Blogs
BlogsCVE-2026-85880 Anatomy: Heap Buffer Overflow in Windows ALPC, AppContainer Sandbox Escape to SYSTEM Without User InteractionCVE-2026-85880 is a heap buffer overflow in Windows ALPC that lets AppContainer-confined code escape to SYSTEM without user interaction. This deep-dive covers…Read →BlogsCVE-2026-82312: How a NULL DACL on OpenVPN’s Named Objects Turned Every Multi-User Windows Box Into a Local Denial-of-Service TargetHow a NULL DACL on OpenVPN's named Windows objects let any local user kill VPN tunnels or block netsh. The bug, the…Read →BlogsCVE-2026-62878 Teardown: Anatomy of the Wormable Windows DNS Server Stack Overflow That Threatens Every Active Directory Domain ControllerCVE-2026-62878 is a wormable, unauthenticated stack overflow in the Windows DNS Server service that puts every Active Directory domain controller at risk.…Read →BlogsSilkParasite Dissected: Seven-RAT China-Nexus Toolkit, Google Drive C2 via ETag Headers, and AI-Assisted Development Against Central Asian GovernmentsBitdefender's SilkParasite disclosure reveals a seven-family China-nexus toolkit using Google Drive as C2, HTTP ETag/Cookie covert channels, HalosGate syscall evasion, and AI-assisted…Read →BlogsDeadLock Ransomware’s Blockchain C2: How Polygon Smart Contracts Replace Traditional Infrastructure and Why Takedowns No Longer WorkDeadLock ransomware replaced traditional C2 infrastructure with Polygon smart contracts, making server seizures and domain takedowns structurally obsolete. Learn the architecture, the…Read →BlogsCVE-2026-59310 and CVE-2026-59309 Teardown: How a China-Nexus APT Turned vCenter’s Log Collector Into an Unauthenticated Root ShellA China-nexus APT exploited CVE-2026-59310 within five days of disclosure, turning vCenter's syslog handler into an unauthenticated root shell across 361 victims.…Read →BlogsCVE-2026-62815 Teardown: Zero-Auth Use-After-Free in Microsoft QUIC’s msquic Stack, One Malformed UDP Packet to RCE on Every Unpatched Windows Server 2022/2025CVE-2026-62815 is a CVSS 9.8 use-after-free in Microsoft's msquic stack - one unauthenticated UDP packet can achieve RCE on unpatched Windows Server…Read →BlogsCVE-2026-68820 Anatomy: How Lazarus Group’s afd.sys Use-After-Free Race Condition Became a SYSTEM-Level Zero-Day Paired With FudModule Rootkit and ForestTiger BackdoorCVE-2026-68820 is Lazarus Group's fourth afd.sys zero-day since 2024 - a race-triggered use-after-free that escalates to SYSTEM, blinds ETW-based sensors with FudModule…Read →BlogsAPT-C-60 / SpyGlace 2026: LNK-to-mshta Execution, Developer-Platform Abuse as CDN, and How Japan’s Most-Targeted Espionage Group Turned GitHub, GitLab, and jsDelivr Into a Malware Distribution NetworkAPT-C-60's 2026 SpyGlace campaign bypasses reputation-based defenses by staging payloads on GitHub, GitLab, jsDelivr, and Codeberg. Learn how the LNK-to-mshta chain works…Read →BlogsCVE-2026-18577 Teardown: How an Incomplete N-able N-central Auth-Bypass Patch Became a God-Mode MSP Supply Chain WeaponCVE-2026-18577 exposed a critical flaw in N-able N-central: the first patch left an alternate auth bypass open, giving attackers god-mode console access…Read →BlogsAPT-C-20 / Fancy Bear’s PNG Steganography Campaign: LSB Payload Concealment, PBKDF2-Derived AES-256, and Reflective C# Loading Against Defense MinistriesAPT-C-20 (Fancy Bear) stacked LSB steganography, PBKDF2-derived AES-256-CBC, and reflective CLR loading to compromise defense ministries without writing a payload to disk.…Read →BlogsEggStreme Fileless Framework: Dissecting the China-Nexus APT Targeting Philippine Military Organizations With a Zero-Footprint ImplantEggStreme is a China-nexus, six-component fileless framework that injects a gRPC/mTLS backdoor into winlogon.exe without ever writing decrypted code to disk. Dissect…Read →