Security: what’s taking off on GitHub

The fastest-growing repositories in “Security”: plain-language summaries, use cases and a check on star quality. Updated every 30 minutes.

7.7
qybaihe/bla
BLA (Blind LLM Agents) is a defensive tool that poisons release artifacts (binaries, Electron/ASAR, JS bundles, Python, WASM, models, SQLite) so AI reverse-engineering agents hit resource budgets, follow decoys, and…

Early signalSecurityTypeScript+378 stars measured 2026-10-30, 00:15–10:05 UTC, ≈ 860 by evening
6.5
interplains/Zero-Breach-Toolkit
Free offline scanner for traces of known mercenary spyware (Pegasus, Predator, Graphite, Candiru) on Windows computers, Android phones and iPhone backups. Read-only, makes no network requests, and states the limits of…

PeakingSecurityPython+119 stars measured 2026-10-30, 00:15–10:05 UTC, ≈ 420 by evening
6.2
MarkBlah/smsofdeath
Proof-of-concept Android app that sends a crafted 8-byte WAP Push PDU via SMS to crash com.android.phone on the target handset, dropping active calls without user interaction.

Early signalSecurityJava+68 stars measured 2026-10-30, 00:16–10:05 UTC, ≈ 183 by evening
5.9
KeygraphHQ/shannon
Autonomous AI pentester for web applications and APIs: analyzes source code, finds attack vectors, and runs real exploits, reporting only vulnerabilities with a working proof-of-concept.

BreakoutSecurityTypeScript+90 stars measured 2026-10-30, 00:16–10:05 UTC, ≈ 220 by evening
5.8
soimy/c3rb3r-rescue
Evidence-based recovery toolkit for C3RB3R/.L0CK3D ransomware on Synology DSM NAS: preserve the scene, capture RAM to extract session keys, decrypt file copies, and validate results. Aimed at admins and AI assistants…

Early signalSecurityPython+41 stars measured 2026-10-30, 05:51–10:05 UTC, ≈ 114 by evening
5.6
johncassil/dontallow
A macOS utility that automatically presses "Don't Allow" on the system prompt asking whether an app may find devices on local networks. Runs as a launchd agent via Accessibility, uses zero CPU while idle, and survives…

Early signalSecuritySwift+34 stars measured 2026-10-30, 00:16–10:06 UTC, ≈ 73 by evening
5.3
jmanico/grim-prompter
A prompt library and runbook that turns Claude Code, Codex or any coding agent into a threat-modeling assistant for your repository, with 36 architecture workflows and 29 analysis methods. Findings are traced to…

Early signalSecurity+38 stars measured 2026-10-30, 00:16–10:06 UTC, ≈ 90 by evening
5.1
YuJunZhiXue/dsh-purge
A local DeepSeek Harness plugin that reversibly patches installed @deepseek-ai packages to strip built-in refusals and swap prompts per model. Intended for red-team research and robustness evaluation in an authorized…

PeakingSecurityJavaScript+451 stars measured 2026-10-30, 00:16–10:06 UTC, ≈ 994 by evening
5.1
crystalmasta/unbihex
VPN client with its own Rust networking core, compatible with Xray servers (VLESS, REALITY, XTLS Vision, XHTTP, Shadowsocks, SOCKS5) and available for Windows, Linux, macOS, Android and iOS.

Early signalSecurityRust+22 stars measured 2026-10-30, 00:16–10:06 UTC, ≈ 70 by evening
4.6
cloudflare/security-audit-skill
A coding-agent skill that turns the agent into a security auditor, running a multi-phase code audit with independently verified, machine-readable findings.

SteadySecurityJavaScript+459 stars measured 2026-10-30, 00:16–10:06 UTC, ≈ 1,102 by evening
4.4
MatrixNewtPresent/Wise-Registrity
Repository offers a Wise Registrity installer for Windows x64, run via a PowerShell script from a remote server. The README describes bypassing execution policy and disabling antivirus, which is typical of unwanted…

Early signalSecurity+3 stars measured 2026-10-30, 09:22–10:06 UTC, ≈ 45 by evening
4.3
hevnsnt/CVEngine
Self-hosted external attack surface assessment platform: discovers internet-facing assets, fingerprints services and versions, matches live CVEs, and validates findings with safe read-only checks.

