VoidSec

The post CVE-2026-40369: Twelve Bytes to Escape the Browser Sandbox appeared first on VoidSec.

The post AI Vulnerability Research and the Fuzzer Era Déjà Vu: Why the Numbers Are Only Half the Story appeared first on VoidSec.

It’s been a long time since I posted on my blog, and while many of you will expect something related to Windows vulnerability research or exploit development.

In November of last year, I took the OffSec EXP-401 Advanced Windows Exploitation class (AWE) at Black Hat MEA.

Recently, a threat actor (TA) known as SpyBot posted a tool, on a Russian hacking forum, that can terminate any antivirus/Endpoint Detection & Response (EDR/XDR) software.

In July 2022, I took the SANS SEC 760 class in Berlin.

As the last post of the year, I decided to do something chill and a bit “off-topic” from my usual content.

Last month, during Ekoparty, Blue Frost Security published a Windows challenge.

In case you’re wondering why I’m not posting as regularly as before, with the new year, I’ve finally transitioned into a fully offensive vulnerability research and exploit development role at Exodus Intelligence that fulfilled my career dream (BTW, we’re…

With this blog post I’d like to sum up my year-long Windows Drivers research; share and detail my own methodology for reverse engineering (WDM) Windows drivers, finding some possible vulnerable code paths as well as understanding their exploitability.