Security Review #323

Cache key injection is an underestimated web cache poisoning technique that turns the cache key itself into the attack surface. Using NGINX we demonstrate how ambiguous cache keys can enable access-control bypasses, cache deception, CPDoS, stored XSS and origin cache poisoning.

In this article, we review how zsh modules on macOS enable malicious behaviors such as reverse shells and in-memory payload delivery without spawning external utilities and thus evading detections that rely on child-process telemetry.

PowerShell command-line tools on macOS fall back to standard Authorization Code flow, caching refresh and access tokens in the Keychain. This post explores how any script executed by the user can silently read these cached tokens, provides a tool to audit your exposure, and details key mitigations like process-scoped sessions and token protection.

We explain how RustPack modifies packed payloads by inserting hundreds of benign Win32 API imports, fake IAT entries, export table and .pdata sections, and optional code-signing. These operations lower EMBER2024 machine-learning scores and evade active LLM analysis, causing the binaries to be classified as benign.

The AI bug-fixing pipeline nearly every team wires up first has a hole in it: an anonymous, made-up crash report can run attacker code inside the agent that holds your repo and credentials. Here's the exact vector - standard across today's automated-remediation setups - and how to close it.

Frappe LMS is an open-source learning management system built on the Frappe framework. While performing research on Frappe LMS, we found several vulnerabilities, including an attack chain that could enable a student user to gain remote code execution (RCE) on the server.

Microsoft's shift to passkeys as the default sign-in experience replaces password-based authentication with device-bound credentials, removing the shared secret that phishing attacks exploit but moving the primary attack vector to the passkey recovery flow. This guide provides role-specific instructions for deploying and supporting passkeys across end users, security leads, helpdesks, and IT admins.

We delve into reflective DLL loading, a technique that replays the Windows PE loading process in memory so a custom mapper can load a DLL from a byte buffer without using LoadLibrary. This enables hot-swappable in-process plugins on Windows, reducing the resident footprint and eliminating the need for separate helper processes.

I ran into a browser behavior worth documenting: it enables two new variants of Referer-based CSRF bypass. These are niche techniques, but they both trace back to one browser rule: the default referrer policy, strict-origin-when-cross-origin.

Two ways out of the Codex sandbox. One lets a patch write anywhere on the disk with no prompt. The other gets unsandboxed command execution out of read-only, the strictest mode Codex has.

Analyze the Borrowing Windows Hello Keys attack, WHfB registration logs, rogue device activity, PRT abuse, and detection opportunities in Microsoft Entra ID.

The UaniaBOX hands its admin a web GUI and no shell. Its packet capture page validated the one field that looked dangerous, then handed me arbitrary file reads and writes over UBUS. One writable path, /etc/firewall.user, was enough to run commands as root.

A DFIR guide to Windows Registry forensics: interpreting hives, LastWrite timestamps, persistence, and configuration evidence without overclaiming.

This is a practical guide to assessing the security of an agentic AI system. It covers how to model the target, the attack classes, the controls that stop them, and a methodology for running an engagement from start to finish.

PhantomFix (CVE-2026-90999) is a critical vulnerability in Sentry Seer's autonomous autofix: a fabricated error report sent to a public DSN can reach the coding agent and lead to code execution and access to connected repositories.

The daemon that Finder uses to “repair” permissions on iCloud files turned out to be willing to repair permissions on anything - including system directories. In this article we’ll look at how DesktopServicesHelper works under the hood and why a single XPC request was enough to get root. But before we get there, let’s cover some macOS internals.

Technical details of CVE-2026-19174, an integer overflow vulnerability in V8 that allows arbitrary code execution without a heap sandbox bypass.

Group Policy Objects (GPOs) can contain cleartext passwords, scripts, and other sensitive data stored in SYSVOL that any domain user can read, and misconfigured permissions can allow low-privileged users to edit or own GPOs, enabling code execution on linked machines. These issues let attackers extract credentials and deploy malicious policies across the domain, leading to privilege escalation and widespread compromise.

We analyze a malicious browser extension that forges Chromium's integrity checks and pulls its C2 from Ethereum smart contracts.

Impacket's RemoteOperations registry-dumping workflow creates eight-character "*.tmp" files that contain partial SAM hives and triggers Microsoft Defender alerts. The leftover temporary file and associated Service Control Manager Event ID 7040 changes provide forensic evidence of the registry dump via impacket.

We analyze a malware sample using a multi-stage malware loader that chains together obfuscation and shellcode-injection techniques. The sample begins as obfuscated Python bytecode and concludes with encrypted .NET resources, using nested layers of shellcode generation, encryption, and obfuscation to frustrate detection and analysis at each stage.

Paxton10 is an access control system widely deployed. This post documents a chain of vulnerabilities that allows a network-adjacent, unauthenticated attacker to obtain operating system command execution on the Paxton10 server.

Turning an approved blueprint into a rogue cloud identity. I do not need to exploit Microsoft Graph, nor do I need to register an obviously malicious OAuth application or ask an administrator to approve a new set of permissions.

An attacker-controlled workspace/project folder, containing a .git/ directory, can escape the Cursor CLI's macOS sandbox and run code on your Mac with the logged-in user's full authority, no permission prompt, regardless of tool permission mode. The same class of bug as the Claude Code escape (Beltdown), but with no git hardening at all.