Early signalSecurityPython+33 stars measured 2026-10-30, 00:17–10:06 UTC, ≈ 71 by evening
4.1
NVIDIA/SkillSpector
Security scanner for AI agent skills: detects vulnerabilities, malicious patterns, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before installation.

PeakingSecurityPython+85 stars measured 2026-10-30, 00:16–10:06 UTC, ≈ 213 by evening
4.1
lalalune/pumpfun-source
Research project reconstructing the source of Pump.fun Solana programs: collects byte-exact deployment evidence and tooling to compare rebuilt artifacts against the original. Reconstruction is incomplete.

Early signalSecurityPython+13 stars measured 2026-10-30, 00:17–10:06 UTC, ≈ 32 by evening
3.9
DrWhax/unfairplay
A Go utility that recovers a FairPlay model from an enrolled Mac and uses it to decrypt personalized iOS IPAs. It does not sign in to Apple or download apps — it only decrypts IPAs you already have.

CoolingSecurityGo+22 stars measured 2026-10-30, 00:16–10:06 UTC, ≈ 51 by evening
3.8
NationalSecurityAgency/ghidra
A software reverse engineering framework from the NSA: disassembly, decompilation, graphing and scripting for analyzing compiled code on Windows, macOS and Linux.

SteadySecurityJava+141 stars measured 2026-10-30, 00:17–10:07 UTC, ≈ 337 by evening
3.7
AhmadHassan-BTed/Turnitout-Humanizer
A tool for removing AI and plagiarism traces from text, LaTeX, DOCX and source code: it strips invisible Unicode characters, C2PA metadata and watermarks to evade detectors like Turnitin and GPTZero without using LLMs.

SteadySecurityHTML+258 stars measured 2026-10-30, 00:17–10:07 UTC, ≈ 620 by evening
3.7
guillaumemeyer/watermarks-remover
A Python service and agent skill that strips AI provenance marks (invisible Unicode, statistical watermarks, C2PA/EXIF/XMP metadata) from text and files you own.

SteadySecurityPython+59 stars measured 2026-10-30, 00:16–10:07 UTC, ≈ 143 by evening
3.7
beenuar/AiSOC
A self-hostable AI Security Operations Center: ingests telemetry, correlates alerts, investigates incidents with an LLM agent whose every step is auditable, and proposes human-approved actions.

PeakingSecurityPython+72 stars measured 2026-10-30, 00:16–10:07 UTC, ≈ 200 by evening
3.4
janderson1017/Hiddify-Manager
Multi-user anti-censorship panel with effortless installation, supporting over 20 protocols (Reality, Telegram proxy, etc.) and user management.

BreakoutSecurityPython+0 stars measured 2026-10-30, 00:17–10:07 UTC, ≈ 36 by evening
3.4
usestrix/strix
Open-source AI pentesting tool: autonomous agents run your code, find vulnerabilities, and validate them with working PoCs. For developers and security teams needing fast testing without manual pentests or…

SteadySecurityPython+73 stars measured 2026-10-30, 00:17–10:07 UTC, ≈ 177 by evening
3.2
trhhubsd/ARTEX
AI autonomous penetration testing system with a Go backend and Next.js frontend: agents explore assets, find vulnerabilities and re-test them. Supports asset sync from ScopeSentry, traffic recording, MCP and…

SteadySecurityGo+49 stars measured 2026-10-30, 00:18–10:07 UTC, ≈ 109 by evening
3.2
sanjayadanushka712/Ghost-Night
Local-only CLI toolkit for authorized pentesting: rotates IPs via Tor/obfs4/proxies and coherent browser fingerprints to test tracking, rate-limiting, and bans on web apps.

Early signalSecurityPython+2 stars measured 2026-10-30, 00:17–10:08 UTC, ≈ 16 by evening
3.1
SnailSploit/Claude-Red
A curated library of drop-in SKILL.md files for the Claude Skills system that primes Claude with offensive security methodology, from SQL injection to EDR evasion and exploit development.

