setresuid(⚡): Glitching Google’s TV Streamer from ADB to Root
Original text: “setresuid(⚡): Glitching Google’s TV Streamer from adb to root” — Raelize B.V. (May 17, 2026). Code blocks, tables, and figures are reproduced verbatim with attribution captions.
Executive Summary
Researchers at Raelize B.V., presenting at hardwear.io NL 2025, demonstrated a practical electromagnetic fault injection (EMFI) attack against Google’s TV Streamer 4K. Starting from an…
https://core-jmp.org/2026/07/setresuid-glitching-google-tv-streamer-adb-root/
Original text: “setresuid(⚡): Glitching Google’s TV Streamer from adb to root” — Raelize B.V. (May 17, 2026). Code blocks, tables, and figures are reproduced verbatim with attribution captions.
Executive Summary
Researchers at Raelize B.V., presenting at hardwear.io NL 2025, demonstrated a practical electromagnetic fault injection (EMFI) attack against Google’s TV Streamer 4K. Starting from an…
https://core-jmp.org/2026/07/setresuid-glitching-google-tv-streamer-adb-root/
🔥8
Breaking eBPF Security: How Kernel Rootkits Blind Observability Tools
Original text: “Breaking eBPF Security: How Kernel Rootkits Blind Observability Tools” — 0xMatheuZ, matheuzsecurity.github.io. Code blocks are reproduced verbatim with attribution captions.
Executive Summary
eBPF-based security tools — Falco, Tracee, Tetragon, GhostScan — have become the dominant approach to Linux kernel observability and runtime threat detection. They attach to syscall tracepoints and kernel events, stream…
https://core-jmp.org/2026/07/breaking-ebpf-security-kernel-rootkits-blind-observability-tools/
Original text: “Breaking eBPF Security: How Kernel Rootkits Blind Observability Tools” — 0xMatheuZ, matheuzsecurity.github.io. Code blocks are reproduced verbatim with attribution captions.
Executive Summary
eBPF-based security tools — Falco, Tracee, Tetragon, GhostScan — have become the dominant approach to Linux kernel observability and runtime threat detection. They attach to syscall tracepoints and kernel events, stream…
https://core-jmp.org/2026/07/breaking-ebpf-security-kernel-rootkits-blind-observability-tools/
🔥3😱1
How to Use Ghidra to Analyse Shellcode and Extract Cobalt Strike Command & Control Servers
Original text: “How to Use Ghidra to Analyse Shellcode and Extract Cobalt Strike Command & Control Servers” — Matthew, Embee Research (Dec 08, 2023). Images reproduced verbatim with attribution captions.
Executive Summary
Cobalt Strike shellcode is one of the most widely deployed payloads in commodity malware campaigns, yet its analysis remains non-trivial for practitioners new…
https://core-jmp.org/2026/07/ghidra-shellcode-analysis-cobalt-strike/
Original text: “How to Use Ghidra to Analyse Shellcode and Extract Cobalt Strike Command & Control Servers” — Matthew, Embee Research (Dec 08, 2023). Images reproduced verbatim with attribution captions.
Executive Summary
Cobalt Strike shellcode is one of the most widely deployed payloads in commodity malware campaigns, yet its analysis remains non-trivial for practitioners new…
https://core-jmp.org/2026/07/ghidra-shellcode-analysis-cobalt-strike/
🔥6👍2
Debugging the Pixel 8 Kernel via KGDB
Original text: “Debugging the Pixel 8 kernel via KGDB” — Andrey Konovalov, xairy.io (Jul 28, 2025; revised Mar 11, 2026). Code, tables and figures below are reproduced verbatim with attribution captions.
Executive Summary
Debugging a running Linux kernel on a physical device is qualitatively different from debugging inside a virtual machine. Hypervisors expose built-in GDB…
https://core-jmp.org/2026/07/debugging-pixel-8-kernel-kgdb/
Original text: “Debugging the Pixel 8 kernel via KGDB” — Andrey Konovalov, xairy.io (Jul 28, 2025; revised Mar 11, 2026). Code, tables and figures below are reproduced verbatim with attribution captions.
Executive Summary
Debugging a running Linux kernel on a physical device is qualitatively different from debugging inside a virtual machine. Hypervisors expose built-in GDB…
https://core-jmp.org/2026/07/debugging-pixel-8-kernel-kgdb/
🔥7👍3
The Dark Side of WebAssembly: Cryptomining, Keyloggers, and Browser Exploitation
Original text: “El lado oscuro de WebAssembly” — Carlos Ávila, Telefónica Tech Blog (September 16, 2020). Images are reproduced verbatim with attribution captions.
