buffer overflow672 A single byte written past the end of a PagedPool allocation in a Windows 10 x64 kernel driver, followed all the way…
Active Directory950 Active Directory stores Unicode characters its own LDAP server cannot search for. Semperis researcher Shai Laron turned that gap into KerberLoss (CVE-2026-25177)…
.NET1.2k Windows Application Control (formerly WDAC) blocks binaries that are not signed by an approved authority — but a Microsoft-signed binary that deserialises…
Memory Management689 A technical deep dive into NTDLL unhooking techniques using KnownDlls section mapping, Virtual Address Descriptors, and RWX page detection to bypass EDR…
Bootkit650 RedLotus is a Windows UEFI bootkit written in Rust that executes before the kernel and bypasses Driver Signature Enforcement (DSE) using manual…
Browser Security625 How the Wipeload chain turns an ALPC use-after-free into a stable cross-process read/write primitive and escapes the Chrome renderer sandbox — reclaiming…
Browser Security1.3k CVE-2026-40369 is an unprivileged twelve-byte arbitrary kernel write in nt!ExpGetProcessInformation, reachable via NtQuerySystemInformation from browser renderer sandboxes. Root-cause analysis and a full…
Malware2.3k A reverse-engineering walkthrough of SakDriver, a Windows kernel-mode rootkit first mistaken for a Cobalt Strike Beacon. It patches ETW, hides processes via…
Privilege Escalation931 A comprehensive technical analysis of CVE-2026-57239, a privilege escalation vulnerability in Foxit PDF Reader that allows unprivileged users to escalate to NT…
windows1.6k Deep technical analysis of Windows Global Device Identifier (GDID), a persistent 64-bit device identifier stored in HKCU and used by Microsoft for…
Exploit Development682 CVE-2026-58629 is a double-fetch bug in the Windows graphics kernel (dxgkrnl). When D3DKMTCreateAllocation rolls back a failed create, it re-reads a user-controlled…
Reverse Engineering911 A user-controlled 64-bit record count multiplied by the 0x228 record size wraps to zero in the Windows tcpip.sys WFP ALE deserialiser, defeating…
