Archive

TL;DR In April 2026, Adobe disclosed three critical security issues (CVE-2026-34621,CVE-2026-34622,CVE-2026-34626) affecting Acrobat DC, Acrobat Reader DC, and Acrobat 2024. According to Adobe’s advisories, these vulnerabilities could allow attackers to execute arbitrary code and leak user information through a malicious PDF file via a prototype pollution chain and they were reportedly exploited in the wild. The initial issue, CVE-2026-34621, was first identified by EXPMON. While several reports have already covered the threat intelligence and malware-analysis aspects of the ITW samples, we were more interested in the underlying vulnerabilities themselves and how Adobe patched them.

Learn 7 techniques to enable RDP remotely via NetExec, Impacket, Evil-WinRM & Metasploit for lateral movement in pentesting.

Using Page Guard Exceptions and Vectored Exception Handling to achieve early return from AmsiScanBuffer.

Elastic Security Labs explores the ongoing arms race between LLM-driven reverse engineering and obfuscation.

Introduction Hello, I’m RyotaK (@ryotkak ), a security engineer at GMO Flatt Security Inc. A while ago, I participated in the Google Cloud VRP bugSWAT, a live hacking event organized by Google. During this event, I discovered a remote command execution vulnerability in one of Google Cloud’s services. As the vulnerability has now been fixed, I would like to share the technical details in this article. TL;DR Google Cloud has a product called Looker, and this product has a feature to manage Git repositories.

This post breaks down a bug chain we found in Samsung Galaxy Store that leads to arbitrary local APK install on the Samsung S25, using weak signature verification, an unprotected exported receiver, path traversal, predictable randomness, and a denial-of-service bug.

Laws of UX is a collection of best practices that designers can consider when building user interfaces.

Modern kernel anti-cheat systems are, without exaggeration, among the most sophisticated pieces of software running on consumer Windows machines. They operate at the highest privilege level available to software, they intercept kernel callbacks that were designed for legitimate security products, they scan memory structures that most programmers never touch in their entire careers, and they do all of this transparently while a game is running. If you have ever wondered how BattlEye actually catches a cheat, or why Vanguard insists on loading before Windows boots, or what it means for a PCIe DMA device to bypass every single one of these protections, this post is for you.

Hello! Yes, it's all a disaster again! Let's get this party started: 0:00 /0:12 1× No comments today, so imagine this: * We wrote something that we find very funny, * Nobody else gets it, * But everyone humors us Just like a typical watchTowr Labs blog introduction. As with all

【続・マルウェア解析】Atomic Stealer攻撃チェーンの解析

Cognitoの罠10選と称して、Cognitoにおける設定ミス等を引き起こしやすい勘違いポイントを10項目紹介します。

Multiple Cross-Site Scripting (XSS) Vulnerabilities in Mailcow

Race conditions in web applications represent a persistent class of vulnerabilities that allow adversaries to bypass business logic through synchronized request bursts. While the transition from TCP-based HTTP/2 to UDP-based HTTP/3 (QUIC) introduces stochastic processing delays and independent stream delivery, the security implications of these protocol shifts remain under-explored. This work investigates the effectiveness of race condition exploits across modern transport protocols. Our experimental results demonstrate that while the user-space implementation of QUIC provides a resilience threshold against low-volume attacks, this protection is an artifact of scheduling jitter and is inherently fragile. We identify a critical concurrency threshold ( $$N=100$$ N = 100 ) where the density of a Single Datagram Attack (SDA) saturates the protocol parser, achieving an exploitation efficiency (f) that exceeds traditional HTTP/2 methods. However, we also identify a “smothering effect” unique to high-density bursts, where extreme transaction arrival rates trigger database-level lost updates that can paradoxically limit total economic impact. Furthermore, we show that infrastructure-level defenses, such as network pacing, are effectively neutralized by the reverse proxy’s de-multiplexing process. We conclude that protocol-level evolution does not mitigate application-layer concurrency risks; rather, it shifts the attack surface dynamics toward more efficient but higher-contention exploitation primitives.

A prototype pollution bug in Figma’s variant counter, chained through a plugin-context race against $INTERNAL_DO_NOT_USE$RERUN_PLUGIN$, a jsx_debugging feature-flag flip, and a forgotten writeFileToPath IPC in the Electron desktop app, to achieve zero-click cross-platform RCE from a published plugin. Reported to Figma and patched within hours.

Kaspersky researcher discovered a vulnerability in RPC architecture that enables an attacker to create a fake RPC server and escalate their privileges.

Abusing legitimate machine learning infrastructure for payload delivery, in-memory staging, and EDR evasion on Windows 10/11. Introduction Every red team operator knows the arms race: EDR vendors get better at flagging suspicious API sequences, shellcode patterns, and reflective loaders. Meanwhile, Windows keeps shipping new legitimate subsystems that are rarely audited from an offensive perspective. Windows Machine Learning (WinML) - shipped since Windows 10 1809 (build 17763) - is one su

“” is published by Excalibra in MeetCyber.

A full technical teardown of FUD Crypt (Cryptor-as-a-Service) and surrounding activity performed by this threat actor

Learn how to identify and exploit SSRF vulnerabilities in cloud-native environments, from metadata services to filter bypass.

I have had several discussions over the years with folks on tackling EDR bypass as it pertains to fully undetected (FUD) code. In my opinion, there isn’t really a perfect silver bullet approach to tackling FUD. Especially with ML (machine learning) / AI integrated in most modern EDR solutions, you really have to adjust your approach to FUD as you go. I will say that I truly believe script interpreter type languages such as Python, Ruby, Perl, even PHP, are great candidates to meet this need. Scripting languages are not heavily scrutinized when we’re comparing with compiled (PE executable) code. Now I can already hear the disgruntled offsec folks questioning my rationale when they have tried countless times to make their powershell and javascript/vbscript code into FUD worthy code. I get it and I’m with you. It’s not a one size fits all right? Powershell, while also a script interpreter type language, has been so abused by threat actors that it’s incredibly difficult to tackle FUD due to its prolific use in malicious campaigns, but it’s certainly not impossible. Let’s get to it!

Overview

Publications from Calif. Contribute to califio/publications development by creating an account on GitHub.

Cisco Talos documents several macOS living-off-the-land (LOTL) techniques, demonstrating that native pathways for movement and execution remain accessible to those who understand the underlying architecture.