Security Review #317

A full reverse-engineering teardown of the CrowdStrike Falcon sensor: the six kernel callback sources, the WFP network engine, the file-system minifilter, the cspcm4 broker, the user-mode service (DNS / AMSI / browser / Identity Protection), and the cloud-loaded detection engine - plus every structural blind spot. How Falcon sees you, and where the seams are.

In this article, we will cover two ways to execute actions in agents without declaring a hook. In Codex, project-scoped Model Context Protocol (MCP) configurations cause Codex to start an attacker-controlled process. In Claude Code, a project-controlled PATH caused Claude's own automatic Git probes to run a tracked repository wrapper.

It's quite common for webmail clients to render untrusted CSS in a trusted UI. They attempt to make this safe using CSS sanitization. In this paper I'm going to show you how to break out of trust boundaries, exfiltrate tokens, compromise 3rd party websites and even steal passwords.

In this article, we detail how a hidden .mcp.json file lets attackers achieve remote code execution in Claude Code via a malicious pull request - no user action required.

A proof of concept: fine-tuning small open-weight coding models into silent backdoors that execute code on the machine of anyone who connects to them.

Django's admin auto-linked URLField values without validating the scheme -- a stored javascript: value rendered as a live link.

Technical deep dive into CVE-2026-66066: how a .mat file declared as image/png chains into arbitrary file read and remote code execution as root on a default Ruby on Rails application.

This post will provide a high-level overview of TLS and the steps that should be taken to implement it in a secure manner that will meet just about any compliance requirements. A deep dive will then be taken to help understand how TLS works and why these configuration steps are important.

We had complete static devirtualization of Tencent VM obfuscation for quite some time now, and we will explain in great detail the Tencent virtual machine obfuscation, how it supports CET and SEH, and how it is weak against guided symbolic evaluation.

After reviewing Flowise, a popular AI agent/workflow platform, and its history of critical security advisories, we uncovered 6 new remote code execution vulnerabilities via Pandas (CSVAgent), sandbox escape, environment variables, datasource options, and the SQL database.

In this second part of the series, we move from buffer overflows to a Write-What-Where primitive. Facing register volatility across kernel call stacks, I'll orchestrate a stack pivot into a 32-bit mapped fake stack and dynamically reconstruct the legitimate kernel stack using _KTHREAD's InitialStack anchor.

Arbitrary read/write is not code execution. This post walks the road from read64/write64 to a real native call inside the WebContent sandbox on iOS 26.1: disabling the GC, parking a thread inside dlopen, making dyld's own allocator install our interpose table, the three locks in that path which 26.1 now checks in ways 18.6 did not - and the default-false embedder preference that silently disables the phone-number trigger on stock hardware.

This blog details a technique related to Windows Hello for Business (WHFB) design: the ability to perform single-sign on with the backing cryptographic keys from a user session, without needing the PIN or other information/user presence. We will see how we can utilize this to request Primary Refresh Tokens (PRTs), and how we can use this to perform device registration by using the WHFB key as a FIDO key/passkey.

Windows Provisioning Packages are used by Administrators to deploy configuration scripts on Windows environments by using a container format. We review how threat actors with elevated privileges could abuse provisioning packages to hide arbitrary payloads and commands within these containers, and discuss detection mechanims.

We show that an autonomous AI pipeline can invent, validate and weaponize novel HTTP‑desync attacks- evealing dozens of new triggers, a dangling‑byte technique, shared‑parser confusion, and other exploits that compromised real‑world targets - and provides an open‑source blueprint for building similar AI‑driven security‑research systems.

We detail a use-after-free vulnerability in the Linux kernel bridge (net/bridge) Spanning Tree Protocol (STP) implementation. A bridge that is administratively down while kernel STP is enabled arms periodic STP timers which are never deleted. The backing net_device is freed with a timer list still queued on a per-CPU timer base. The result is a slab use-after-free in the kmalloc-cg-8k cache.

In this first part, we explore the fundamentals of kernel stack corruption. I’ll be bypassing Supervisor Mode Execution Prevention (SMEP) with a CR4-flipping ROP chain, steal the SYSTEM token via Direct Kernel Object Manipulation (DKOM), and calculate precise stack deltas to restore execution context and prevent kernel panics.

