Cisco435 Aaron Thacker jailbroke a Cisco C195 ESA by splicing a newer BIOS so CIMC came online, exploiting command injection in expRemoteFwUpdate (CVE-2024-20356)…
iOS Security417 Yuval Hanoch Hirschenbein Sadde traced a DEF CON 34 demo crash to one character in XNU: unp_ino++ assigns inode 0 to the…
Defender532 On 8–9 September 2026 Nightmare Eclipse published ShieldCrash, a skeleton proof of concept that Microsoft's September engine update for ShieldBreak (CVE-2026-69414) closed…
Authentication & Access Control529 Rapid7 researchers discovered two critical authentication bypass vulnerabilities in N-able N-Central RMM platform. When chained together, CVE-2026-86206 and CVE-2026-86207 allow unauthenticated attackers…
Android579 A critical SQL injection vulnerability in Android 17's ContactsProvider allows apps using the system contact picker to exfiltrate all contacts on a…
Active Directory639 Demonstrate a sophisticated privilege escalation technique exploiting Windows IIS AppPool identity elevation to obtain machine account certificates from AD CS, leading to…
Virtualization441 Comprehensive security analysis of SIM-originating AT commands via the RUN AT proactive command in cellular devices, including the CATANA toolkit, device survey,…
Virtualization1.3k An unauthenticated authentication bypass in Proxmox VE 7.0–8.0.3 allows attackers to mint a full root@pam ticket with a single HTTP request. The…
Linux418 How Singularity rootkit bypasses Elastic Defend 9.5's enhanced module load detection through source obfuscation, BPF hook manipulation, and exploitation of trusted process…
windows787 Explore a sophisticated kernel-level technique that mutates process identity structures to evade Sysmon telemetry. This research demonstrates how patching EPROCESS.UniqueProcessId and ETHREAD.Cid…
Exploit Development590 CVE-2026-53360 is a heap out-of-bounds read/write in KVM SEV-SNP Page State Change handler: the guest picks the scratch buffer size, the host…
Malware726 SLEEPWALKER is a passive Windows backdoor that never beacons, opens no listening port and carries no payload. It side-loads into ESET Management…
Exploit Development823 Two nginx rewrite-engine bugs share one root cause: an is_args flag computed in one pass and consumed in another. Pointed at r->args…
Obfuscation738 Tencent's virtual-machine obfuscation protects the ACE anti-cheat kernel drivers, complete with Intel CET shadow-stack handling and full SEH unwind support. This deep…
Red Team Operations641 BOFScale combines a modified Tailscale daemon, client, and port forwarder running as Beacon Object Files to enable in-memory C2 networking infrastructure through…
BYOVD684 CVE-2020-12446 in eneio64.sys does not corrupt anything. Its MAPPHYSTOLIN handler opens \Device\PhysicalMemory and maps the entire physical address space, read/write, into whichever…
Exploit Development566 Examining advanced shellcode architecture that eliminates reflective loaders while maintaining position independence and global instance management. This deep dive into the Stardust…
