LSASS dumping from a vanilla admin shell stopped being a one-liner the day PPL went mainstream. The modern shape is BYOVD — bring a signed driver with an arbitrary-kernel-memmove primitive, flip the Protection byte on yourself, clone the target, and dump the clone. This post walks through a from-scratch implementation against PDFWKRNL.sys (AMD USB-C Power Delivery driver, IOCTL 0x80002014), the HVCI block-list math that picks the right sample, and the full chain — driver load → EPROCESS walk → PPL flip → NtCreateProcessEx clone → in-memory MiniDump → XOR-obfuscated write. Validated on Win11 26200.

CVE-2026-40050 is a routing-tree exposure on LogScale lightweight-ingest nodes. The advisory lists 1.224.0–1.234.0 as vulnerable and the SaaS fleet as "patched" because a perimeter WAF rule was deployed in April. The rule is one URL-encoded byte wide. The same hosts also expose a GraphQL endpoint that the rule never covered, which resolves `meta` and `installedLicense` pre-auth. The vendor declined the report. This is the walkthrough of the bug, the bypass, the JAR diff that shows the code fix lives in 1.235.x and not in 1.234.x, and the lesson about treating "WAF deployed" as a synonym for "fixed".

In May I found a pre-auth heap overflow in the Linux LIO iSCSI target's CHAP BASE64 decoder. I built the patch, took a KASAN trace, wrote the review document — and then sat on it for two weeks. While the patch was in "operator review", another researcher (ahossu) found the same bug independently, sent upstream, and got the fix merged. This is the walkthrough of the bug, the math, the patch I almost shipped, and the lesson I actually learned about review cadence.

An unguarded u32+u32 in the Linux cifs client lets a malicious SMB2 server trick the kernel into reading ~4 GiB from the TCP socket, stalling the connection for 180 seconds. Walkthrough of the code, the wire trigger, a KASAN-instrumented reproducer in QEMU, and the upstream fix. Patch landed in v7.1 and was AUTOSEL'd to stable. With a working PoC repo.

Cortex XDR's `sharphound` behavioral rule (c0400067) consumes events from the Microsoft-Windows-LDAP-Client ETW provider. Replacing wldap32.dll with a pure-managed BER LDAP stack (Novell.Directory.Ldap on System.Net.Sockets) silences that provider. Two days of testing — including an initial false positive caused by a disconnected VPN — confirmed the transport hypothesis but uncovered a second, independent detection channel keyed on filter shape. Implementation, what we got wrong, what we got right, and the path forward.

AMSI is the Microsoft anti-malware barrier that every modern user-mode loader has to deal with. Patching it is loud — every defender knows the byte signature. This post walks through a patchless bypass using x86 hardware debug registers + a vectored exception handler. Validated against a contemporary commercial EDR in a licensed lab. Implementation, stack mechanics, and detection avenues.

HackTheBox RSAiseazy challenge walkthrough. When two RSA moduli are not coprime, GCD recovers the shared prime — both keys collapse.