Malware20 Fox-IT (NCC Group) details RemotePE, a North-Korean Lazarus in-memory RAT delivered through a three-stage chain — DPAPILoader (environmentally-keyed first-stage), RemotePELoader (HellsGate /…
Exploit Development11 A heap use-after-free in NASM's response-file parser (CVE-2026-6068) sounds boring — until the dangling pointer is reused as a filename for fopen().…
Application Security16 CVE-2025-49113 is a critical authenticated remote-code-execution flaw in Roundcube webmail — the default in cPanel, Plesk, and many hosting stacks — caused…
Hardware24 TREVEX is a post-silicon black-box CPU fuzzer from CISPA designed to discover data-flow transient execution vulnerabilities without needing RTL access, an ISA…
Exploit Development17 CVE-2025-54539 is a deserialization policy bypass in Apache.NMS.AMQP (≤ 2.3.0) that lets a single 290-byte AMQP message reach BinaryFormatter inside an unsuspecting…
ASM13 A tiny funny FASM program for Windows where BX generously shares its value with AX using mov ax, bx, turning a simple…
EDR786 A walkthrough of "APC Tandem", a stealth Windows process-injection technique that replaces WriteProcessMemory, CreateRemoteThread and VirtualAllocEx with a chain of less-watched primitives…
Cybersecurity20 A structured walkthrough of how virtual memory really works on modern operating systems — from contiguous allocation and external fragmentation to paging,…
Application Security18 A practical, security-engineering view of the essential iOS hardening steps every iPhone user — and especially high-risk targets — should apply: Lockdown…
pets8 The Akita Inu is a national treasure of Japan and a symbol of loyalty and courage. Discover the history, character, care, and…
Hardware13 External PCIe DMA cheats are hard because the cheat code runs on another PC. Detection must move to PCIe fingerprints, IOMMU faults,…
AMSI14 SYLK is an ancient spreadsheet format, but Excel still supports it. GhostWolf Lab shows how .slk files can carry XLM macros, masquerade…
MacOS17 CVE-2024-32002 turns git clone --recursive into RCE on case-insensitive filesystems. A crafted submodule + symlink can plant a Git hook in .git…
GhostTree abuses NTFS junctions to create recursive, near-endless valid paths. Recursive scanners and EDRs can hang in the maze while malware in…
Uncategorized8 DLL proxy loading lets a fake DLL forward every expected export to the real one while running a payload inside a trusted…
Active Directory4 Printers are not harmless office boxes. Misconfigured LDAP, SMTP, SMB or SNMP can leak domain creds, enabling AD enumeration, relay attacks and…
Uncategorized9 Linux CR Pinning was meant to stop old SMEP/SMAP bypass tricks, but this research shows a clever two-shot path back: abuse the…
