Danny Odler

Breaking code

[Danny Odler @DannyOdler]

Here is my writeup for 2 Windows kernel bugs I reported to MSRC. Both are race conditions that cause Use-After-Free. As there is very few windows kernel writeups I share my research methodology and more. Hope it helps other researchers. Share it😀
https://t.co/QVPqfb5HFf

[1ce0ear @1ce0ear]

Slides for our OffensiveCon talk (by me and @jmartijnb) https://t.co/F3yM2pIgwy:

A tiny mistake in a render config ➡️ corrupt a special GPU stack pointer register ➡️ GPU hardware “renders” pixels to the AP kernel directly ➡️ pwned

More presentations: https://t.co/0QOsr0uuTJ :)

[vx-underground @vxunderground]

Nightmare Eclipse guy has returned (as is tradition) and has released another Microsoft Windows zero day (as is tradition).

> releases zero day
> spells rogue wrong in file
> "rogeplanet"

smh

https://t.co/YrNJwGupvq

[Shift @Shiftreduce]

We live in interesting times.

Last month Linux patched a core uaf in the epoll subsystem, we rarely see these kind of bugs.
As i like these kind of bugs, i wrote a few words about it here: https://t.co/XIiPU7LSSN

[Danny Odler @DannyOdler]

@orinimron123 very cool primitives 💥

[Seth Jenkins @__sethJenkins]

My new blogpost is out! I can't think of another kernel bug quite as easy to exploit as this one 😭 Big shout out to @tehjh who said something along the lines of "Uh...Seth come check out this mmap handler" 😂
https://t.co/07PQim2ysp

[Jonathan Bar Or (JBO) 🇮🇱🇺🇸🇺🇦 @yo_yo_yo_jbo]

Do not be worried that LLMs are going to find all the vulns - that is not the case at all.
Read: why vulnerability research is mathematically difficult: https://t.co/qhzOyzf5jP

[Mark Ermolov @_markel___]

Intel SGX has fallen! Its most important key is in our hands: we extracted the Global Wrapping Key from an instance of the Intel Gemini Lake platform

[Boris Larin @oct0xor]

We analyzed the Coruna exploit kit and found intriguing code overlaps with Operation Triangulation. Full analysis on our blog: link below.

[Axel Souchet @0vercl0k]

"CrackArmor: Multiple vulnerabilities in AppArmor" https://t.co/GmJfrFjvWR

[Joe Desimone @dez_]

Patch Diff to SYSTEM - using LLMs to exploit a LPE vuln on Windows. More importantly, some thoughts on model capabilities the implications on our security industry https://t.co/wmPNfoLbt8

[Natalie Silvanovich @natashenka]

In the final part of his blog series, @tiraniddo tells the story of how a bug was introduced into a Windows API.

Code re-writes can improve security, but it’s important not to forget the security properties the code needs to enforce in the process.

https://t.co/MZHNks6eGc

[Danny Odler @DannyOdler]

@Bad_Jubies Good writing!

[Danny Odler @DannyOdler]

@Dark_Puzzle @msftsecresponse Cool work

[Dillon Franke @dillon_franke]

It's been just over a year since CVE-2024-54529 was patched. To celebrate, I'm open-sourcing my full PoC exploit for this CoreAudio type confusion vulnerability 🔊

The code is right here! Enjoy: https://t.co/GRvILp6C84

[Back Engineering Labs @BackEngineerLab]

We’re releasing our analysis of https://t.co/cAmTrO7mvx, a major game cheat targeted by multiple studios in recent legal actions. We partially deobfuscated several Themida-protected components and document how it hijacks Hyper-V to inject and manipulate game code.

https://t.co/ykGrHdl6ty
https://t.co/LhEXxeIcnF

[Haifei Li @HaifeiLi]

Someone submitted the real CVE-2026-21509 sample to EXPMON last night!

Check out this submission:
https://t.co/5Cf6TDBQxz

The SHA256 of the sample, it's a RTF file:
c91183175ce77360006f964841eb4048cf37cb82103f2573e262927be4c7607f

While EXPMON didn't report the 0day immediately - this is well expected, it reported various highly suspicious Indicators, including the key Indicator named "activex compatibility shellexplorer registry key accessed". I shared how to use this key Indicator on EXPMON to hunt the 0day just days ago: https://t.co/Qwcvhb6VKa.

That's enough to investigate it manually in your local env, and I have just confirmed this is indeed the CVE-2026-21509 zero-day exploit!

My quick analysis showed that this is the initial attack vector sample in a full attacking chain. Thanks to EXPMON logs, I quickly found that the RTF file was trying to load the IE engine (the "ieframe.dll") while also trying to connect to the threat actor controlled server, one of the url is "\\wellnesscaremed[.]com\davwwwroot\venezia\Favorites\blank.doc" (see the pic attached) - all activities are automatic, meaning as soon as the victim open the Word document, the victim could be pwned. There're not just one but quite serveral OLE objects in the RTF which are, to be honest, quite sophisticated, showing the sophistication of the zero-day attack. Full details haven't been fully understood in such a short time.

The same sample was also listed/confirmed by the Ukrainian CERT https://t.co/PMi6u3r5Wr independently, there're more details in that article please go check out.

What a wild story! Thank you very much to the person who submitted the sample (and I received your message about adding the "unzip" feature:))! Once again it confirmed the effectiveness of the EXPMON system when it comes to detecting unknown 0day exploits.

Quickly, for defenders:
1. Please research all the things starting from the sample, this is the confirmed CVE-2026-21509 0day intinal attack vector sample, and add detections (currently the detection ratio on VT is pretty low) in the full chain.
2. If you're an Microsoft Office user, please apply Microsoft's official patch or workarounds ASAP https://t.co/E6q8y0aZa0, as now the attacking exploit is well known so attacks are expected to increase rapidly.

For me, there's more work to do, including an EXPMON update for determinate detection against this 0day exploits. In the meantime, if you see the "activex compatibility shellexplorer registry key accessed" Indicator on EXPMON, please be cautions because that's likely the 0day sample/variants.

#CVE-2026-21509 #expmon #0day #zeroday #exploit #threatintel

[Danny Odler @DannyOdler]

Very nice work 💯

[Billy Ellis @bellis1000]

Spent some time recreating the ‘Blastpass’ iOS exploit in a faked target process, to understand the heap shaping strategy first-hand. Video here
https://t.co/yTbHslvhMG

[Natalie Silvanovich @natashenka]

Our intrepid 20%-er @dillon_franke exploited a vulnerability in CoreAudio. See his process for gaining privilege escalation on a Mac:

https://t.co/hTFagZqBRz

[Andrea Allievi @aall86]

https://t.co/txBlxmMa61 Anti-cheat evolution in Windows... New Year post while I am in vacation is ready!!! 🎉 Happy 2026!

[Connor McGarr @33y0re]

Starting 2026 with a new blog! I've really been enjoying my Windows on ARM machine - so my post is about interrupts for WoA. This includes x64/ARM differences, virtual interrupts, Hyper-V's synthetic controller, and Secure Kernel interrupts/intercepts
https://t.co/HvSbtsCtGu