Executive Summary
WebAssembly (WASM) is an open binary instruction format — announced in 2015 and broadly supported by browsers from 2017 onward — designed to let code written in C, C++, Rust,…
https://core-jmp.org/2026/07/dark-side-webassembly-cryptomining-keyloggers-browser-exploitation/
Original text: “El lado oscuro de WebAssembly” — Carlos Ávila, Telefónica Tech Blog (September 16, 2020). Images are reproduced verbatim with attribution captions.
Executive Summary
WebAssembly (WASM) is an open binary instruction format — announced in 2015 and broadly supported by browsers from 2017 onward — designed to let code written in C, C++, Rust,…
https://core-jmp.org/2026/07/dark-side-webassembly-cryptomining-keyloggers-browser-exploitation/
👍6🔥2😱1
Process Parameter Poisoning: EDR Evasion via Windows Process Startup Parameters
Original text: “Process Parameter Poisoning” — Max Hirschberger & Ogulcan Ugur, SensePost / Orange Cyberdefense (6 July 2026). Code listings and figures are reproduced verbatim with attribution captions.
Executive Summary
Process Parameter Poisoning (P3) is a code injection technique that transfers shellcode into a foreign process via the startup parameters of CreateProcessW—specifically the lpCommandLine, lpEnvironment,…
https://core-jmp.org/2026/07/process-parameter-poisoning-edr-evasion-windows/
Original text: “Process Parameter Poisoning” — Max Hirschberger & Ogulcan Ugur, SensePost / Orange Cyberdefense (6 July 2026). Code listings and figures are reproduced verbatim with attribution captions.
Executive Summary
Process Parameter Poisoning (P3) is a code injection technique that transfers shellcode into a foreign process via the startup parameters of CreateProcessW—specifically the lpCommandLine, lpEnvironment,…
https://core-jmp.org/2026/07/process-parameter-poisoning-edr-evasion-windows/
🔥3
Harnessing LLM Harnesses: AI Orchestration for Offensive Security Research
Original text: “Harnessing Harnesses – Climbing the LLM Hills” — Andy Gill, ZephrSec / blog.zsec.uk (27 Jun 2026).
Executive Summary
Most LLM workflow discussion centres on prompt engineering and model selection, yet in practice the biggest gains in capability, cost and reliability come from the orchestration layer sitting above the model—what Andy Gill (ZephrFish) calls…
https://core-jmp.org/2026/07/harnessing-llm-harnesses-offensive-security-ai-orchestration/
Original text: “Harnessing Harnesses – Climbing the LLM Hills” — Andy Gill, ZephrSec / blog.zsec.uk (27 Jun 2026).
Executive Summary
Most LLM workflow discussion centres on prompt engineering and model selection, yet in practice the biggest gains in capability, cost and reliability come from the orchestration layer sitting above the model—what Andy Gill (ZephrFish) calls…
https://core-jmp.org/2026/07/harnessing-llm-harnesses-offensive-security-ai-orchestration/
🔥4
CVE-2026-47291: Integer Overflow Remote Code Execution in Windows HTTP.sys
Original text: “CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys” — Yazhi Wang and Jonathan Lein, TrendAI Zero Day Initiative (July 10, 2026). Code blocks are reproduced verbatim from the original with attribution captions.
Executive Summary
CVE-2026-47291 is a critical remote code execution vulnerability in HTTP.sys, the kernel-mode HTTP protocol driver that underpins Internet Information…
https://core-jmp.org/2026/07/cve-2026-47291-rce-windows-http-sys/
Original text: “CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys” — Yazhi Wang and Jonathan Lein, TrendAI Zero Day Initiative (July 10, 2026). Code blocks are reproduced verbatim from the original with attribution captions.
Executive Summary
CVE-2026-47291 is a critical remote code execution vulnerability in HTTP.sys, the kernel-mode HTTP protocol driver that underpins Internet Information…
https://core-jmp.org/2026/07/cve-2026-47291-rce-windows-http-sys/
🔥8👍2
Two Bytes to RCE: Chaining Rift + PoolSlip into an ASLR-Independent nginx 1.30.0 Exploit
Original text: “Two Bytes to RCE: Chaining Rift + PoolSlip” — y198, Verichains (Jun 06, 2026). Code, tables and figures below are reproduced verbatim with attribution captions. PoC: github.com/y198nt/Nginx-chain-Rift-Poolslip.
Executive Summary
A two-bug chain in nginx 1.30.0 achieves unauthenticated remote code execution without relying on ASLR breaks. The first bug, CVE-2026-42945 (“Rift”), is a forward…
https://core-jmp.org/2026/07/nginx-rce-rift-poolslip-aslr-independent/
Original text: “Two Bytes to RCE: Chaining Rift + PoolSlip” — y198, Verichains (Jun 06, 2026). Code, tables and figures below are reproduced verbatim with attribution captions. PoC: github.com/y198nt/Nginx-chain-Rift-Poolslip.
