The QNAP Pattern: Systemic Security Failures in QTS Plugin Architecture
Original text: “The QNAP Pattern” — Runic Labs. Code blocks, tables, and figures are reproduced verbatim with attribution captions.
Executive Summary
QNAP NAS devices suffer from a recurring class of architectural security failures that go well beyond individual CVEs. Researchers at Runic Labs analyzed four vulnerabilities spanning two plugins—Notes Station 3 and QmailAgent—and found that…
https://core-jmp.org/2026/07/the-qnap-pattern-systemic-security-failures-in-qts-plugin-architecture/
Original text: “The QNAP Pattern” — Runic Labs. Code blocks, tables, and figures are reproduced verbatim with attribution captions.
Executive Summary
QNAP NAS devices suffer from a recurring class of architectural security failures that go well beyond individual CVEs. Researchers at Runic Labs analyzed four vulnerabilities spanning two plugins—Notes Station 3 and QmailAgent—and found that…
https://core-jmp.org/2026/07/the-qnap-pattern-systemic-security-failures-in-qts-plugin-architecture/
🔥2
Building an Encrypted C2 Implant Using QUIC
Original text: “Building an Encrypted C2 Implant Using QUIC” — R.B.C (g3tsyst3m), G3tSyst3m’s Infosec Blog (April 30, 2026). Code blocks and figures are reproduced verbatim with attribution captions.
Executive Summary
This article by R.B.C (g3tsyst3m) walks through the construction of a minimal proof-of-concept C2 implant—crudeRAT—that uses the QUIC protocol as its transport layer. QUIC is…
https://core-jmp.org/2026/07/building-encrypted-c2-implant-quic/
Original text: “Building an Encrypted C2 Implant Using QUIC” — R.B.C (g3tsyst3m), G3tSyst3m’s Infosec Blog (April 30, 2026). Code blocks and figures are reproduced verbatim with attribution captions.
Executive Summary
This article by R.B.C (g3tsyst3m) walks through the construction of a minimal proof-of-concept C2 implant—crudeRAT—that uses the QUIC protocol as its transport layer. QUIC is…
https://core-jmp.org/2026/07/building-encrypted-c2-implant-quic/
👍4🔥3
How I Ruined My Vacation by Reverse Engineering WSC
Original text: “how i ruined my vacation by reverse engineering wsc” — es3n1n, blog.es3n1n.eu (May 8, 2025). Code blocks and figures are reproduced verbatim with attribution captions.
Executive Summary
es3n1n is the author of no-defender, a tool that disabled Windows Defender by calling Windows Security Center (WSC) COM APIs while posing as an authorized security…
https://core-jmp.org/2026/07/how-i-ruined-my-vacation-reverse-engineering-wsc/
Original text: “how i ruined my vacation by reverse engineering wsc” — es3n1n, blog.es3n1n.eu (May 8, 2025). Code blocks and figures are reproduced verbatim with attribution captions.
Executive Summary
es3n1n is the author of no-defender, a tool that disabled Windows Defender by calling Windows Security Center (WSC) COM APIs while posing as an authorized security…
https://core-jmp.org/2026/07/how-i-ruined-my-vacation-reverse-engineering-wsc/
🔥5👍4😱3
setresuid(⚡): Glitching Google’s TV Streamer from ADB to Root
Original text: “setresuid(⚡): Glitching Google’s TV Streamer from adb to root” — Raelize B.V. (May 17, 2026). Code blocks, tables, and figures are reproduced verbatim with attribution captions.
Executive Summary
Researchers at Raelize B.V., presenting at hardwear.io NL 2025, demonstrated a practical electromagnetic fault injection (EMFI) attack against Google’s TV Streamer 4K. Starting from an…
https://core-jmp.org/2026/07/setresuid-glitching-google-tv-streamer-adb-root/
Original text: “setresuid(⚡): Glitching Google’s TV Streamer from adb to root” — Raelize B.V. (May 17, 2026). Code blocks, tables, and figures are reproduced verbatim with attribution captions.
Executive Summary
Researchers at Raelize B.V., presenting at hardwear.io NL 2025, demonstrated a practical electromagnetic fault injection (EMFI) attack against Google’s TV Streamer 4K. Starting from an…
https://core-jmp.org/2026/07/setresuid-glitching-google-tv-streamer-adb-root/
🔥8
Breaking eBPF Security: How Kernel Rootkits Blind Observability Tools
Original text: “Breaking eBPF Security: How Kernel Rootkits Blind Observability Tools” — 0xMatheuZ, matheuzsecurity.github.io. Code blocks are reproduced verbatim with attribution captions.
Executive Summary
eBPF-based security tools — Falco, Tracee, Tetragon, GhostScan — have become the dominant approach to Linux kernel observability and runtime threat detection. They attach to syscall tracepoints and kernel events, stream…
https://core-jmp.org/2026/07/breaking-ebpf-security-kernel-rootkits-blind-observability-tools/
Original text: “Breaking eBPF Security: How Kernel Rootkits Blind Observability Tools” — 0xMatheuZ, matheuzsecurity.github.io. Code blocks are reproduced verbatim with attribution captions.
