Archive

Abusing an unauthenticated Bluetooth protocol to turn a PC speaker into a Rubber Ducky.

Adobe Acrobat Reader Escript.api Use-After-Free Remote Code Execution By Michele Campa Overview In this blog post we take a look at a use-after-free vulnerability found in Adobe Acrobat Reader’s Escript.api module in February 2025. This issue was patched on April 2026 and likely assigned CVE-2026-34621,  CVE-2026-34626 , or CVE-2026-34622. Disclaimer: Every offset and function name referenced in this blog ... Read more Adobe Acrobat Reader Escript.api Use-After-Free Remote Code Execution

If you would like to read the Korean version, please visit se1en.tistory.

XBOW discovered CVE-2026-45185, a critical unauthenticated RCE in Exim, and used the disclosure window to test how far human and autonomous exploit development could go.

A journey into the USR-G806AU 4G LTE industrial router. From fake root accounts to real and undocumented root accounts, and the discovery of hardcoded credentials that expose devices to remote compromise.

How AI-assisted reverse engineering of stripped PAN-OS binaries led to finding a JWT algorithm confusion vulnerability in GlobalProtect's Cloud Authentication Service, enabling full VPN auth bypass with just a username.

A chance Discord message, two missing pieces, and one hour before the window closed: From info leak to RCE on Google Cloud. Three months later, it happened again.

Apple Maps side channel attack

A widely used Secure E-Mail Gateway "SeppMail" revealed critical vulnerabilities with little effort and without chaining of multiple vulnerabilities. RCE to compromise the device, LFI to read mails and more. (CVE-2026-2743, CVE-2026-7864, CVE-2026-44127, CVE-2026-44128)

Vulnerability research blog

Summary

Server-driven heap overflow in the lwIP SMTP client. (crlf - auth) is never bounded against SMTP_TX_BUF_LEN; a 64 KiB AUTH line lands in a 255-byte buffer.

A New Threat Posed by 𝖌𝖌𝖍𝖍𝖔𝖔𝖘𝖘𝖙𝖙 Bits in Java

By Tyler Holmwood on 2026-05-14

Unmanaged PowerShell Execution: Hunting Beyond powershell.exe PowerShell remains one of the most abused tools in an attacker’s arsenal , traditional PowerShell detections often rely on monitoring …

Unmanaged PowerShell Execution: Hunting Beyond powershell.exe PowerShell remains one of the most abused tools in an attacker’s arsenal , traditional PowerShell detections often rely on monitoring …

This article demonstrates devirtualization of CodeVirtualizer/Themida protected code, however the techniques described here apply to pretty much every virtual machine based obfuscator. Only requiring some minor modifications to support each of them.

How address translation, memory allocation, and physical topology shape the performance of data-intensive systems. Told through a dialogue between two processes

Horizon3.ai details CVE-2025-64155, revealing chained FortiSIEM vulnerabilities enabling remote code execution and root access, analysis of the root cause, and indicators of compromise.

A grammar-driven .glb fuzzing campaign found a memory-corruption bug in the shared 3D parser used by Microsoft Word and the Microsoft 3D Viewer. The same input crashed both products at matching call-site offsets. Reported to the Microsoft Security Response Center on January 30, 2020. Microsoft published the fix on June 9, 2020 as the Microsoft Office Remote Code Execution Vulnerability, graded Important, CVSS 7.8, exploitation less likely.

Technical reference on modern EDR architecture, detection mechanisms, evasion techniques, and reverse-engineering methodology. Covers kernel callback APIs, file-system mini-filters, ETW providers, the four detection-engine model, syscall gates (FreshyCalls, RecycledGate, SysWhispers4, Acheron, Sysplant), sleep obfuscation (Ekko, FOLIAGE, DreamWalkers), call-stack spoofing (SilentMoonwalk, VulcanRaven), ETW-TI hardware-breakpoint bypass, patchless AMSI bypass via VEH, BYOVD against the vulnerable-driver blocklist, and the eight-phase EDR research methodology.

Authored by stratan In Part 1, we went over the background details that are needed to follow along, as well as the trigger specifics of the bug. In Part 2, we'll go through the relevant code paths, analyze the patch, and develop an in-cage read/write primitive. Disclaimer This article has been prepared for

When this bug shipped, the dinosaurs had just gone extinct, only 64.999979 million years prior.

Written by Hyunseo Shin

Exploiting TP-Link Home Security Smart Cameras