In May I found a pre-auth heap overflow in the Linux LIO iSCSI target's CHAP BASE64 decoder. I built the patch, took a KASAN trace, wrote the review document — and then sat on it for two weeks. While the patch was in "operator review", another researcher (ahossu) found the same bug independently, sent upstream, and got the fix merged. This is the walkthrough of the bug, the math, the patch I almost shipped, and the lesson I actually learned about review cadence.

An unguarded u32+u32 in the Linux cifs client lets a malicious SMB2 server trick the kernel into reading ~4 GiB from the TCP socket, stalling the connection for 180 seconds. Walkthrough of the code, the wire trigger, a KASAN-instrumented reproducer in QEMU, and the upstream fix. Patch landed in v7.1 and was AUTOSEL'd to stable. With a working PoC repo.

Cortex XDR's `sharphound` behavioral rule (c0400067) consumes events from the Microsoft-Windows-LDAP-Client ETW provider. Replacing wldap32.dll with a pure-managed BER LDAP stack (Novell.Directory.Ldap on System.Net.Sockets) silences that provider. Two days of testing — including an initial false positive caused by a disconnected VPN — confirmed the transport hypothesis but uncovered a second, independent detection channel keyed on filter shape. Implementation, what we got wrong, what we got right, and the path forward.

AMSI is the Microsoft anti-malware barrier that every modern user-mode loader has to deal with. Patching it is loud — every defender knows the byte signature. This post walks through a patchless bypass using x86 hardware debug registers + a vectored exception handler. Validated against a contemporary commercial EDR in a licensed lab. Implementation, stack mechanics, and detection avenues.

HackTheBox RSAiseazy challenge walkthrough. When two RSA moduli are not coprime, GCD recovers the shared prime — both keys collapse.