Clean indirect syscalls on Windows x64. It single-steps a hooked ntdll stub with the CPU trap flag to learn the live System Service Number and the syscall opcode, then jumps to that opcode with different arguments and a spoofed return address. The public proof of concept injects a calc.exe launcher into Notepad. core-jmp.org/2026/10/syscall… #DirectSyscalls #DoomSyscalls #EDR #EDRBypass #ETW #ETWThreatIntelligence #HalosGate #HellsGate #IndirectSyscalls #NTDLL #parametertampering #PEB #PEBWalking #ProcessInjection #returnaddressspoofing #RIPspoofing #ROR13 #si13nt #SilentisVox #SYSCALL #SyscallRevenant #SystemServiceNumber #SysWhispers #TartarusGate #TrapFlag #VectoredExceptionHandler #VEH #WindowsInternals

CVE-2026-23866: Finding a Whatsapp NDay core-jmp.org/2026/10/cve-202… CVE-2026-23866 described incomplete validation of WhatsApp AI-rich Instagram Reel messages that could make another device fetch an arbitrary URL. numb3rs used only the public NVD text, grepped an iOS 25.9.72 IPA for AiRich, and proved a 1-click UIApplication.openURL path. The CVE’s automatic media sink was not reproduced; a 10 October edit points at LaTeX unifiedData image URLs. #AIRich #Android #CVE202623866 #CWE20 #CWE601 #Frida #IDAPro #InputValidation #InstagramReels #iOS #MobileAppSecurity #nday #NdayResearch #numb3rs #protobuf #Swift #WhatsApp #whatsmeow

core-jmp.org/2026/10/followi… STM32F401 Xbox One controller from “we have SWD” to a live CoreSight instruction trace. ETM and TPIU are programmed from OpenOCD, SWO is captured on PB3 with a hobbyist logic analyzer, and Ghidra explains why the first decode dies: the PLL moves the baud rate, then firmware steals the pin for I2C2. #ARM #CoreSight #CortexM #DWT #ETM #FaultInjection #FirmwareAnalysis #FirmwareReverseEngineering #Ghidra #HardwareHacking #ITM #JTAG #logicanalyzer #MatthewAlt #OpenOCD #Pulseview #SerialWireOutput #STM32 #SVD #SWD #SWO #TPIU #VoidStarSecurity #wrongbaud #XboxOne

Cisco published CVE-2026-76504, a critical authentication bypass in Catalyst SD-WAN Manager. Landon Rice at VulnCheck showed that a single percent-encoded POST to /%6a_security_check plus a reserved Viptela username mints an admin JSESSIONID, because getRequestURI() does not decode while WildFly does. About 1,500 vManage consoles were internet-exposed; the bug was exploited as a zero-day. core-jmp.org/2026/10/revenge… #ATT&CKT1190 #AuthenticationBypass #Cisco #CiscoCatalystSDWAN #CVE #CVE202676504 #CWE177 #Envoy #getRequestURI #InitialAccess #JAAS #JSESSIONID #LandonRice #RBACBypass #SDWAN #SessionHijacking #URLencoding #Viptela #vManage #VulnCheck #WildFly #ZeroDay

Dumps WD and Samsung drive firmware, debugs a live HDD over JTAG, hot-patches overlay RAM to stall DMA READ EXT, then watches an Xbox 360 race start firing on unmodified stock firmware. core-jmp.org/2026/10/hdd-fir… #ATA #firmware #FirmwareAnalysis #FirmwareDumping #FirmwareHacking #grimdoomer #HDD #JTAG #LZHUF #Microcode #OpenOCD #overlaymodule #PC3000 #RyanMiceli #Samsung #servicearea #WesternDigital #Xbox360

Reverse Engineering a Ledger Nano X Hardware Implant core-jmp.org/2026/10/reverse… Reverse-engineered a real Ledger Nano X hardware implant for HARDWEAR.IO 2026 in Santa Clara. The add-on board does not break the Secure Element: it watches the OLED SPI bus, template-matches BIP-39 glyphs, stores the recovery seed at flash 0x7000, and sends it out over a Luat Air700E LTE modem with a Vodafone NL data eSIM. This article walks the 78-slide talk in source order and adds kitchen-table and operator notes. #ATT&CKT1195 #ATT&CKT1200 #BIP39 #CryptocurrencyThreats #CWE1263 #eSIM #firmware #FirmwareReverseEngineering #hardwareimplant #hardwarewallet #Hardweario #JoeGrand #Kingpin #Ledger #LedgerNanoX #MalwareAnalysis #OLED #SecureElement #SPIBusSniffing #SupplyChainAttack #SupplyChainSecurity

BeakSec's CVE-2026-107181: Telegram Desktop through 7.2.8 handed clicked links to the running instance over a local socket and never escaped the semicolon that separated commands. A leftover interpret: helper then sent named local files to a chat with no confirmation. One click, three tdata files, account takeover. Fixed in 7.2.9. core-jmp.org/2026/10/telegra… #AccountTakeover #arbitraryfileread #BeakSec #CommandInjection #CVE #CVE2026107181 #CWE77 #CWE862 #IPC #OffensiveSecurity #oneclick #SecurityResearch #SessionHijacking #Telegram #TelegramDesktop #URIHandler #windows #ZDI

