Exploit Development531 Jonathan Johnson’s first public RE of WESP on Insider 29661: wesp.sys + espclient.dll, EspFilterPort, WESP://Permission and AM-PPL, process-create queues, a working consumer…
Exploit Development732 QED’s CVE-2026-19174: three constants overflow in V8’s wasm deserializer, 102.4 MiB instead of 921.6, overlapping RWX JIT, renderer RCE without a heap-sandbox…
Exploit Development1.2k Acronis TRU: Red Heron turned CVE-2026-60004 into a Gitea steal-and-pivot factory within days of the PoC, hit five countries, and dropped JITTERLY…
Android436 Natalie Silvanovich’s Part 3: the Pixel 9 0-click was person-weeks, not a miracle. Rare codecs on transcription, missing seccomp, kASLR dead since…
Android545 Seth Jenkins’s Part 2: from mediacodec to kernel R/W on Pixel 9 via CVE-2025-36934 in /dev/bigwave. A 16-second ioctl timeout UAF becomes…
Android584 Project Zero’s Natalie Silvanovich turns CVE-2025-54957 in the Dolby Unified Decoder into mediacodec code execution on a Pixel 9 with no tap:…
Cisco824 Cisco Talos is tracking in-the-wild abuse of CVE-2026-20079 (FMC auth bypass, CVSS 10.0) and CVE-2026-20316 (static low-priv credentials, SIR High) on Cisco…
Active Directory750 S12 points a notepad.exe File handle at ntds.dit, SYSTEM, and SECURITY on a live DC via BYOVD LowQword patch. No LSASS, no…
Machine Learning399 Quarkslab’s pcode_graph lifts functions to Ghidra P-Code CDGs and a GINE embedding that matches GMN (AUC 0.87 XM) on Cisco-Talos, across ISA,…
Android671 Quarkslab shows Android hardware attestation end to end, then a Frida relay: a clean phone signs the backend nonce, the rooted analysis…
Cisco587 CVE-2026-20093 is a CVSS 9.8 pre-auth password change on Cisco IMC via configConfMo/aaaUser. Lab notes unpack HUU 4.3.2.250063 vs 4.3.2.260007: nginx /nuova,…
kernel416 Patch EPROCESS.UniqueProcessId and every ETHREAD.Cid with a GIO kernel write, and Sysmon attributes file, DNS and child-process events to Notepad. PspCidTable still…
Bluetooth470 Praetorian's Caeruleus is one Go binary on Linux/BlueZ that replaces hcitool, gatttool, bettercap BLE, and throwaway Bleak scripts: scan, enumerate, assess unpaired…
kernel1.1k Lazarus spent a Windows kernel zero-day in afd.sys on a fake recruiter PDF. CVE-2026-68820 is a local UAF that skips BYOVD controls;…
Exploit Development695 USENIX Security 2026: KERAT mines atomicity rules for check-use pairs on Linux and FreeBSD shared fields, then FSM-walks LLVM IR. 351 real…
Active Directory399 Hope Walker's SpecterOps sequel to manual LDAP querying: OR parentheses that lie, nested Domain Admins, Kerberoastable SPNs, userAccountControl sticker-math, passwords in schema…
Active Directory331 When BloodHound and PowerView will not load, Active Directory is still a phone book. Hope Walker's SpecterOps lab shows how to query…
