Cisco69 Cisco Talos is tracking in-the-wild abuse of CVE-2026-20079 (FMC auth bypass, CVSS 10.0) and CVE-2026-20316 (static low-priv credentials, SIR High) on Cisco…
Active Directory64 S12 points a notepad.exe File handle at ntds.dit, SYSTEM, and SECURITY on a live DC via BYOVD LowQword patch. No LSASS, no…
kernel151 Patch EPROCESS.UniqueProcessId and every ETHREAD.Cid with a GIO kernel write, and Sysmon attributes file, DNS and child-process events to Notepad. PspCidTable still…
kernel261 Lazarus spent a Windows kernel zero-day in afd.sys on a fake recruiter PDF. CVE-2026-68820 is a local UAF that skips BYOVD controls;…
Exploit Development255 USENIX Security 2026: KERAT mines atomicity rules for check-use pairs on Linux and FreeBSD shared fields, then FSM-walks LLVM IR. 351 real…
Active Directory170 Hope Walker's SpecterOps sequel to manual LDAP querying: OR parentheses that lie, nested Domain Admins, Kerberoastable SPNs, userAccountControl sticker-math, passwords in schema…
Active Directory134 When BloodHound and PowerView will not load, Active Directory is still a phone book. Hope Walker's SpecterOps lab shows how to query…
iOS Security177 Yuval Hanoch Hirschenbein Sadde traced a DEF CON 34 demo crash to one character in XNU: unp_ino++ assigns inode 0 to the…
Defender207 On 8–9 September 2026 Nightmare Eclipse published ShieldCrash, a skeleton proof of concept that Microsoft's September engine update for ShieldBreak (CVE-2026-69414) closed…
Active Directory374 Demonstrate a sophisticated privilege escalation technique exploiting Windows IIS AppPool identity elevation to obtain machine account certificates from AD CS, leading to…
windows577 Explore a sophisticated kernel-level technique that mutates process identity structures to evade Sysmon telemetry. This research demonstrates how patching EPROCESS.UniqueProcessId and ETHREAD.Cid…
Malware549 SLEEPWALKER is a passive Windows backdoor that never beacons, opens no listening port and carries no payload. It side-loads into ESET Management…
