Parvez Anwar

An Independent Security Researcher

[nafiez @zeifan]

Found a heap overflow vulnerability in Windows SMB that leads to RCE and reported it to MSRC in June.

The vulnerability has now been addressed with CVE-2026-62800 in the August Patch Tuesday updates.

https://t.co/MVDbXNccfw

[YungBinary @YungBinary]

We're tracking a new EDR killer using a #BYOVD driver that isn't in Microsoft's block lists / #LOLDrivers and enumerates 140+ security products, including: Crowdstrike, SentinelOne, Microsoft Defender / Sentinel, Carbon Black, Cybereason, Cylance, Symantec, Sophos, FortiEDR, Elastic, Kaspersky, ESET, Avast / AVG, Bitdefender, McAfee / Trellix, Malwarebytes, Webroot, Trend Micro, Avira, Dr. Web, F-Protect / F-Secure, G-Data, Panda Security, and more.

All credits to @jgajek for finding it in the wild 🔥

It only activates if the payload being loaded contains ScreenConnect-related strings, uses IOCTL control code 0x2205c0, and passes each security product PID to terminate via input buffer to the driver via DeviceIOControl, which terminates the specified PID via ZwTerminateProcess.

BYOVD: https://t.co/qqhDFhFKiq

Blog coming soon on the loader, after Defcon of course!

[Cyber Security News @The_Cyber_News]

⚠️ 7-Zip Vulnerability Exposes Millions of Users to Remote Code Execution Risk

Source: https://t.co/iRliCYhIwE

A newly disclosed vulnerability in 7-Zip, one of the most widely used open-source file archiving tools, could allow remote attackers to execute arbitrary code on affected systems.

Tracked as CVE-2026-14266, the flaw stems from improper handling of XZ chunked data and has been addressed in the latest software update. The vulnerability resides in how 7-Zip processes XZ-compressed data streams.

Specifically, specially crafted XZ chunked data can trigger a heap-based buffer overflow, a memory corruption issue that occurs when data written to a buffer exceeds its allocated space.

#cybersecuritynews #vulnerability

[0xSha @0xsha]

PoC: https://t.co/R74SgNhuEA this is based on nebula writeup, so credit goes to @nebusecurity , This is renderer-only RCE and far from truly weaponized. Multiple frontier LLMs hammered on it for ~4 days to improve reliability, but there is still a lot left as open work (e.g Flag free, ASLR-on RCE)

[R.B.C. @G3tSyst3m]

My latest blog post: Using BYOVD to loot LSASS bypassing HVCI and all other security protections built in to Windows 11 25h2:

https://t.co/xuKSBQSwYr

[nafiez @zeifan]

Found a denial-of-service vulnerability in a Windows driver (a classical IOCTL bug) that can trigger a BSOD. Reported to the vendor; no patch is planned. Sharing here the writeup (I asked AI to write one for me). Enjoy🫰

https://t.co/z03CuLPVJl

[Dark Web Informer @DarkWebInformer]

‼️ CVE-2026-34621: Adobe Acrobat 2026 Prototype Pollution & JS Injection Chain

GitHub: https://t.co/o8bqoi7oHl

Write-up: https://t.co/oZkQ1fWd9d

[MCKSys Argentina @MCKSysAr]

Analysis of RedSun: Local Privilege Escalation via Defender Remediation Abuse

https://t.co/nrQUqOJOzO

[r3verii @r3verii]

HAProxy HTTP/3 -> HTTP/1 Desync: Cross-Protocol Smuggling via a Standalone QUIC FIN (CVE-2026-33555) https://t.co/ZNUsWrBfLe

[The Hacker News @TheHackersNews]

🚨 A critical nginx-ui flaw is now exploited in the wild.

CVE-2026-33032 (9.8) allows auth bypass via the /mcp_message endpoint, letting attackers take full control of Nginx with two HTTP requests due to an “allow-all” default.

🔗 Details here → https://t.co/TjMKE5Uy1S

[blackorbird @blackorbird]

#Lazarus exploited a flaw in the Windows AppLocker driver (appid.sys) as a zero-day to gain kernel-level access and turn off security tools.CVE-2024-21338
Beyond BYOVD with an Admin-to-Kernel Zero-Day
https://t.co/irFNz3Dntt

[Alex @xaitax]

CVE-2024-21413 | Microsoft Outlook Remote Code Execution Vulnerability PoC

https://t.co/sJPbySQBa3

Happy weekend.

[Yarden Shafir @yarden_shafir]

Be prepared to lose your kernel pointers! Windows will soon start restricting KASLR leaks to non-admins: https://t.co/n2WoFqU9og

(mentioned this here before but figured it's worth a blog post)

[Antonio Cocomazzi @splinter_code]

Do you want to start the RemoteRegistry service without Admin privileges?
Just write into the "winreg" named pipe 👇

[Parvez Anwar @ParvezGHH]

Persistence - Scheduled Task Tampering https://t.co/uB8qJSCVLh

[Stan Hegt @StanHacked]

Making sense of #PrintNightmare. A flowchart to help understand exploitation of CVE-2021-34527.

Special thanks to @tiraniddo, @dez_, @gentilkiwi and @_f0rgetting_ for their test input and insights.

[Daniel García @danigargu]

During this quarantine I've been researching with my colleague Manu (@dialluvioso_) the latest SMBv3 bug (CVE-2020-0796), we've achieved a local privilege escalation.
We're releasing the exploit code at https://t.co/lKsy4dBkpp

[CERT/CC @certcc]

Microsoft has released ADV200006 about an 0day vulnerability being exploited in the wild in Microsoft Windows Adobe Type Manager Type 1 font parsing.
There are almost as many workarounds provided as there are attack vectors!
https://t.co/CNu5iV2Pc2

[Georgios Baltas @gebaltas]

The hardlink mitigation was backported in with month's security update. For all updated systems, hardlink creation now requires FILE_WRITE_ATTRIBUTES access to the target file. This breaks many existing file-redirection EOP attacks that require the use of hardlinks.

[Parvez Anwar @ParvezGHH]

@atorrrr Thanks, yep I mainly start by fuzzing and once got a crash Then I start reversing