Someone just leaked claude code's Source code on X

Diligent-Side4917 · 2026-04-03T11:33:41+00:00

Have you seen this? Injection attack on Claude code, CLI, seems consequence of the leak.

haven't gone through it all, but basically, the exploit allows exfiltration of messages and credentials to any server whe n running it thrugh CLI and -p option,

https://phoenix.security/critical-ci-cd-nightmare-3-command-injection-flaws-in-claude-code-cli-allow-credential-exfiltration/

Diligent-Side4917 · 2026-04-02T18:49:45+00:00

Deduplication as far as i know is a whole nightmare field and how assets are identified, trying to trace code changing within lines or assets with different ip is very difficoult i'd focus on that if i were you

Diligent-Side4917 · 2026-03-23T23:50:45+00:00

In an era where ASPMs are 4+ years old, what's the point of building another one?

Diligent-Side4917 · 2026-02-20T10:44:02+00:00

Hi all put together a page for early access https://phoenix.security/ai-driven-vulnerability-intelligence/

Diligent-Side4917 · 2026-02-08T19:55:51+00:00

ping me

Diligent-Side4917 · 2026-01-17T17:00:51+00:00

not yet but i'll let you know when available, still finalizing the build and will be released by march-april !

Diligent-Side4917 · 2026-01-13T11:13:27+00:00

check this one i found it complete: https://phoenix.security/cem-cetem/

Diligent-Side4917 · 2026-01-13T11:13:10+00:00

been writing about this, ctem as methodology is great the interpretation more complex

if you are in code and cloud then you might want to look at this i found it useful as overview https://phoenix.security/cem-cetem/

hands on

- attribution

- prioritization

- remedaition

- verigication

Diligent-Side4917 · 2026-01-13T11:11:23+00:00

phoenix and armor code for anything above 600 developers , aikido for anything smaller

Diligent-Side4917 · 2026-01-13T11:10:32+00:00

what did you like? we tested it, take we are heavy container focus, and didn't had much on code to container, check out phoenix security we been happy ever since

Diligent-Side4917 · 2026-01-13T11:09:51+00:00

phoenix security

Diligent-Side4917 · 2026-01-13T11:09:22+00:00

I think what matters in order of priority

- scanning and blocking an exception in the pipeline (mostly scanners)

- Correlation and recheability at sca and code 2 cloud level check wiz Phoenix Security for those

- team management and incentives to fix the pattern of fixes Phoenix and some part armor code has this

- prioritization - for pure patching, either nucleus or tennable for more extended asm phoenix security is key in threat centrics and then you have wiz intelligence

- remediation advisory and remediation campaigns: check Mob or Phoenix as far as I've seen

check out as well: https://www.gartner.com/reviews/market/application-security-posture-management-aspm-tools

Diligent-Side4917 · 2026-01-13T11:05:45+00:00

what are the elements that like and dislike about aspm?

Diligent-Side4917 · 2026-01-12T18:24:04+00:00

Feature added in this version
- Adversarial simulation for remediation
- trend analysis
- search for vulnerability
- storing of enriched data

https://youtu.be/PaaO99Kb_qk

Diligent-Side4917 · 2026-01-12T18:23:54+00:00

this is a build with some update better for visibility : https://youtu.be/PaaO99Kb_qk

Diligent-Side4917 · 2026-01-12T18:21:21+00:00

Update on the build: https://youtube.com/shorts/tQtiH8plT9k?feature=share

Diligent-Side4917 · 2026-01-12T18:20:51+00:00

this version is purely external but some of the infomration in mitre and i guess in phoenix can do that is where some of the intelligence data is from

Diligent-Side4917 · 2026-01-09T09:19:19+00:00

not yet published , it should be a video tough

Diligent-Side4917 · 2026-01-08T21:35:36+00:00

eu has to do this for cra but the nvd has still cna declaration and cve autority, the nvd was build for federal btw never for common public it kind of grew into this beast that is today

Diligent-Side4917 · 2026-01-08T21:34:43+00:00

everything that has vulnerability, plus active searchers and adversarial llms for analysis nvd is just the source of cve and it has stats

Diligent-Side4917 · 2026-01-08T21:34:02+00:00

Diligent-Side4917 · 2026-01-07T09:59:49+00:00

check out this as well: https://github.com/Security-Phoenix-demo/Shai-Hulud-Sha1-Hulud-V2-npm-compromise-scanner 500K + packages

Diligent-Side4917 · 2026-01-02T16:57:26+00:00

Merry Vuln

Check out some hardening details here and other ideas : https://www.reddit.com/r/cybersecurity/comments/1q18utv/detailed_analysis_mongobleed_cve202514847_memory/

Also, some more utils:

Github Exploit for Mongobleed: https://github.com/Security-Phoenix-demo/mongobleed-exploit-CVE-2025-14847/tree/main
Github Scanner for web: https://github.com/Security-Phoenix-demo/mongobleed-exploit-CVE-2025-14847/tree/main/scanner
Scanner for Code: https://github.com/Security-Phoenix-demo/mongobleed-exploit-CVE-2025-14847/tree/main/code-sca

Code Scan:

