AI Security Research491 0xkato's walkthrough of the mechanisms inside modern transformer-based LLMs — tokenization, embeddings, Rotary Position Embeddings, attention with Q/K/V and causal masking, multi-head…
Exploit Development237 Varik Matevosyan's step-by-step ladder from a single artificial OOB on a double-array butterfly to stable cage-free read64/write64 in JavaScriptCore. Covers heap grooming,…
EDR Evasion560 Mohamed Alzhrani's LACUNA Chain combines BYOUD-Gap, the ETW-Ti APC window, win32u's 1,242 NOP gaps, ntdll/kernelbase ghost functions, BYOUD-MF machine-frame RSP teleport, BYOUD-RT…
kernel403 A deep technical walkthrough of how Windows on ARM (WoA) discovers, initializes and dispatches interrupts through the Generic Interrupt Controller (GIC) —…
AI Security Research530 Andy Gill's ZephrSec write-up of an autonomous vulnerability hunting system built around Claude Code and the Model Context Protocol: 8 MCP servers,…
Exploit Development342 A full-pipeline walkthrough: build a vulnerable Windows console program, take RIP with a strcpy overflow, then use rop_scanner — an offline ROP…
Reverse Engineering254 mrexodia publishes Striga: a deliberately small Python lifter that translates x86_64 instructions to LLVM IR using Capstone and a new set of…
Vulnerability Analysis308 An independent PoC reliably bug-checks Windows 11 25H2 (26100.8655) by spraying malformed batched virtualisation-mapping messages at bindflt.sys, faulting inside BfValidateShortName at +0x23783.…
Active Directory331 Decoy accounts in Active Directory look legitimate at the schema level but cannot fake behavioural history. This walkthrough shows how to read…
Exploit Development469 Synacktiv’s open-source DCOMIllusionist takes James Forshaw’s .NET DCOM deserialization primitive — the same one that seeded the “Potato” family — and turns…
AI Security Research346 A Quarkslab red team exercise stitches insecure LLM output handling, missing cookie flags and a conversation-sharing IDOR into a single-click admin account…
Exploit Development374 Eleven months after RarLab shipped WinRAR 7.13 to fix CVE-2025-8088, two Russia-aligned APT clusters (Earth Dahu / Gamaredon and SHADOW-EARTH-066 / UAC-0226)…
Exploit Development177 Meeting-room cameras and conference-room tablets are some of the least-monitored, most insecurely-configured attack surfaces in an enterprise. Spaceraccoon (Eugene Lim) walks through…
Cryptography285 Trail of Bits and the badkeys project found hundreds of RSA and DSA keys in the wild whose moduli have regularly spaced…
Exploit Development426 CVE-2026-40369 is an unprivileged arbitrary 12-byte kernel write in nt!ExpGetProcessInformation, reachable from Chrome/Edge/Firefox renderer sandboxes via NtQuerySystemInformation. A walk through the unchecked…
Exploit Development460 A SYSTEM shell is the top of the user-mode pile, but it is not the kernel. This walkthrough of Windows HVCI in…
Exploit Development344 Part 2 of NCC Group's CVE-2018-8611 series by Aaron Adams: a full walk-through of the Kernel Transaction Manager patch, including how to…
