An unguarded u32+u32 in the Linux cifs client lets a malicious SMB2 server trick the kernel into reading ~4 GiB from the TCP socket, stalling the connection for 180 seconds. Walkthrough of the code, the wire trigger, a KASAN-instrumented reproducer in QEMU, and the upstream fix. Patch landed in v7.1 and was AUTOSEL'd to stable. With a working PoC repo.

Cortex XDR's `sharphound` behavioral rule (c0400067) consumes events from the Microsoft-Windows-LDAP-Client ETW provider. Replacing wldap32.dll with a pure-managed BER LDAP stack (Novell.Directory.Ldap on System.Net.Sockets) silences that provider. Two days of testing — including an initial false positive caused by a disconnected VPN — confirmed the transport hypothesis but uncovered a second, independent detection channel keyed on filter shape. Implementation, what we got wrong, what we got right, and the path forward.

AMSI is the Microsoft anti-malware barrier that every modern user-mode loader has to deal with. Patching it is loud — every defender knows the byte signature. This post walks through a patchless bypass using x86 hardware debug registers + a vectored exception handler. Validated against a contemporary commercial EDR in a licensed lab. Implementation, stack mechanics, and detection avenues.

HackTheBox RSAiseazy challenge walkthrough. When two RSA moduli are not coprime, GCD recovers the shared prime — both keys collapse.