core-jmp

Connor McGarr on ETW’s undocumented SecurityTrace bit: QUERY wants Antimalware-PPL, STOP does not, and a user-mode ControlTrace hook lets admin consume Threat-Intelligence without a driver.

Adam Chester’s SpecterOps research on disposable Mythic agents: from a vibe-coded abomination to a two-hour Oracle harness that one-shots stage-0 implants in Python, Go, Zig, C#, and Rust.

Asim Manizada’s four Linux LPEs: DirtyAH6, TUNderflow, PPPoEject, DiagSpill.

Gen Threat Labs: CVE-2026-51990 one-click RCE in Sogou IME — sgbiz: argument injection, skincenter CEF, Chromium 80 unsandboxed.

Pruva REPRO-2026-00354: CVE-2026-85706 unauthenticated GitLab file read via commits.json defeating Workhorse, file.path sink, %zz echo, Files API trailing-slash variant.

Jonathan Johnson’s first public RE of WESP on Insider 29661: wesp.sys + espclient.dll, EspFilterPort, WESP://Permission and AM-PPL, process-create queues, a working consumer POC, and Microsoft.Windows.WESP.Client ETW.

QED’s CVE-2026-19174: three constants overflow in V8’s wasm deserializer, 102.4 MiB instead of 921.6, overlapping RWX JIT, renderer RCE without a heap-sandbox bypass.

Acronis TRU: Red Heron turned CVE-2026-60004 into a Gitea steal-and-pivot factory within days of the PoC, hit five countries, and dropped JITTERLY with a new LD_PRELOAD rootkit, SIXZUT.

Natalie Silvanovich’s Part 3: the Pixel 9 0-click was person-weeks, not a miracle.

Seth Jenkins’s Part 2: from mediacodec to kernel R/W on Pixel 9 via CVE-2025-36934 in /dev/bigwave.

Project Zero’s Natalie Silvanovich turns CVE-2025-54957 in the Dolby Unified Decoder into mediacodec code execution on a Pixel 9 with no tap: Google Messages transcribes RCS audio, an evo-heap pad wraps, scudo secondary headers slide, and /proc/self/mem p…

Cisco Talos is tracking in-the-wild abuse of CVE-2026-20079 (FMC auth bypass, CVSS 10.0) and CVE-2026-20316 (static low-priv credentials, SIR High) on Cisco Secure Firewall Management Center.

S12 points a notepad.exe File handle at ntds.dit, SYSTEM, and SECURITY on a live DC via BYOVD LowQword patch.

Quarkslab’s pcode_graph lifts functions to Ghidra P-Code CDGs and a GINE embedding that matches GMN (AUC 0.87 XM) on Cisco-Talos, across ISA, compiler and -O.

Quarkslab shows Android hardware attestation end to end, then a Frida relay: a clean phone signs the backend nonce, the rooted analysis phone presents that genuine chain.

CVE-2026-20093 is a CVSS 9.8 pre-auth password change on Cisco IMC via configConfMo/aaaUser.

Patch EPROCESS.UniqueProcessId and every ETHREAD.Cid with a GIO kernel write, and Sysmon attributes file, DNS and child-process events to Notepad.

Praetorian's Caeruleus is one Go binary on Linux/BlueZ that replaces hcitool, gatttool, bettercap BLE, and throwaway Bleak scripts: scan, enumerate, assess unpaired reads, DFU doors, and fuzz writable GATT characteristics with JSON for humans and agents.

Lazarus spent a Windows kernel zero-day in afd.sys on a fake recruiter PDF.

USENIX Security 2026: KERAT mines atomicity rules for check-use pairs on Linux and FreeBSD shared fields, then FSM-walks LLVM IR. 351 real bugs, 65 confirmed, 10 CVEs.

Hope Walker's SpecterOps sequel to manual LDAP querying: OR parentheses that lie, nested Domain Admins, Kerberoastable SPNs, userAccountControl sticker-math, passwords in schema attributes, OU search bases, forest trusts, and Foreign Security Principals.

When BloodHound and PowerView will not load, Active Directory is still a phone book.

Aaron Thacker jailbroke a Cisco C195 ESA by splicing a newer BIOS so CIMC came online, exploiting command injection in expRemoteFwUpdate (CVE-2024-20356) for root on the ASPEED BMC, then swapping /tmp/pid_validated so Secure Boot loaded a wider key set.

Yuval Hanoch Hirschenbein Sadde traced a DEF CON 34 demo crash to one character in XNU: unp_ino++ assigns inode 0 to the first UNIX domain socket statted after boot, so the second fstat() invents a new identity.