Security Review #328

Abliterated models never refuse, which makes them tempting for bug hunting. But on the same kernel source, they graduate three to four times as many findings to VALID, including false positives the base correctly rejects, and across a 28-file scan of FreeBSD's sys/rpc the most aggressive build never surfaced the real CVE at all.

Origins and technical analysis of CVE-2026-109618 and CVE-2026-109619, two remote code execution vulnerabilities in PHP that arise from out-of-memory/fatal-error interruption points in the interpreter, allowing attackers to achieve pre-authentication RCE on default-configuration mod_php and PHP-FPM deployments and on bundled applications such as WordPress, or Drupal.

A formatter, minifier or deobfuscator can be made to turn one script into another. 186 techniques across 37+ JavaScript processors, from Chromium DevTools to WebCrack, plus a Tetris script that becomes Snake.

We document massive daily churn in reverse DNS (PTR) records, including a prompt-injection PTR from a Dutch ISP that tells AI agents to ignore prior commands, HTML-based XSS payloads published across a /24 block, and 28 spoofed Googlebot PTRs that passed forward-confirmed DNS checks, affecting reverse-DNS-dependent reconnaissance,

Most encoded-PowerShell detections look for a word: -enc, sometimes -e, sometimes the full -EncodedCommand. PowerShell accepts these flags as any prefix, after a slash or a Unicode dash, evading most detection engines. This post measures the gap, closes it in KQL, Splunk and Sigma, and then shows how to read what the encoded command did without running a line of it.

CVE-2026-108097: how a Drupal Field UI callback led to file disclosure and RCE in a paired lab.

An unauthenticated attacker can read the whole GLPI database via the planning endpoint. Analysis, proof of concept and the fix.

Deep dive analyzis of CVE-2026-106173, a critical FortiSIEM gRPC vulnerability enabling unauthenticated path traversal, arbitrary file writes, and code execution.

Analysis of Hearbreaker, a metamorphic ransomware for MacOS that recursively encrypts files with AES-256-GCM using a hard-coded key. It embeds its own Rust source and employs the mimicore/metacore framework to insert junk functions, randomize identifiers, and rebuild a new binary via cargo, changing its hash while preserving the same encryption-and-ransom behavior.

CloudKeyVaultEvents is a table in Microsoft Defender Advanced Hunting. It records Azure Key Vault operations along with identity, IP address, user-agent, and request context. It provides visibility for detecting unauthorized or anomalous access, enumeration, and destructive changes by exposing fields such as ActivityName, HttpStatusCode, and token identifiers for threat-hunting and incident-response investigations.

In this article, we explore a documented SMB2/3 re-authentication behavior that keeps a reflected authentication working against a signing-required target.

Deep dive into a trivial ReDoS in symfony/http-foundation, reachable by default and unauthenticated through Cache-Control: on Laravel + nginx it turns into an application-layer DoS

We review an incident involving a malicious version of the LiteLLM package that was uploaded to PyPI and Docker. This malicious version includes a credential stealer targeting browser, cloud and AI secrets as well as a dormant C2 capability.

This article goes into details on the malicious LiteLLM package uploaded on PyPi, focusing on its impact as well as the countermeasures to take.

Running your applications inside containers does not guarantee that the host is immune to cyberattacks - a misconfigured container can be as exploitable as a third-party service. Throughout this article, we will explore two common techniques for pivoting and escaping containers, demonstrate them in a controlled lab, and offer concrete mitigation strategies.

In this series we will build a full kernel exploit chain for CVE-2023-20938, a use-after-free (UaF) in Android's Binder driver. This first part focuses on proving the bug is real. We send the Binder driver a malformed transaction that trips its error path into over-releasing one of our own objects, so the kernel frees it while a pointer to it is still queued.

Mean Time to Detect (MTTD) is a flawed, gameable metric that only measures detected threats, ignores undetected dwell time, and creates a false sense of security about breach impact. We proposes shifting focus to Mean Time to Respond (MTTR) and its own Mean Time Before Exploitation (MTBE) metric, using automated dependency scanning and exploitability-based prioritization to reduce response time and prevent exploitation.

Threat actors may create a custom extension or modify an existing file extension to masquerade a malicious implant as a legitimate file. A custom file extension may be used to support phishing scenarios by evading email gateways and other controls, like the Windows SmartScreen. They are controlled via the registry, and can be monitored through the associated keys to identify the threat at an early stage.

PHP2Shell (CVE-2026-109618, CVE-2026-109619) is a critical unauthenticated PHP RCE. This article details what the two bugs are and how to patch them.

In this article, I introduce PhantomBuffer, an EDR evasion that uses stealth injection via SendMessage with WM_SETTEXT to effective bypass EDR.

We caught live malware attempting a new kind of attack: a file planted in the Downloads folder that turns your own AI coding agent against you. This article details how it works on Codex and Claude Code, and why the vector stays open.

We demonstrate how to dump and decrypt the firmware from Viltrox 28 mm F4.5 pancake (LyLens ODM) and Viltrox 25 mm F1.7 E (RAIKAGE ODM) lenses by bypassing STM32 read-out protection via SWD, using an interrupt-jigsaw exploit on an STM32F103 and deriving product-specific AES-128-CBC keys, resulting in full plaintext firmware extraction and exposure of the proprietary update encryption schemes.

An estimated 17.3 trillion stored rows across a wide range of Microsoft datasets were reachable through a single internal analytics service, all because it never checked the signature on a login token. That flaw let me claim an administrator’s identity and submit unauthorized SQL queries without any real credentials. I used only table descriptions, metadata, and bounded sample rows to understand the potential scope.

We explain how to use Codex for Bug Bounty research, from reconnaissance and black-box testing to subagents, skills and rigorous vulnerability validation.

Most guides to building a malware lab start with VirtualBox or VMware. We built on Hyper-V instead and found almost nothing written about it. What the platform actually gives you for telemetry, containment and fast resets - and the quirk that will quietly take your ports.

We found three unauthenticated vulnerabilities in SPIP, a French open-source CMS (CVE-2026-72708, CVE-2026-72709, CVE-2026-72710) that chain into remote code execution on a default install.

CVE-2026-23866 is an incomplete-validation flaw in WhatsApp on Android that can cause a malicious AI-rich response message to trigger processing of media content from an arbitrary URL, forcing the victim's device to load the URL and leak information such as headers and IP address.

We researched the attack surface of the Danfoss AK-SM 800A refrigeration controller platform and identified multiple vulnerabilities affecting the embedded web management interface: a hidden "code-of-the-day" authentication mechanism that could be abused to bypass normal authentication, a command-injection vulnerability leading to remote code execution, and an arbitrary Nginx configuration directives injection.

Learn what the 6 SharePoint Admin Center security groups are, what each one does, and how to use them correctly to manage access.