Archives
- 07 Jul OpenConnect Fortinet: server-induced chosen-offset stack write via snprintf-return-value cursor arithmetic
- 07 Jul Case-variant path aliases in Rust denial gates: anatomy of a canonicalize-fallback bypass
- 15 Jun Android IncFS verity-signature race — and what Google ASR "Won't Fix (Infeasible)" actually means
- 11 Jun An Android Bluetooth ISO out-of-bounds write that lands RIP on `commit_creds`, marked Infeasible by Google ASR
- 05 Jun Two Lenovo Power Manager kernel drivers, one Everyone:RW DACL — a class-pattern in TPPWR64V and ibmpmdrv
- 05 Jun LnvMSRIO.sys, the 13 IOCTLs nobody audited, and an eight-round walk past Cortex XDR
- 04 Jun Eight rounds against Cortex XDR's driver-load coverage — process hollowing, the IAT trap, and a 2.7 KB shellcode that finally landed
- 03 Jun BYOVD LSASS Dump in 2026 — PDFWKRNL, PPL Toggle, and a Cloned Target
- 02 Jun One byte of URL-encoding past a WAF: notes on CVE-2026-40050 and the GraphQL endpoint nobody fenced
- 01 Jun Found the same Linux iSCSI CHAP base64 overflow 25 days early — and what 'review-ready' really means
- 01 Jun u32 + u32 = 0 is still a bug in 2026 — an SMB2 client integer overflow walkthrough
- 01 Jun ProviderSidestep — Defeating Cortex XDR's `sharphound` Rule From User-Mode, Honestly
- 01 Jun Patchless AMSI Bypass via Hardware Breakpoints — Implementation Notes