In this last part, we mathematically resolve absolute kernel addresses using double-pipe grooming. By forging unbuffered IRP structures, avoiding IoCompleteRequest crashes via PeekNamedPipe, and parsing ntoskrnl.exe PE exports to perform an _EPROCESS token swap, I’ll be able to achieve a stable Local Privilege Escalation.

How to hide the Chrome Remote Desktop connection banner by patching a single dialog resource, then abuse host.json and MSI packaging to turn CRD into a quiet persistent access channel.

This post walks through a set of TTPs that red teams can integrate into authorized operations to demonstrate rerouting, interception, and modification of LLM traffic. We also cover things defenders can look out for.

We found that Microsoft's UCPD driver stores a signed, code‑less PE blob in the registry (the “DR” value) that contains an encrypted list of Microsoft‑signed executables used for dynamic "deny‑list" rules. However current blobs can’t be decoded due to a flaw in the implementation, making the dynamic‑rule mechanism effectively dead despite its design for policy updates.

In this part, we abandon execution hijacking entirely in favor of pure Data-Only attacks. Facing modern Windows 11 mitigations that strip kernel pointer leaks, I’ll exploit an out-of-bounds pool read, pivot to NonPagedPoolNx using Named Pipes.

GhostLock (CVE-2026-43499) is a Linux kernel vulnerability that exists in every major distribution since 2011. Triggering the bug does not require any special kernel config or privilege. This writeup covers the technical details of the exploit.

This is a technical breakdown of my latest finding, which allowed me to read files on my target (including secrets and aws role) which led to the compromise of their customers' PII and many other stuff, just by changing my avatar (and some config mistakes on their side)

In this blog we will turn a heap overflow in paged pool into a linear OOB read and write through WNF objects, then into an arbitrary read and write primitive through I/O Rings. This exploit is written for Windows 11 25H2, so we will also use ALPC objects to get the infoleak we need for privilege escalation. I will show two variants for that final step: the classic token stealing route and a parent spoofing route with winlogon.exe as parent.

We uncover IonBanana, a subtle SpiderMonkey IonMonkey just-in-time miscompilation that can be exploited to achieve arbitrary code execution in the Firefox content process. We also used it to pwn Tor Browser, showing that even after heavy auditing, JIT compilers still have plenty of places for a banana peel to hide.

Coming from V8 and landing in JavaScriptCore. Building the addrof/fakeobj/read64/write64 ladder from a single out-of-bounds write, and the JSC-specific walls (the gigacage, butterflies, NaN-boxing) that make the last step harder than it is in V8.

Linux kernel page-cache poisoning via AES-256 chosen-plaintext on the RxGK RESPONSE path and why authenticated encryption did not stop it.

Explore a Jellyfin remote code execution flaw where inconsistent validation enables FFmpeg argument injection and unauthenticated code execution.

This will be a blog series where we'll do a deep dive into the Mercusys MB115-4G router. In this first post, we'll cover the workflow from receiving the device to gaining a root shell via UART and extracting the firmware. In the upcoming posts, we'll analyze the firmware searching for vulnerabilities.

In this article we look for sideloadable DLLs with ProcMon and x64dbg, then build a Rust proxy DLL that forwards every export to the real library while your implant runs behind it. The host app keeps working. The signed binary keeps signing.

We analyze a self-replicating worm that is spreading across the npm registry using binding.gyp, a file that triggers code execution during npm install without touching package.json scripts. The attack bypasses conventional security tools and has already compromised dozens of packages across multiple maintainer accounts.

In this post we will exploit a classic kernel-mode stack buffer overflow on Windows 7 SP1 x86. This target is intentionally friendly, and that is a feature, not a bug. It lets us focus on the fundamentals before modern mitigations start punching us in the face.

We delve into the technical details of CVE-2026-25166 and demonstrate how an insecure deserialisation in imgmgr.exe (Windows ADK) can bypass Application Control. We also provide defenders with block list recommendation.