TL;DR: Two command injection vulnerabilities exist in the Windows Explorer “Open PowerShell window here” context menu due to improper quoting and command injection through user-controlled folder paths. By creating folders with crafted names (e.g., folder; calc), an attacker can trigger arbitrary PowerShell command execution when a user uses Shift + Right-Click → Open PowerShell window here. One variant affects modern Windows 11 builds, while another existed since Windows 10 1703 (2017).
You can find the scenarios and the slides of the Insomni’hack 2026 talk in https://github.com/p0dalirius/Shift-Happens-Uncovering-to-builtin-command-injection-in-Windows-context-menus
👍2
Malware, Cats and Cryptography
2026-cocomelonc-bsideslux.pdf
Let me keep it short… use uncommon stuff for static
(here is my conference ┐( ∵ )┌)
chain things smart to get past behavior detection.