浑水摸鱼

Penetration Testing | Bounty Hunter|Threat Analysis | Happy Waste
加密投资 - 死磕 Arbitrum

[hackyboiz @hackyboiz2]

[1day-1line] CVE-2026-40369: Arbitrary Kernel Address Increment LPE/Sandbox Escape Vulnerability Caused by Untrusted Pointer Dereference in Windows Kernel(ntoskrnl.exe)

Hello, this is banda.

Today's 1day-1line covers an LPE/Sandbox Escape vulnerability in the Windows Kernel. In the NtQuerySystemInformation Class 253 path, Length=0 can bypass pointer validation and trigger a limited 12-byte kernel write primitive at an attacker-controlled kernel address, potentially leading to SYSTEM privilege escalation even from restricted environments such as a browser renderer sandbox.

Please refer to the blog post for more details!
https://t.co/wUPADuCioQ

[Wietze @Wietze]

🫯 New entry added to the #LOLBAS Project:
Proxy execution via system-native scp.exe. Takes any remote destination, doesn't actually have to run an SSH server.

👉 https://t.co/jLCiaB1fuM
Thanks @BinFault

[OS Dev @OSdev_]

One of the latest and most notable Windows privilege escalation vulnerabilities is CVE-2025-62215 in the Windows Kernel - https://t.co/3BV6DBr20n

The flaw is a race condition caused by improper synchronization when multiple threads concurrently access shared kernel resources. By carefully winning this race, a local authenticated attacker can manipulate kernel state during execution and cause the operating system to perform privileged operations on behalf of the attacker. Successful exploitation allows escalation from a low-privileged user account to SYSTEM privileges, providing complete control over the affected machine.

Because race-condition bugs are often difficult to exploit reliably yet highly impactful when successful, CVE-2025-62215 attracted significant attention after Microsoft confirmed it was being actively exploited in the wild. The vulnerability was addressed in Microsoft's November 2025 security updates by correcting the synchronization logic and preventing unsafe concurrent access to the affected kernel resources.

[浑水摸鱼 @DavidJou734]

The exploit has been tested in Windows 11 (Official channel + Canary) and Windows 10 with june 2026 patch installed. The PoC however does not work in Windows Server since standard users cannot mount an ISO image
https://t.co/bLQ1KWeUiB

[starlabs @starlabs_sg]

We spent almost 2 years seeing this disclosure through… and then accidentally forgot to post it here. 😅

Never gonna give you up.
Never gonna let you down.
Never gonna run around and forget the advisory.

CVE-2026-41873 is now public:
https://t.co/oLFwiOCMfI

[blackorbird @blackorbird]

#APT37 ZIP(LNK) -> Python Backdoor
Webshell as always
ref:
https://t.co/CQOKhucDYy
github
https://t.co/JUqxxEu1sx

[Nicolas Krassas @Dinosn]

Windows bypasses EDR to implement DumpHash https://t.co/I1hidkt6qP

[Calif @calif_io]

MAD Bugs: Discovering a 0-Day in Zero Day

Here’s how I used Claude to find and patch a radare2 0-day on my first day at @calif_io.

https://t.co/sAkSdMS0gh

[Het Mehta @hetmehtaa]

Breaking Down CVE-2026-25049: How TypeScript Types Failed n8n's Security

https://t.co/VZVDeOt9e2

[Moonbeom(Daniel) @krNeoTra]

Exploit Demo & Analysis Article by 78ResearchLab(@78_lab)

CVE-2026-20817 : Windows Error Reporting(WER) Service Elevation of Privilege Vulnerability

https://t.co/x3x8XInNQU

#CVE_2026_20817 #LPE #Windows

[/r/netsec @_r_netsec]

Browser based tech support scam abusing full screen, input lock, and fake BSOD https://t.co/ny9IjdaeNT

[Florian Hansemann @CyberWarship]

''Hide the threat - GPO lateral movement''

#infosec #pentest #redteam #blueteam
https://t.co/QAlmAv2QUf

[blackorbird @blackorbird]

The Great VM Escape: ESXi Exploitation in the Wild
VMware:CVE-2025-22226+CVE-2025-22224+CVE-2025-22225

https://t.co/x98bSiGuBY

Key:
When vmci.sys is loaded, it owns the VMCI adapter and actively uses these same I/O ports. Two drivers cannot safely share the same hardware, if both attempt to send commands simultaneously, it would corrupt the device state and crash the system. By disabling vmci.sys first, the exploit gains exclusive access to the VMCI hardware.

[Lukasz Olejnik @lukOlejnik]

So what's cyberwarfare? In my book I explain the rationale for using this term. https://t.co/E7lriwnIss

[浑水摸鱼 @DavidJou734]

CVE-2025-7771: Exploiting a Signed Kernel Driver in a Red Team Operation
https://t.co/oiA3iZTgUK

[Smukx.E @5mukx]

DLL Sideloading & Proxying basics:

https://t.co/Pj46WZAogs

[/r/netsec @_r_netsec]

How we got hit by Shai-Hulud: A complete post-mortem | https://t.co/cxmhPOWrSl https://t.co/c3ICSFyE17

[Nicolas Krassas @Dinosn]

New React Server Components Vulnerabilities: DoS and Source Code Exposure https://t.co/vkqPCEsgL6

[/r/netsec @_r_netsec]

SVG Clickjacking: A novel and powerful twist on an old classic https://t.co/kIrog7F0Vo

[Florian Hansemann @CyberWarship]

''Using EDR-Redir To Break EDR Via Bind Link and Cloud Filter''

#infosec #pentest #redteam #blueteam
https://t.co/tmpA6Z6rRt