Yehuda Smirnov

Security Researcher @Microsoft, opinions are my own.

[Yehuda Smirnov @yudasm_]

What if you skipped VirtualAlloc, skipped WriteProcessMemory and still got code execution?
We explored process injection using nothing but thread context.
Full write-up + PoCs:
https://t.co/Sa1oUSYyqU

[Andrew @4ndr3w6S]

Round two!

Yesterday was one report, here’s another: an unpatched NTLM coercion via the Windows Search (search-ms://) URI handler.

Same questions about how it got handled. It’s all in the writeup, timeline included.

https://t.co/eMbyEGbx8b

[kernullist @kernullist]

Cleaned up my old ETW notes from Obsidian and put them into one post.
No new research here.
Just a practical map of the parts I keep coming back to, providers, sessions, kernel loggers, ETWTI, tampering, and detection.

https://t.co/e068LAH8p7

[The Dustin Childs @dustin_childs]

Wow - #Microsoft releases an emergency patch for an Exchange spoofing bug in the wild. Looks like it's confined to OWA and Preview Pane is NOT a vector. Still, start your test and deployment engines! https://t.co/cz0pYlvqBg

[TrendAI Zero Day Initiative @thezdi]

Confirmed! Orange Tsai (@orange_8361) of DEVCORE Research Team (@d3vc0r3) chained 4 logic bugs to achieve a sandbox escape on Microsoft Edge, earning $175,000 and 17.5 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin

[Project Zero Bugs @ProjectZeroBugs]

A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens https://t.co/iZZgVoKNd9

[impulsive @weezerOSINT]

I just reverse engineered the YellowKey BitLocker bypass

Microsoft shipped code that checks for a flag called "FailRelock" in every Windows 11 recovery image. When it's set to 1, after recovery unlocks your BitLocker drive, it never relocks it. All you need is a USB stick.

This code only exists in the recovery environment. Not in normal Windows. They left an entire debug testing framework in production.

[incendiumrocks @incendiumrockz]

It's been a while since I wrote a blog post. My new post writes about some cool updates to the MS-RPC-Fuzzer for recursively fuzzing complex structures, logging using ETW, and we found a way to escalate to nt\authority system!

https://t.co/Guxzx0gu2J

[Synacktiv @Synacktiv]

This second blogpost concludes @yaumn_'s research on #Windows authentication reflection.
He discloses the new Kerberos authentication coercion technique he discovered to remotely compromise Windows systems 💥

A little bonus is even included at the end 👀👇
https://t.co/RsJHxCdIGe

[Synacktiv @Synacktiv]

Authentication reflection attacks are still not dead!

In our new blogpost series, @yaumn_ shares his journey into bypassing the mitigations of CVE-2025-33073 to pop SYSTEM shells again🚀

👇
https://t.co/pbZ2KjXq7Q

[sapir federovsky @sapirxfed]

Really great post, and fun priv esc!
The idea is that agent identity is also a service principal, which caused the developers to assign permissions to the AI administrator role to add passwords to all SP types. It's really clever 🧠 by @noaaariel
https://t.co/MnzTrpqihM

[Origin @originhq]

Claude Code's remote control protocol lets developers orchestrate instances programmatically. @tyholms reverse engineered it and found an undocumented flag that redirects any instance to attacker-controlled infrastructure, silently bypassing all permission checks.

https://t.co/Tn85uj1R77

[SpecterOps @SpecterOps]

Hidden GPO-based attack paths are now in BloodHound.

@croco_byte breaks down new OU & AD Site abuse paths that can lead to privilege escalation or full domain compromise, and how to find, map, and weaponize them. #SOCON2026

[Nightmare Eclipse @ChaoticEclipse0]

As promised, UnDefend Denial of Service PoC for windows defender.
https://t.co/eXrYL0CDiD

[Yehuda Smirnov @yudasm_]

@ZephrFish @neuralhax This is actually crazy! I've been doing something similar and funnily enough also called every component / system a campaign in my lab.
Thanks for sharing this!

[Andy Gill @ZephrFish]

This is what happens when I take time off, I actually write silly length blog posts and deep dive things https://t.co/SUgxpGqGFr the post dives into a MCP pipeline I've put together for autonomous 0day hunts.

[Yehuda Smirnov @yudasm_]

@GrahamHelton3 What do you do about Twitter stuff you want to save to read later? For example links to blogs, etc

[Craig S. Blackie @craigsblackie]

Been playing around UEFI and DMA...

https://t.co/jYexQbIL29

[MDSec @MDSecLabs]

In our latest post, researcher @craigsblackie documents attacks against the Dell UEFI firmware that enable DMA attacks against TPM-only bitlockered devices https://t.co/b835C7rlW4

[Trail of Bits @trailofbits]

93% recall vs 50% for baseline prompts. Our new dimensional-analysis plugin for Claude Code doesn't ask it to find bugs. It annotates your codebase with dimensional types, then flags mismatches mechanically. 🧵

[Synacktiv @Synacktiv]

If #RBCD has been thoroughly documented, only a few resources mention the workflow in cross-domain environment.
In our new blogpost, we dive into the cross-domain and cross-forest RBCD workflows.

Read it here 👇
https://t.co/cJsnify0qQ