xpldotjs

[kernullist @kernullist]

ETWPrism is a Windows research tool for inspecting user-mode ETW at the emitting process.
Many high-signal events are assembled in user-mode runtimes, DLLs, or service processes before they enter the normal ETW tracing pipeline. ETWPrism helps look at that pre-submission point directly.
Current focus includes PowerShell, AMSI, CLR, WinINet, WinHTTP, DNS Client, LDAP Client, CAPI2, DPAPI, WMI Activity, BITS Client, Schannel, RPC, COMRuntime, and CNG-related providers.
Useful for validating what payloads are actually emitted, how filtering changes visibility, and where service-hosted providers require a different capture point.

repo: https://t.co/rf8vWAW6eB

[OS Dev @OSdev_]

One unchecked integer multiplication can own the entire Windows kernel.

In CVE-2024-30088, an integer overflow caused the kernel to allocate a smaller buffer than required while continuing to process it as if it were large enough. The resulting out-of-bounds write let attackers corrupt kernel memory, build arbitrary read/write primitives, and ultimately replace their process token with the SYSTEM token.

https://t.co/zccTyNAfFK

[Matt @zer0matt_]

zer0matt's blog: Whoops! I did it again. I patched Windows Kernel a... https://t.co/9WLZZ79hxf

[cr3ghost @cr3ghost]

This is the type of malware game hackers build to bypass kernel anti-cheat. The same techniques can be used by malware authors to evade EDRs.

A UEFI bootkit that injects into Microsoft's own Hyper-V at ring -1 before the OS even loads (easier than building a custom hypervisor from scratch).

Four phase bootloader. Hypervisor VM-exit interception. EPT page shadowing. MSR virtualization. EFI memory map ghosting. TPM measurement spoofing.

Reads like malware. Because it is. Videos and full technical breakdown in the link.

Author: https://t.co/iHtxyJSbwy

#ReverseEngineering #Malware #AntiCheat

[kernullist @kernullist]

Cleaned up my old ETW notes from Obsidian and put them into one post.
No new research here.
Just a practical map of the parts I keep coming back to, providers, sessions, kernel loggers, ETWTI, tampering, and detection.

https://t.co/e068LAH8p7

[r1cksec @r1cksec]

Stack spoofing Detection for CET processes by comparing shadow and user stacks.

https://t.co/L5iAWVIjQq

#infosec #cybersecurity #redteam #pentest

[Washi @washi_dev]

Custom attributes in #dotnet give me nightmares.

Read my new blog post to learn why:
👉https://t.co/JUgfI6Iq2u

#reversing #malware #pe #binary #asmresolver

[Linux Kernel Security @linkersec]

Privilege Escalation via a Page Use-After-Free in Qualcomm's AI Accelerator Linux Kernel Driver

Article by Lukas Maar about exploiting a bug in the mmap handler of the QAIC driver that causes a page UAF.

https://t.co/RqMi8QuuLG

[cr3ghost @cr3ghost]

Themida turns a few lines of code into thousands of VM handler instructions. Completely unreadable.

back engineering built a static devirtualizer that lifts it all to IR, resolves the control flow, and recovers the original logic.

The before/after in the repo is genuinely shocking.

Works on pretty much any VM obfuscator, not just Themida.

Blog: https://t.co/fY4YkY2aH3
Devirt output: https://t.co/p2gkKi1vXp

Author: @BackEngineerLab

#ReverseEngineering #InfoSec #Malware

[r1cksec @r1cksec]

A post about how Windows Named Pipes can become an attack surface when their ACLs are too permissive or when pipe creation flags are misused

https://t.co/m3KnfqXNfk

#infosec #cybersecurity #redteam #pentest #windows

[scriptjunkie (Matt) @scriptjunkie1]

Gargoyle a decade later
https://t.co/QJSTvwxsyY

[kshitij vaze @VazeKshitij]

THIS is what I pay my internet bills for man, fucking amazing stuff!!!!

[Smukx.E @5mukx]

Callback hell: abusing callbacks, tail-calls, and proxy frames to obfuscate the stack

Blog:- https://t.co/s4M2ONRGKB

#callstack #windows

[winterknife 🌻 @_winterknife_]

Updated my project to bypass write protection via PTE manipulation.
HVCI / KDP will prevent this technique by marking the code / data page as read-only in the SLAT entry.
Do note that the Dirty bit is clear in the PxE despite the page being written to.
https://t.co/IMPevg6mws

[0xor0ne @0xor0ne]

Static Devirtualization of Themida

https://t.co/4UQrXtppDz

#infosec

[Coiffeur @Coiffeur0x90]

🏴‍☠️ I can finally share a VMware 0day I discovered that led to CVE-2026-41702 (LPE as root). Funny enough, I found the bug in my hotel room after the second day of attending Csaba Fitzl (@theevilbit) & Gergely Kalman (@gergely_kalman) training at Zer0con.

https://t.co/mG55Ksc4gE

[V12 @v12sec]

Due to popular demand We have made the Poc more user friendly 😊

This way you can test the safety of your qemu more time effectively 😃

[Blackstorm Security @blackstormsecbr]

Time Travel Analysis with QEMU on IoT Targets: Not Always That Hard - Part I:

https://t.co/oH3ZDDWDhd

Time Travel Analysis with QEMU on IoT Targets: Not Always That Hard - Part II:

https://t.co/WxxCooHN9h

#qemu #iot #reversing #informationsecurity #cybersecurity #hardware

[Het Mehta @hetmehtaa]

Every 3rd website you visit runs Nginx.

18,959,833 of them can be hijacked right now.

A bug from 2008 just got a working exploit.

CVE-2026-42945 (CVSS 9.2)

No login. No access. Just one HTTP request.

→ Heap overflow → Worker process → RCE

Patch ASAP to Nginx 1.31.0 or 1.30.1

PoC is already out:
https://t.co/O4556KGjqD

[thaidn @XorNinja]

(cross-posting from a private Signal group)

To all these posts comparing AI with fuzzing, find me a fuzzer that can reliably exploit UAF and I’ll be convinced that they are the same tech.

For example this bug and its exploit: https://t.co/kjFwqthFPL

We did it with Claude. Then a friend at OpenAI showed that GPT 5.5 reliably single-shot built a different exploit, using a better strategy, without consulting our article or PoC. This is mind blowing, and super fun, not sure why people keep denying the fun part.

In a Chrome exploit, we had some trouble with ASLR leak with float precision (i.e., need to leak info through pixel positions such that some maths must hold). The model came up with this: https://t.co/0DoRLdRgke. No idea what that is, but it seems to work for real!

When the first humans discovered how to use fire, they didn’t say, well, this is just another form of sunlight. They cooked!

Let's go cooking the greatest exploits!