Breaking Out of Chrome’s Sandbox: A Native Messaging Backdoor Observed in Italy
Original text: “Breaking Out of Chrome’s Sandbox: A Native Messaging Backdoor Observed in Italy” — Andrea Draghetti, D3Lab (June 22, 2026). Code blocks, tables, and figures below are reproduced verbatim with attribution captions.
Executive Summary
In June 2026, Italian security firm D3Lab documented a targeted malware campaign distributing a compound browser threat via invoice-themed phishing…
https://core-jmp.org/2026/07/breaking-out-of-chromes-sandbox-native-messaging-backdoor-italy/
Original text: “Breaking Out of Chrome’s Sandbox: A Native Messaging Backdoor Observed in Italy” — Andrea Draghetti, D3Lab (June 22, 2026). Code blocks, tables, and figures below are reproduced verbatim with attribution captions.
Executive Summary
In June 2026, Italian security firm D3Lab documented a targeted malware campaign distributing a compound browser threat via invoice-themed phishing…
https://core-jmp.org/2026/07/breaking-out-of-chromes-sandbox-native-messaging-backdoor-italy/
🔥4
CVE-2026-43503: Python PoC for DirtyClone, a Linux kernel LPE via page-cache corruption exploit https://github.com/entra1337/DirtyClone
GitHub
GitHub - entra1337/DirtyClone: Python Proof of Concept for DirtyClone (CVE-2026-43503) - Linux kernel LPE via page-cache corruption
Python Proof of Concept for DirtyClone (CVE-2026-43503) - Linux kernel LPE via page-cache corruption - entra1337/DirtyClone
😱5👍3🔥3
HDD Firmware Hacking Part 1
Original text: “HDD Firmware Hacking Part 1” — Ryan Miceli, icode4.coffee (May 14, 2026). Code blocks and screenshots are reproduced verbatim with attribution captions.
Executive Summary
Reverse engineering and modifying hard drive firmware sounds exotic, but the primitives turn out to be surprisingly accessible once you know where to look. In this first installment, security…
https://core-jmp.org/2026/07/hdd-firmware-hacking-part-1/
Original text: “HDD Firmware Hacking Part 1” — Ryan Miceli, icode4.coffee (May 14, 2026). Code blocks and screenshots are reproduced verbatim with attribution captions.
Executive Summary
Reverse engineering and modifying hard drive firmware sounds exotic, but the primitives turn out to be surprisingly accessible once you know where to look. In this first installment, security…
https://core-jmp.org/2026/07/hdd-firmware-hacking-part-1/
👍11🔥9😱2
Callback Hell: Abusing Callbacks, Tail-Calls, and Proxy Frames to Obfuscate the Stack
Original text: “Callback hell: abusing callbacks, tail-calls, and proxy frames to obfuscate the stack” — klezVirus, personal security research blog (December 21, 2025). Code, tables and figures below are reproduced verbatim with attribution captions. Licensed under CC BY 4.0.
Executive Summary
This post by klezVirus explores a set of novel techniques for obfuscating call stacks…
https://core-jmp.org/2026/07/callback-hell-stack-obfuscation-proxy-frames/
Original text: “Callback hell: abusing callbacks, tail-calls, and proxy frames to obfuscate the stack” — klezVirus, personal security research blog (December 21, 2025). Code, tables and figures below are reproduced verbatim with attribution captions. Licensed under CC BY 4.0.
Executive Summary
This post by klezVirus explores a set of novel techniques for obfuscating call stacks…
https://core-jmp.org/2026/07/callback-hell-stack-obfuscation-proxy-frames/
🔥2👍1
The QNAP Pattern: Systemic Security Failures in QTS Plugin Architecture
Original text: “The QNAP Pattern” — Runic Labs. Code blocks, tables, and figures are reproduced verbatim with attribution captions.
Executive Summary
QNAP NAS devices suffer from a recurring class of architectural security failures that go well beyond individual CVEs. Researchers at Runic Labs analyzed four vulnerabilities spanning two plugins—Notes Station 3 and QmailAgent—and found that…
https://core-jmp.org/2026/07/the-qnap-pattern-systemic-security-failures-in-qts-plugin-architecture/
Original text: “The QNAP Pattern” — Runic Labs. Code blocks, tables, and figures are reproduced verbatim with attribution captions.
