Security Review #315

Windows includes a file-system virtualization feature that can redirect one local path to another without modifying the original file or leaving a persistent filesystem artifact. We detail three new techniques relying on this feature, that an attacker running as a local administrator can use to blind EDR sensors and bypass built-in Windows defenses such as AMSI and AppLocker.

Large Language Models introduce security issues reminiscent of early-2000s software bugs. Special Token Injection (STI) exploits how LLMs parse structured prompts. This post breaks down what STI is, how it works, where it appears, and why it matters - through a pentester's lens.

In this post we use a local, open-source LLM running offline via Ollama to generate a libFuzzer harness for a C library, compile it with AddressSanitizer, and catch a real stack-buffer-overflow, all reproducible on your own machine.

Device code phishing has a quality that makes it unusually effective: it does not follow the pattern of traditional phishing attacks. The victim ends up granting access to the attacker by completing a genuine sign-in on a Microsoft URL. This post unpacks how the attack works, what it looks like in the logs, and what actually stops it.

In this article, we discuss where the Windows Global Device Identifier lives, how Microsoft issues it, how it is used to track installs across services, and how far you can actually patch it.

Attackers can get valuable data even if they don't have access to the web version of the tool, If they gain access to the system where Octopus is deployed - using default credentials or any server-side vulnerabilit - they can get the master key that encrypts the database.

We found stack-based buffer overflows in the upload handlers of the QNAP file management application named File Station. Since classic control-flow hijacking was blocked by ASLR, NX, stack canaries, and the CGI execution model, we had to find a different way for exploitation.

Permission lives in at least five disjointed systems that Azure doesn't unify. These permission systems don't share identifiers either; they have different logs and data models. An attacker can hop between them without getting caught precisely because defenders rarely look at more than one at a time. We explore how one credential walked through all five permission systems.

We detail the AgentBaiting a malware delivery technique leveraging agentic AI capabilities. An AI agent searching for a new capability such as a Skill or an MCP server can discover a malicious repository, treat the attacker's README as legitimate documentation, and hand the malware installation instructions to the user.

This technical analysis provides the most detailed view yet into the inner workings of the Pegasus spyware system. This includes key technical capabilities such as the infection vectors and methodologies used to infect devices.

Technival analysis of Cruciferra, a sophisticated crypter service used to deliver a wide range of remote access trojans and infostealers. It employs extensive defense-evasion capabilities and over 90 variations of cryptographic functions to obfuscate its data and payloads.

Prior to build 26200.8737, Windows.UI.Storage.dll's private AppResolver factory failed to verify the caller's capabilities, allowing a zero‑capability AppContainer to create a protected "ms‑settings:" handler that a later auto‑elevated fodhelper.exe would run as a High‑integrity process, which the exploit then escalated to a full SYSTEM shell.

We detail how three small bugs in WordPress Core chain into CVE-2026-63030 (wp2shell), a pre-auth RCE. A single anonymous POST to the REST API batch endpoint reaches a SQL injection that leads to direct access to the WordPress and can be escalated to a pre-auth RCE.

An EV charger's charging port is a network port. We found SSH and Telnet services exposed on XCharge C6 chargers with default root:root credentials. A threat actor with a malicious EV can gain immediate full control access on the charger and perform energy theft or potentially cause physical damage.

In this article, we show that serving executables over HTTPS WebDAV and then accessing them via a mapped drive (or directly from a PowerShell/CMD session) makes Windows treat the files as locally‑stored, allowing them to run without SmartScreen, MOTW "downloaded from the Internet" tags, or the "outside your local network" warning.

Analysis of 2 clickfix campaigns leading to the deployment of ACR Stealer, an information-stealing malware family reportedly offered through a malware-as-a-service (MaaS).

It was possible to obtain NT AUTHORITY\SYSTEM privileges from the perspective of an unprivileged user using Foxit PDF Reader. The vulnerability has reported and has been assigned CVE-2026–57239 and requires some form of code execution on the machine already to exploit. Detection and remediation steps can be found at the end of this blog post.

