A user-controlled 64-bit record count multiplied by the 0x228 record size wraps to zero in the Windows tcpip.sys WFP ALE deserialiser, defeating a kernel bounds check. A walkthrough of CVE-2026-58532, its 30-line proof of…
oxfemale
July 17, 2026
8 min read
155 
Exploit Development180 Nightmare-Eclipse's LegacyHive is an unpatched Windows privilege-escalation flaw: a standard user coerces the SYSTEM-level User Profile Service into loading another user's registry…
Hardware82 Runic Labs dissects a QNAP QTS disclosure cycle — four bugs across three plugins (Notes Station 3, QmailAgent, QVPN) — and shows…
Robotics Security103 Full technical writeup of two critical unauthenticated RCEs in Unitree Go2 robots (V1.1.7-V1.1.11): CVE-2026-27509 DDS-based RCE and CVE-2026-27510 mobile database tampering, with…
Security Patches69 Dustin Childs reviews the July 2026 security patch cycle, covering 88 Adobe CVEs and a record-breaking 621 Microsoft vulnerabilities, including critical RCEs…
Secure Boot41 ESET research reveals 11 old, Microsoft-signed UEFI shim bootloaders (versions 0.9 and below) that can bypass UEFI Secure Boot on any UEFI…
Exploit Development41 A novel technique combining thread pool execution, enum callback trampolining, and indirect syscalls to produce fully legitimate call stacks during syscall execution,…
buffer overflow36 A two-bug nginx 1.30.0 chain: CVE-2026-42945 (Rift) heap overflow + CVE-2026-9256 (PoolSlip) heap over-read combine into an ASLR-independent remote system() call at…
buffer overflow57 CVE-2026-47291 is a critical unauthenticated RCE vulnerability in Windows HTTP.sys caused by a 16-bit integer overflow in the buffer reference array growth…
Cybersecurity35 A practical survey of publicly available AI harnesses for offensive security research—RAPTOR, Anthropic's reference harness, baby-naptime, Evil Socket's Audit, and Visa's VVAH—plus…
Cybersecurity41 Process Parameter Poisoning (P3) is a stealthy process injection technique that abuses Windows startup parameters to transfer and execute code in a…
Cybersecurity35 WebAssembly (WASM) unlocks near-native performance for compiled code inside the browser — and that same power has been weaponized by threat actors.…
Android31 A complete walkthrough of attaching GDB to a running Android kernel on a physical Pixel 8 via KGDB: USB-Cereal UART wiring, custom…
