Vulnerability research blog

Summary

Server-driven heap overflow in the lwIP SMTP client. (crlf - auth) is never bounded against SMTP_TX_BUF_LEN; a 64 KiB AUTH line lands in a 255-byte buffer.

A New Threat Posed by 𝖌𝖌𝖍𝖍𝖔𝖔𝖘𝖘𝖙𝖙 Bits in Java

By Tyler Holmwood on 2026-05-14

Unmanaged PowerShell Execution: Hunting Beyond powershell.exe PowerShell remains one of the most abused tools in an attacker’s arsenal , traditional PowerShell detections often rely on monitoring …

Unmanaged PowerShell Execution: Hunting Beyond powershell.exe PowerShell remains one of the most abused tools in an attacker’s arsenal , traditional PowerShell detections often rely on monitoring …

This article demonstrates devirtualization of CodeVirtualizer/Themida protected code, however the techniques described here apply to pretty much every virtual machine based obfuscator. Only requiring some minor modifications to support each of them.

How address translation, memory allocation, and physical topology shape the performance of data-intensive systems. Told through a dialogue between two processes

Horizon3.ai details CVE-2025-64155, revealing chained FortiSIEM vulnerabilities enabling remote code execution and root access, analysis of the root cause, and indicators of compromise.

A grammar-driven .glb fuzzing campaign found a memory-corruption bug in the shared 3D parser used by Microsoft Word and the Microsoft 3D Viewer. The same input crashed both products at matching call-site offsets. Reported to the Microsoft Security Response Center on January 30, 2020. Microsoft published the fix on June 9, 2020 as the Microsoft Office Remote Code Execution Vulnerability, graded Important, CVSS 7.8, exploitation less likely.

Technical reference on modern EDR architecture, detection mechanisms, evasion techniques, and reverse-engineering methodology. Covers kernel callback APIs, file-system mini-filters, ETW providers, the four detection-engine model, syscall gates (FreshyCalls, RecycledGate, SysWhispers4, Acheron, Sysplant), sleep obfuscation (Ekko, FOLIAGE, DreamWalkers), call-stack spoofing (SilentMoonwalk, VulcanRaven), ETW-TI hardware-breakpoint bypass, patchless AMSI bypass via VEH, BYOVD against the vulnerable-driver blocklist, and the eight-phase EDR research methodology.

Authored by stratan In Part 1, we went over the background details that are needed to follow along, as well as the trigger specifics of the bug. In Part 2, we'll go through the relevant code paths, analyze the patch, and develop an in-cage read/write primitive. Disclaimer This article has been prepared for

When this bug shipped, the dinosaurs had just gone extinct, only 64.999979 million years prior.

Written by Hyunseo Shin

Exploiting TP-Link Home Security Smart Cameras

TL;DR In April 2026, Adobe disclosed three critical security issues (CVE-2026-34621,CVE-2026-34622,CVE-2026-34626) affecting Acrobat DC, Acrobat Reader DC, and Acrobat 2024. According to Adobe’s advisories, these vulnerabilities could allow attackers to execute arbitrary code and leak user information through a malicious PDF file via a prototype pollution chain and they were reportedly exploited in the wild. The initial issue, CVE-2026-34621, was first identified by EXPMON. While several reports have already covered the threat intelligence and malware-analysis aspects of the ITW samples, we were more interested in the underlying vulnerabilities themselves and how Adobe patched them.

Learn 7 techniques to enable RDP remotely via NetExec, Impacket, Evil-WinRM & Metasploit for lateral movement in pentesting.

Using Page Guard Exceptions and Vectored Exception Handling to achieve early return from AmsiScanBuffer.

Elastic Security Labs explores the ongoing arms race between LLM-driven reverse engineering and obfuscation.

Introduction Hello, I’m RyotaK (@ryotkak ), a security engineer at GMO Flatt Security Inc. A while ago, I participated in the Google Cloud VRP bugSWAT, a live hacking event organized by Google. During this event, I discovered a remote command execution vulnerability in one of Google Cloud’s services. As the vulnerability has now been fixed, I would like to share the technical details in this article. TL;DR Google Cloud has a product called Looker, and this product has a feature to manage Git repositories.

This post breaks down a bug chain we found in Samsung Galaxy Store that leads to arbitrary local APK install on the Samsung S25, using weak signature verification, an unprotected exported receiver, path traversal, predictable randomness, and a denial-of-service bug.

Laws of UX is a collection of best practices that designers can consider when building user interfaces.

Modern kernel anti-cheat systems are, without exaggeration, among the most sophisticated pieces of software running on consumer Windows machines. They operate at the highest privilege level available to software, they intercept kernel callbacks that were designed for legitimate security products, they scan memory structures that most programmers never touch in their entire careers, and they do all of this transparently while a game is running. If you have ever wondered how BattlEye actually catches a cheat, or why Vanguard insists on loading before Windows boots, or what it means for a PCIe DMA device to bypass every single one of these protections, this post is for you.