luckyu

[Satya Nadella @satyanadella]

Our new multi-model agentic security system brings together more than 100 specialized agents across frontier and custom models to find exploitable bugs, delivering top performance on the CyberGym benchmark.

We used it ahead of Patch Tuesday to help find and fix 16 vulnerabilities. Today we’re announcing that customers can sign up to test it in private preview.

https://t.co/maAN55yZQ1

[Mr. OS @ksg93rd]

#Offensive_security
Bypassing Windows (11 24H2/Server 2025) authentication reflection mitigations for SYSTEM shells
Part 1 (CVE-2025-33073) https://t.co/2T97IwM5wr
Part 2 (CVE-2026-26128) https://t.co/ANcOgXJW1m
// Authentication relay (or reflection) attacks will persist as long as integrity mechanisms are not enforced by default on Windows services

[chiefpie @cplearns2h4ck]

Some of the bugs I disclosed to MSRC last year is now public on the company's advisory page.

E.g: CVE-2025-47985 Windows Event Tracing Elevation of Privilege

https://t.co/G6eCy2E1kt

[MDSec @MDSecLabs]

Our latest post on the blog details a Windows EoP courtesy of @filip_dragovic... "Total Recall – Retracing Your Steps Back to NT AUTHORITY\SYSTEM" - https://t.co/zpk744Jeit

[Souhail Hammou @Dark_Puzzle]

I've published the first entry in my new Windows vulnerability research series.

It details how exploring Windows I/O completion internals led to uncovering a use-after-free in afd.sys (CVE-2026-21241).

https://t.co/DwYlSpbGtL

[Project Zero Bugs @ProjectZeroBugs]

Bypassing Windows Administrator Protection https://t.co/JSBShX6ezJ

[Project Zero Bugs @ProjectZeroBugs]

Defeating KASLR by Doing Nothing at All https://t.co/PKSfMIuT98

[Check Point Research @_CPResearch_]

🚨 We uncovered #security #vulnerabilities in #Windows graphics. #CVE-2025-30388 and CVE-2025-53766 are #BufferOverflows enabling #RemoteCodeExecution. CVE-2025-47984 leaks memory over the network due to an incomplete fix. 👇https://t.co/mK5qUol34V

[D4m0n @d4m0n_8]

It’s time to publish the blog post about the bug that won at P2O Berlin 2025. Enjoy!
With this post, I mark my last moment as a researcher at @oobs_io. I’m moving on to a new place for a fresh start.🔥🦎

https://t.co/PAdwKgeHuL

[immortalp0ny @immortalp0ny]

Today we released write up about vulnerability that I found and which was patched recently in NTFS.sys CVE-2025-49689. Enjoy! https://t.co/eFTkDN2eSW

[k0shl @KeyZ3r0]

Our slide is online: https://t.co/vpdHxw7NV5

Glad to share our pre-auth DoS & RCE bug hunting research at #BHUSA! Thanks @BlackHatEvents for the pre-recording, as we couldn’t attend in person this time for personal reasons. Questions? DM us @vv474172261 @XiaoWei___ @edwardzpeng

[Anatomist @th3anatomist]

🚨 We got RCE on Solana 🚨
Finally revealing FULL details about the RCE vulnerability we found 2 years ago.
Found it. Lost it. Exploited it anyway.
🔬 Here’s what real-world bug hunting looks like: https://t.co/k6o6IKtuSW

[Jael Koh @_jaelkoh]

The slides for @offensive_con talk "Hunting for overlooked cookies in Windows 11 KTM and baking exploits for them" by @saidelike and I are here:

https://t.co/KBEGZ1CohL

[Project Zero Bugs @ProjectZeroBugs]

The Windows Registry Adventure #7: Attack surface analysis https://t.co/OZGQ1cRN8k

[Yuval Gordon @YuG0rd]

🚀 We just released my research on BadSuccessor - a new unpatched Active Directory privilege escalation vulnerability
It allows compromising any user in AD, it works with the default config, and.. Microsoft currently won't fix it 🤷‍♂️
Read Here - https://t.co/c969sNjQH0

[ö @r0keb]

Good morning! I just published a blog post about a KASLR bypass that works on modern Windows 11 versions. It leverages Intel CPU cache timings to exfiltrate the base address of ntoskrnl.exe. I hope you like it!

https://t.co/jXM3uXIcHR

[Angelboy @scwuaptx]

Thrilled to share our latest deep dive into Windows Kernel Streaming!
Just presented this research at @offensive_con.

Check it out: https://t.co/DRxHWf5pTJ

[Azure @4zure9]

Excited to share that my talk "Booting into Breaches: Hunting Windows SecureBoot's Remote Attack Surfaces" has been accepted at @BlackHatEvents #BHUSA! 🎉

Looking forward to discussing SecureBoot research and the story behind these 31 CVEs in Las Vegas! See you there! 🔍💻