SteadySecurityPython+46 stars measured 2026-10-30, 00:18–10:08 UTC, ≈ 110 by evening
3.1
YOURSJEYO/claude-switcher
Fail-closed account environment manager for Claude that runs 11 fingerprint checks before launch, performs STUN-based WebRTC leak detection, kill-switch on tunnel loss, and multi-account snapshot isolation to prevent…

SteadySecurityPowerShell+63 stars measured 2026-10-30, 00:18–10:08 UTC, ≈ 130 by evening
3.0
Cd1s/safarier
Native macOS browser built on WebKit with isolated profiles, built-in sing-box proxy routing, and engine-level privacy protection. Lets you run dozens of independent accounts side by side while appearing as genuine…

Early signalSecuritySwift+3 stars measured 2026-10-30, 00:16–10:08 UTC, ≈ 14 by evening
2.9
interplains/zero-breach
A local, read-only Python scanner that looks for traces of the AdFection / Candiru spyware campaign on a machine: browser history and cookies, caches, autostart entries, file hashes and the DNS resolver cache. No admin…

SteadySecurityPython+17 stars measured 2026-10-30, 00:17–10:08 UTC, ≈ 57 by evening
2.9
vaishantsah/watson-AI-osint-all-in-one
Free OSINT tool for Windows that searches profiles and mentions of a person by nickname, email, phone or website across 3,100+ public sources. No account or API keys required, results can be saved as PDF.

Early signalSecurityTypeScript+6 stars measured 2026-10-30, 00:16–10:08 UTC, ≈ 13 by evening
2.9
reacher-z/Awesome-REA
An independent curated collection of reverse-engineering tools, case studies and research papers covering websites, games, apps, native binaries, firmware and protocols. It indexes 3,300+ resources and organizes them…

PeakingSecurityPython+28 stars measured 2026-10-30, 00:18–10:08 UTC, ≈ 63 by evening
2.9
mmparko/dsh-purge
A red-team plugin for the official DeepSeek Harness: patches host policies and prompts on a local install to separate host-layer blocks from model refusals.

CoolingSecurityJavaScript+40 stars measured 2026-10-30, 00:18–10:08 UTC, ≈ 87 by evening
2.9
KillaBoi/StealMyBitcoin-PoC
A single-file Python proof of concept reproducing a PHP 8.4.26 memory-exhaustion exploit chain: leaks heap and code addresses via session cookies, then forges a HashTable to reach zif_system and run a command.

CoolingSecurityPython+5 stars measured 2026-10-30, 00:17–10:09 UTC, ≈ 14 by evening
2.8
smicallef/spiderfoot
Python OSINT automation tool that gathers data about a target from 200+ modules (DNS, breaches, social media, threat intel) via web UI or CLI. Used for reconnaissance in pentests and for assessing your own attack…

SteadySecurityPython+17 stars measured 2026-10-30, 00:17–10:09 UTC, ≈ 44 by evening
2.7
openssl/openssl
OpenSSL is a general-purpose cryptography library and implementation of TLS, DTLS and QUIC protocols, including libssl, libcrypto and a command-line tool. It is used for encryption, certificate handling and secure…

SteadySecurityC+11 stars measured 2026-10-30, 00:20–10:09 UTC, ≈ 24 by evening
2.6
anthropics/sandbox-runtime
A lightweight sandboxing tool that enforces filesystem, network and Unix socket restrictions on arbitrary processes at the OS level without containers, using sandbox-exec, bubblewrap and proxies.

CoolingSecurityTypeScript+14 stars measured 2026-10-30, 00:18–10:09 UTC, ≈ 33 by evening
2.5
jiwoochris/artex-global
Korean-localized edition of ARTEX, an autonomous penetration-testing framework driven by multi-agent LLMs (Go backend + Next.js) that plans and executes attack steps on its own. Aimed at security practitioners studying…

SteadySecurityGo+23 stars measured 2026-10-30, 00:19–10:10 UTC, ≈ 45 by evening
2.5
projectdiscovery/nuclei
A vulnerability scanner driven by YAML templates that checks applications, APIs, networks, DNS and cloud configurations for known vulnerabilities. Community-contributed templates mimic real-world exploitation steps to…

SteadySecurityGo+12 stars measured 2026-10-30, 00:19–10:09 UTC, ≈ 30 by evening
2.5
EthanArbuckle/fairplay-decrypt
Tool for offline decryption of FairPlay-protected App Store IPAs: retrieves a 16-byte credential from a jailbroken device and decrypts arm64 Mach-O pages. Runs on macOS and Linux.

