Clean indirect syscalls on Windows x64. It single-steps a hooked ntdll stub with the CPU trap flag to learn the live System Service Number and the syscall opcode, then jumps to that opcode with different arguments and a spoofed return address. The public proof of concept injects a calc.exe launcher into Notepad. core-jmp.org/2026/10/syscall… #DirectSyscalls #DoomSyscalls #EDR #EDRBypass #ETW #ETWThreatIntelligence #HalosGate #HellsGate #IndirectSyscalls #NTDLL #parametertampering #PEB #PEBWalking #ProcessInjection #returnaddressspoofing #RIPspoofing #ROR13 #si13nt #SilentisVox #SYSCALL #SyscallRevenant #SystemServiceNumber #SysWhispers #TartarusGate #TrapFlag #VectoredExceptionHandler #VEH #WindowsInternals

CVE-2026-23866: Finding a Whatsapp NDay core-jmp.org/2026/10/cve-202… CVE-2026-23866 described incomplete validation of WhatsApp AI-rich Instagram Reel messages that could make another device fetch an arbitrary URL. numb3rs used only the public NVD text, grepped an iOS 25.9.72 IPA for AiRich, and proved a 1-click UIApplication.openURL path. The CVE’s automatic media sink was not reproduced; a 10 October edit points at LaTeX unifiedData image URLs. #AIRich #Android #CVE202623866 #CWE20 #CWE601 #Frida #IDAPro #InputValidation #InstagramReels #iOS #MobileAppSecurity #nday #NdayResearch #numb3rs #protobuf #Swift #WhatsApp #whatsmeow

core-jmp.org/2026/10/followi… STM32F401 Xbox One controller from “we have SWD” to a live CoreSight instruction trace. ETM and TPIU are programmed from OpenOCD, SWO is captured on PB3 with a hobbyist logic analyzer, and Ghidra explains why the first decode dies: the PLL moves the baud rate, then firmware steals the pin for I2C2. #ARM #CoreSight #CortexM #DWT #ETM #FaultInjection #FirmwareAnalysis #FirmwareReverseEngineering #Ghidra #HardwareHacking #ITM #JTAG #logicanalyzer #MatthewAlt #OpenOCD #Pulseview #SerialWireOutput #STM32 #SVD #SWD #SWO #TPIU #VoidStarSecurity #wrongbaud #XboxOne

Cisco published CVE-2026-76504, a critical authentication bypass in Catalyst SD-WAN Manager. Landon Rice at VulnCheck showed that a single percent-encoded POST to /%6a_security_check plus a reserved Viptela username mints an admin JSESSIONID, because getRequestURI() does not decode while WildFly does. About 1,500 vManage consoles were internet-exposed; the bug was exploited as a zero-day. core-jmp.org/2026/10/revenge… #ATT&CKT1190 #AuthenticationBypass #Cisco #CiscoCatalystSDWAN #CVE #CVE202676504 #CWE177 #Envoy #getRequestURI #InitialAccess #JAAS #JSESSIONID #LandonRice #RBACBypass #SDWAN #SessionHijacking #URLencoding #Viptela #vManage #VulnCheck #WildFly #ZeroDay

Dumps WD and Samsung drive firmware, debugs a live HDD over JTAG, hot-patches overlay RAM to stall DMA READ EXT, then watches an Xbox 360 race start firing on unmodified stock firmware. core-jmp.org/2026/10/hdd-fir… #ATA #firmware #FirmwareAnalysis #FirmwareDumping #FirmwareHacking #grimdoomer #HDD #JTAG #LZHUF #Microcode #OpenOCD #overlaymodule #PC3000 #RyanMiceli #Samsung #servicearea #WesternDigital #Xbox360

