Security Review #321

Elastic Defend added taint_flags to the module_load BPF event and a new detection rule on top of it. In this article we explain how Singularity deals with it to load clean: source obfuscation for YARA, trusted_pids insertion for the BPF hook, and OBF_OUT=/var/lib/dkms for the .ko creation rule.

A follow-up on klist.exe: extracting non-zeroed TGT session keys without SeTcbPrivilege, abusing WinRM for in-memory remote dumping, and examining behavior under Credential Guard.

A URL validator checks a representation of the destination before the client connects. Parsing, object construction, resolution, redirects, and authority emission can each replace that representation after the check. This article follows those handoffs to determine whether the approved destination stays bound to the socket and request used on the wire.

Agent Skills vulnerability lets an AI agent treat skill files as executable instructions while reviewers treat them as documentation, enabling LLM01 Prompt Injection (and LLM05 Supply-Chain) attacks that let a skill leak sensitive files. This impacts any agent that loads skill packages, allowing credential exfiltration or silent report manipulation without visible anomalies.

Active Directory Certificate Services (ADCS) has emerged as one of the most significant and under-monitored attack surfaces in enterprise Windows environments. After observing the abuse of misconfigured certificate templates to impersonate privileged identities, we decided to investigate what detection opportunities existed at the source: the Certificate Authority (CA) server itself.

Papercut contain multiple authorization-bypass flaws that can be chained to a SQL injection, arbitrary file write and unauthenticated remote code execution as the service account. We detail how we leveraged Claude to find those vulns and build the attack chain.

In this blog post, I am going to demonstrate how to escalate privileges from IIS AppPool\DefaultAppPool to NT Authority\SYSTEM without using any Potato exploit, when we have Remote Code Execution on an IIS server and compromised host is a part of Windows Active Directory Domain.

We detail CVE-2026-9586, a critical Switchvox SQL injection leading to RCE, with active exploitation observed in the wild.

Local llama.cpp servers can be exposed to browser-origin abuse if CORS is permissive and no API key is set. With default-like settings, a malicious page can send prompts to a local model and consume resources. If the server is also started with --tools all, malicious same-origin content, such as a bookmarklet or injected extension script, can drive the model to execute local tools.

We analyze JSCeal, a cryptocurrency-focused stealer delivered as compiled V8 bytecode (.jsc) executed by a bundled Node.js runtime and protected with javascript-obfuscator. The deobfuscated payload reveals keylogging, browser and credential theft, screenshot capture, a local HTTPS MITM proxy with attacker-controlled certificate, and automated Google OAuth token harvesting, enabling broad credential and cryptocurrency account compromise.

We discuss on how attackers can abuse today's AI agents in ways most defenders haven't thought about yet, from tricking agents into spilling secrets to forcing them to carry out unauthorized actions on behalf of the victim.

We detail 4 vulnerabilities found in GeoNetwork: unauthenticated file upload and SSRF, a reflected XSS and a remote code execution.

Abusing Windows' native klist.exe binary to enumerate Kerberos tickets and extract credentials.

Azure VMs disks can use BitLocker encryption with recovery keys backed up in Entra ID. Attackers can exploit this setup to extract sensitive data from disk snapshots.

A technical analysis of CVE-2026-63520, a remote code execution vulnerability due to an unrestricted .NET type instantiation, affecting Microsoft SharePoint.

How we found CVE-2026-75960: the Rently app showed a resident two codes, but the API returned every code for the property, including the master PIN. The story, the disclosure, and the lesson.

This blog will walk through the complete kill chain: an attacker enumerates domain-wide SPNs, identifies a vulnerable user account, and silently requests a Kerberos Ticket Granting Service (TGS) ticket encrypted with the weak RC4-HMAC algorithm.

We introduce research that provides a way to simulate authenticated LDAP and SMB services on an internal network, in a flexible way that can be adapted to various use-cases. The research will be presented through the prism of GPO exploitation, but the aim of the resulting tooling is to be flexible in order to facilitate future research in other areas.

Compromise of ServiceNow tenants via session hijacking, exposed config.xml credentials, role escalation and persistence mechanisms enables adversaries to obtain full administrative control of the ServiceNow platform and pivot to internal MID servers and other infrastructure; the impact includes unrestricted access, credential exfiltration, and the ability to execute arbitrary code and maintain stealthy, long-term footholds.

CVE-2026-12554, CVE-2026-12555, and CVE-2026-12556 affect HP Easy Start for macOS. They enable privileged file modification via predictable world-writable temporary paths, rely on an unmaintained OSPFTP download component, and permit cleartext software-download transport through a relaxed App Transport Security setting and FTP fallback.

We found a second delayed RCE in MECCHA CHAMELEON: a malicious custom map could write files anywhere on your system and run code after a restart.

This post details my discovery and exploitation of a sandbox escape vulnerability in Google Cloud's Application Integration service. The vulnerability, assigned CVE-2025-0982, allowed complete sandbox escape and arbitrary command execution within Google's Borg infrastructure.

We intoduce waf-fu, a tool that extracts AWS WAF logs from CloudWatch, S3 buckets, or direct sampling, caches them locally, and replays captured requests. By leveraging the default unredacted logging of headers, query strings, and other request data, the replay capability can expose authentication details and enable further unauthorized access to protected applications.

In this writeup, we’ll be focusing on DarkSword’s kernel exploit in iOS (CVE-2025-43520). It's a race condition in the VFS subsystem, specifically in the cluster_write_contig and cluster_read_contig functions. We will have a look at its root cause, and its reimplementation as ClearSword.

A fully patched AD CS issued me a client-auth certificate with no szOID_NTDS_CA_SECURITY_EXT in it at all. No requester SID. Not mine, not anyone's. The extension that is the entire point of KB5014754 was simply absent from the issued certificate.

We delve into Caeruleus, a single Go binary that covers the whole BLE lifecycle that lets you scan, enumerate, read/write/notify characteristics, fuzz, and run structured security assessment workflows against your Bluetooth Low Energy devices.

In this series of blog posts I'll cover dumping and analyzing the firmware, live debugging a HDD via JTAG, modifying the drive firmware, and how I used AI to help with analysis and identifying an unknown MCU architecture. This first post is going to focus on dumping, analyzing, and modifying HDD firmware.

Popular StackOverflow encryption code snippets for Java, C# and other languages misuse cryptographic APIs by treating passwords as keys, hard-coding keys and IVs as strings, employing static or zero IVs, using deprecated algorithms or modes, and omitting authenticated encryption. These flaws lead to weak security that can be broken far more easily than a true 128-bit key, rendering the encrypted data insecure for production use.