A technical teardown of a multi-stage .NET dropper chain that hides its loaders inside bitmap pixel channels, wraps an Eazfuscator crypter around an academic epidemiology simulator, and delivers AsyncRAT 0.5.8. Includes pixelchain, a keyless end-to-end chain extractor.

We detail and demonstrate CVE‑2026‑50458, a use‑after‑free in the Windows Brokering File System driver (bfs.sys) caused by a race condition in BfsInsertDirectory that fails to increment the reference count when an AVL insert returns an existing entry, allowing multiple threads to dereference a freed object and crash the system.

We show how Flask‑Ninja's HttpBearer class disables a security guarantee by storing the header name and scheme in a public, mutable attribute; an attacker who can deserialize untrusted data (or inject config) can replace those attributes, causing the framework to read an internal proxy header and echo it back in a 401 response, thereby leaking secret information.

Full technical breakdown of eight high-severity NodeBB vulnerabilities, including XSS chains, authentication bypasses, and post hijacking.

We perform the technical analysis of a statically-linked x86-64 Linux ELF backdoor/C2 implant written in C++. When executed, it implements a classic double fork for daemonization, redirects its standard streams to /dev/null, changes directories to /tmp and checks if it was executed with the -nodel argument. If it was, it executes the main backdoor logic. If not, it self-deletes.

Technical analysis and key IOCs of SolidPDFCreator.dll, a single-file stage-1 backdoor loader disguised as a legitimate SolidPDF product.

In this article, we demonstrate how a standard user can redirect WalletService to an attacker-seeded ESE database, load a callback DLL as LocalSystem, and then move the resulting SYSTEM token into the active desktop session.

A missing save/restore of PCRE capture state in nginx’s script engine lets a remote unauthenticated attacker trigger a heap buffer overflow with fully controlled content and length, and separately an information leak of heap pointers sufficient to defeat ASLR. The two primitives chain into reliable pre-auth remote code execution.

How REST batch-route confusion, a scalar SQL injection, WordPress's object cache, the Customizer, and nested REST dispatch formed an unauthenticated path to code execution.

wp2shell is a critical unauthenticated RCE in WordPress core (CVE-2026-63030 + CVE-2026-60137). This post documents the defensive tooling and forensic incident response methodology our team built to answer the questions a defender actually has: Am I on a patched version? Was I already hit? And if I was, where is the evidence?

In this article, I’ll cover Operational Security (OPSEC) techniques for PE files on Windows. I'll also release a toolkit to help check the most common metadata artifacts that both red teams and blue teams often rely on.

Two components can each pass every scan and still combine into a vulnerability that lives in the seam between them. A term, two examples, and a look at why existing tooling misses this class of issue.

We found CVE-2026-50052, a request smuggling vulnerability in Vinyl. All it takes is a two-byte HPACK pseudo-header, :a, to desynchronize the translation layer and smuggle arbitrary HTTP requests through the proxy, enabling cache poisoning, XSS, credential theft, and more.

I have been working on building a command and control framework using the Nim programming language called Conquest. This blog post outlines how I am combining symmetric and asymmetric cryptography to secure C2 traffic, ensuring that both the confidentiality and integrity of the network packets are guaranteed.

The article details how Windows ETW providers and kernel‑level callbacks supply the rich telemetry that EDRs consume, showing how to locate and enumerate the underlying kernel structures and how specific providers or driver/object callbacks can be disabled. It also illustrates practical techniques to evade the telemetry that security solutions rely on.

I identified a double TOCTOU (Time of check Time of use) race condition in VMWare fusion. By exploiting two sequential race windows, an unprivileged user can redirect the binary’s root privileged file creation operations to arbitrary directories on the filesystem. Combined with a carefully crafted GPT disk image and a creative choice of target directory, this vulnerability achieves persistent Local Privilege Escalation as root.

The leaked Windows 2003 source code reveals the exact implementation details that both attackers and defenders need to mimic or detect. By navigating key directories such we show how researchers can turn these concrete implementation quirks into reliable IOCs, more realistic tooling, and hardened detections.