CoolingSecurityC+13 stars measured 2026-10-30, 00:19–10:10 UTC, ≈ 30 by evening
2.4
mitmproxy/mitmproxy
An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers. It lets you inspect, modify, and debug HTTP/1, HTTP/2, and WebSocket traffic via console, CLI, or web interface.

CoolingSecurityPython+10 stars measured 2026-10-30, 00:19–10:09 UTC, ≈ 26 by evening
2.4
keepassxreboot/keepassxc
Cross-platform offline password manager with KDBX-encrypted databases, password generator, TOTP, YubiKey support, and browser integration.

SteadySecurityC+++9 stars measured 2026-10-30, 00:19–10:09 UTC, ≈ 24 by evening
2.4
chaitin/SafeLine
SafeLine is a self-hosted Web Application Firewall (WAF) and reverse proxy written in Go. It filters and monitors HTTP/HTTPS traffic to protect web apps from SQL injection, XSS, RCE, SSRF, bot abuse, and other attacks.

PeakingSecurityGo+23 stars measured 2026-10-30, 00:20–10:10 UTC, ≈ 45 by evening
2.4
gitleaks/gitleaks
Gitleaks is a Go tool that detects hardcoded secrets like passwords, API keys, and tokens in git repos, files, directories, and stdin. It is aimed at developers and DevSecOps engineers to prevent credential leaks via…

SteadySecurityGo+11 stars measured 2026-10-30, 00:19–10:10 UTC, ≈ 34 by evening
2.3
liseami/CCBaga
A native macOS toolkit that cleans up local Claude data, rotates a companion browser's fingerprint, applies region-based system settings, and verifies browser readings against the real network exit.

SteadySecurityRust+19 stars measured 2026-10-30, 00:19–10:10 UTC, ≈ 44 by evening
2.3
aixisstudio/Snitch
A local real-time network traffic visualizer that shows who your computer connects to, where they are, and which app is responsible. Runs offline; data never leaves the machine.

SteadySecurityPython+7 stars measured 2026-10-30, 00:19–10:10 UTC, ≈ 17 by evening
2.3
angusdevgo/Seep-Reverse-Lab
Agent-native reverse engineering workbench for binaries and CWE-602 client-side authorization auditing: unifies Radare2, JADX, Apktool, Frida and IDA via 23 MCP tools with automatic task routing.

SteadySecurityLua+11 stars measured 2026-10-30, 00:20–10:10 UTC, ≈ 24 by evening
2.3
zgsfsec/Full-Chain-Sentinel-System
An authorized penetration-testing agent (built on the pi agent harness) with a Chinese web console and per-project containerized Kali work environments. It guides recon, enumeration, exploitation and reporting while…

SteadySecurityTypeScript+19 stars measured 2026-10-30, 00:22–10:10 UTC, ≈ 39 by evening
2.2
aquasecurity/trivy
Security scanner that finds vulnerabilities, misconfigurations, secrets and SBOM in containers, Kubernetes, code repositories, clouds and filesystems. Aimed at developers and DevOps for checking artifact security.

SteadySecurityGo+12 stars measured 2026-10-30, 00:20–10:11 UTC, ≈ 29 by evening
2.1
wazuh/wazuh
Open source security platform with endpoint agents and a management server: intrusion detection, log analysis, file integrity monitoring, vulnerability detection and incident response.

SteadySecurityC+++10 stars measured 2026-10-30, 00:21–10:11 UTC, ≈ 24 by evening
1.9
armanlife/firefox-vpn-client
Free VPN client for Android, Windows, macOS, and Linux that routes traffic through Mozilla's servers over HTTP/2 and HTTP/3 using Firefox Accounts with multi-account rotation.

SteadySecurityGo+7 stars measured 2026-10-30, 00:17–10:12 UTC, ≈ 18 by evening
1.9
google/gvisor
gVisor is an application kernel implementing a Linux-like interface in userspace in Go. It isolates containers from the host kernel, reducing container escape risk when running untrusted code.