Executive Summary
QNAP NAS devices suffer from a recurring class of architectural security failures that go well beyond individual CVEs. Researchers at Runic Labs analyzed four vulnerabilities spanning two plugins—Notes Station 3 and QmailAgent—and found that…
https://core-jmp.org/2026/07/the-qnap-pattern-systemic-security-failures-in-qts-plugin-architecture/
🔥2
Building an Encrypted C2 Implant Using QUIC
Original text: “Building an Encrypted C2 Implant Using QUIC” — R.B.C (g3tsyst3m), G3tSyst3m’s Infosec Blog (April 30, 2026). Code blocks and figures are reproduced verbatim with attribution captions.
Executive Summary
This article by R.B.C (g3tsyst3m) walks through the construction of a minimal proof-of-concept C2 implant—crudeRAT—that uses the QUIC protocol as its transport layer. QUIC is…
https://core-jmp.org/2026/07/building-encrypted-c2-implant-quic/
Original text: “Building an Encrypted C2 Implant Using QUIC” — R.B.C (g3tsyst3m), G3tSyst3m’s Infosec Blog (April 30, 2026). Code blocks and figures are reproduced verbatim with attribution captions.
Executive Summary
This article by R.B.C (g3tsyst3m) walks through the construction of a minimal proof-of-concept C2 implant—crudeRAT—that uses the QUIC protocol as its transport layer. QUIC is…
https://core-jmp.org/2026/07/building-encrypted-c2-implant-quic/
👍4🔥3
How I Ruined My Vacation by Reverse Engineering WSC
Original text: “how i ruined my vacation by reverse engineering wsc” — es3n1n, blog.es3n1n.eu (May 8, 2025). Code blocks and figures are reproduced verbatim with attribution captions.
Executive Summary
es3n1n is the author of no-defender, a tool that disabled Windows Defender by calling Windows Security Center (WSC) COM APIs while posing as an authorized security…
https://core-jmp.org/2026/07/how-i-ruined-my-vacation-reverse-engineering-wsc/
Original text: “how i ruined my vacation by reverse engineering wsc” — es3n1n, blog.es3n1n.eu (May 8, 2025). Code blocks and figures are reproduced verbatim with attribution captions.
Executive Summary
es3n1n is the author of no-defender, a tool that disabled Windows Defender by calling Windows Security Center (WSC) COM APIs while posing as an authorized security…
https://core-jmp.org/2026/07/how-i-ruined-my-vacation-reverse-engineering-wsc/
🔥5👍4😱3
setresuid(⚡): Glitching Google’s TV Streamer from ADB to Root
Original text: “setresuid(⚡): Glitching Google’s TV Streamer from adb to root” — Raelize B.V. (May 17, 2026). Code blocks, tables, and figures are reproduced verbatim with attribution captions.
Executive Summary
Researchers at Raelize B.V., presenting at hardwear.io NL 2025, demonstrated a practical electromagnetic fault injection (EMFI) attack against Google’s TV Streamer 4K. Starting from an…
https://core-jmp.org/2026/07/setresuid-glitching-google-tv-streamer-adb-root/
Original text: “setresuid(⚡): Glitching Google’s TV Streamer from adb to root” — Raelize B.V. (May 17, 2026). Code blocks, tables, and figures are reproduced verbatim with attribution captions.
Executive Summary
Researchers at Raelize B.V., presenting at hardwear.io NL 2025, demonstrated a practical electromagnetic fault injection (EMFI) attack against Google’s TV Streamer 4K. Starting from an…
https://core-jmp.org/2026/07/setresuid-glitching-google-tv-streamer-adb-root/
🔥8
Breaking eBPF Security: How Kernel Rootkits Blind Observability Tools
Original text: “Breaking eBPF Security: How Kernel Rootkits Blind Observability Tools” — 0xMatheuZ, matheuzsecurity.github.io. Code blocks are reproduced verbatim with attribution captions.
Executive Summary
eBPF-based security tools — Falco, Tracee, Tetragon, GhostScan — have become the dominant approach to Linux kernel observability and runtime threat detection. They attach to syscall tracepoints and kernel events, stream…
https://core-jmp.org/2026/07/breaking-ebpf-security-kernel-rootkits-blind-observability-tools/
Original text: “Breaking eBPF Security: How Kernel Rootkits Blind Observability Tools” — 0xMatheuZ, matheuzsecurity.github.io. Code blocks are reproduced verbatim with attribution captions.