Executive Summary
eBPF-based security tools — Falco, Tracee, Tetragon, GhostScan — have become the dominant approach to Linux kernel observability and runtime threat detection. They attach to syscall tracepoints and kernel events, stream…
https://core-jmp.org/2026/07/breaking-ebpf-security-kernel-rootkits-blind-observability-tools/
🔥3😱1
How to Use Ghidra to Analyse Shellcode and Extract Cobalt Strike Command & Control Servers
Original text: “How to Use Ghidra to Analyse Shellcode and Extract Cobalt Strike Command & Control Servers” — Matthew, Embee Research (Dec 08, 2023). Images reproduced verbatim with attribution captions.
Executive Summary
Cobalt Strike shellcode is one of the most widely deployed payloads in commodity malware campaigns, yet its analysis remains non-trivial for practitioners new…
https://core-jmp.org/2026/07/ghidra-shellcode-analysis-cobalt-strike/
Original text: “How to Use Ghidra to Analyse Shellcode and Extract Cobalt Strike Command & Control Servers” — Matthew, Embee Research (Dec 08, 2023). Images reproduced verbatim with attribution captions.
Executive Summary
Cobalt Strike shellcode is one of the most widely deployed payloads in commodity malware campaigns, yet its analysis remains non-trivial for practitioners new…
https://core-jmp.org/2026/07/ghidra-shellcode-analysis-cobalt-strike/
🔥6👍2
Debugging the Pixel 8 Kernel via KGDB
Original text: “Debugging the Pixel 8 kernel via KGDB” — Andrey Konovalov, xairy.io (Jul 28, 2025; revised Mar 11, 2026). Code, tables and figures below are reproduced verbatim with attribution captions.
Executive Summary
Debugging a running Linux kernel on a physical device is qualitatively different from debugging inside a virtual machine. Hypervisors expose built-in GDB…
https://core-jmp.org/2026/07/debugging-pixel-8-kernel-kgdb/
Original text: “Debugging the Pixel 8 kernel via KGDB” — Andrey Konovalov, xairy.io (Jul 28, 2025; revised Mar 11, 2026). Code, tables and figures below are reproduced verbatim with attribution captions.
Executive Summary
Debugging a running Linux kernel on a physical device is qualitatively different from debugging inside a virtual machine. Hypervisors expose built-in GDB…
https://core-jmp.org/2026/07/debugging-pixel-8-kernel-kgdb/
🔥7👍3
The Dark Side of WebAssembly: Cryptomining, Keyloggers, and Browser Exploitation
Original text: “El lado oscuro de WebAssembly” — Carlos Ávila, Telefónica Tech Blog (September 16, 2020). Images are reproduced verbatim with attribution captions.
Executive Summary
WebAssembly (WASM) is an open binary instruction format — announced in 2015 and broadly supported by browsers from 2017 onward — designed to let code written in C, C++, Rust,…
https://core-jmp.org/2026/07/dark-side-webassembly-cryptomining-keyloggers-browser-exploitation/
Original text: “El lado oscuro de WebAssembly” — Carlos Ávila, Telefónica Tech Blog (September 16, 2020). Images are reproduced verbatim with attribution captions.
Executive Summary
WebAssembly (WASM) is an open binary instruction format — announced in 2015 and broadly supported by browsers from 2017 onward — designed to let code written in C, C++, Rust,…
https://core-jmp.org/2026/07/dark-side-webassembly-cryptomining-keyloggers-browser-exploitation/
👍6🔥2😱1
Process Parameter Poisoning: EDR Evasion via Windows Process Startup Parameters
Original text: “Process Parameter Poisoning” — Max Hirschberger & Ogulcan Ugur, SensePost / Orange Cyberdefense (6 July 2026). Code listings and figures are reproduced verbatim with attribution captions.
Executive Summary
Process Parameter Poisoning (P3) is a code injection technique that transfers shellcode into a foreign process via the startup parameters of CreateProcessW—specifically the lpCommandLine, lpEnvironment,…
https://core-jmp.org/2026/07/process-parameter-poisoning-edr-evasion-windows/
Original text: “Process Parameter Poisoning” — Max Hirschberger & Ogulcan Ugur, SensePost / Orange Cyberdefense (6 July 2026). Code listings and figures are reproduced verbatim with attribution captions.
Executive Summary
Process Parameter Poisoning (P3) is a code injection technique that transfers shellcode into a foreign process via the startup parameters of CreateProcessW—specifically the lpCommandLine, lpEnvironment,…
https://core-jmp.org/2026/07/process-parameter-poisoning-edr-evasion-windows/
🔥3
Harnessing LLM Harnesses: AI Orchestration for Offensive Security Research
Original text: “Harnessing Harnesses – Climbing the LLM Hills” — Andy Gill, ZephrSec / blog.zsec.uk (27 Jun 2026).
