Security Review #320

We review how the exploitation of the LiteLLM gateway (CVE-2026-42271 and CVE-2026-48710) and the Kestra orchestration service (CVE-2026-49869) allowed attackers to harvest model-provider credentials, access Azure PostgreSQL databases, and deploy XMRig cryptomining, while a separate RAGFlow compromise intercepted LLM API keys via runtime hooks.

Root on a $20,000 humanoid robot from Bluetooth range. This article a the technical breakdown of the attack chain, crossing Bluetooth, Unitree's cloud, mobile, and the firmware running the G1 itself. Including the 2 CVE found in the path: CVE-2026-76639 and CVE-2026-76640.

Custom HTML tag names accept arbitrary characters, are normalized to uppercase, and expose a lowercase version via the element's localName property, which can be abused in onfocus handlers (e.g., attributes[0].value, textContent, nodeValue, getAttributeNode, setHTMLUnsafe, contenteditable, classList) to execute JavaScript payloads, resulting in cross-browser XSS and WAF bypasses.

In this post, we explore how a simple website summary request hijacks Claude Code Opus 5 in Auto Mode and achieves code execution with 60-80% attack success rate using a small sample size.

A postmortem on my own EDR: no auth on self-destruct, permissive agent keys, forged automation results, LDAP injection, and 8 routes with no authorization check.

This post explores using ServiceNow script includes to create a cleartext credential retrieval mechanism valid for any discovery credential type and LDAP credential records.

A bad actor hid inside an already-approved ScreenConnect agent. In this article, we review the entire kill chain, the one signal that fired, and how agents with context were able to find it.

Investigating a compromise in Amazon EKS means piecing together evidence spread across three layers: the managed Kubernetes control plane, the worker nodes, and the surrounding AWS services. This article maps the data sources an EKS cluster exposes for digital forensics and threat hunting, and the tooling used to correlate them, from the Kubernetes audit log down to the AWS identity of the nodes.

Technical writeup for CVE-2026-8508, a Zyxel captive-portal social login trust-boundary flaw involving browser-submitted Facebook identity fields.

We introduce here the Python library pcode_graph, a tool developed to abstract the semantics of binary code. It provides an API to build and visualize Control & Data flow Graphs (CDG) from a function, a basic-block or any arbitrary piece of code. We present how to use it to detect function similarities in binaries.

We identified the active abuse of FTP banners as DDRs to distribute malicious commands, a technique observed in the wild. Further infrastructure analysis led to the discovery of two previously undocumented Remote Access Trojans (RATs), which we have named E4del and PINHOLE.

GRC (Governance, Risks and Compliance) usually works top-down, you read a piece of regulation, draft a policy, declare coverage, and archive a documentary record. We explore a reverse direction of reading and start from verifiable technical questions.

A memory-corruption RCE in the Call of Duty 1 dedicated server, a binary that has been on the internet for two decades, found and weaponized in a single evening with an AI agent driving the disassembly.

We reverse-engineered ADHD-assessment web app and found that only timing of user activities are sent to the server, where they are used to calculate standardized Z-scores. We show that the client-side code also exposes a provider-trial sign-up flow that can generate reports, and that abnormal "spam" behavior triggers a low-credibility flag while normal interaction produces a normal-looking report, directly influencing the diagnostic outcome.

Ruby 4.0.6's Marshal.load can invoke attacker-chosen code via six implicit "kick-off" gadgets (hash, eql?, <=>, to_str, to_s, respond_to?) in addition to the documented marshal_load, _load and _load_data entry points, expanding the deserialization attack surface.

While analyzing BeheMOF malware I found a passive backdoor that opens no obvious listening port and carries no payload inside itself. It waits in memory doing nothing at all until one specifically crafted network packet reaches the machine, which is why I am calling it SLEEPWALKER.

The Wibu-Systems CodeMeter service (CodeMeter.exe) runs as NT AUTHORITY\SYSTEM. An arbitrary file delete combined with a little ::$INDEX_ALLOCATION NTFS trickery and the C:\Config.Msi Windows Installer rollback technique, can lead to a full local privilege escalation to SYSTEM.

In this series we will walk through how token-based attacks work in the context of Microsoft defenses. This first post sets the stage: why token theft matters, and how attackers actually get their hands on a token.

This article details how I chained three public V8 bugs against Google's v8CTF, escaped the V8 sandbox, printed a real flag, and still received no bounty.

ShieldBreak combines Cloud Files, Object Manager namespace manipulation, direct Windows Defender API invocation, and a timing race in the remediation path. The result is a self-contained local privilege escalation chain in which Windows Defender's own clean engine is redirected to write an attacker-supplied DLL, followed by SYSTEM execution through the built-in Windows Error Reporting task.

