Security Review #319

In this publication, we present the first full reverse engineering of the Windows Defender Boot-Time Removal driver (BTR.sys) and its proprietary transaction format. We dissect its encrypted configuration mechanism, integrity validation logic, and execution pipeline, and demonstrate how this legitimate remediation component can be transformed into a universal kernel operation engine.

Hitting AI guardrails on frontier models is annoying, therefore this blog explains them and describes how to work around them.

We provide a structured, seven‑phase workflow for investigating suspicious Git commits - from case registration and evidence preservation, through technical analysis, stakeholder interviews, and credential review, to containment, root‑cause mitigation, and final reporting - emphasizing thorough documentation, hash‑based integrity, and the importance of commit signing and audit‑log retention to reliably attribute and remediate supply‑chain compromises.

We introduce the CRLF-Powered desync attacks. They exploit HTTP header injection in Nginx (e.g., using $uri in proxy_pass) to achieve request smuggling, response queue poisoning, cache poisoning, XSS, session hijacking and cross-user account takeover, including stealing HTTPOnly cookies and injecting malicious Set-Cookie headers.

We analyze C2Looper, a new backdoor likely affiliated with an initial access broker for ransomware that uses GitHub for C2 communications.

n8n uses a user-supplied schema name as a bare object key. Set it to __proto__, pollute the prototype, chain into RCE via the Git node. One request, full shell.

This post explains how macOS EDR tools (via the built‑in spindump utility) unwind ARM64 call stacks, details the ARM64 stack layout, compact‑unwind recipes, and pointer‑authentication (PAC) that protect return addresses, and then shows how to craft PAC‑aware synthetic frames and a trampoline gadget to obfuscate a stack trace and evade detection on Apple‑Silicon systems.

In this article, I detail how Codex found authorization and replay flaws plus a race condition in EggGame - and used them to turn a simple browser egg into a legendary Roc.

We detail how legitimate SentinelOne installers and accessible COM interfaces can be abused to bypass Protected Process Light (PPL) protections and execute unsigned code - completely bypassing the need for kernel vulnerabilities or traditional exploits.

We first review the concepts of hardware boot components security, then detail vulnerabilities affecting them allowing unsigned or malicious code to run despite valid signatures. The impact stems from ignored verification results, incorrect coverage of signed metadata, misuse of authority or rollback policies, and TOCTOU or pointer-swap attacks that break secure-boot enforcement and remote attestation.

N-Able's PassPortal extension, on Chrome and Edge allowed any site or iframe a user is presented with to gain complete, persisted access to the decrypted vault.

In this article, we'll explore web fuzzing from the ground up: what it actually is, the tooling and wordlists that make it work, and how to fuzz to discover more content and find more security vulnerabilities.

Technical writeup for CVE-2026-6837, a post-authentication command injection vulnerability in Zyxel export-cgi PKCS#12 export handling.

This post will primarily focus on the Remote Code Execution vulnerability (CVE-2026-52813) in Gogs, an open-source Git hosting platform like GitHub or GitLab. But I'll also explain a logic bug to write on read-only repositories (CVE-2026-52810), together with an XSS vulnerability in the Jupyter rendering library Gogs was using

Instead of leaving behind recognizable fingerprints from public tooling, adversaries can now generate realistic device names that blend naturally into enterprise environments. This blog explores how that changes Entra ID detection and what are the behavioral signals that still expose these attacks.

I uncovered 14 critical and high severity vulnerabilities, including multiple unauthenticated prompt-injection to RCE chains, across seven AI orchestration platforms.

We explain how we managed to have BOFScale leveraging a modified Tailscale daemon compiled as a BOF-PE to seamlessly hide C2 traffic and DERP relays behind CDNs using standard WebSockets.

In this post, we’re going to walk through a vulnerability a Heap Overflow vulnerability in Citrix NetScaler and show how it can be used to achieve Remote Code Execution.

This is a story about what happens when a widely-used image cropping library ships android:exported="true" on an Activity and root-scoped <paths> on a FileProvider as its defaults.

A GDB walkthrough of House of Apple 2, from FSOP to stack pivot and ROP on glibc 2.43. This article provides an interactive walkthrough that readers can follow alongside the sandbox to develop a more intuitive understanding of the primitive.

Hardware key attestation lets an Android app prove to its backend that a key lives in secure hardware on a locked, verified device. This article opens the mechanism from the analyst's chair, from the certificate chain and the attestation extension down to the root of trust, then shows a simple bypass that never touches the secure hardware.

We discovered an unauthenticated RCE flaw in CircleCI's MCP server allowing for full pipeline takeover. The flaw lies in sending Host: localhost header with no Origin that results in passing security checks.

We explain how TURN (Traversal Using Relays around NAT) servers, a video conferencing relay host, can redirect traffic to C2.

How I chained a conditional SysReptor Host header account takeover with Ghostscript and GnuPG behaviours to achieve application-user RCE.

GhostLock (CVE-2026-43499) is a Linux kernel vulnerability that exists in every major distribution since 2011. After turning it into a stable privilege escalation and container escape, we migrated the exploit for Android.

ChatMate, the first documented instance of remote prompt execution, shows how a malicious document can lead to sandbox escape.

We dive into ollvm, an obfuscation framework fused directly into an LLVM 22 checkout, and detail what obfuscation actually does at each layer.