Executive Summary
Most LLM workflow discussion centres on prompt engineering and model selection, yet in practice the biggest gains in capability, cost and reliability come from the orchestration layer sitting above the model—what Andy Gill (ZephrFish) calls…
https://core-jmp.org/2026/07/harnessing-llm-harnesses-offensive-security-ai-orchestration/
Original text: “Harnessing Harnesses – Climbing the LLM Hills” — Andy Gill, ZephrSec / blog.zsec.uk (27 Jun 2026).
Executive Summary
Most LLM workflow discussion centres on prompt engineering and model selection, yet in practice the biggest gains in capability, cost and reliability come from the orchestration layer sitting above the model—what Andy Gill (ZephrFish) calls…
https://core-jmp.org/2026/07/harnessing-llm-harnesses-offensive-security-ai-orchestration/
🔥4
CVE-2026-47291: Integer Overflow Remote Code Execution in Windows HTTP.sys
Original text: “CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys” — Yazhi Wang and Jonathan Lein, TrendAI Zero Day Initiative (July 10, 2026). Code blocks are reproduced verbatim from the original with attribution captions.
Executive Summary
CVE-2026-47291 is a critical remote code execution vulnerability in HTTP.sys, the kernel-mode HTTP protocol driver that underpins Internet Information…
https://core-jmp.org/2026/07/cve-2026-47291-rce-windows-http-sys/
Original text: “CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys” — Yazhi Wang and Jonathan Lein, TrendAI Zero Day Initiative (July 10, 2026). Code blocks are reproduced verbatim from the original with attribution captions.
Executive Summary
CVE-2026-47291 is a critical remote code execution vulnerability in HTTP.sys, the kernel-mode HTTP protocol driver that underpins Internet Information…
https://core-jmp.org/2026/07/cve-2026-47291-rce-windows-http-sys/
🔥8👍2
Two Bytes to RCE: Chaining Rift + PoolSlip into an ASLR-Independent nginx 1.30.0 Exploit
Original text: “Two Bytes to RCE: Chaining Rift + PoolSlip” — y198, Verichains (Jun 06, 2026). Code, tables and figures below are reproduced verbatim with attribution captions. PoC: github.com/y198nt/Nginx-chain-Rift-Poolslip.
Executive Summary
A two-bug chain in nginx 1.30.0 achieves unauthenticated remote code execution without relying on ASLR breaks. The first bug, CVE-2026-42945 (“Rift”), is a forward…
https://core-jmp.org/2026/07/nginx-rce-rift-poolslip-aslr-independent/
Original text: “Two Bytes to RCE: Chaining Rift + PoolSlip” — y198, Verichains (Jun 06, 2026). Code, tables and figures below are reproduced verbatim with attribution captions. PoC: github.com/y198nt/Nginx-chain-Rift-Poolslip.
Executive Summary
A two-bug chain in nginx 1.30.0 achieves unauthenticated remote code execution without relying on ASLR breaks. The first bug, CVE-2026-42945 (“Rift”), is a forward…
https://core-jmp.org/2026/07/nginx-rce-rift-poolslip-aslr-independent/
🔥11
CET-Compliant Callstack Spoofing via Thread Pool Enum Callback Trampolining
Original text: “CET-Compliant Callstack Spoofing via Thread Pool Enum Callback Trampolining” — Tiziano Marra, Tiziano’s Cybersecurity Blog (12 July 2026). Code blocks, tables, and figures below are reproduced verbatim with attribution captions.
Research published for educational and defensive purposes. Always obtain explicit written authorization before testing security techniques on any computer system. Unauthorized access is…
https://core-jmp.org/2026/07/cet-compliant-callstack-spoofing-thread-pool-enum/
Original text: “CET-Compliant Callstack Spoofing via Thread Pool Enum Callback Trampolining” — Tiziano Marra, Tiziano’s Cybersecurity Blog (12 July 2026). Code blocks, tables, and figures below are reproduced verbatim with attribution captions.
Research published for educational and defensive purposes. Always obtain explicit written authorization before testing security techniques on any computer system. Unauthorized access is…
https://core-jmp.org/2026/07/cet-compliant-callstack-spoofing-thread-pool-enum/
🔥5
Forgotten UEFI Shims Undermining Secure Boot
Original text: “Forgotten UEFI shims undermining Secure Boot” — Martin Smolár, ESET Research (July 14, 2026). Figures, code blocks, and technical diagrams below are reproduced verbatim with attribution captions.
Executive Summary
ESET researchers identified 11 old and forgotten UEFI shim bootloaders at versions 0.9 and below that can be used to bypass UEFI Secure Boot…
https://core-jmp.org/2026/07/forgotten-uefi-shims-undermining-secure-boot/
Original text: “Forgotten UEFI shims undermining Secure Boot” — Martin Smolár, ESET Research (July 14, 2026). Figures, code blocks, and technical diagrams below are reproduced verbatim with attribution captions.
Executive Summary
ESET researchers identified 11 old and forgotten UEFI shim bootloaders at versions 0.9 and below that can be used to bypass UEFI Secure Boot…
https://core-jmp.org/2026/07/forgotten-uefi-shims-undermining-secure-boot/
🔥5👍3