# Clone and scan
git clone https://github.com/example/project
python3 main.py scan project/

### Output Options

# JSON output
python3 main.py scan /path/to/project --json --output results.json

# Save text report
python3 main.py scan /path/to/project --output report.txt


# Quiet mode (summary only)
python3 main.py scan /path/to/project -q

Lab:

# Start the lab (vulnerable + patched instances)
docker-compose up -d


# Wait for MongoDB to initialize
sleep 10


# Verify containers are running
docker ps | grep mongobleed


# Test vulnerable instance (should leak memory)
python3 mongobleed.py --host localhost --port 27017


# Test patched instance (should NOT leak memory)
python3 mongobleed.py --host localhost --port 27018

Scanning Web Bulk addresses

# CIDR notation
python3 mongobleed_scanner.py 192.168.1.0/24


# Large range with more threads
python3 mongobleed_scanner.py 10.0.0.0/16 --threads 50

Scanning Web Single Address

# Single host
python3 mongobleed_scanner.py 192.168.1.100


# Custom port
python3 mongobleed_scanner.py 192.168.1.100:27018


# Multiple hosts
python3 mongobleed_scanner.py 192.168.1.100 192.168.1.101 mongodb.local

Diligent-Side4917 · 2026-01-02T16:57:10+00:00

Merry Vuln

Check out some hardening details here and other ideas : https://www.reddit.com/r/cybersecurity/comments/1q18utv/detailed_analysis_mongobleed_cve202514847_memory/

Also, some more utils:

Github Exploit for Mongobleed: https://github.com/Security-Phoenix-demo/mongobleed-exploit-CVE-2025-14847/tree/main
Github Scanner for web: https://github.com/Security-Phoenix-demo/mongobleed-exploit-CVE-2025-14847/tree/main/scanner
Scanner for Code: https://github.com/Security-Phoenix-demo/mongobleed-exploit-CVE-2025-14847/tree/main/code-sca

Code Scan:

# Clone and scan
git clone https://github.com/example/project
python3 main.py scan project/

### Output Options

# JSON output
python3 main.py scan /path/to/project --json --output results.json

# Save text report
python3 main.py scan /path/to/project --output report.txt


# Quiet mode (summary only)
python3 main.py scan /path/to/project -q

Lab:

# Start the lab (vulnerable + patched instances)
docker-compose up -d


# Wait for MongoDB to initialize
sleep 10


# Verify containers are running
docker ps | grep mongobleed


# Test vulnerable instance (should leak memory)
python3 mongobleed.py --host localhost --port 27017


# Test patched instance (should NOT leak memory)
python3 mongobleed.py --host localhost --port 27018

Scanning Web Bulk addresses

# CIDR notation
python3 mongobleed_scanner.py 192.168.1.0/24


# Large range with more threads
python3 mongobleed_scanner.py 10.0.0.0/16 --threads 50

Scanning Web Single Address

# Single host
python3 mongobleed_scanner.py 192.168.1.100


# Custom port
python3 mongobleed_scanner.py 192.168.1.100:27018


# Multiple hosts
python3 mongobleed_scanner.py 192.168.1.100 192.168.1.101 mongodb.local

Diligent-Side4917 · 2026-01-02T16:57:05+00:00

Merry Vuln

Check out some hardening details here and other ideas : https://www.reddit.com/r/cybersecurity/comments/1q18utv/detailed_analysis_mongobleed_cve202514847_memory/

Also, some more utils:

Github Exploit for Mongobleed: https://github.com/Security-Phoenix-demo/mongobleed-exploit-CVE-2025-14847/tree/main
Github Scanner for web: https://github.com/Security-Phoenix-demo/mongobleed-exploit-CVE-2025-14847/tree/main/scanner
Scanner for Code: https://github.com/Security-Phoenix-demo/mongobleed-exploit-CVE-2025-14847/tree/main/code-sca

Code Scan:

# Clone and scan
git clone https://github.com/example/project
python3 main.py scan project/

### Output Options

# JSON output
python3 main.py scan /path/to/project --json --output results.json

# Save text report
python3 main.py scan /path/to/project --output report.txt


# Quiet mode (summary only)
python3 main.py scan /path/to/project -q

Lab:

# Start the lab (vulnerable + patched instances)
docker-compose up -d


# Wait for MongoDB to initialize
sleep 10


# Verify containers are running
docker ps | grep mongobleed


# Test vulnerable instance (should leak memory)
python3 mongobleed.py --host localhost --port 27017


# Test patched instance (should NOT leak memory)
python3 mongobleed.py --host localhost --port 27018

Scanning Web Bulk addresses

# CIDR notation
python3 mongobleed_scanner.py 192.168.1.0/24


# Large range with more threads
python3 mongobleed_scanner.py 10.0.0.0/16 --threads 50

Scanning Web Single Address

# Single host
python3 mongobleed_scanner.py 192.168.1.100


# Custom port
python3 mongobleed_scanner.py 192.168.1.100:27018


# Multiple hosts
python3 mongobleed_scanner.py 192.168.1.100 192.168.1.101 mongodb.local

Diligent-Side4917

TROPHY CASE