SteadySecurityGo+7 stars measured 2026-10-30, 00:21–10:11 UTC, ≈ 16 by evening
1.9
Z4nzu/hackingtool
A console toolkit bundling 215 pentesting tools across 21 categories (recon, OSINT, web, wireless, forensics, etc.) with an AI layer that maps a plain-English goal to the right tool and command. Aimed at pentesters,…

SteadySecurityPython+7 stars measured 2026-10-30, 00:20–10:12 UTC, ≈ 18 by evening
1.9
songjianyang/xss-audit
A static XSS audit skill for React, TypeScript and JavaScript codebases with 14 layers of checks, from DOM injection to Trusted Types, writing findings to xss-audit-report.md.

CoolingSecurity+7 stars measured 2026-10-30, 00:20–10:12 UTC, ≈ 15 by evening
1.9
Maldev-Academy/WhisperHijack
A process injection PoC that delivers x64 shellcode via Thread Name-Calling and executes it through Waiting Thread Hijacking, without cross-process writes.

SteadySecurityC+0 stars measured 2026-10-30, 09:23–10:12 UTC, ≈ 5 by evening
1.7
zacharybenson/arken-protocol
Passwordless authentication middleware for Express and FastAPI based on DID signatures: the client signs a one-time nonce with a secp256k1 key, and the server verifies it without passwords, sessions, or a user database.

SteadySecurityRust+1 star measured 2026-10-30, 07:15–10:13 UTC, ≈ 4 by evening
1.7
openai/codex-security
OpenAI's CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in code, and for drafting SECURITY.md security policy.

SteadySecurityTypeScript+5 stars measured 2026-10-30, 00:21–10:13 UTC, ≈ 12 by evening
1.6
ikow/php2shell-poc
A proof-of-concept toolkit for two PHP pre-auth RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting PHP 5.4.0 through 8.5.11, with exploits, detection rules, and a lab environment.

CoolingSecurityPython+12 stars measured 2026-10-30, 00:22–10:13 UTC, ≈ 23 by evening
1.6
anchore/syft
A CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images, filesystems, and archives. Supports many packaging ecosystems and output formats (CycloneDX, SPDX).

SteadySecurityGo+3 stars measured 2026-10-30, 00:21–10:13 UTC, ≈ 8 by evening
1.6
openbao/openbao
OpenBao is an open-source secrets management system for storing, encrypting, and distributing credentials, keys, and certificates, with dynamic secrets and auditing. A community-governed fork of Vault.

SteadySecurityGo+8 stars measured 2026-10-30, 00:21–10:13 UTC, ≈ 16 by evening
1.6
haiou-666/Haiou-workshop
An AI workbench for reverse engineering, authorized penetration testing and security development, combining Codex, Claude Code and DeepSeek Harness with a built-in skill library, REA analysis and toolchains (Ghidra,…

SteadySecurity+8 stars measured 2026-10-30, 00:24–10:13 UTC, ≈ 16 by evening
1.6
theorem-labs/oss-verify-proofs
Rocq proofs that OSS-Fuzz fuzz targets for 25 libraries (OpenSSL, zstd, simdjson, etc.) never trigger sanitizer errors on any input within stated limits, checked against compiled RISC-V binaries via the LPS Linux…

CoolingSecurityRocq Prover+3 stars measured 2026-10-30, 00:22–10:13 UTC, ≈ 6 by evening
1.5
x86rc/unthemidator
A universal unpacker for binaries protected with Themida, Code Virtualizer and WinLicense (v3.0–v4), with PE rebuild, import restoration and VM version identification.

CoolingSecurityC+++2 stars measured 2026-10-30, 00:19–10:13 UTC, ≈ 5 by evening
1.5
rfjakob/gocryptfs
Encrypted overlay filesystem written in Go on top of FUSE, inspired by EncFS and fixing its security issues. It transparently encrypts directories on disk.

SteadySecurityGo+3 stars measured 2026-10-30, 00:21–10:13 UTC, ≈ 7 by evening
1.5
WoYun520/dsh-purge
A red-team plugin for the official DeepSeek Harness that patches host-layer prompt rewriting, approval gates and sandbox policy on your own install, letting you separate host blocks from model refusals for controlled…

CoolingSecurityJavaScript+2 stars measured 2026-10-30, 00:22–10:13 UTC, ≈ 6 by evening
1.5
V4bel/InfinityCore
A document with technical analysis of six Linux kernel vulnerabilities (Timer, Signal, MM, Futex, Scheduler, SLAB) enabling LPE and container escape, with CVEs and PoCs.

