Rémi GASCOU (Podalirius)

Senior Security Researcher @SpecterOps | 3xMicrosoft Security MVP | Creator of opensource security tools 🎬 | Views are my own

[Rémi GASCOU (Podalirius) @podalirius_]

Ever wanted to trigger a #NTLM authentication to a machine using every possible RPC call ? You can do this using #Coercer 🥳🎉

This tool automatically detects available pipes and protocols and call every possible functions to trigger an #authentication.

https://t.co/6aVELSP4NC

[Daily CyberSecurity @Daily_CyberSec]

A public PoC for CVE-2026-42980 details a Windows privilege escalation flaw in the kernel WMI code. It grants SYSTEM on unpatched builds.
#CVE202642980 #Windows #PrivilegeEscalation #Infosec #Cybersecurity
https://t.co/x8pWIqWqr6

[ClaudeDevs @ClaudeDevs]

Claude Code on desktop now works with the iOS simulator.

Build and run your iOS app, and the simulator opens in a panel right next to your conversation. Available today in public beta.

[Smukx.E @5mukx]

I explored the windows global device identifier (GDID) and wrote a poc, including a BoF to extract it. But the main question is: Can we patch another user's GDID ?

Repo (coff BoF, Rust/C PoC) :- https://t.co/0RFJM9b2Ty

Read the full Research here:- https://t.co/7kbcN1Iwqz

[Octoberfest7 @Octoberfest73]

Really nice research into Microsoft's GDID that got everyone's attention recently

[solst/ICE of Astarte @IceSolst]

I "ported" @hashcat to the GBA, the ultimate password cracking rig ever (my dumbest project yet).

The monstrously powerful 16.78 MHz ARM7TDMI chip does an astronomical 727 SHA256 hashes per second!! which is about thirty million times slower than a modern cracking rig. 350 days of continuous cracking on this bad boy could be done in about 1 second with a modern GPU-accelerated cracking rig.

[hashkitten @hash_kitten]

Seems that wp2shell PoCs are now floating around the internet, so we've published our blog post including our research methodology for finding the bug as well as a deep dive into the chain itself - https://t.co/iuU0yiYJBT

[Janggggg @testanull]

https://t.co/9fDj2QoT3W
The PoC of SharePoint SE preauth RCE
I still can't believe that MS replaced an old stable one with a new terrible design, come with multiple preauth vuln ¯\_(ツ)_/¯

[Nicolas Krassas @Dinosn]

CVE-2026-42980, a Windows kernel WMI integer-underflow vulnerability that can be exploited for local privilege escalation to NT AUTHORITY\SYSTEM on vulnerable lab builds. https://t.co/VfwV0Bq3Xr

[INFINITE NIGHTMARE @MSNightmare2000]

I would do anything for this exploit to work, please please let it be true it would be really funny pleaaase...

[nad @Nadsec11]

CVE-2026-50343 - InstallService Windows local privilege Escelation - Writeup and POC

Found another cool one!
https://t.co/Qp9bOYSxJK
not sure who first to find was, but shoutout to them. Despite not being FTF, my mom thinks it's cool and that's all that matters 😎

[DebugPrivilege @DebugPrivilege]

Honored to share that I’ve been awarded Microsoft MVP for the second year in a row 🎉 #mvpbuzz

[Rick de Jager @rdjgr]

Finally, two huge shout-outs for the RE work:

• @ZetaTwo for the excellent RE//verse talk
• The intern who released AoE2DE_s_original.exe without obfuscation ;)

The bug was patched in April (update 174992); MSRC just took a while to assign the CVE.

[Md Ismail Šojal 🕷️ @0x0SojalSec]

Crazy, Capacitive Touchscreens Just Got Hacked From 5cm Away.👀

Your Phone's Screen Is Whispering Your Secrets,
New Research Just Show a super practical contactless side-channel attack on capacitive screens,
Researchers show how everyday touch interactions leak through EM emanations.

This Contactless Attack Listens to Your Touchscreen's Invisible Chatter, 99% Accurate on Real Phones.

Modern phones scan the screen constantly for touches, Your finger couples with it and creates unique EM signals that basically encode where and how you're touching spatiotemporal leakage in one neat package.

An attacker just places a simple probe nearby (think 5cm, hidden under a table or in a bag) and captures the chatter.

without any wires or physical access, no special charger needed.

What can they steal?
- creen unlock PINs: up to 99.3% success
- Keyboard inputs: 97.6% reconstruction
- App categories (banking? shopping?): 95%
- Even continuous handwriting trajectories like signing docs with 76.8% character accuracy and solid geometric similarity (Jaccard 0.74)

Works in real environments: private rooms, public libraries. Phones tested: iPhone X, Xiaomi 10 Pro, Samsung S10, Huawei Mate 30 Pro.

Compared to older attacks, TESLA is broader, faster thousands of samples per minute, and way more practical.

Four-phase pipeline: classify interaction type
- intercept valid signals
- normalize
- deep learning magic (CNNs, Transformers, etc.)
Offline training on a matching phone, then online inference on the victim.
Contactless and condition-agnostic.

This feels like one of those 'we knew hardware leaks were a thing, but damn' moments. Raises real questions for phone makers better shielding? randomized scanning?
software noise?

[Nicolas Krassas @Dinosn]

Windows Privilege Escalation: SeTcbPrivilege https://t.co/4FbHAyYtmE

[SpecterOps @SpecterOps]

Need to do an NTLM relay over C2 but local priv-esc isn't possible?

@_logangoins new post walks through relaying NTLM auth out of a network and back in through red team infra to bypass traditional relay controls, plus how defenders actually stop it.

https://t.co/gV9M93hBhs

[Rick de Jager @rdjgr]

Here’s the Age of Empires RCE from yesterday’s Patch Tuesday: CVE-2026-50663.

Join an attacker’s lobby, (auto-)accept UCG, and you get remote code execution.

[Rapid7 @rapid7]

In conducting a 0-day research project against #SharePoint, Rapid7 Labs discovered 2 new vulns that, when chained together, achieve RCE against a vulnerable server.

Today, Rapid7 and Microsoft are disclosing CVE-2026-55040 – the first vuln in this chain: https://t.co/UkI7uCvRZN

[Ani @aniziki]

hi friends if you're having trouble with fable doing security work, just use /btw

ig the safeguard doesnt work in /btw and once you fork it, claude code treats the request as a system message so it doesn't properly revert the conversation and breaks it for the fork

have fun!

[Paul Moore - Security Consultant  @Paul_Reviews]

Bypassing the latest #EU #ageVerification app (2026.07-1) with a Chrome extension... again.

Despite 3 months of security hardening and genuine improvements across the board, the fundamental issue cannot be solved.

Anonymous age verification doesn't work.

[cr3ghost @cr3ghost]

Open-source user-defined reflective loaders that bypass CrowdStrike, Elastic, Microsoft Defender, and SentinelOne. Compatible with Cobalt Strike, NightHawk, Havoc, Adaptix, Mythic, Brute Ratel, and Sliver (with minor modifications).

If you are building detections for reflective loading, these are your test cases. If you are not testing against these, your rules have blind spots.

TitanLdr: https://t.co/FAP7UhsOTF by @ilove2pwn_

BokuLoader: https://t.co/L1FQgYPgn4 by @0xBoku

AceLdr: https://t.co/d5hSI7uwVa by @kyleavery

TitanLdrNG: https://t.co/0EmU2JXe8f by @klaboratory

sRDI with extra evasion capabilities. All open source. Free.

#DetectionEngineering #RedTeam #InfoSec