CVE-2026-28910: Breaking the macOS App Sandbox, TCC and Code Signing with Archive Utility

Attribution. This is an original English rewrite based on “CVE-2026-28910: Breaking macOS App Sandbox Data Containers, TCC, and Hijacking Apps Using Archive Utility” by Talal Haj Bakry and Tommy Mysk on Mysk Blog (mysk.blog, published 19 May 2026). All research, screenshots, videos, code listings and the disclosure timeline are the original authors’ work. Every figure,…

https://core-jmp.org/2026/05/cve-2026-28910-macos-archive-utility-sandbox-tcc-app-hijacking/

BYOVD Attack Surface: From Vulnerability-Driven to Certificate Abuse

Source attribution. This is an original English rewrite of the research article “BYOVD宣击面从漏洞驱动到合法证书的范式转移” (“BYOVD Attack Surface: Paradigm Shift from Vulnerability-Driven to Legitimate Certificate Abuse”), published on Ghost Wolf Lab — Research on 2026-05-24. Author not clearly listed (publication: Ghost Wolf Lab). All technical claims, code samples, and figures are credited to the original author and…

https://core-jmp.org/2026/05/byovd-attack-surface-vulnerability-to-certificate-abuse/

Callback Hell: Abusing Callbacks, Tail Calls, and Proxy Frames to Obfuscate the Stack

Source & licence. This is a faithful English republication of “Callback hell: abusing callbacks, tail-calls, and proxy frames to obfuscate the stack” by klezVirus (posted 2025-12-21, updated 2025-12-22). The original is licensed under CC BY 4.0; that licence allows republication with attribution, which is provided here in full. All figures, assembly listings, and the POC…

https://core-jmp.org/2026/05/callback-hell-tail-calls-proxy-frames-stack-obfuscation/

CVE-2024-27398: Exploiting a Linux Bluetooth SCO Use-After-Free with SMEP Bypass

Source attribution. This is an original English rewrite of “CVE-2024-27398 — Exploiting a Linux Bluetooth SCO Use-After-Free with SMEP Bypass”, published on Secunnix Cyber Security on 2026-04-25 (author not clearly listed — byline reads “Yayıncı: Anonymous”). The original carries an “All rights reserved” notice (© Secunnix Cyber Security — Tüm hakları saklıdır.), so this is…

https://core-jmp.org/2026/05/cve-2024-27398-linux-bluetooth-sco-uaf-smep-bypass/

UAC-0247 / UAC-0244: HTA-Borne Malware Hunts Ukrainian FPV Drone Operators

Original English rewrite with full credit. This article is an independent English-language rewrite of “UAC-0244 / UAC-0247: Malware Targeting FPV drone operators” by Robin Dost, published on the Synaptic Security Blog on May 21, 2026.

All original research, screenshots, decoded scripts, hashes, infrastructure findings, and the IIM Chain diagram remain the work of the original…

https://core-jmp.org/2026/05/uac-0247-uac-0244-fpv-drone-operators-malware/

Attacking Samsung RKP: Three Bypasses of EL2 Kernel Protection on Exynos Devices

Original English rewrite with full credit. This article is an independent English-language rewrite of “Attacking Samsung RKP” by Alexandre Adamski, published on the Impalabs Blog on November 25, 2021.

All vulnerability research, reverse engineering, source-code excerpts, ASCII diagrams, and the exploit proof-of-concept are the work of the original author and were originally disclosed by Longterm…

https://core-jmp.org/2026/05/attacking-samsung-rkp-impalabs-rewrite/

PPL Abuse: How Attackers Turn Windows’ Own Trust Anchors Into EDR Killers

Original English rewrite with full credit. This article is an independent English-language rewrite of «PPL滥用» (“PPL Abuse”), published on the Ghost Wolf Lab research blog on May 25, 2026. Author not clearly listed on the source page — attributed to Ghost Wolf Lab.

The original is in Chinese. All technical analysis, the PPL-inspection C program,…

https://core-jmp.org/2026/05/ppl-abuse-ghost-wolf-lab-rewrite/

Malware Development Essentials for Operators: From PEB Walking to Kernel-Mode DKOM

Original English rewrite with full credit. This article is an independent English-language rewrite of “Malware Development Essentials for Operators”, published on f00crew.org (page /0x33). Author not clearly listed on the source page — site handle 0x00, no byline.