Executive Summary
eBPF-based security tools — Falco, Tracee, Tetragon, GhostScan — have become the dominant approach to Linux kernel observability and runtime threat detection. They attach to syscall tracepoints and kernel events, stream…
https://core-jmp.org/2026/07/breaking-ebpf-security-kernel-rootkits-blind-observability-tools/
🔥3😱1
How to Use Ghidra to Analyse Shellcode and Extract Cobalt Strike Command & Control Servers
Original text: “How to Use Ghidra to Analyse Shellcode and Extract Cobalt Strike Command & Control Servers” — Matthew, Embee Research (Dec 08, 2023). Images reproduced verbatim with attribution captions.
Executive Summary
Cobalt Strike shellcode is one of the most widely deployed payloads in commodity malware campaigns, yet its analysis remains non-trivial for practitioners new…
https://core-jmp.org/2026/07/ghidra-shellcode-analysis-cobalt-strike/
Original text: “How to Use Ghidra to Analyse Shellcode and Extract Cobalt Strike Command & Control Servers” — Matthew, Embee Research (Dec 08, 2023). Images reproduced verbatim with attribution captions.
Executive Summary
Cobalt Strike shellcode is one of the most widely deployed payloads in commodity malware campaigns, yet its analysis remains non-trivial for practitioners new…
https://core-jmp.org/2026/07/ghidra-shellcode-analysis-cobalt-strike/
🔥6👍2
Debugging the Pixel 8 Kernel via KGDB
Original text: “Debugging the Pixel 8 kernel via KGDB” — Andrey Konovalov, xairy.io (Jul 28, 2025; revised Mar 11, 2026). Code, tables and figures below are reproduced verbatim with attribution captions.
Executive Summary
Debugging a running Linux kernel on a physical device is qualitatively different from debugging inside a virtual machine. Hypervisors expose built-in GDB…
https://core-jmp.org/2026/07/debugging-pixel-8-kernel-kgdb/
Original text: “Debugging the Pixel 8 kernel via KGDB” — Andrey Konovalov, xairy.io (Jul 28, 2025; revised Mar 11, 2026). Code, tables and figures below are reproduced verbatim with attribution captions.
Executive Summary
Debugging a running Linux kernel on a physical device is qualitatively different from debugging inside a virtual machine. Hypervisors expose built-in GDB…
https://core-jmp.org/2026/07/debugging-pixel-8-kernel-kgdb/
🔥7👍3
The Dark Side of WebAssembly: Cryptomining, Keyloggers, and Browser Exploitation
Original text: “El lado oscuro de WebAssembly” — Carlos Ávila, Telefónica Tech Blog (September 16, 2020). Images are reproduced verbatim with attribution captions.
Executive Summary
WebAssembly (WASM) is an open binary instruction format — announced in 2015 and broadly supported by browsers from 2017 onward — designed to let code written in C, C++, Rust,…
https://core-jmp.org/2026/07/dark-side-webassembly-cryptomining-keyloggers-browser-exploitation/
Original text: “El lado oscuro de WebAssembly” — Carlos Ávila, Telefónica Tech Blog (September 16, 2020). Images are reproduced verbatim with attribution captions.
Executive Summary
WebAssembly (WASM) is an open binary instruction format — announced in 2015 and broadly supported by browsers from 2017 onward — designed to let code written in C, C++, Rust,…
https://core-jmp.org/2026/07/dark-side-webassembly-cryptomining-keyloggers-browser-exploitation/
👍6🔥2😱1
Process Parameter Poisoning: EDR Evasion via Windows Process Startup Parameters
Original text: “Process Parameter Poisoning” — Max Hirschberger & Ogulcan Ugur, SensePost / Orange Cyberdefense (6 July 2026). Code listings and figures are reproduced verbatim with attribution captions.
Executive Summary
Process Parameter Poisoning (P3) is a code injection technique that transfers shellcode into a foreign process via the startup parameters of CreateProcessW—specifically the lpCommandLine, lpEnvironment,…
https://core-jmp.org/2026/07/process-parameter-poisoning-edr-evasion-windows/
Original text: “Process Parameter Poisoning” — Max Hirschberger & Ogulcan Ugur, SensePost / Orange Cyberdefense (6 July 2026). Code listings and figures are reproduced verbatim with attribution captions.
Executive Summary
Process Parameter Poisoning (P3) is a code injection technique that transfers shellcode into a foreign process via the startup parameters of CreateProcessW—specifically the lpCommandLine, lpEnvironment,…
https://core-jmp.org/2026/07/process-parameter-poisoning-edr-evasion-windows/
🔥3