Security Review #262

Through "Confused Deputy" attacks, Dependabot (and other GitHub bots) can be tricked into merging malicious code. It can also escalate to full command injection via crafted branch names and even bypass branch protection rules. Additionally, we disclose two new TTPs to build upon previously known techniques.

The HTML specification has been updated to escape '<' and '>' in attributes to prevent mutation XSS (mXSS) vulnerabilities. This post details the reasoning behind this change and explains why this update improves security.

In this article, we explore how SQL line comments can open the door to unexpected injection vulnerabilities in several PostgreSQL client libraries.

What if you could influence an LLM's output not by breaking its rules, but by bending its probabilities? In this deep-dive, we explore how small changes in user input (down to a single token) can shift the balance between "true" and "false", triggering radically different completions.

Reflective Kerberos Relay Attack does not only bypass the restrictions put in place for NTLM reflection but it also exploits a privilege-escalation vulnerability. If you can coerce any Windows host to authenticate back to you via SMB, you can relay the computer account’s Kerberos ticket back to the host and obtain NT AUTHORITY\SYSTEM privileges and thereby Remote Code Execution.

Details on the voice phishing (vishing) threat, and strategic recommendations and best practices to stay ahead of it.

We transform an older Google Pixel 3 XL into a highly portable, clamshell-style palmtop. This setup serves as a convenient alternative to carrying a full-sized laptop or struggling with a smartphone's virtual keyboard for complex technical tasks. It offers comfortable typing and an efficient portability.

In this article, we detail the Hanwha firmware file decryption method. More globally, we demonstrate how a persistent attacker is going to reverse-engineer hardcoded password/encryption scheme in IoT devices.

CVE-2025-47934 allows attackers to spoof arbitrary signatures and encrypted emails that appear as valid in OpenPGP.js. The only requirement is access to a single valid signed message from the target author ("Alice").

A step-by-step guide to setup a lab infrastructure simulating compromise by phishing that leverages Living-Off-the-Land Binaries (LOLBAS) technique often used by attackers. To detect and respond we use Wazuh as our XDR platform to monitor Sysmon and Suricata network traffic logs, to further respond to the threat.

SSDs don't behave like HDDs - especially when it comes to deleted files. One key reason: the TRIM command. TRIM makes SSDs behave different to magnetic hard drives when it comes to recovering deleted evidence. This article breaks down what TRIM actually does, how SSDs respond, and what forensic experts need to know when handling modern storage.

BEC (Business Email Compromise) is a type of social engineering and phishing-based attack that targets companies by tricking employees - particularly those in finance or executive roles. In this post, we’ll take a closer look at how attackers maintain persistence and exfiltrate data after gaining initial access in a BEC attack.

BadSuccessor is a critical attack technique that enables low-privileged users to escalate privileges to Domain Admin. This post explains the practical implications of the attack, how it evades detection in default auditing configuration, and how defenders can reliably detect such abuse by configuring targeted object-level auditing in Active Directory.

When executing malware in contested territory clearing your tracks is very important. Hence the Lloyd Labs self delete technique which has had interpretations published by many researchers throughout the years. In this blog, we explore why this doesn’t work as expected in 24H2 and how to fix it

In this article, we will look at the root cause and walk through how we exploited a vulnerability leading to arbitrary read/write access in V8, the JavaScript engine used by Chrome and other Chromium-based browsers.

We describe a technique for remotely dumping Windows local credentials (SAM) by leveraging Shadow Snapshots. Using Shadow Snapshots makes it possible to access the required registry hives (SAM, SYSTEM, and/or SECURITY) directly over SMB, without executing code on the target machine.

In this article, we present CVE-2025-33073, a logical vulnerability which bypasses NTLM reflection mitigations and allows an authenticated remote attacker to execute arbitrary commands as SYSTEM on any machine which does not enforce SMB signing.

We discuss Hydroph0bia (CVE-2025-4275), a flaw that allows attackers to bypass SecureBoot protections by manipulating certain NVRAM variables related to Insyde H2O firmware updates.

This publication provides an overview of techniques used to compromise Active Directory, and recommended strategies to mitigate these techniques. By implementing the recommendations in this publication, organisations can significantly improve their Active Directory security, and therefore their overall network security posture.

We dive into HelloTDS, a sophisticated Traffic Direction System (TDS) infrastructure that facilitates FakeCaptcha scams, malware distribution, and other malicious activities. HelloTDS fingerprints users based on their network details and browser behavior to selectively deliver harmful content.

in this article, we'll walk you through the concept of DNS rebinding from scratch, demystify how it works, and explore why it’s a serious browser-based security issue. Finally, we'll go over practical steps you can take to protect yourself or your application from this often-overlooked but potent attack vector.

We describe a security vulnerability discovered in Netflix’s software supply chain leading to remote command execution (RCE). The vulnerability is a dependency confusion, occurring when internal package names conflict with publicly available package repositories, and allowing attackers to inject malicious code during automated software builds.

We uncovered a malware campaign exploiting expired and released Discord invite links allowing attackers to redirect users from trusted sources to malicious servers. Attackers combined the ClickFix phishing technique, multi-stage loaders, and time-based evasions to stealthily deliver AsyncRAT, and a customized Skuld Stealer targeting crypto wallets.

In this blog, I’m going to talk about some of the weirdness in Suricata when processing URL-encoded data and will go deep into detail about one technical aspect of Suricata rule creation.

CVE-2025-49091 is a vulnerability in KDE's terminal emulator Konsole. 10th June 2025. On vulnerable systems remote code execution from a visited website is possible if the user allows loading of certain URL schemes (telnet://, rlogin:// or ssh://) in their web browser.