Executive Summary
A two-bug chain in nginx 1.30.0 achieves unauthenticated remote code execution without relying on ASLR breaks. The first bug, CVE-2026-42945 (“Rift”), is a forward…
https://core-jmp.org/2026/07/nginx-rce-rift-poolslip-aslr-independent/
🔥11
CET-Compliant Callstack Spoofing via Thread Pool Enum Callback Trampolining
Original text: “CET-Compliant Callstack Spoofing via Thread Pool Enum Callback Trampolining” — Tiziano Marra, Tiziano’s Cybersecurity Blog (12 July 2026). Code blocks, tables, and figures below are reproduced verbatim with attribution captions.
Research published for educational and defensive purposes. Always obtain explicit written authorization before testing security techniques on any computer system. Unauthorized access is…
https://core-jmp.org/2026/07/cet-compliant-callstack-spoofing-thread-pool-enum/
Original text: “CET-Compliant Callstack Spoofing via Thread Pool Enum Callback Trampolining” — Tiziano Marra, Tiziano’s Cybersecurity Blog (12 July 2026). Code blocks, tables, and figures below are reproduced verbatim with attribution captions.
Research published for educational and defensive purposes. Always obtain explicit written authorization before testing security techniques on any computer system. Unauthorized access is…
https://core-jmp.org/2026/07/cet-compliant-callstack-spoofing-thread-pool-enum/
🔥5
Forgotten UEFI Shims Undermining Secure Boot
Original text: “Forgotten UEFI shims undermining Secure Boot” — Martin Smolár, ESET Research (July 14, 2026). Figures, code blocks, and technical diagrams below are reproduced verbatim with attribution captions.
Executive Summary
ESET researchers identified 11 old and forgotten UEFI shim bootloaders at versions 0.9 and below that can be used to bypass UEFI Secure Boot…
https://core-jmp.org/2026/07/forgotten-uefi-shims-undermining-secure-boot/
Original text: “Forgotten UEFI shims undermining Secure Boot” — Martin Smolár, ESET Research (July 14, 2026). Figures, code blocks, and technical diagrams below are reproduced verbatim with attribution captions.
Executive Summary
ESET researchers identified 11 old and forgotten UEFI shim bootloaders at versions 0.9 and below that can be used to bypass UEFI Secure Boot…
https://core-jmp.org/2026/07/forgotten-uefi-shims-undermining-secure-boot/
🔥5👍3
The July 2026 Security Update Review
Original text: “The July 2026 Security Update Review” — Dustin Childs, Zero Day Initiative (July 14, 2026). Tables and figures are reproduced verbatim with attribution captions.
Executive Summary
July 2026 delivered a landmark month for security patches: Adobe released 88 CVEs across twelve products via their bimonthly cycle, while Microsoft disclosed 621 vulnerabilities—a volume that…
https://core-jmp.org/2026/07/july-2026-security-update-review/
Original text: “The July 2026 Security Update Review” — Dustin Childs, Zero Day Initiative (July 14, 2026). Tables and figures are reproduced verbatim with attribution captions.
Executive Summary
July 2026 delivered a landmark month for security patches: Adobe released 88 CVEs across twelve products via their bimonthly cycle, while Microsoft disclosed 621 vulnerabilities—a volume that…
https://core-jmp.org/2026/07/july-2026-security-update-review/
🔥2👍1
The QNAP Pattern: Four Bugs and the Architecture That Keeps Producing Them
Original text: “The QNAP Pattern” — Runic Labs (May 17, 2026). Code and architecture diagrams below are reproduced with attribution.
Executive Summary
Runic Labs disassembled a full disclosure cycle against QNAP’s QTS operating system—four bugs across three App Center plugins (Notes Station 3, QmailAgent, QVPN) spanning two firmware releases—and found that the individual vulnerabilities matter…
https://core-jmp.org/2026/07/qnap-pattern-architecture-vulnerabilities/
Original text: “The QNAP Pattern” — Runic Labs (May 17, 2026). Code and architecture diagrams below are reproduced with attribution.
Executive Summary
Runic Labs disassembled a full disclosure cycle against QNAP’s QTS operating system—four bugs across three App Center plugins (Notes Station 3, QmailAgent, QVPN) spanning two firmware releases—and found that the individual vulnerabilities matter…
https://core-jmp.org/2026/07/qnap-pattern-architecture-vulnerabilities/
👍1🔥1