death of core jump
A path traversal in darwin-init, the PID 1 process that provisions every Apple Private Cloud Compute node, gave a researcher an arbitrary root file write that survives the userspace reboot. One dropped plist redirected PCC's internal splunkloggingd forwarder to an attacker-controlled endpoint, leaking CloudBoard state, per-request inference metadata and token-level side channels. Apple's own…
Every hardware security boundary on a modern x86 platform — SMRAM, the AMD PSP's private DRAM, the C6 save area, the live microcode patch — is enforced somewhere above the memory controller. Christopher Domas' skitter-creek-bath-salts flips a single bit in the AMD Family 16h DCT, rewires the physical-address-to-DRAM-coordinate transform underneath all of it, and recovers the resulting scramble…
veffects analyzes any track — mp3, wav, flac or midi — into a compact 160-bytes-per-frame “score” of audio features, then renders 28 procedural, plugin-based scenes from it: no textures, no assets, no GPU, just code reacting to the music. A full technical breakdown of the .veffects format, the FFT analyzer, the four-function plugin ABI and the software HDR renderer — plus where you would actually…
On 12 August 2026 Nightmare Eclipse published ShieldBreak, a proof of concept that defeats Microsoft's July fix for CVE-2026-50656 (RoguePlanet) and escalates a standard user to NT AUTHORITYSYSTEM on fully patched Windows 11 25H2 and Server 2025. This is a line-by-line walkthrough of the chain: registering a fake cloud storage provider so the attacker controls what Defender reads, using Object…
HTTP header injection has been under-rated for twenty years. This research shows how one injected CRLF sequence in an Nginx-normalised path escalates into the full desync arsenal — response queue poisoning, CL.TE and 0.CL smuggling, cache poisoning and request tunnelling — and ultimately into a self-replicating CRLF-powered desync worm. It also introduces novel techniques for connection-locked and…
Writing the harness is the friction that keeps most codebases from ever being fuzzed. This walkthrough puts an offline open-weights model behind that job: it drafts a libFuzzer harness for a vulnerable C record parser, clang compiles it with AddressSanitizer, and the binary reports a genuine stack-buffer-overflow with a symbolized frame on the offending memcpy. From there it scales to what real…
A single byte written past the end of a PagedPool allocation in a Windows 10 x64 kernel driver, followed all the way to SYSTEM. The target is searchme.sys from the WCTF 2018 "Searchme" challenge, and the route taken deliberately avoids pool metadata entirely. Large kernel pool chunks are page-aligned and frequently adjacent, so the stray byte lands on the first byte of the neighbouring object — a…
A complete hardware-to-firmware walkthrough of the Mercusys MB115-4G, the best-selling router on Amazon Spain: pre-purchase firmware recon, PCB teardown, UART pinout discovery with a voltmeter, a root shell from hardcoded credentials, and a full flash dump over TFTP without an EEPROM programmer. The second half is the root cause analysis of CVE-2026-12495, a pre-authentication stack buffer…
CVE-2026-71320 lets an attacker inject a template key into Nuxt server island props and have Vue's runtime compiler execute it inside the Nitro process - server-side RCE, CVSS 8.1. Three preconditions must all hold, and the third one, attribute fallthrough onto a polymorphic root component, is the part that catches people out. A walkthrough of the real mechanism verified against the upstream…
A multi-tenant document vault enforced a real server-side tenant-ownership check on its permission-grant endpoint - and it was still bypassable. The authorization layer read user_group_id as a single value; the ACL writer split the same string on commas and processed every element. Sending two IDs joined by a comma, victim first, granted an external account access across the tenant boundary and…