SteadySecurityC+3 stars measured 2026-10-30, 00:22–10:14 UTC, ≈ 6 by evening
1.4
elder-plinius/T3MP3ST
Multi-agent red-teaming platform that turns an existing AI coding agent into a vulnerability-hunting harness, automating the recon → exploit → report kill chain for web apps, CTFs, smart contracts, and source code.

SteadySecurityTypeScript+4 stars measured 2026-10-30, 00:22–10:14 UTC, ≈ 9 by evening
1.4
Ernket/CodeScan-Artex
A static code audit platform (Go backend, Next.js frontend) where multiple LLM agents read source code in parallel and build asset and exploration graphs. Read-only: no network, commands, or code execution.

SteadySecurityGo+2 stars measured 2026-10-30, 00:22–10:14 UTC, ≈ 5 by evening
1.4
logto-io/logto
Open-source authentication and authorization infrastructure built on OIDC and OAuth 2.1 for SaaS and AI apps, with multi-tenancy, SSO, and RBAC. It ships pre-built sign-in flows, customizable UIs, and SDKs for 30+…

SteadySecurityTypeScript+4 stars measured 2026-10-30, 00:23–10:14 UTC, ≈ 9 by evening
1.4
9bie/php2shell-bypass-aslr-exp
A proof-of-concept exploit that achieves RCE against PHP 8.4.26 on Apache prefork/mod_php using only HTTP multipart requests, bypassing ASLR via heap and libphp leak, without session_start() or target-side files.

CoolingSecurityPython+5 stars measured 2026-10-30, 00:23–10:14 UTC, ≈ 11 by evening
1.4
projectdiscovery/nuclei-templates
A community-curated collection of templates for the nuclei vulnerability scanner, covering CVEs, exposures, panels and known exploited vulnerabilities. It helps pentesters and bug bounty hunters quickly find issues in…

SteadySecurityJavaScript+5 stars measured 2026-10-30, 00:22–10:14 UTC, ≈ 10 by evening
1.3
aarsaputra/php2shell
Research toolkit reproducing an unauthenticated RCE chain in PHP 5.4–8.4.26 (CVE-2026-109619/109618) over pure HTTP with JA3 impersonation and capped proof-of-access commands.

CoolingSecurityPython+3 stars measured 2026-10-30, 00:23–10:14 UTC, ≈ 7 by evening
1.3
ZigZagBoi1/PS5-14.10-Research
Open research into the PS5 firmware 14.10 kernel attack surface: 62 Lua probes via a userland loader on TCP 9026 map syscalls, memory, networking, and exploit paths.

CoolingSecurityAssembly+4 stars measured 2026-10-30, 00:22–10:14 UTC, ≈ 9 by evening
1.2
KatrielMoses/voidaccess
Self-hosted OSINT platform that turns dark-web research queries into structured threat intelligence through a 13-step pipeline with collection, enrichment, relationship graphs, and exports.

SteadySecurityPython+0 stars measured 2026-10-30, 00:23–10:14 UTC, ≈ 3 by evening
1.2
zitadel/zitadel
Open-source identity and access management platform with SSO, MFA, Passkeys, OIDC, SAML, SCIM and multi-tenancy. Suits teams needing a self-hosted or cloud identity provider without vendor lock-in.

SteadySecurityGo+1 star measured 2026-10-30, 00:22–10:15 UTC, ≈ 4 by evening
1.2
Fluepke/emudrahahahahaha
A Go project for working with private keys, published under the name Private Keys. Details are unclear because the repository has no README.

CoolingSecurityGo+0 stars measured 2026-10-30, 00:24–10:14 UTC, ≈ 1 by evening
1.1
PandaSI-Labs/pandasi-agent
Deterministic offline evidence-policy checker for PandaSI: reads a JSON packet about a BNB Smart Chain token and returns RESEARCH or ABSTAIN, never authorizing execution.

CoolingSecurityPython+3 stars measured 2026-10-30, 00:23–10:15 UTC, ≈ 7 by evening
1.1
eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC
Repository with a PoC exploit for two critical RCE flaws in the PHP core (php2shell), plus detection and patching guidance. Intended for security researchers and administrators.

