Security Review #329

We analyze a full chain of logic bugs in Edge leading to an UXSS without any user intercation. The chain relies on a trusted origin bypass, a popup blocker bypass, the OneAuth feature and a CORS misconfiguration.

Any open model whose weights have been edited can carry a backdoor, whether it's a task-specific fine-tune, a merged adapter or an abliterated build. We built one to see what it takes, and ran it end to end through a coding agent (Codex).

I tested eight popular SVG sanitizers and bypassed six of them. In this post, I'll show you how a response header can run JavaScript in Firefox even when the response body is completely harmless XML. I'll also show you how to get Safari to import a GIF as SVG and execute JavaScript from it.

In this article I will present how to generate arbitrary strings in javascript without using any special characters (except +,=, , and .)

In this article, we provide an investigation-driven approach to detecting compromised service principals, cross-tenant authentication, privilege escalation, and application-level persistence in Microsoft cloud environments.

This post starts with a high level architectural review of the Steam platform followed by a dive into several local and remote code execution bugs

We detail CVE-2026-110355, an unauthenticated SSTI in Imperia CMS that enables remote code execution via SiteActive's TEMPLATE parameter when PHP is available.

Analysis of Aokigahara, an infostealer that includes traditional data theft capabilities as well as AI-related assets. It collect authentication files, session data, and configuration files associated with Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and other tools.

We detail four mechanismsleading to connection reuse when the previous request is not finished: pre-grant write, unproven-drain reuse, promise-credited framing and reset-with-debt. They were found in several servers such as Go net/http, nginx, HAProxy, Elsaticsearch, etc.

This article details CVE-2026-97631, an out-of-bounds write in EDK II’s PXE Base Code driver. While a machine is network booting over IPv4 or IPv6, an unauthenticated attacker who can get an oversized ICMP error message to its IP address can corrupt firmware memory and run code before the operating system loads and before Secure Boot or measured boot has checked anything.

Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop each built a browser into their AI assistant, then enriched it beyond what a normal browser allows. Those enrichments broke the browser threat model, letting a web page or a local file reach the machine behind it. Two issues remain unpatched.

LLM-based penetration-testing harnesses let language models execute actions such as reading files, browsing sites, and running tools, enabling automated dynamic testing of web applications. We analyze open-source harnesses Artex, Cairn, and Strix which have been used to discover vulnerabilities like DOM-based XSS, IDOR, and account-takeover on vulnerable sites.

In this article, we'll focus on prompt injection, one of the most impactful vulnerability classes targeting LLM-powered applications, and walk through how to identify and exploit it in practice.

A PaperCut attacker left their open directories exposed. We reconstruct the AI-driven exploitation pipeline, a second XML-RPC RCE path, and chisel persistence from the operator's own server.

Vulnerable Dependency Seeding is a new attack where AI agents such as Instinct and Muse are tricked into building software that includes known vulnerable components. Then the attacker delivers a crafted payload to achieve code execution inside the agents' sandboxes.

We achieved XSS through Cloudflare's /cdn-cgi/image/ endpoint by chaining an SVG sanitizer bypass with a Chromium Cache-Control trick that strips CSP. The same trick also works on Netlify and S3.

In this blog post, we will walk through three distinct vulnerabilities across multiple PeopleSoft components, starting with a Server-Side Request Forgery (SSRF) vulnerability. We will also review the validateClient method that Oracle introduced to allow PeopleSoft system administrators to restrict access to certain functionality.

Three independent bugs in GoAhead's TLS integrations can leave revoked client certificates accepted, encrypted sessions recoverable to an observer or a configured chain-depth limit unenforced. Exposure depends on the TLS library and the verification settings built into the device.

DarkVision is a malware classified as a Remote Access Trojan (RAT), incorporating various techniques associated with other types of malware focused on stealing information. Unlike other malware in the same category, it is developed in C++ and ASM and contains a plugin subsystem within its payload, providing operational capabilities at runtime.

In this article, we'll work with WMI-Activity, Sysmon, PowerShell, Volatility 3 and Sigma, and set up some hunting along the way. In particular we'll focus on ActiveScriptEventConsumer. It lets WMI run a script when a specified condition is met, with execution handled by the system process scrcons.exe.

