C2 is dead - This is NextGen Command Control Cognitive Collaborative Coordination AI-native | Open source | Self-hosted You own the server. You own the data. Built for the operators who actually do the work. 🔗 GitHub: github.com/SquidSec/SquidC5 #BlackHat #DEFCON #BHUSA #RedTeam #C2 #Infosec @BlackHatEvents @RedTeamVillage_ @ReconVillage @defcon

Stay a while, and listen....

Good morning world! Today is a great day to scan your attack surface. SquidScan is online, armed, and standing by ~> SquidScanner.com

BloodBash 1.5.0 is out! Windows and Linux Binaries built and ready New in this release: - ATT&CK id on every finding - SARIF export for code scanning - --fail-on-severity CI gate - baselines and suppressions - ESC10/11/12 + Entra postureSquidSec shipped BloodBash 1.5.0 today! BloodBash is our offline SharpHound and AzureHound analyzer. It builds the AD and Entra graph, surfaces attack paths and misconfigurations, and prints prioritized findings, without Neo4j or the BloodHound UI. This release is mostly about fitting the tool into how teams already work: pipelines, recurring collections, and review cycles where someone has to sign off. What changed: - Every finding now carries a MITRE ATT&CK technique ID, visible in the console and carried through SARIF, tickets, and JSON. - SARIF 2.1.0 export, so results drop into GitHub code scanning and DefectDojo without a translator in the middle. - A severity gate. --fail-on-severity returns exit 2 when a finding meets your threshold, which turns a recurring collection into a compliance check instead of a document. - Baselines and suppressions. Compare against last month's report to separate new risk from accepted debt. Suppression entries can carry an expiry date. - --explain, for when someone asks why a finding fired. It prints the contributing rows, the ATT&CK ID, and the graph edges behind it. - More coverage: ESC10 through ESC12 when the collection has CA registry data, GPO triggers and local group changes in XML parsing, and a new Entra posture check for standing privileged assignments, broad consent scopes, and unmanaged devices. We also fixed several bugs found during a full review. The ones that mattered most: AD objects whose names or descriptions mentioned "azure" were misclassified as Entra users and skipped by the AD checks, unzipped collector folders loaded zero objects, and password-age inventories counted disabled accounts as enabled. Each fix shipped with a regression test. The suite is now 533 tests across Python 3.9, 3.11, and 3.13, plus a 20-scenario engagement battery. Linux and Windows binaries, no Python required: github.com/SquidSec/BloodBas…

Have you tried Squid Scanner yet?

Have you signed up for the SquidSec daily threat brief? One email, all of the most important events from the last 24 hours. ~> SquidHacker.com/brief/

Three days. That is how long CVE-2026-102255 stayed “no evidence of exploitation.” SonicWall patched this CVSS 10 pre-auth SSRF in SMA1000 WorkPlace on Tuesday. Friday, Previdian honeypots saw OPTIONS requests consistent with the flaw, pivoting the appliance at its own CouchDB on 127.0.0.1:5984 squidhacker.com/brief/

"Over 86,000 internet-facing Fortinet FortiGate firewalls and VPN gateways have been compromised as part of an ongoing campaign tracked as FortiBleed" ~FBI and Secret Service. squidhacker.com/brief

SquidSec has experience penetration testing environments securing HIPPA data as well as PCI CDE environments. Are you ready to see what other tests are missing? SquidOffense.com

Are you up to date on today's cyber security threats? squidhacker.com/brief/

🚨BloodBash 1.4.2 released🚨 - multi-domain lookup - user@domain and DOMAIN\user stay in that domain - A bare SAM in two domains is listed, not guessed - `--domain` TTIG matches TTIG.INTERNAL - SID-only foreign principals no longer overwrite the named user - Dossiers show which collection the foothold came from github.com/SquidSec/BloodBas…

If your pentest consists of one stage "hand it to the model and yolo the test" then it's worse than a scanner only report. AI is great at augmenting a human led test and it's practically irresponsible not to use it today on pentests given the real value it's providing. It absolutely should not be the only thing being used and a human should still be in the loop to make sure it's staying in scope and on task full article here ~> squidhacker.com/2026/10/ai-p…

SquidSec is ready to scope your next pentest now

SquidSec Threat feed (available online, rss, and daily recap email) currently aggregates 16 different sources to bring you high quality up to the hour reports. CISA, CISA Current, KEV, Krebs, BleepingComputer, Dark Reading, The Record, Unit 42, Talos, Microsoft Security, CERT.PL, JPCERT, CERT-EU, DFIR Report, VMware Security, and Ivanti. squidhacker.com/brief/

It's true tho 💅

Make sure you're staying in the loop with the SquidSec hourly threat feed SquidHacker.com/brief/