CoolingSecurityShell+4 stars measured 2026-10-30, 00:24–10:15 UTC, ≈ 8 by evening
1.1
openai/php2shell-checker
A Node.js CLI that checks a website's PHP version via HTTP headers or a local php -v binary for vulnerability to php2shell. Returns OK, VULNERABLE, or UNKNOWN with matching exit codes.

CoolingSecurityJavaScript+3 stars measured 2026-10-30, 00:24–10:17 UTC, ≈ 7 by evening
1.1
NCSC-NL/php2shell
Operational information on the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 allowing unauthenticated RCE: patching guidance, detection material and affected software inventories.

CoolingSecurityPython+2 stars measured 2026-10-30, 00:23–10:15 UTC, ≈ 5 by evening
1.1
assetnote/php2shell-scanner
Python CLI scanner for detecting php2shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP applications. It sends multipart probes and flags targets based on memory-exhaustion errors, PHP-FPM worker…

CoolingSecurityPython+1 star measured 2026-10-30, 00:22–10:15 UTC, ≈ 4 by evening
1.1
dimasma0305/CVE-2026-111497-POC
PoC for CVE-2026-111497: a malformed Brotli stream triggers an out-of-bounds write in Node.js decoders, reaching RCE in three lab profiles. Ships with local Docker labs, a scanner, and defender detection rules.

SteadySecurityPython+0 stars measured 2026-10-30, 00:23–10:15 UTC, ≈ 2 by evening
1.1
Alejandros17487/ai-jailbreaks
A collection of 35 paste-ready jailbreak prompts for 25+ models: system prompts, AGENTS.md files, Modelfiles and configs for AI red-teaming and security research.

CoolingSecurity+2 stars measured 2026-10-30, 00:24–10:15 UTC, ≈ 5 by evening
1.0
Bodila51/reverse-engineer-Wi-Fi-router
A Claude Code skill that reverse-engineers your Wi-Fi router's admin API from a photo to audit privacy and fix slow Wi-Fi, without manuals or exploits.

CoolingSecurityPython+1 star measured 2026-10-30, 00:24–10:15 UTC, ≈ 3 by evening
1.0
LSPosed/dexsql-release
A tool for querying classes, methods, strings and call references in Android APK and DEX files using SQL, usable from the CLI or by connecting it to an AI agent via MCP.

SteadySecurityPython+2 stars measured 2026-10-30, 00:24–10:15 UTC, ≈ 5 by evening
1.0
thomasunise/argus
Self-hosted multi-tenant security operations platform where AI agents only analyze evidence from an evidence graph, while a separate approval-gated action broker is the only component allowed to change infrastructure.

CoolingSecurityPython+0 stars measured 2026-10-30, 00:23–10:15 UTC, ≈ 1 by evening
0.9
murrez/php2shell
A PHP security research framework that probes PHP core vulnerabilities (CVE-2026-109618, 109619, 115560) and discovers application upload handlers, including automatic LFI parameter discovery.

SteadySecurityPython+2 stars measured 2026-10-30, 00:24–10:15 UTC, ≈ 4 by evening
0.9
whokilleddb/TTs
Payload builder that packages XOR-encrypted shellcode into a C# assembly and .tt file for execution via TextTransform.exe without VirtualAlloc appearing in the stack trace.

SteadySecurityPython+1 star measured 2026-10-30, 00:24–10:15 UTC, ≈ 2 by evening
0.8
usestrix/firewall
A Rust tool that blocks installation of malicious packages from npm, PyPI, crates.io, Go and RubyGems by checking Strix's blocklist and holding back new versions. Runs locally: either machine-wide on macOS/Windows or…

SteadySecurityRust+0 stars measured 2026-10-30, 00:24–10:16 UTC, ≈ 0 by evening
0.8
pastawithpesto/PS5-14.10-Jailbreak-Research
WebKit exploit research for PlayStation 5 firmware 14.10: a browser-to-kernel chain map, 90+ probes validated on the console, and analysis of known CVEs.

CoolingSecurityJavaScript+0 stars measured 2026-10-30, 00:23–10:16 UTC, ≈ 1 by evening
0.8
hashicorp/vault
Vault is a tool for securely storing secrets, managing keys, dynamic credentials, and auditing access.

