities with concrete attack scenarios, while reducing false positives through independent verification. Designed as the foundation of Cloudflare's Vulnerability Discovery Harness (VDH), the skill supports coding agents capable of tool use and parallel sub-agents, producing actionable security findings instead of generic best-practice recommendations. https://github.com/cloudflare/security-audit-skill

SkillTracer is a free security scanner from Metano Labs that analyzes AI agent skills before they are installed or executed. It combines static analysis (SAST) with dynamic sandbox execution (DAST) to detect malicious behaviors such as credential theft, prompt injection, remote code execution, data exfiltration, MCP/tool poisoning, and obfuscated code. The scanner produces transparent risk and threat scores aligned with the OWASP Agentic Top 10, OWASP AIVSS, and MITRE ATLAS, along with evidence-backed reports to help developers evaluate the safety of third-party AI skills.  https://labs.metano.ai/scanner

SecureAI-Scan is an open-source, local-first static analysis tool designed to identify security issues unique to AI-powered applications that traditional SAST tools often miss. It analyzes JavaScript, TypeScript, and Python codebases for vulnerabilities such as prompt injection, insecure prompt construction, excessive data exposure, unsafe MCP configurations, and other risks mapped to the OWASP LLM Top 10. The tool performs dataflow analysis, generates AI Bills of Materials (AI-BOMs), supports SARIF output and GitHub Code Scanning integration, and is designed to run entirely offline for privacy-sensitive environments.  https://github.com/akanthed/SecureAI-Scan