The article discusses SinkVPN, a technique that enables non-admin users to create malicious VPN connections that can divert and block cloud-bound traffic, evading security measures. It highlights the ease of implementation across various systems and emphasizes the need for organizations to monitor and control VPN configurations to prevent misuse.

In this post, I’ll demonstrate how to leverage the Performance Logs and Alerts APIs to create what is essentially a remote, agentless EDR solution. This approach also offers unique advantages for offensive engineers who need stealthy monitoring capabilities and for defenders who want to extend their visibility without the complexity of traditional agent deployment.

This article explores the types of malicious binaries that threat actors are developing for use in attacks against Linux-based environments. While ELF-based malware is not new, these malware families and the types of attack techniques they involve are likely to evolve toward the targeting of cloud infrastructure.

We identified primarily design flaws in ISPConfig user creation/edit functionality, which allow a client user to escalate their privileges to superadmin. Additionally, the language modification feature enables arbitrary PHP code injection due to improper input validation.

I have identified Prompt Injection attacks in numerous implementations and applications, and I’ve decided to write a blog post to recommend different methodologies I experimented with that can prevent prompt injection at scale.

OneLogin was found to have security vulnerabilities in its AD Connector service that exposed authentication credentials and enabled account impersonation. Attackers could access credentials and signing keys to generate valid JWT tokens, allowing user impersonation.

A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac. When an archived virtual machine is restored, the prl_vmarchiver tool decompresses the file and writes the content back to its original location using root privileges.

In this blog post, we’ll be digging into a pretty esoteric PHP Object Injection vulnerability. While the affected versions are considered obsolete by today’s standards, the vulnerability offers a fascinating glimpse into how this flaw was introduced and how it might be exploited in real-world scenarios - and still serves as a timely reminder of the dangers of insecure deserialization.

Heroes of Might and Magic V is a turn-based strategy video game developed by Nival Interactive. A map editor is provided with the video game. Players can create maps that can be played in solo or multiplayer. This is an interesting attack vector. In this article we will see how to execute malicious code from a Heroes of Might and Magic V maps.

Audit Logging is the process of tracking changes to table records in a database and is an important part of application security and change management. Let's look how Audit Logs are implemented at the database level.

We detail a use-after-free vulnerability in the Linux CAN BCM kernel subsystem and also highlights a potential pattern that has been present in the subsystem, as at least another issue has already been reported and fixed.

This blog post will explore different methods for scoping incidents within AWS using primarily CloudTrail logging, focusing on key identifiers such as Access Key ID, Principal ID, Username, Source ARN, and Source IP, along with the utility of Geolocational information.

In this blog post, I wanted to share my experience testing different sample watermarking implementations and ways in which have managed to circumvent intended protections.

Microsoft changed the way the Entra Connect Connect Sync agent authenticates to Entra ID. These changes affect attacker tradecraft, as we can no longer export the sync account credentials; however, attackers can still take advantage of an Entra Connect sync account compromise and gain new opportunities that arise from the changes.

We propose a new approach on how to fuzz WebSocket messages, and also move past the manual analysis required by most existing tools. In short, we send prerequisite messages and capture all resulting messages within a configurable window, enabling correlation between sent and received messages for effective analysis.

Easy Auth can be abused to elevate privileges via delegated permissions if an attacker has the right privileges. In some scenarios, abuse of delegated permissions through Easy Auth could lead to account takeover, or cross-tenant user takeover. This is likely a niche technique, and abuse requires several pre-conditions to be met.

I identified a vulnerability impacting GitHub's dependabot-core repository that could have allowed an attacker to conduct a supply chain attack on GitHub users by backdooring the Dependabot containers. The cause of the vulnerability was a race condition in a workflow that maintainers would trigger to perform integration testing on approved pull requests prior to merging.

BEC (Business Email Compromise) is a type of social engineering and phishing-based attack that targets companies by tricking employees - particularly those in finance or executive roles. In this post, I'll focus on how BEC attacks begin - highlighting initial access techniques and the latest trends shaping early-stage compromise.

We discovered three malicious VS Code extensions that target Solidity developers on Windows. They employ complex infection chains involving a payload hidden inside an image file hosted on the Internet Archive, establish persistence on the victim system, and exfiltrates victim data and credentials to attacker infrastructure.

I identified a small denial of service vulnerability on Nuxt. The ability to trick the server into rendering the payload on main routes could force the caching of the response on these routes. This could severely impact the application's availability, as the page content would be entirely altered, rendering the site unusable.

App-based privilege escalation threats occur when an attacker leverages application permissions to gain elevated access within the Microsoft Entra ID environment. These attacks are particularly dangerous because they bypass traditional security measures, like multi-factor authentication (MFA).

Hypervisor-enforced Paging Translation (HVPT) is a Windows Hyper-V feature that helps protect guest virtual address (GVA) to guest physical address (GPA) translation. In this blog, we will cover the attacks HVPT is designed to help protect against, and dive into how HVPT helps protects GVA to GPA translations.

In this second part, we delve into the challenges and insights gained from fuzz testing PCRE2, a widely used regex library. We will discuss how to improve fuzzing accuracy, including enabling JIT fuzzing and investigating differential fuzzing, and highlight what challenges still persist.

NTLM relay is a technique of standing between a client and a server to perform actions on the server while impersonating the client. Protections such as SMB signing or MIC allow to limit the actions of an attacker. This article goes into detail about this technique to understand how it works and what are its limits.