Security Review #318

Security Assertion Markup Language (SAML) is a widely deployed standard for Single Sign-On (SSO) and a recurring source of critical authentication vulnerabilities. In this post we will review real-world SAML vulnerabilities - signature stripping, XML signature wrapping, comment injection, and the 2025 wave of digest-confusion and parser-differential attacks.

By modifying the bottom layers of the memory hierarchy to rewire the physical DRAM address translations, we scramble platform memory, exposing protected regions of DRAM - carveouts invisible even to the kernel. When the address translations break, so do the security primitives built on them, and we unlock everything.

We catalog how arbitrary file‑write bugs can be turned into remote code execution, and show that the real impact hinges on knowing the target environment. We use that knowledge to fingerprint writable, re‑readable paths, and once profiled how to reliably give code execution even in stripped‑down containers.

Eleven frontier models, one malicious MCP server. Ask them to leak your credentials and they refuse. Split the request into multiple harmless fragments and the refusal turns into 100% compliance. This is because to the model the task now looks like filling in a form, not stealing. Here is how, and why the MCP servers you install matter more than they look.

Browser extensions can turn Chromium into a persistent foothold. This post introduces a way to silently install extensions turning Chromium browsers into a command and control (C2) platform for persistent cookie theft.

A technical deep-dive into a production EDR kernel sensor: bootstrap, authenticated IPC, behavioral classification pipeline, WFP networking, and process termination, documenting important drivers in bitdefender EDR antigravity zone, and analysing how it catches bad guys.

In this second part we detail how to bypass WSUS signature checks using .esd or .txt file extensions and deploy unsigned payloads via BITS for stealthy C2 persistence.

A review of Blacklight, an open-source security research toolkit for discovering and analyzing AI agent artifacts that reside on endpoints. It helps authorized security teams assess exposure, guide next decisions, and develop detection and hardening guidance

A technical analysis of AmnesiaStealer, a multi-stage Rust-based macOS infostealer spread through a counterfeit GitHub download page that captures the login password, reaches for macOS bypasses Apple has already patched, and can hand the operator live, hidden control of the victim's Chromium browser to steal authenticated sessions.

Cookie protections have made traditional session theft harder, but they do not eliminate the value of an authenticated browser session to adversaries. This post explores enabling the Chrome DevTools Protocol (CDP) inside a running Chromium browser to perform post-ex activities such as browser enumeration, cookie theft, and browser takeover.

We uncovered CVE-2026-17106, a container-to-host arbitrary file-write vulnerability in Docker's docker cp command. A malicious container or sandbox could exploit the copy process to create or overwrite files outside the destination selected by the user, potentially enabling code execution on the machine running the Docker CLI.

A deep dive into WSUS exploitation, showing how NTLM relay grants SQL database access and lets attackers push malicious updates to targets.

In this blog, we analyze the latest Operation Dream Job campaign, walking through the complete attack chain and providing a technical analysis of the malware and the novel techniques employed throughout the operation, offering new insights into the group’s evolving modus operandi.

By storing the NTUSER.MAN file in the user profile directory, all the associated registry modifications are loaded into the system without invoking APIs associated with registry key modifications, which are monitored by endpoint detection and response controls.

This post releases a new universal chain that turns a single Marshal.load into command execution on Ruby, built with new gadgets from untapped sources as well as old gadgets put to new use.

Write-up on three authorization failures in Frappe - one at the object level, one at the field level, and one in the lifetime of the grant itself - that allowed an attacker to access data they aren't authorized to.

Sending an RFC 9114-compliant trailer HEADERS frame to music.youtube.com causes Google's ESF (Edge Side Frontend) to hang for 60 seconds before closing the connection with QUIC INTERNAL_ERROR (0x0001).

Private Cloud Compute (PCC) is a core Apple Intelligence feature, allowing on-device for AI inference requests. I found CVE-2026-20685, a path traversal in the code that provisions PCC nodes, darwin-init, that lets an attacker write files as root and compromises privacy and security guarantees in PCC.

SCTPhantom is a Linux kernel use-after-free in SCTP Dynamic Address Reconfiguration. An ordered ASCONF sequence can remove a transport and then reuse its stale pointer, leaving the association with dangling path references.

We uncovered a PowerShell-based payload delivery using Vercel-hosted infrastructure, including Grape2.zip, UltraToolliteSetup.exe, and draw.zip. Analysis of the hosted scripts revealed hidden PowerShell execution, obfuscation, dynamically constructed IEX, and a decoy prompt.

I built a fake stack in user-mode memory and pivoted the kernel into it. SMAP (Supervisor Mode Access Prevention) should have thrown a #PF and blue-screened the box. Instead, I got SYSTEM. This is the three-experiment proof that Windows leaves its own guard down.

A pre-authentication XSS to RCE chain in WordPress Core that allows unauthenticated attackers to achieve remote code execution on any default WordPress installation through the login page.

This article details two new Active Directory privilege escalation vulnerabilities: KerberLoss (CVE-2026-25177) and ResetNightmare (CVE-2026-27912). Each vulnerability takes a unique approach to causing identity confusion on DCs, resulting in various impacts. The second enables a low-privileged user to instantly gain Domain Admin privileges.

We found 2 vulnerabilities in Microsoft's Python in Excel: a symbolic link flaw that lets escalate privilege escalation and a Trusted Records bypass (CVE-2026-45459).

We uncovered a vulnerability in Rovo, Atlassian's enterprise AI assistant with access to Jira, Confluence, Microsoft 365, Google Workspace, Slack, and more. Dubbed RovoBlast, a single click on a link triggers the attacker's embedded instructions and forces Rovo to accept externally supplied parameters as trusted inputs within a user's session.

I found a heap out-of-bounds read/write in KVM';s SEV-SNP Page State Change handler. A malicious guest VM can corrupt host kernel heap memory and leak its layout, across the VM boundary, as many times as it wants.

A single misconfigured listening socket on FIMER's React 2 hybrid inverter lets an unauthenticated attacker send commands straight to the Supervisor MCU that governs the device's grid protections.

We found a security vulnerability in Apple's Beats Studio Buds' pairing mechanism. The devices were found vulnerable to an insecure Bluetooth pairing window in which an attacker could pair with the earbuds without user interaction and establish a valid Bluetooth bonding. This would allow an attacker to eavesdrop on the victim through the earbuds' microphone, play audio on the device, or track the device via Bluetooth Low Energy.

A Linux-oriented walkthrough of the CVE-2026-27912 ResetNightmare and KerberLoss (CVE-2026-25177) workflow.

We dissect an Interlock ransomware ESXi decryptor - revealing it embeds the victim's RSA‑4096 private key, uses AES‑256‑GCM (with the authentication tag ignored) in a progressive, in‑place "strided" decryption that overwrites data without integrity checks, and includes several design flaws that can silently destroy files.

This article covers where large language models add real leverage in AI vulnerability research, where they can mislead, and how pairing an agentic CLI with an MCP server turns a chat model into an invaluable part of your offensive security toolkit.

We explain how HTTP/2's multi-frame architecture allows attackers to bypass WAFs by exploiting timing delays, protocol translation flaws, and incomplete body inspection across various reverse proxies

A path traversal vulnerability exists in the SharePoint Server file upload page (Upload.aspx). An authenticated attacker with upload permissions to one document library can craft a request that uploads files to a different, restricted document library on the same site, including the Master Page Gallery.