Security Review #325

A deep dive into how email actually works - SMTP, MTAs, SPF/DKIM/DMARC authentication, spam filtering and TLS - traced step by step from Alice to Bob.

This blog will focus on a vulnerability in an open-source project, Rejetto HTTP File Server (HFS), that speaks to Mythos’s capabilities in understanding of mathematics, how it identified an exploitable set of cryptographic missteps, and approached solving the constraints to achieve remote code execution.

We explore a subclass of email spoofing was explored - header smuggling. Based on a case study of Apple iCloud's emailing services, we once again reveal the dangers of trusting emails by being able to send messages from arbitrary icloud.com addresses.

Technique performs Windows process code injection by leveraging a Windows named pipe, it does not use VirtualAllocEx and WriteProcessMemory. This enables execution of arbitrary code in trusted Windows processes such as explorer.exe, svchost.exe, netsh.exe, or nslookup.exe without triggering conventional cross-process memory-modification detections.

By monitoring public Certificate Transparency logs, attackers can discover internal application hostnames and associated certificates, revealing internal finance tools, upcoming product code names, and open API endpoints. This exposure enables further reconnaissance such as checking internet accessibility, weak cookies, CORS misconfigurations, and potential exploitation of unauthenticated services.

MikroTik routers running RouterOS are widespread in production networks and a frequent target for attackers. This article is about finding the indicators they leave behind; we assume the attacker is already on the device.

We detail a full exploit chain inIBM's HashiCorp Vault and OpenBao leading from unauthenticated access to full remote code execution.

In this post, I detail CVE-2026-65669, an elevation-of-privilege vulnerability in Microsoft SQL Server's Copilot integration for SQL Server Management Studio (SSMS) that lets Copilot bypass its read-only mode and execute arbitrary T-SQL, including stored procedures such as sp_executesql and xp_dirtree, enabling data exfiltration and privilege escalation to sysadmin.

TrickDump is an LSASS dumping technique that avoids creating a conventional minidump on the victim. In this blog, we look for TrickDump artefacts, reconstruct the LSASS minidump and determine what credential material could be recovered from the data collected by the attacker.

CVE-2026-88771 is a pre-authentication command-injection flaw in Citrix NetScaler ADC and NetScaler Gateway default configuration that lets an unauthenticated attacker execute arbitrary commands as root, resulting in remote code execution.

In this second part, we will answer the question: how does a proxy configured by an interactive user arrive inside ncsi.dll when the service thread is not impersonating that user? We will walk through the internals of NCSI to understand how a proxy configured by another user finally lands in netprofm, and how that value is later used by the WinHTTP request.

Certificate Enrollment Services (CES) in Active Directory Certificate Services can be abused via NTLM relay to obtain certificates, using a SOAP/WSTEP protocol distinct from the classic Web Enrollment form-based flow. An attacker who can authenticate to the CES endpoint can submit a CSR and receive a certificate, enabling credential theft techniques such as Un-PAC-The-Hash and Pass-The-Certificate.

We investigate a Windows proxy behaviour in which a proxy configured by an unprivileged user caused NCSI to negotiate NTLM with an attacker-controlled proxy from a service security context.

Combining threshold signature schemes with trusted execution environments (TEEs) can strengthen multi-party computation (MPC) deployments. This blog post discusses what TEE attestation can and can't fix in MPC deployments, explores the pitfalls we see most often in audits, and covers best practices, such as incorporating strong attestation processes and binding them to the MPC parties' identities.

Proton Mail's web interface can be made to present a forged sender identity that is visually indistinguishable from a legitimate one.

What a pod in an unrelated namespace could reach on default Ray and vLLM deployments in one EKS testbed, and what NetworkPolicy blocked.

We discovered CVE-2026-72018, an out-of-bounds write in the Linux kernel's SMC-D driver, and turned one weak primitive into a working root exploit.

We dive into the technical incident analysis of PAYLOAD ransomware: an encryptionless, binary-less operation that abused Active Directory mechanisms for managing Group Policy Objects.

In this second part we detail the full exploitation of CVE-2025-13032, turning a double-fetch vulnerability in Avast's kernel driver into a local privilege escalation to SYSTEM on Windows 11.

A lapsed DMARC reporting domain, re-registered for $10, collected aggregate reports for 86 domains across 20+ organizations. In this article we explain how it happened and how to check yours.

We evaluates what an attacker who already controls a single pod in the cluster (a "network neighbour") can reach when official Helm charts are installed with out-of-the-box defaults. We review default Helm security audit across 15 AI serving, vector database and MCP charts and provide empirical analysis of auth omissions, root containers and lateral paths.

In this post, we a case of container escape by exploiting CVE-2026-80521, a Linux kernel use-after-free vulnerability in the AF_UNIX subsystem discovered with dfs-large1.

A retrospective on CVE-2025-39964, an AF_ALG race condition I found before Copy Fail drew attention to the same subsystem. I explain the out-of-bounds scatterlist access, the usercopy oracle, and the exploit that achieved root and a Docker container escape.

XWe explore CVE-2026-88772, a DTLS pre-authentication memory overflow in Citrix NetScaler ADC and NetScaler Gateway that can be triggered when DTLS is enabled and may lead to remote code execution or denial-of-service.

Cisco Smart Software Manager (CSSM) contains a post-authentication remote code execution flaw in the nginx certificate upload path, where a crafted intermediate certificate injects commands via childProcess.execSync and executes them as root.

We detail how CVE-2026-32740 became a Next.js RCE against PIE Node: pixel leak, chosen-address write, memcpy GOT hijack and 10/10 proof.

Microsoft's Self-Service Password Reset (SSPR) portal tells you quite a lot about the accounts in a tenant - whether they exist, what authentication methods they have registered, and in some cases, which ones are likely administrators. This post covers what the portal leaks, why it matters from both sides, and what defenders can do about it.

Creative Sound Blaster Katana V2X permits unauthenticated CTP commands over Bluetooth, allowing an attacker within 15 m to upload arbitrary firmware that can turn the speaker into a covert microphone or a USB HID keyboard (Rubber Ducky) and execute commands on a connected PC.

We analyze Abyssos, a new modular RAT with credential theft, file exfiltration, VNC remote access, anti-analysis, and extensible C2 commands.

AADGraphActivityLogs is an Azure AD diagnostic log that records Azure AD Graph API calls, enabling detection of reconnaissance activity. The logs expose request details (UserAgent, RequestUri, ResponseSizeBytes, CallerIpAddress) allowing analysts to identify high-volume enumeration, default-grant abuse, and conditional-access bypass attempts.

Uncovering CVE-2025-13032: 4 kernel heap overflows in Avast Antivirus. In this firt part, we detail the challenging sandbox manipulation of the $aswSnx$ kernel driver required to reach the vulnerability attack surface and begin breaking the custom sandbox.

In this post, we will investigate a Vidar Malware sample containing suspicious encrypted strings. We will use Ghidra cross references to analyse the strings and identify the location where they are used.