Introduction What if I told you six thousand of your employees were two steps removed from gaining full control over your IT infrastructure. If we told you this was related...

SafeBreach Labs uncovered 3 severe flaws in Telnet and Samba, two CVSS 10.0 RCEs and a root privilege escalation, hiding in legacy Linux services for decades.

You can outsource the hacking, but not the understanding

A clear look into DarkSword, the latest public Kernel Exploit up to iOS 26.0.1, its root cause, and its reimplementation as ClearSword.

Technical breakdown of OnlyShells — a five-vulnerability chain in ONLYOFFICE Desktop Editors combining zero-click XSS, a Chromium V8 RCE, and an update-service LPE to achieve remote code execution as NT AUTHORITYSYSTEM when a victim opens a crafted document.

The Problem If you are like me, you have found yourself digging through Microsoft specifications and RFC documentation trying to wrangle with a new exploit or tooling to get DA faster than your peers. The biggest problem one may encounter is the specifications are meant for developers; they will tell you the song and dance in its entirety, but it never goes beyond in any way that may be useful for you to weaponize. Fixing that may potentially lay with using the Windows 2003 Source code.

A journey into the USR-G806AU 4G LTE industrial router. From fake root accounts to real and undocumented root accounts, and the discovery of hardcoded credentials that expose devices to remote compromise.

When this bug shipped, the dinosaurs had just gone extinct, only 64.999979 million years prior.

CVE-2026-34980 + CVE-2026-34990: two CUPS vulnerabilities, discovered by an autonomous LLM pipeline, chainable from unaut'd remote print job to root file (over)write.

Highlights Introduction While the abuse of vulnerable drivers has been around for a while, those that can terminate arbitrary processes have drawn increasing attention in recent years. As Windows security continues to evolve, it has become more challenging for attackers to execute malicious code without being detected. As a result, the attackers often aim to […]

Kaspersky researchers discovered previously unidentified commercial Dante spyware developed by Memento Labs (formerly Hacking Team) and linked it to the ForumTroll APT attacks.

Trends Description

Mutation-Based XSS + V8 type confusion + V8 sandbox escape = RCE on Basecamp. Disclosed it on Hackerone: https://t.co/slsv3j4jXx go read the comments if you wanna see what a week of exploit dev pain looks like.

Learn how to use Mimkatz for hacking with this comprehensive guide to dumping credentials and performing lateral movement.

Master AD attacks with Impacket: Kerberos exploitation, credential dumping, and lateral movement techniques for red teams.

Introduction Versa Concerto is a widely used network security and SD-WAN orchestration platform, designed to provide seamless policy management, analytics, and automation for enterprises. With a growing customer base that includes large enterprises, service providers, and government entities, the security of this platform is critical. Given its extensive adoption and potential exposure to external threats, we initiated research to assess its security posture and uncover possible vulnerabilities

OneNote is one of the Office suite components which is often overlooked when RedTeaming. Though OneNote cannot execute VBA Macros, it has an important potential for phishing as an initial vector.

A true story on taking over a client’s Azure tenant via a successful phish. TL;DR A tempting phish got lots of users to disclose their passwords, and a lack of […]

UAC Bypass via DLL hijacking of Microsoft Support Diagnostic Tool (MSDT). The UAC bypass method described here is based on DLL hijacking which happens when loading the Bluetooth diagnostic package.

Windows Defener... как много боли в этом слове. Вероятнее всего, если вы хоть краем уха были связаны с распространением ВПО -- данный антивирус уже успел доставить вам массу неудобств. Имеющий самую обширную облачную базу в мире АВ не мог остаться без внимания крипторов и малварщиков, в...

I often hear that AppLocker is not very safe and it is easy to bypass. Since I really like AppLocker and I recommend it to customers, I decided to do this blogpost series and go over the different …

During a red team engagement, one of the first things you may want to do after obtaining initial access is establish reliable persistence on the endpoint. Being able to streamline...

Overview Performing lateral movement in an OpSec safe manner in mature Windows environments can often be a challenge as defenders hone their detections around the indicators generated by many of...

This is a special post because I fully based on another researcher, s1guza’s 0day. All of this story began from the following tweet: Siguza told us that his 0day was patched in the iOS 13.5 beta3. So this is actually a sandbox escape 0day for the newest, non-beta iOS version (13.4.1). In this post, I’ll show you how I reproduced that bug and wrote a malicious application that uses that 0day to steal the iMessage history!

1. Content process -> Privileged content process (first_stage.js) When spawning a new Edge content process, its privilege is determined by its URL. This URL check is performed by the LCIEUrlPolicy::Ge…