A .po translation file is meant to be data. In Godot, part of it is executed as code. A player who installs a community translation for an affected game can be made to run attacker-chosen GDScript inside the game, with the game's privileges, on their own machine.

I exploited CVE-2025-30023 (insecure deserialization) chained with CVE-2025-30026 (authentication bypass) to get SYSTEM-level RCE on two Windows machines running Axis Camera Station on a factory. After that, I discovered CVE-2026-63286, a weak credential encryption scheme, which allowed me to decrypt all the camera credentials stored in the application's database and connect to the cameras.

This article explores how ESC17 certificate abuse revives an old GLPI agent tactic, enabling attackers to achieve RCE without needing access to the GLPI server.

DTLS is the Godot engine's optional encryption layer for UDP multiplayer. We found that one unauthenticated datagram can overwrite heap memory in a game that uses it: killing a community-hosted server when a player joins, or the player after they join a hostile server.

We analyze Yoba, a campaign where attackers abuse the popularity of AI tools such as ChatGPT and Claude, creating fake GitHub projects that pretend to be desktop applications. The malware is placed next to legitimate, signed executables from OpenAI and Anthropic so it can be loaded indirectly, a technique commonly known as DLL sideloading, which is often used to bypass security protections.

AWS's MCP server provides a tool called aws___run_script. This tool accepts a short Python script as an argument and runs it in a server-side sandbox. The sandbox restricts imports, builtins, attribute access and file operations. In this blog, I explain how I bypassed those Python restrictions and reached system command execution inside the Lambda environment.

cups2root is a local privilege escalation technique in Linux based on the built-in mechanisms of the CUPS printing system. The cupsd scheduler does not restrict the path component of the device URI for non-file backends, so the root-privileged serial backend can write print data to an arbitrary file, and substitution of the parameters of this configuration causes the root process to execute the attacker's files.

A vulnerability in Telerik UI for ASP.NET AJAX led to an arbitrary file read via RadImageEditor's image cache. Leaking web.config turned it into RCE.

Microsoft is moving EDR out of the Windows kernel, and the preview binaries show wesp.sys telling a user-mode client that a process is starting, with nothing in its imports to let that client block it. A kernel debugging session shows what the Windows Endpoint Security Platform can and can't do just now.

Egov.Integrations.MPass.Saml is a SAML 2.0 authentication handler for ASP.NET Core. We found that an attacker who possesses a validly signed MPass SAML message can use XML Signature Wrapping to separate the signed content from attacker-chosen assertion content presented at the trusted document root. The relying party can then authenticate the attacker as an arbitrary user.

We investigate PowerShell scripts left by an attacker on a compromised system. They enable the attacker to run arbitrary PowerShell commands, capture valid user credentials in clear text, identify systems with remote admin access, and access shared files, exposing compromised credentials and network resources.

This blog post presents an end-to-end side-channel analysis of the AES encryption performed by the Arm CryptoCell-310 (Arm CC310), the cryptographic coprocessor embedded in the Nordic nRF52840. Tis attack leads to full AES key recovery via EM analysis and collision-correlation.

Technical analysis of The Gentlemen, a ransomware that uses a double-extortion model. In addition to encrypting files, the ransomware can exfiltrate data from compromised systems. This puts additional pressure on victims to pay the ransom to restore access to their files and prevent the stolen data from being publicly leaked.

A remote TIPC peer-state transition can expose an empty-queue dereference and panic the receiving Linux kernel.

This blogpost introduces a new path for abusing Kerberos delegation. By combining Reflective RBCD technique, U2U sacrificial user technique, and extending Impacket to support S4U2Proxy with U2U, we can now obtain the forwardable ticket required for Constrained Delegation without Protocol Transition when the account trusted for delegation has no SPN.

In this blog, we will be talking about understanding how to read and dump iOS Sandbox Profiles, making it possible to analyze allowed versus denied resources, and assess the attack surface available to compromised processes.

I detail how, with Claude Opus, I was able to take a patch for a zero day, identify 3 critical vulnerabilities and create a full chain proof of concept resulting in unauthenticated code execution on a Papercut NG. Before then finding a bypass for the patches that had been released.