Security

Native red, blue, and purple security-agent harness for CYBER-FROST

Android & iPhone intrusion check

JsOwl —— Go 编写的 Web 安全信息收集利器。集 JavaScript 信息收集、API 端点提取、敏感信息扫描、攻击面梳理 于一体，同时提供 CLI 工具与 Go 库。内置 direct / browser / auto 三种采集模式，兼容 HaE 规则，支持登录态扫描、运行时交互、AI 辅助分析与 MCP Server，输出 JSON 与交互式 HTML 报告，是渗透测试、红队信息收集与 Web 安全测试的高效自动化方案。

Agentshield is open source defense for Kubernetes and AWS. It learns how your workloads really talk, flags lateral movement with evidence, and proposes fixes you approve.

🔓 An AI web-pentest skill for Claude Code. Point it at a site you're authorized to test — it maps the attack surface, works through the OWASP WSTG, validates findings, and writes dev + stakeholder reports (PDF).

Portable, evidence-bound security skills for authorized defensive assessment, red teaming, penetration testing, detection engineering, and engagement operations.

ARTEX · AI autonomous penetration testing system (multi-agent LLM, Go + Next.js) · AI 自主渗透测试系统 · 百度 agent+ 攻防挑战赛冠军

Protects an unpatched PHP against php2shell (CVE-2026-109618 / CVE-2026-109619): a small extension that mirrors the official fix component by component and steps aside once the engine carries it. PHP 5.6-8.5; Sury, cPanel EA4, DirectAdmin, Docker, Windows.

PHP 7.4 / 8.0 / 8.1 Docker images with the CVE-2026-109618 / CVE-2026-109619 fix backported

AI-driven malware analysis framework with 30+ integrated tools, web REPL, and MCP server

Privacy focused NixOS pentesting environment with a customizable desktop and security tools.

Watson — free OSINT tool for Windows: people search across 3,100+ public sites by nickname, email, phone or website. Open-source intelligence made simple: digital footprint check, username lookup, social media search. No account, no tracking. Site: watsonfind.icu

Non-destructive scanner for CVE-2026-109618 / CVE-2026-109619 (PHP core RCE). Subdomain recon via crt.sh + subfinder, robust banner grabbing, version-based detection.

Python scanner for CVE-2026-109618, CVE-2026-109619 and the php2shell session chains (handler mismatch + LFI). No external dependencies.

AI jailbreaks: 35 paste-ready AI jailbreak prompts for 25+ frontier and open-weight LLMs - system prompts, persona locks, AGENTS.md specs, and Ollama Modelfiles. Built for AI security research and red-team testing.

Open-source cross-platform defensive spyware, stalkerware and surveillance software detector

WireGuard, AmneziaWG, Cisco AnyConnect and Tailscale in one native, free and open-source macOS VPN client: SwiftUI app, Network Extension, kill switch, on-demand, and a wombat CLI

云鲲自动化渗透控制台：功能介绍、使用流程、新增与优化、界面预览。当前仓库仅含文章与截图，暂无产品源码。

Published: 2026-10-28

CVE-2026-109618/109619 — PHP session.upload_progress pre-auth RCE. Exploit research: remote ASLR chain, PoC & patch analysis.

Jevline: start from one confirmed-malicious process; Jev links the rest of the incident into a timeline, execution chain and evidence table.

🛡 Official AI Security Tool module for CVE-2026-75604 (Next.js Windows Unauthenticated Remote Code Execution) with safe in-app execution, deep vulnerability validation, and DevSecOps-ready security auditing workflows.

Defensive mitigation and testing toolkit for PHP security vulnerabilities (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560), including Apache protections and PHP hardening guidance

Open reverse engineering — PE/ELF/Mach-O, x86/x64/AArch64, graphs, pseudocode. Rust engine, no network. Desktop · CLI · browser.

一键给 18 款 AI 编程工具注入提示词和技能的 Windows 桌面工具 · Qt / 20 MB · 134 skills · 两层任务路由

Build AI agents and LLM workflows visually. Security-maintained continuation of Flowise: security fixes, Apache-2.0 only, drop-in for your existing flows and data.

Elden Ring Cheat 2026 — Single-player modding and gameplay toolkit concept featuring character build optimization, rune planning, weapon upgrades, boss strategies, save management and offline trainer research.

Umbrella Spoofer v2.0.4 scans hwid reset beside hwid checker. hwid ban tally, smbios board, volume label, nic oui, snapshot pair, disk serial, caller id, device fingerprint, webgl canvases.

Open source browser lab to build a simulated infrastructure, watch an attack move through it, and check whether your defense works.

Evidence-driven Java security review workbench

Evidence-based PHP security assessment: patch verification, intrusion tracing, and offline reports.

Soroban contract for authorized Stellar Sentinel flags, configurable thresholds, and latest-flag records.

🛡️ Official AI Security Tool module for CVE-2026-20817 (Windows Error Reporting WER ALPC Local Privilege Escalation PoC).

FastAPI service for Stellar account screening, Soroban event monitoring, and network health.

💩 Defensive agent that finds what your frontend leaks: exposed keys, source maps, API maps and debug globals. Chrome extension + CLI.

Get correct Kahoot answers instantly and free—no limits, fees, or subscriptions. Boost your quiz scores now.

1Password — Security SaaS listing. Visit link via SOFTGIT. Third-party; rights belong to original authors.

Far Cry 3 Ultimate Trainer & Memory Editor 2026 Toolkit

HTTPS overlay for operators. Secure admin session that holds through short disconnects and packet loss. Protocol loft/1.0.

Observe AI agent runs and control consequential actions. Signed policies, exact-action approvals, AuthZEN API vetoes and evidence. MCP gateway today; connected-channel supervision and scoped reactions toward 1.0. Experimental alpha.

「セキュリティチェックして」の一言で、Mac・リポジトリ・GitHub・Vercel・AWS・Gmailを読み取り専用で横断点検する Claude Code スキル

High-speed web security auditor & DevSecOps dashboard for SSL, HTTP headers, DNS defenses, and port exposure.

A fetch wrapper that drops your custom auth headers when a redirect crosses to another origin.

Zero-install, air-gapped, self-decrypting HTML vaults using AES-256-GCM and native WebCrypto.

Go http.Client redirect policy that drops caller-set headers such as X-Api-Key when a redirect changes origin.

Rebuild the JavaScript GitHub Actions your workflows pin and check that their committed dist matches the source.

JSON.parse with hard limits on nesting depth, key count, string length and input size. Refuses parser bombs before they are allocated.