Archive

Before sandbox escapes became one of AI security’s loudest conversations, pwn spent weeks inside nested KVM, built a 14,338-line exploit harness, and made Google’s live kvmCTF host return the flag. This is the story of what happened inside the sandbox.

macOS creates a fully read/write CDC-ACM serial device node with no TCC gate. Chained with a HID keyboard interface on the same USB composite device, this exfiltrates SSH keys, cloud credentials, and secrets in 24 seconds through a channel that shows no consent prompts. Apple was notified on 2026-04-26, declined the report on 2026-05-20, and I am publishing this today after 4 months of silence following my final response.

Security Advisory

During a recent assessment, I came upon a VPN management portal I had never seen before that I found to be a FatPipe MPVPN appliance. After a little research I discovered this was a monolithic native application, ideal for pointing Claude/GPT 5.6 sol at to hopefully find some vulnerabilities and land an old-fashioned native

Evading Machine Learning based detections

true

CVE-2026-20093 is a CVSS 9.8 pre-auth password change on Cisco IMC via configConfMo/aaaUser. Lab notes unpack HUU 4.3.2.250063 vs 4.3.2.260007: nginx /nuova, FastCGI, xapireqproc manageUsers. Patch or isolate the BMC.

CTF/pwn writeups and V8 exploitation notes.

A simulation of an Active Directory attack lifecycle(blackbox pentesting)

Using the Linux kernel keyring to stage an ELF in slab memory and execute it via userland exec, skipping execve and the filesystem entirely.

KnowBe4 Threat Lab reveals how attackers abuse six Google services to bypass email gateways and deploy credential harvesters and remote access tools.

TantoSec turned an unauthenticated AES-CBC padding oracle in Telerik UI for ASP.NET AJAX into remote code execution, chaining a decrypt-versus-parse oracle, a predictable HMAC key, and a type-name deserialisation gadget.

A small note from me

A technical walkthrough of a new offensive technique that activates the Chrome Debugging Protocol directly in memory, bypassing Google's --remote-debugging-port mitigations. Covers chrome.dll signature scanning, DevToolsSocketFactory vtable reconstruction, PartitionAlloc constraints, and Special APC-based shellcode injection into the Chrome parent process.

Sansec discovered StyleSmuggler, an unpatched Magento and Adobe Commerce zero-day that gives unauthenticated attackers remote code execution. All current ver...

Learn how to get a free .arpa domain by abusing IPv6 reverse DNS delegations on Hurricane Electric, configuring deSEC, and hosting a live website.

How a missing @PreAuthorize line in GeoNetwork led to unauthenticated Remote Code Execution across government geospatial infrastructure in 39 countries.

Introduction What if I told you six thousand of your employees were two steps removed from gaining full control over your IT infrastructure. If we told you this was related...

Analysis of server-side data associated with The Gentlemen ransomware group identified the complete TukTuk C2 project structure, DLL side-loading configurations, EDR neutralization research, vulnerable driver materials, and data assessed to have been exfiltrated from multiple organizations.

PwnEye can compromise cameras through ONVIF and RTSP. It can play the stream, deface a camera, move it and get a shell.

Learn Basic Concepts of Linux. Best site to learn Linux from beginner to Advanced.

Prove or reject unauthenticated remote OS command execution as the PaperCut service account on stock PaperCut NG/MF 25.0.11 via a pre-auth Release Station / MFD card-ID flow reaching the external card-lookup runtime, then replay identically on stock 25.0.12 to confirm the fix blocks the chain. This maps to the PaperCut NG/MF URGENT Security Bulletin of 27 Aug 2026 active exploitation, all versions affected . Whether a stock remote mechanism exists is an open question; card-ID SQL injection and JDBC URL injection are unproven hypotheses only.

AmberWolf Security Research Blog