SteadySecurityGo+1 star measured 2026-10-30, 00:25–10:16 UTC, ≈ 2 by evening
0.7
qkaiser/broadcom-wps
Toolkit for detecting routers running Broadcom's vulnerable 802.11/WPS implementation: YARA rules for firmware and a live access point fingerprinting script.

CoolingSecurityPython+1 star measured 2026-10-30, 00:24–10:16 UTC, ≈ 2 by evening
0.7
assetnote/node2shell-scanner
CLI scanner for detecting CVE-2026-111497 in Node.js HTTP applications: sends control requests and a Brotli probe without executing commands.

CoolingSecurityPython+0 stars measured 2026-10-30, 00:22–10:16 UTC, ≈ 0 by evening
0.7
devploit/php2shell
Research toolkit for exploiting pre-auth RCE in PHP's Apache module (session.upload_progress) via CVE-2026-109618 and CVE-2026-109619, with build profiles, labs and calibration.

CoolingSecurityPython+1 star measured 2026-10-30, 00:25–10:16 UTC, ≈ 2 by evening
0.7
JoasASantos/php2shell-exploit
A Python exploit framework for CVE-2026-109618/619, achieving pre-auth remote code execution in PHP via a session.upload_progress use-after-free, with ASLR bypass and webshell planting. Intended for authorized security…

CoolingSecurityPython+0 stars measured 2026-10-30, 00:24–10:16 UTC, ≈ 1 by evening
0.7
IvanIVGrozny/iOS27.0.1-SPTM-Research
An analysis of a TLB-invalidation race fix in the Secure Page Table Monitor (SPTM) between iOS 27.2 beta 1 and beta 3 on iPhone18,4 (T8150), with tooling to unpack and analyze the firmware.

SteadySecurityPython+0 stars measured 2026-10-30, 00:24–10:16 UTC, ≈ 0 by evening
0.5
valimised/ivxv
Source code of the Estonian IVXV online voting system, published for public review. It is used in elections and development is supervised by the State Electoral Office of Estonia.

SteadySecurityGo+1 star measured 2026-10-30, 00:25–10:16 UTC, ≈ 2 by evening
0.5
JoasASantos/php2shell-scanner
Non-destructive scanner for CVE-2026-109618 and CVE-2026-109619, RCE bugs in the PHP core. Discovers subdomains via crt.sh and subfinder, detects PHP versions from banners and error pages, and scans origin IPs behind…

SteadySecurityPython+0 stars measured 2026-10-30, 00:25–10:16 UTC, ≈ 0 by evening
0.5
dinosn/php-cve-2026-10961x-lab-poc
Lab PoC for the PHP 8.5.11 RCE chains CVE-2026-109618/109619: unauthenticated code execution via four HTTP requests, address disclosure through PS(id)→cookie and a UAF, plus a check of the 8.5.12 patch.

SteadySecurityPython+0 stars measured 2026-10-30, 00:25–10:16 UTC, ≈ 0 by evening
0.4
Barbpouncouple/Robux-Generator
The repository offers a "Robux Generator" Windows installer that downloads and runs a third-party file via a PowerShell script. It claims to be a standalone build for generating Robux, which is unverified and resembles…

QuietSecurity+0 stars measured 2026-10-30, 00:26–10:16 UTC, ≈ 1 by evening
0.4
Wtrwx/vesper
iOS reverse engineering platform: MCP tools and agent skills for runtime inspection, automation, decryption, debugging and tweak development via SSH, Frida and IDA.

SteadySecurityJavaScript+0 stars measured 2026-10-30, 00:25–10:16 UTC, ≈ 0 by evening
0.4
SRN0129/Agenttrust
AgentTrust is a security gateway between autonomous LLM agents and external tool execution: it intercepts actions, screens for prompt injections and secret leaks, enforces spend limits, and gates dangerous operations…

SteadySecurityTypeScript+0 stars measured 2026-10-30, 00:25–10:16 UTC, ≈ 0 by evening
0.3
HOSTED-POWER/php_uploadprogress_guard
A PHP extension that protects unpatched PHP against the php2shell vulnerabilities (CVE-2026-109618/109619) by mirroring the official fix, and adds protections against a unserialize() use-after-free and SimpleXML…

CoolingSecurityC+0 stars measured 2026-10-30, 00:24–10:16 UTC, ≈ 0 by evening