TL;DR: I ported the functionality of dnscmd.exe into (slightly) more OPSEC safe Beacon Object Files (BOFs) so you can get domain admin…

Understanding emulation and fuzzing from scratch!

How SindriKit implements dynamic Fat Frame discovery and JMP-Trampolines to defeat RtlVirtualUnwind and call-stack telemetry.

TL;DR: Noma Labs discovered a critical prompt injection vulnerability within GitHub’s new Agentic Workflows, allowing an unauthenticated attacker to silently pull data from private repositories by posting a crafted GitHub Issue in a public repository belonging…

How to map your existing detection rules to MITRE ATT&CK, find the gaps that actually matter, and prioritize what to build next. A practical guide from 10 years of SOC operations.

Posted by Emergency_Stable_923 - 5 votes and 3 comments

1-in-2 phones sold in Africa ship a hidden telemetry framework that encrypts whole-device activity to shalltry.com Transsion is the world's fourth-largest

In June 2026 the IETF published RFC 10008 and gave HTTP a new method: QUERY. New HTTP methods are rare. Most engineers have not seen one added in about twenty years, so this is worth understanding before it shows up in your stack.

At first, when I saw this…

Author(s): Vlad Pasca Executive Summary Threat actor distributes malicious cryptocurrency wallets (Anchor, Zec, Iota, Onto, Dark, and Stella...

Coal India’s intelligent CCTV platform developed by DeepSight AI Labs and Accenture had plaintext passwords and no API authentication.

Agentic AI systems introduce a security surface that is qualitatively different from that of stateless LLMs. They persist memory, invoke external tools, coordinate with peer agents, and operate...

Static analysis of a .NET RAT that ships browser credential theft, Discord token harvesting, cryptocurrency wallet draining, and a Jigsaw-inspired ransomware module in a single 2.5 MB executable.

(Part 1 here)

Posted by Emergency_Stable_923 - 1 vote and 0 comments

This is the second part of my write-up on vulnerabilities in the Realtek SD card reader driver. In this part, I will show how exposing device registers to non-privileged users can lead to access to physical memory. The post focuses solely on the DMA vulnerability…

LIEF 1.0.0: a new cross-platform Runtime API, faster Rust bindings, stable-ABI and free-threaded Python wheels | LIEF

The Antimalware Scan Interface (AMSI) is a Microsoft control that directs PowerShell content to the installed antimalware engine or EDR to conduct a scan and identify malicious indicators. However,…

AmberWolf Security Research Blog