CVE-2026-90049 (also tracked as CVE-2026-89487 and CVE-2026-80977) is a deterministic unprivileged local privilege escalation in Open vSwitch's datapath that clears the SKBFL_SHARED_FRAG flag, enabling an unprivileged user to perform arbitrary page-cache writes and obtain root.

We detail a vulnerability in Visual Studio Code that makes it possible to bypass Workspace Trust by allowing "command: links" in the source editor to execute arbitrary commands, resulting in full workstation compromise and persistent malicious extension installation.

The msPKI-Certificate-Name-Flag attribute is frequently explained using an oversimplified, inaccurate sequential bitmask. This post uses the official Microsoft protocol specifications as the source of truth to decode the exact values, expose the common “5-row table” fallacy, and provide a definitive reference for offensive operators and detection engineers.

Two authorization bypasses in n8n's AI agents let low-privileged users perform actions beyond those allowed by their role, including executing arbitrary nodes and exfiltrating credentials in cleartext. In some configurations, the same attack path can also give a read-only user command execution on the n8n host.

Inside StyleSmuggler, the unauthenticated Magento RCE: report poisoning, email-template object injection, and a DI-compiler include. Full chain + PoC.

In this blog post, we will briefly go over the points that make sniffing BIS complicated, describe what they are, and how we tackle them in the sniffer. But before that, let me briefly explain what Broadcast Isochronous Streams are.

We dive into CVE-2026-53264, a use-after-free bug in the Linux kernel net/sched subsystem and CVE-2026-64300, a page-UAF bug in the Linux kernel perf/events code that also provides local privilege escalation.

In 2024 and 2025, we reassessed remote Spectre attacks on our Workers infrastructure. We share details about the new attack primitives like Spectre gadgets, remote timers, achieving co-location and how new defenses further harden Cloudflare Workers.

We uncover three critical Microsoft RCEs found by tracing ordinary image-processing and file-upload paths to proven code execution. CVE-2026-32194 and CVE-2026-32194: 2 critical RCEs in Bing Images, and CVE-2026-21536: an RCE in the Microsoft Devices Pricing Program.

VE Commercial Vehicles' My Eicher platform had a critical vulnerability that let you take over anyone's account and gain control over their vehicle fleets.

A vulnerability in vBulletin has been identified, the vulnerability allows an unauthenticated user to cause the vBulletin to execute arbitrary code (PHP) on the remote server.

In this last part of the series we will develop a malicious MCP server and utilize it to check MCP hosts for insecure MCP server handling.

I came across a really interesting SQL injection scenario in order by clause. The endpoint had a WAF (Baffin Bay Networks Threat Protection) sitting in front, blocking all the usual SQLi payloads.

A technical analysis of TWINLOOT, a modular Python implant hardened with PyArmor that runs in victim pythonw.exe processes and uses only Microsoft-provided services - SharePoint Online/Graph API for dead-drop tasking,

This post delves into SQL MCP servers. We managed to bypass read-only restrictions, found insecure files operations, exploited SQM servers for port scanning and found a local filename enumeration vulnerability.

Scoping a penetration test defines the technical boundaries, testing types, timeframe, and resource allocation needed to meet client expectations and avoid missing critical findings, involving risk owners, knowledgeable technical staff, and the test team, and may incorporate existing vulnerability assessments.

We review the structure and content of a penetration testing report - including executive summary, technical summary, engagement overview, detailed findings, and appendices - and explain how the report and subsequent client debrief communicate identified security issues, risk ratings, and remediation guidance to C-level executives, managers, and technical teams.

We found 58 vulnerabilities across 37 AI agents, including remote code execution, data exfiltration, read-only bypasses, arbitrary file writes/reads, port scanning, XSS, tool poisoning, and tool spoofing. This first post of the series provides a global overview of the project and main results.

The article outlines penetration-testing methodology, detailing pre-engagement activities, the five core phases (planning & reconnaissance, discovery / enumeration, attack simulation / exploitation, optional command-and-control and exfiltration, and analysis / reporting), and how each step is executed to identify exposures, misconfigurations, and vulnerabilities in client environments.

This blog post will answer any questions you may have or at least helps lighten the load with all the moving parts you will encounter or have to deal with pre and post-engagement by the end of this post; you should better understand what penetration testing is, the differences in the types of approaches and how each has various pros and cons.

In this second post of the series, we focus on achieving RCE and Data Exfiltration in AI Coding Agents. The RCE stems from autonomous command execution or allowlist bypasses, while data exfiltration leverages Markdown image rendering (including CSP bypasses) to leak file contents such as .env via URLs.

I gave an AI agent access to a cable modem, a serial console, Ghidra, and a custom GDB stub, then asked it to reverse the firmware and hunt for bugs. It re-discovered known vulnerabilities, found new ones, and wrote working exploits. This post covers the setup, what it managed to do on its own, and where I still had to step in. The real problem is that the same approach now works on millions of devices nobody plans to fix.

Evilginx is a phishing tool that operates as a man-in-the-middle web proxy to intercept user credentials, 2FA codes, and session cookies from targeted services, enabling attackers to fully compromise victim accounts. In this article, we see how it can be deployed locally or on a remote server with a registered domain to generate phishing lures that capture login data in real time.