SquidC5: Free Open Source Self-Hosted C5 Teamserver for Authorized Red Teams
Hey everyone, Mr. The Plague here from SquidSec. Commercial C2 is expensive. A lot of “free” options still want your engagement data on someone else’s cloud, or they…
Live signal
Cybersecurity research without the noise
Penetration testing tradecraft, agentic recon, supply-chain deep dives, and practical hardening — from the SquidSec crew.
Latest intel
BloodBash vs DCSync in a Ludus AD Lab (s12)
Hey everyone, Mr. The Plague here from SquidSec. Engineering expanded the Ludus s12 write-up: BloodBash on a planted SharpHound zip, DCSync on the domain root, no Neo4j. Commands…
Stop Briefing the News: What CISOs Should Put in the Packet After Late August Public Reporting on Publish Paths, Tokens, and Replay
Mr. The Plague here. Late August into early September 2026, public reporting spent a lot of time on publish paths, tokens, and replay. Boards will still ask what…
One WebSocket, one Shell: CVE-2026-39987 Explained
Contents CVE-2026-39987 On this page 01 Summary 02 Root Cause 03 The Patch 04 Impact: Why a PTY Raises the Ceiling 05 Exposure Discovery 06 Exploitation Timeline 07…
Agentic Attack Surface Recon: A Real Case Study From 497 Scans
A real production case study of agentic attack surface recon. SquidScan's 45-agent AI pipeline ran 497 jobs, 23,039 tool tasks, and 487 AI reports. Reliability, finding climate, and what autonomous external recon actually produces off demo day.
SquidShield WP: Free Open Source One-Click WordPress Security by SquidSec
SquidSec launches SquidShield WP: free, open-source, one-click WordPress security. Firewall, login protection, malware scanning, and hardening. Get it on GitHub: DotNetRussell/SquidShield-WP.
SquidScanner: Revolutionizing Agentic Reconnaissance for Bug Hunters, Pentesters, and Security Teams
Hey everyone, it’s ☣️ Mr. The Plague ☣️ here from SquidSec. If you’ve ever spent hours stitching together Subfinder runs, Nuclei templates, and random GitHub dorks only to…
Active Directory Hacking Cheat Sheet
Contents ACTIVE DIRECTORY HACKING CHEAT On this page 01 Quick Start 02 Kerberos Attacks 03 Delegation Abuses 04 AD Certificate Services 05 Replication and Credential Dumping 06 Dangerous…
Modular Agentic Attack Surface Scanning — Built on Rails, Not Magic
Security teams today face a paradox. The attack surface is exploding — cloud assets, containers, APIs, shadow IT, and forgotten subdomains — yet most scanning solutions still force…
Leadership Reckoning in 2026: Actionable Blueprints for Senior Cybersecurity Leaders to Forge Enduring Resilience in a Weaponized, Borderless Digital Economy
This is the fifth and final installment in the “Building Resilience in a Globalized Digital Economy” series. Over the past month we’ve dissected the escalating NPM/JavaScript supply-chain nightmare…