AnyPwn is a pre-approval remote code execution bug in AnyDesk Linux 8.0.2. The session protocol's mode-5 handler trusts a remote payload length, adds a 16-byte object header with 32-bit arithmetic, wraps to a tiny allocation, and copies attacker bytes using the original huge logical length. The public PoC talks TLS to TCP/7070 and runs an arbitrary command; the same parser is reachable over AnyDesk relays. Fixed in 8.0.3. This is not CVE-2025-27918. core-jmp.org/2026/10/anypwn-… #AnyDesk #HeapBufferOverflow #HeapExploitation #heapgrooming #HeapSpray #IntegerOverflow #Linux #preauth #RCE #remotedesktop #UnauthenticatedRCE #V12

Aftermath Labs statically recover 815 of 865 Tencent-VM virtualized functions across four ACE kernel drivers (94.2 percent). Architecture, CET RDSSPQ/INCSSPQ, phantom SEH unwind, guided symbolic execution, VJCC DAGs and a closed MBA identity list. core-jmp.org/2026/10/static-… #AntiCheat #CET #Deobfuscation #Devirtualization #IntelCET #kernel #KernelAntiCheat #MBAObfuscation #ReverseEngineering #SEH #SymbolicExecution #TencentVM #Themida #VMObfuscation #VMProtect #WindowsInternals

Eddie Zhang / Project Black: Claude refuses an LSASS dumper; DeepSeek builds one EDR still catches; uncensored Qwen 3.8 27B on two 4090s stealth-edits it until two lab EDRs stay green. Hygiene > signatures. core-jmp.org/2026/10/bypassi… #CredentialDumping #DeepSeek #EDR #LateralMovement #LLM #localAI #lsass #Qwen #redteam #windows

Mobeta patch-diff of VMSA-2026-0006: vCenter 8.0.3 syslog dynafile traversal (CVE-2026-59310) and SASL SRP A=N auth bypass (CVE-2026-59309), both pre-auth 9.8. Templates, Ghidra, Sigma, YARA. RCE hop unpublished. core-jmp.org/2026/10/vcenter… #CVE202659309 #CVE202659310 #LDAP #preauth #RCE #rsyslog #SRP #syslog #vCenter #VMware

CVE-2026-65660 SharePoint EditingPageParser bypass via RegisterDirective.GetHtml quote rewrite, XamlServices memshell, and ToolPane on AddGallery.aspx for pre-auth RCE when anonymous view is on. Patch 11 Aug 2026. core-jmp.org/2026/10/sharepo… #anonymousaccess #ASPNET #CVE202665660 #deserialization #InsecureDeserialization #microsoft #RCE #SafeControls #SharePoint #ToolPane #UnauthenticatedRCE #Webshell

Super Happytime Death Machine

Connor McGarr on ETW’s undocumented SecurityTrace bit: QUERY wants Antimalware-PPL, STOP does not, and a user-mode ControlTrace hook lets admin consume Threat-Intelligence without a driver. MSRC: not a CVE. core-jmp.org/2026/09/etw-sec… On 16 January 2026 Connor McGarr published a Windows-internals note, first on the Origin (by Prelude) blog, then on his own site. While building Origin’s Runtime Memory Protection preview, his team’s Antimalware-PPL ETW tooling could stop a trace session that had an undocumented SecurityTrace bit set — without Antimalware-PPL. That flag is supposed to keep such sessions (mostly Defender AutoLoggers) in the PPL club. Querying them as SYSTEM fails. #AutoLogger #ETW #kernel #MSRC #PPL #ProtectedProcess #Sechost #ThreatIntelligence #windows #WindowsInternals

Adam Chester’s SpecterOps research on disposable Mythic agents: from a vibe-coded abomination to a two-hour Oracle harness that one-shots stage-0 implants in Python, Go, Zig, C#, and Rust. YARA families rot. Hunt the protocol. core-jmp.org/2026/09/disposa… On 24 June 2026 Adam Chester, Senior Offensive Security Engineer on SpecterOps TRACE, published a 25-minute research post about disposable tooling: LLM-generated Mythic C2 agents that are cheap enough to throw away. The question was blunt: can you one-shot a new agent from an initial prompt to a tested, shippable implant with no human in the loop? #C2Frameworks #C2Infrastructure #Claude #ClaudeCode #CommandandControl(C2) #DisposableTooling #GPT #LLM #LLMassistedDevelopment #Mythic #redteam #RedTeamResearch #RedTeamTools #SpecterOps #YARA

Asim Manizada’s four Linux LPEs: DirtyAH6, TUNderflow, PPPoEject, DiagSpill. Decade-old bugs, userns for three, DiagSpill needs only SCTP. Patch 5.10.270 / 6.6.157 / 6.12.109 and cousins. PoCs on GitHub, VM-only. core-jmp.org/2026/09/linux-l… On 18 September 2026 Asim Manizada published four Linux local-root bugs found with the same agentic graph/geometry harness behind CIFSwitch, OVSwrap, and the “drunk LLM” kernel work. DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), and DiagSpill (CVE-2026-74469). The underlying mistakes are 10–21 years old. The first three LPEs want unprivileged user namespaces (or equivalent CAP_NET_ADMIN in a userns-owned netns). DiagSpill does not. #CVE202668121 #CVE202674469 #CVE202680844 #CVE202681000 #DiagSpill #DirtyAH6 #IPsec #kernel #Linux #LinuxKernel #LinuxKernelExploitation #LinuxLPE #LocalPrivilegeEscalation(LPE) #PPPoE #PPPoEject #PrivilegeEscalation #SCTP #TUNderflow #UserNamespaces