All technical content, code samples, ASCII diagrams, and VirusTotal screenshots are the work of the original author.…

https://core-jmp.org/2026/05/malware-development-essentials-for-operators-rewrite/

educational project
Пфф, ну разумеется, о чем речь то

#rootkits #bootkits

V2X2MAP: A $10 ESP32-C5 Board Plus an Android App Turns Live 802.11p V2X Traffic Into a Map

Original English rewrite with full credit. This article is an independent English-language rewrite of “Monitor live traffic from V2X signals with V2X2MAP open-source Android app and an ESP32-C5 development board”, by Jean-Luc Aufranc (CNXSoft), published on CNX Software on May 25, 2026.

All hardware photos, app screenshots, the legal disclaimer text and the underlying reporting…

https://core-jmp.org/2026/05/v2x2map-esp32-c5-android-v2x-traffic-monitor/

Microphones Leak EM Signals Carrying Audio: A 93%-Accurate Side-Channel Attack on MEMS Mics

Original English rewrite with full credit. This article is an independent English-language rewrite of “Microphones leak EM signals carrying audio: new side-channel attack achieves 93% accuracy” by Denis Laskov, published in the Eye on Cyber Substack newsletter on May 24, 2026.

The Substack post itself is a short pointer to underlying academic work; the underlying…

https://core-jmp.org/2026/05/mems-microphone-em-side-channel-attack-rewrite/

z386: An Open-Source FPGA 80386 Driven by the Original Intel Microcode

Original: This article is an independent of “z386: An Open-Source 80386 Built Around Original Microcode” by nand2mario, published on Small Things Retro on May 23, 2026.

All hardware research, RTL design decisions, performance measurements, block diagrams, die-shot annotations and benchmarks belong to the original author. Three of the original images (Doom II screenshot, 80386 block…

https://core-jmp.org/2026/05/z386-open-source-80386-fpga-microcode-rewrite/

CVE-2026-5426: Mandiant Catches ViewState RCE Against KnowledgeDeliver LMS in Japan

Original: This article is an independent of “Exploitation of KnowledgeDeliver via ViewState Deserialization Vulnerability” by Takahiro Sugiyama, Peter Revelant, and Mathew Potaczek, published on the Google Cloud Threat Intelligence (Mandiant) blog on May 25, 2026.

All incident-response work, IOCs, BLUEBEAM analysis, hunting queries, and the underlying disclosure (MNDT-2026-0009) are the work of the original authors…

https://core-jmp.org/2026/05/knowledgedeliver-viewstate-deserialization-cve-2026-5426/

OpenTrafficMap’s €20 ESP32-C5 Board Turns 802.11p V2X Into a Public Map of Traffic Lights and Buses

Original: This article is an independent of “OpenTrafficMap ESP32-C5 C-ITS receiver board can help improve traffic efficiency using 802.11p V2X communication” by Jean-Luc Aufranc (CNXSoft), published on CNX Software on May 24, 2026.

All hardware photos, deployment screenshots, the Graz Linux Days talk, and the underlying reporting are the work of the original author and…

https://core-jmp.org/2026/05/opentrafficmap-esp32-c5-cits-receiver-rewrite/

CVE-2026-41873: Apache Pony Mail OAuth SSRF + Lua CRLF Smuggling = Unauthenticated Account Takeover

Original: This article is an independent of “(CVE-2026-41873) Apache Pony Mail CRLF Injection and SSRF Leading to Full Account Takeover”, by Li Jiantao and Tevel Sho, published on STAR Labs SG on 28 April 2026.

All vulnerability research, the PoC scripts, the Elasticsearch SQL exfiltration chain, the CRLF / HTTP-request-smuggling payload analysis, and the patch-diff…

https://core-jmp.org/2026/05/cve-2026-41873-apache-pony-mail-ssrf-crlf-rewrite/

Gargoyle, A Decade Later: Josh Lospinoso’s Memory-Scanning Evasion Idea, Refreshed for 2026

Original: This article is an independent of “Gargoyle, a decade later” by Josh Lospinoso, published on lospino.so on May 13, 2026.

All research, framing, the 2017 original Gargoyle proof of concept, the 2026 refresh, and the discussion of the broader sleep-obfuscation / temporal-memory-state family belong to the original author. The post contains no published code…

https://core-jmp.org/2026/05/gargoyle-decade-later-josh-lospinoso-rewrite/

The epoll UAF: A Same-CPU Preemption Race in fs/eventpoll.c on Linux 6.6+

Original: This article is an independent of “The epoll uaf”, published on the personal blog at guysrd.github.io. Author not clearly listed on the source page — the site handle is guysrd, with no byline.

All vulnerability research, reverse engineering, the struct-offset table, the C excerpts from fs/eventpoll.c and the exploit-feasibility analysis are the work of…

https://core-jmp.org/2026/05/epoll-uaf-eventpoll-rcu-race-rewrite/