From DDS Packets to Robot Shells: Two RCEs in Unitree Robots (CVE-2026-27509 & CVE-2026-27510)
CVE-2026-27509 Unauthenticated DDS-Based Remote Code Execution & CVE-2026-27510 Mobile Database Tampering Leading to Remote Code Execution
Boschko Security Blog
Thoughts, stories and ideas.
Latest posts
When Models See Ghosts - Investigating Why Adversarial Examples Break Our Models
Explore the trade-offs between accuracy, simplicity, and the chaos of high-dimensional data.
Breaking Down Adversarial Machine Learning Attacks Through Red Team Challenges
Learn how to craft and understand adversarial attacks on AI/ML models through hands-on challenges on Dreadnode’s Crucible CTF platform.
Incinerator: The Ultimate Android Malware Reversing Tool
Master Android malware reversal with ease using Incinerator, your trusted ally in the fight against threat actors for experts and novices alike.
TP-Link TDDP Buffer Overflow Vulnerability
TP-Link's TDDP programs listening on UDP port 1040, fails to properly verify data length during parsing, leading to memory overflow destroying the memory structure and causing a denial of service.
Shambles: The Next-Generation IoT Reverse Engineering Tool to Discover 0-Day Vulnerabilities
Simplifying the discovery of IoT/ICS 0-days. Revolutionizing embedded systems reverse engineering in a tool for everyone.
Emulating IoT Firmware Made Easy: Start Hacking Without the Physical Device
A step-by-step how-to guide to using QEMU in Ubuntu 18.04 to emulate embedded devices.
Vulnerabilities and Hardware Teardown of GL.iNET GL-MT300N-V2 Router
Hacking GL.iNET MT300N router & hardware teardown (3 CVEs).
Vulnerabilities in Tenda's W15Ev2 AC1200 Router
Reverse engineering Tenda's W15Ev2 AC1200 SOHO router discovering 10 0-days (10 CVEs).
Hacking ATM's & Financially Oriented Web Applications
Solving the ATM/Kiosk & Banking software hacking challenges from Positive Hack Days 2022 Payment Village.
Using NVIDIA's Leaked Certificate to Improve Anti-Kill
Looking at how signing binaries with leaked Nvidia certificates affect evasion.
Hijacking League of Legends Accounts
A tale of stealing from botters/boosters & their win-trading accounts.
ATM/Kiosk Hacking
Solving the ATM/Kiosk hacking challenges from Positive Hack Days 2021 Payment Village.
The Braindead Buffer Overflow Guide to Pass the OSCP Blindfolded
OSCP/eCPPT braindead buffer overflow guide.
Pass-Back-Attack: From Default Printer Credentials to Domain Admin
Looking at Pass-back-attacks & how to exploit trust relationships between devices that are generally considered benign.