Application Security216 A multi-tenant document vault enforced a real server-side tenant-ownership check on its permission-grant endpoint - and it was still bypassable. The authorization…
Active Directory414 Active Directory stores Unicode characters its own LDAP server cannot search for. Semperis researcher Shai Laron turned that gap into KerberLoss (CVE-2026-25177)…
.NET514 Windows Application Control (formerly WDAC) blocks binaries that are not signed by an approved authority — but a Microsoft-signed binary that deserialises…
Credential Attacks321 From a compromised session, a TPM-backed Windows Hello for Business key can be driven to sign arbitrary data with no PIN or…
Exploit Development220 A write-side fuzzing campaign against libpng18's APNG re-encode path found a per-frame buffer lifecycle defect that yields both a memory leak (CWE-401)…
Memory Management381 A technical deep dive into NTDLL unhooking techniques using KnownDlls section mapping, Virtual Address Descriptors, and RWX page detection to bypass EDR…
Reverse Engineering317 A complete layer-by-layer teardown of the ionCube PHP loader (aarch64, v8.5): custom base64, hand-rolled PRNG stream ciphers, a five-source key-derivation routine, XOR-encrypted…
Bootkit357 RedLotus is a Windows UEFI bootkit written in Rust that executes before the kernel and bypasses Driver Signature Enforcement (DSE) using manual…
Browser Security340 How the Wipeload chain turns an ALPC use-after-free into a stable cross-process read/write primitive and escapes the Chrome renderer sandbox — reclaiming…
Exploit Development322 COFF mixing combines capability code with benign functions and links them as PE-ready COFF objects, eliminating memory-injection IOCs while preserving agent capabilities…
Browser Security591 CVE-2026-40369 is an unprivileged twelve-byte arbitrary kernel write in nt!ExpGetProcessInformation, reachable via NtQuerySystemInformation from browser renderer sandboxes. Root-cause analysis and a full…
Exploit Development546 GhostLock (CVE-2026-43499) is a 15-year-old use-after-free in the Linux kernel's rtmutex/futex requeue-PI code. When a proxy lock hits a deadlock and rolls…
Browser Security412 CVE-2026-10702 is a miscompilation bug in Firefox's SpiderMonkey Ion/Warp JIT. The MObjectToIterator instruction produced by scalar-replacing Object.keys() declares a load-only alias set,…
Threat Intelligence369 CVE-2026-50522 is a critical (CVSS 9.8) unauthenticated, pre-auth deserialization RCE in on-premises Microsoft SharePoint Server. A single crafted WS-Federation POST to /_trust/default.aspx…
Browser Security428 CVE-2026-6307 is a single V8 vulnerability that pierces two security boundaries at once. A missing signature comparison lets TurboFan's global value numbering…
Malware1.6k A reverse-engineering walkthrough of SakDriver, a Windows kernel-mode rootkit first mistaken for a Cobalt Strike Beacon. It patches ETW, hides processes via…
Application Security539 A deep tour of HTTP parser inconsistencies: how trim/fold/header disagreements between Nginx, WAFs, caches and frameworks (Node.js, Flask, Spring Boot, PHP) enable…
