Malware689 A complete walkthrough of loading, disassembling, and decompiling raw Cobalt Strike shellcode in Ghidra, resolving ROR13 API hashes via Google lookup and…
Linux593 A kernel rootkit using ftrace hooks can selectively blind Falco, Tracee, GhostScan, and Decloaker simultaneously by intercepting the BPF iterator, ringbuffer, perf…
Android527 Raelize B.V. researchers demonstrated a practical electromagnetic fault injection (EMFI) attack on Google's TV Streamer 4K, corrupting the MT8696 SoC's execution of…
Reverse Engineering441 es3n1n built defendnot—a tool that deregisters any installed antivirus from Windows Security Center—over a four-day vacation in Seoul. This day-by-day diary traces…
Exploit Development508 R.B.C (g3tsyst3m) builds crudeRAT: a minimal Python C2 implant using QUIC (RFC 9000) as its transport. Starting from an unprivileged shell, the…
Exploit Development351 CVE-2026-34007 and CVE-2026-34008 expose a systemic pattern in QNAP QTS: header injection into shell_exec, hand-rolled SQL escaping, and unremapped container namespaces that…
EDR Evasion520 klezVirus introduces frame swapping — a technique that hides Windows callback frames from EDR call-stack inspectors while preserving return value recovery. Building…
Debug503 A first-principles deep-dive into dumping, analyzing, and patching hard drive firmware: Western Digital custom LZHUF decompression, Samsung SSD deobfuscation, JTAG debugging of…
Malware479 In June 2026, D3Lab documented an Italian-language phishing campaign that delivered a compound browser threat: a malicious Google Chrome extension paired with…
Linux459 CVE-2026-46215 is a use-after-free race in the Linux DRM GEM change_handle ioctl (v6.8–v6.14-rc2) that allows unprivileged LPE to root via pipe_buffer slab…
AI Security Research563 A walkthrough of how an LLM, wrapped in a tiered build-and-test harness, can take a Mythic C2 agent from a one-paragraph spec…
Exploit Development485 A data-only technique that hijacks the x64 Interrupt Descriptor Table (IDT) to achieve kernel code execution on a fully hardened Windows 11…
Linux528 Pack2TheRoot (CVE-2026-41651) is a high-severity local privilege escalation flaw in PackageKit that lets any unprivileged user win a race condition during InstallFiles…
Exploit Development488 DirtyClone (CVE-2026-43503) is a high-severity Linux LPE in the DirtyFrag family. A dropped SKBFL_SHARED_FRAG flag during __pskb_copy_fclone() skb cloning lets in-place IPsec…
Apple Silicon559 Apple Silicon's chain of trust hands the XNU kernel an SMMU/IOMMU configuration that iBoot builds once and the OS never re-verifies. An…
Reverse Engineering481 A walkthrough of a recurring type-confusion pattern in Windows RPC servers: when an interface accepts an FC_BINDING_CONTEXT handle without checking its object…
Containers456 A deep technical walkthrough of ipv6_frag_escape, a public proof-of-concept exploit that converts a Linux kernel IPv6 fragmentation linear overflow into a reliable…