ToxNetV2 is an AArch64 Linux peer-to-peer botnet whose controller incorporates NVIDIA NIM LLM to parse telemetry into structured ACTION records that, after operator approval, can trigger local shell execution, file writes, remote SSH, persistent state changes and a fixed compilation workflow, and the malware leverages a range of known exploits such as CVE-2018-10561, CVE-2022-30525 and CVE-2024-3273 for self-propagation.

Code execution via Text Template Transformation Toolkit (.tt) files allows threat actors to embed C# or Visual Basic code that is compiled and run by trusted utilities, enabling execution of arbitrary payloads on developer workstations and in build pipelines.

In this post we build our own mini-GPT completely from scratch in PyTorch, train it on raw bytes of real binaries, and turn it into a practical malware-analysis tool: a packing / encryption detector based on perplexity.

CVE-2026-55145 affects Microsoft 365 Copilot in Outlook, where hidden prompts in external email bodies can inject instructions that shift calendar event times, fabricate tool-call results claiming a cyber-attack, and embed internal mailbox or OneDrive summaries into outbound drafts, leading to misinformation, operational disruption, and unauthorized disclosure of internal data.

CVE-2026-54121 is a vulnerability in Active Directory Certificate Services allowing an attacker-controlled host to be specified and enabling a minimally privileged user to gain control over the domain. We provide detection tips based on monitoring certsrv.exe outbound connections to non-authorized hosts on TCP ports.

Copilot for Microsoft Word can interpret hidden JSON-formatted prompts embedded in attached documents as legitimate instructions, causing the model to copy the malicious prompt into the resulting file, which then serves as a new carrier for further exploitation. The self-propagating behavior enables an AI-worm to spread across internal document workflows without the attacker's continued involvement.

Static devirtualization of the Tencent VM obfuscation recovers native code from ACE driver binaries (ACE-GAME.sys, ACE-BASE.sys, ACE-BOOT.sys, ACE-CORE.sys), achieving 94.2 % overall coverage of virtualized functions. This demonstrates that Tencent VM's virtual-machine protection is weak against guided symbolic evaluation, allowing most virtualized functions to be successfully decompiled.

CVE-2023-2156 ("Route of Death") is a Linux kernel vulnerability that was believed to only lead to a DoS attack. However, we discovered a bypass of the patch and found that it is actually exploitable and can lead to LPE on any Linux distribution that has IPv6 and namespaces enabled.

COFF mixing is a technique that merges a capability compiled as a COFF object with benign code into a PE-ready COFF and links it into a Windows executable, eliminating the need for memory-injected runners. By placing the capability in image-backed memory the resulting PE shows normal stack frames and reduces observable IOCs, making defensive analysis more difficult.

This post highlights common techniques and artifacts encountered in real-world incidents, mapping out exactly where plaintext credentials leak and how adversaries systematically collect them. In addition, it covers hardened Linux appliances and discusses how credentials may still be exposed despite security controls.

We take a piece of code, apply Control Flow Flattening by hand to produce a stripped binary, then use a local LLM running on a single NVIDIA H200 MIG slice to assist reversing it back to readable C

In this post, we will parse a real PE binary with Python and extracting the information that matters for triage.

How to abuse an authenticated Global Secure Access tunnel from a standard-user beacon: extracting cached Entra ID tokens and redirecting the endpoint's existing tunnel for internal network access.

This post details a Python-based command-and-control system that leverages Claude Code's MCP protocol to expose operator functions as native tools, with agents beaconing through Cloudflare to a listener enabling natural-language driven tasking and result analysis. This architecture provides continuous session context for command execution, file access and automated analysis while hiding the VPS IP and requiring no external dependencies.

Reverse-engineering the GSA Windows client: the NDIS/WFP kernel driver, the ALPC IPC seam, and rebuilding the gRPC tunnel protocol and its three-token authentication from scratch.

Cross-Domain Prompt Injection (XPIA) enables attacker-controlled web pages to cause Microsoft 365 Copilot Memory to persist unintended preferences, such as a language setting, which then affect subsequent Copilot sessions across work and web contexts. The attack requires only that the victim invoke Copilot's summarization on the malicious page and does not need tenant access, code execution, or credential theft.

Pentesters and attackers often rely on dumping the LSASS process to get passwords. We are going to explore more sophisticated, alternative methods for attackers to obtain cleartext passwords within a Windows environment. We will look at “quick wins” such as searching for passwords in Group Policy Objects or command lines, and then dive into more advanced techniques like Security Support Providers and Password Filters, which capture passwords in cleartext as users log in.