Cryptography6 Factoring “Short-Sleeve” RSA Keys with Polynomials
Trail of Bits and the badkeys project found hundreds of RSA and DSA keys in the wild whose moduli have regularly spaced…
oxfemale·
Jun 16·
14 min
·6
// June 2026
64 postsCryptography6 
Exploit Development24 CVE-2026-40369: Twelve Bytes to Escape the Browser Sandbox
CVE-2026-40369 is an unprivileged arbitrary 12-byte kernel write in nt!ExpGetProcessInformation, reachable from Chrome/Edge/Firefox renderer sandboxes via NtQuerySystemInformation. A walk through the unchecked…
oxfemale·
Jun 16·
15 min
·24
Exploit Development12 HVCI in 2026: How Far Down a SYSTEM Shell Actually Gets You
A SYSTEM shell is the top of the user-mode pile, but it is not the kernel. This walkthrough of Windows HVCI in…
oxfemale·
Jun 16·
14 min
·12
Exploit Development13 CVE-2018-8611 Part 2/5: Patch Analysis and Basic Triggering of the Windows KTM UAF
Part 2 of NCC Group's CVE-2018-8611 series by Aaron Adams: a full walk-through of the Kernel Transaction Manager patch, including how to…
oxfemale·
Jun 16·
26 min
·13
Exploit Development14 CVE-2018-8611 — Exploiting the Windows Kernel Transaction Manager (Part 1/5: Introduction)
CVE-2018-8611 is a race-condition LPE in the Windows Kernel Transaction Manager (KTM), originally caught in the wild by Kaspersky’s AEP in October…
oxfemale·
Jun 15·
11 min
·14
EDR Evasion5 tabby — A Minimal Position-Independent Windows x64 Shellcode Framework, Built Entirely on Linux
cocomelonc’s tabby is a tiny teaching framework for writing position-independent Windows x64 shellcode in C, with indirect NT syscalls and no IAT,…
oxfemale·
Jun 15·
23 min
·5
AI Security Research3 CuSafe — Catching Memory Corruption on Commodity NVIDIA GPUs (USENIX Security ’26)
CuSafe is a GPU memory sanitizer for off-the-shelf NVIDIA hardware. It combines pointer tagging with in-band buffer bounds via an LLVM 21…
oxfemale·
Jun 15·
25 min
·3
Exploit Development13 Exploiting CVE-2024-1065 via the Page Cache — A Physical-Page UAF in the ARM Mali GPU Driver
CVE-2024-1065 is a physical-page use-after-free in the ARM Mali GPU kernel driver. Because the freed page lands in MIGRATE_MOVABLE, Dirty Pagetable and…
oxfemale·
Jun 13·
20 min
·13
Active Directory15 Weaponizing Writable SMB Shares to Steal Domain Credentials
A walkthrough of a classic-but-still-effective Active Directory attack: how write access to an SMB share — plus a single .lnk file —…
oxfemale·
Jun 13·
11 min
·15
EDR Evasion3 Centurion: A Virtualized Loader and the “Bring Your Own Execution Environment” Model
Praetorian’s Centurion is a virtualized loader built around a custom x86-64-inspired ISA and freestanding C runtime, where the PE loader, TLS stack…
oxfemale·
Jun 13·
21 min
·3
buffer overflow10 Overcoming Space Restrictions with Egghunters in Windows Exploit Development — Savant Web Server 3.1, Syscall & SEH Egghunters, Heap Staging
When a Windows stack overflow gives you ~250 bytes of crash-buffer space but a useful Meterpreter payload is 400+ bytes, the answer…
oxfemale·
Jun 12·
54 min
·10
Exploit Development12 Windows Win32k Elevation of Privilege Vulnerability (CVE-2021-1732): Walkthrough of the ConsoleControl Offset Confusion
CVE-2021-1732 is a Win32k local privilege escalation in win32kfull.sys. By flipping the 0x800 bit on tagWND with NtUserConsoleControl and returning a fake…
oxfemale·
Jun 12·
14 min
·12