Archive

Synack Red Team's Ozgur Alp shows how to exploit a fully blind SQL injection in a PostgreSQL ORDER BY clause using regex error gadgets and subqueries.

Author’s note: this article describes vulnerabilities in ascending order of severity. If you want to skip straight to the most interesting part, feel free to read it from the bottom up. Even though Internet Explorer officially reached its end of life in 2020, its core engine remains widely used in the form of the WebBrowser […]

An analysis of a widely available Exchange Online misconfiguration allowing attackers to spoof internal and external senders.

In the beginning, there was the signature. A simple string of bytes that uniquely identified a piece of malware. Those were simpler times - append your virus to a file, patch the entry point, and you’re done. The AV industry responded with signature databases, and for a while, the game was predictable.

Hunting Honey Pots as Red Teamers

A technical writeup on a 0day vulnerability I reported inside V8, Chrome's JS engine

In this post I’m going to document some notes from reversing the WinNotify signed driver and turning its IOCTL interface into a stable kernel read/write primitive. The driver has been discussed publicly before, but I still wanted to go through the binary myself instead of only following the released PoC. That ended up

What happens when you unleash an AI across all of Google's infrastructure? 1,500 APIs, 3,600 keys, and $500,000 in bounties later, here's what I found.

Today, Ivanti published an advisory. “No way?” we hear you say. "Yes way!" a random dog screams back at you, across the street. Today’s rare advisory outlines two vulnerabilities in Ivanti’s Sentry product, appealing directly to our inner desire for sophisticated server-side, pre-authenticated vulnerabilities. With our inner desire only partially satisfied, we found adults who could help us read the advisory. We were kindly told that although Ivanti managed to provide minimal information, the

How HTTP/2’s multi-frame architecture allows attackers to bypass WAFs by exploiting timing delays, protocol translation flaws, and incomplete body inspection across various reverse proxies

By Oliver Sieber Overview In this blog post, we discuss a use-after-free vulnerability that we found in the nftables subsystem of the Linux kernel in early 2025. This vulnerability was patched upstream on 5 February 2026 and assigned CVE-2026-23111. This blog post covers a technical analysis of the vulnerability and how we exploited it to perform a local ... Read more Off By !: Exploiting a Use-after-Free in the Linux Kernel

The Problem If you are like me, you have found yourself digging through Microsoft specifications and RFC documentation trying to wrangle with a new exploit or tooling to get DA faster than your peers. The biggest problem one may encounter is the specifications are meant for developers; they will tell you the song and dance in its entirety, but it never goes beyond in any way that may be useful for you to weaponize. Fixing that may potentially lay with using the Windows 2003 Source code.

How one Commit Broke Obfuscation: A blog post exploring the role of compilers and optimizations in the field of obfuscation and de-obfuscation.

Security research on a local event-storm condition that makes Trend Micro Deep Security Agent unload and reload bmhook/tmhook, creating a repeatable protection bypass window.

HyperVenom — Security research writeup on subverting VBS on Windows 11.

A firsthand analysis of three modern Chrome-specific exploit mitigations — MiraclePtr, v8 sandbox, and PartitionAlloc — from actual zero day research targeting Google Chrome.

Abusing an unauthenticated Bluetooth protocol to turn a PC speaker into a Rubber Ducky.

Adobe Acrobat Reader Escript.api Use-After-Free Remote Code Execution By Michele Campa Overview In this blog post we take a look at a use-after-free vulnerability found in Adobe Acrobat Reader’s Escript.api module in February 2025. This issue was patched on April 2026 and likely assigned CVE-2026-34621,  CVE-2026-34626 , or CVE-2026-34622. Disclaimer: Every offset and function name referenced in this blog ... Read more Adobe Acrobat Reader Escript.api Use-After-Free Remote Code Execution

If you would like to read the Korean version, please visit se1en.tistory.

XBOW discovered CVE-2026-45185, a critical unauthenticated RCE in Exim, and used the disclosure window to test how far human and autonomous exploit development could go.

A journey into the USR-G806AU 4G LTE industrial router. From fake root accounts to real and undocumented root accounts, and the discovery of hardcoded credentials that expose devices to remote compromise.

How AI-assisted reverse engineering of stripped PAN-OS binaries led to finding a JWT algorithm confusion vulnerability in GlobalProtect's Cloud Authentication Service, enabling full VPN auth bypass with just a username.

A chance Discord message, two missing pieces, and one hour before the window closed: From info leak to RCE on Google Cloud. Three months later, it happened again.

Apple Maps side channel attack

A widely used Secure E-Mail Gateway "SeppMail" revealed critical vulnerabilities with little effort and without chaining of multiple vulnerabilities. RCE to compromise the device, LFI to read mails and more. (CVE-2026-2743, CVE-2026-7864, CVE-2026-44127, CVE-2026-44128)