EDR485 SyscallRevenant: Clean Indirect Syscalls with Trap-Flag Tracing
Clean indirect syscalls on Windows x64. It single-steps a hooked ntdll stub with the CPU trap flag to learn the live System…
oxfemale·
Oct 19·
31 min
·485
// windows
198 postsEDR485 
Command Injection1.2k Telegram Desktop: one-click account takeover via IPC injection
BeakSec's CVE-2026-107181: Telegram Desktop through 7.2.8 handed clicked links to the running instance over a local socket and never escaped the semicolon…
oxfemale·
Oct 9·
43 min
·1.2k
kernel1.2k Static Devirtualization of Tencent VM: ACE Kernel Drivers, CET, SEH, and Guided Symbolic Execution
Aftermath Labs statically recover 815 of 865 Tencent-VM virtualized functions across four ACE kernel drivers (94.2 percent). Architecture, CET RDSSPQ/INCSSPQ, phantom SEH…
oxfemale·
Oct 2·
41 min
·1.2k
AI Agents733 Bypassing EDR with Local AI
Eddie Zhang / Project Black: Claude refuses an LSASS dumper; DeepSeek builds one EDR still catches; uncensored Qwen 3.8 27B on two…
oxfemale·
Oct 2·
12 min
·733
RCE529 CVE-2026-59309 & CVE-2026-59310: Patch-diffing VMware vCenter to Auth Bypass and RCE
Mobeta patch-diff of VMSA-2026-0006: vCenter 8.0.3 syslog dynafile traversal (CVE-2026-59310) and SASL SRP A=N auth bypass (CVE-2026-59309), both pre-auth 9.8. Templates, Ghidra,…
oxfemale·
Oct 2·
36 min
·529
RCE528 SharePoint CVE-2026-65660: From Anonymous Access to Pre-Auth RCE via EditingPageParser Type-Check Bypass
CVE-2026-65660 SharePoint EditingPageParser bypass via RegisterDirective.GetHtml quote rewrite, XamlServices memshell, and ToolPane on AddGallery.aspx for pre-auth RCE when anonymous view is on.…
oxfemale·
Oct 2·
21 min
·528
kernel708 Windows Internals: Check Your Privilege — The Curious Case of ETW’s SecurityTrace Flag
Connor McGarr on ETW’s undocumented SecurityTrace bit: QUERY wants Antimalware-PPL, STOP does not, and a user-mode ControlTrace hook lets admin consume Threat-Intelligence…
oxfemale·
Sep 21·
37 min
·708
kernel1.1k A Quartet of Linux Local Root Vulns: DirtyAH6, TUNderflow, PPPoEject, and DiagSpill
Asim Manizada’s four Linux LPEs: DirtyAH6, TUNderflow, PPPoEject, DiagSpill. Decade-old bugs, userns for three, DiagSpill needs only SCTP. Patch 5.10.270 / 6.6.157…
oxfemale·
Sep 21·
34 min
·1.1k
Cisco931 Active Exploitation of Cisco Secure Firewall Management Center: CVE-2026-20079, CVE-2026-20316, Cyclops Blink and Qilin
Cisco Talos is tracking in-the-wild abuse of CVE-2026-20079 (FMC auth bypass, CVSS 10.0) and CVE-2026-20316 (static low-priv credentials, SIR High) on Cisco…
oxfemale·
Sep 14·
29 min
·931
Active Directory847 Domain Credential Dumping via File Handle Redirection
S12 points a notepad.exe File handle at ntds.dit, SYSTEM, and SECURITY on a live DC via BYOVD LowQword patch. No LSASS, no…
oxfemale·
Sep 14·
15 min
·847
kernel501 Process ID Mutation via BYOVD: Making Sysmon Blame Notepad
Patch EPROCESS.UniqueProcessId and every ETHREAD.Cid with a GIO kernel write, and Sysmon attributes file, DNS and child-process events to Notepad. PspCidTable still…
oxfemale·
Sep 11·
29 min
·501
kernel1.3k From Job Offer to Ring 0: Lazarus, CVE-2026-68820 and FudModule 3.1
Lazarus spent a Windows kernel zero-day in afd.sys on a fake recruiter PDF. CVE-2026-68820 is a local UAF that skips BYOVD controls;…
oxfemale·
Sep 11·
28 min
·1.3k