Reverse Engineering a Ledger Nano X Hardware Implant core-jmp.org/2026/10/reverse… Reverse-engineered a real Ledger Nano X hardware implant for HARDWEAR.IO 2026 in Santa Clara. The add-on board does not break the Secure Element: it watches the OLED SPI bus, template-matches BIP-39 glyphs, stores the recovery seed at flash 0x7000, and sends it out over a Luat Air700E LTE modem with a Vodafone NL data eSIM. This article walks the 78-slide talk in source order and adds kitchen-table and operator notes. #ATT&CKT1195 #ATT&CKT1200 #BIP39 #CryptocurrencyThreats #CWE1263 #eSIM #firmware #FirmwareReverseEngineering #hardwareimplant #hardwarewallet #Hardweario #JoeGrand #Kingpin #Ledger #LedgerNanoX #MalwareAnalysis #OLED #SecureElement #SPIBusSniffing #SupplyChainAttack #SupplyChainSecurity

Simon Koeck's Google DevSite write-up: a pre-auth Flask session cookie on developers.google.com carried a pickled OAuth flow whose client_secret was also the Flask SECRET_KEY. Forging the cookie reached pickle.loads. Unauthenticated RCE, proved with time.sleep, paid $90,000, fixed 7 Oct 2026. core-jmp.org/2026/10/google-… #CWE502 #deserialization #DeserializationVulnerability #Flask #GoogleDevSite #InsecureDeserialization #itsdangerous #OAuth #Python #PythonPickle #PythonSecurity #RCE #SECRET_KEY #sessionforgery #SessionHijacking #UnauthenticatedRCE

BeakSec's CVE-2026-107181: Telegram Desktop through 7.2.8 handed clicked links to the running instance over a local socket and never escaped the semicolon that separated commands. A leftover interpret: helper then sent named local files to a chat with no confirmation. One click, three tdata files, account takeover. Fixed in 7.2.9. core-jmp.org/2026/10/telegra… #AccountTakeover #arbitraryfileread #BeakSec #CommandInjection #CVE #CVE2026107181 #CWE77 #CWE862 #IPC #OffensiveSecurity #oneclick #SecurityResearch #SessionHijacking #Telegram #TelegramDesktop #URIHandler #windows #ZDI

AnyPwn is a pre-approval remote code execution bug in AnyDesk Linux 8.0.2. The session protocol's mode-5 handler trusts a remote payload length, adds a 16-byte object header with 32-bit arithmetic, wraps to a tiny allocation, and copies attacker bytes using the original huge logical length. The public PoC talks TLS to TCP/7070 and runs an arbitrary command; the same parser is reachable over AnyDesk relays. Fixed in 8.0.3. This is not CVE-2025-27918. core-jmp.org/2026/10/anypwn-… #AnyDesk #HeapBufferOverflow #HeapExploitation #heapgrooming #HeapSpray #IntegerOverflow #Linux #preauth #RCE #remotedesktop #UnauthenticatedRCE #V12

ГОГ LOL

Aftermath Labs statically recover 815 of 865 Tencent-VM virtualized functions across four ACE kernel drivers (94.2 percent). Architecture, CET RDSSPQ/INCSSPQ, phantom SEH unwind, guided symbolic execution, VJCC DAGs and a closed MBA identity list. core-jmp.org/2026/10/static-… #AntiCheat #CET #Deobfuscation #Devirtualization #IntelCET #kernel #KernelAntiCheat #MBAObfuscation #ReverseEngineering #SEH #SymbolicExecution #TencentVM #Themida #VMObfuscation #VMProtect #WindowsInternals

Eddie Zhang / Project Black: Claude refuses an LSASS dumper; DeepSeek builds one EDR still catches; uncensored Qwen 3.8 27B on two 4090s stealth-edits it until two lab EDRs stay green. Hygiene > signatures. core-jmp.org/2026/10/bypassi… #CredentialDumping #DeepSeek #EDR #LateralMovement #LLM #localAI #lsass #Qwen #redteam #windows

Mobeta patch-diff of VMSA-2026-0006: vCenter 8.0.3 syslog dynafile traversal (CVE-2026-59310) and SASL SRP A=N auth bypass (CVE-2026-59309), both pre-auth 9.8. Templates, Ghidra, Sigma, YARA. RCE hop unpublished. core-jmp.org/2026/10/vcenter… #CVE202659309 #CVE202659310 #LDAP #preauth #RCE #rsyslog #SRP #syslog #vCenter #VMware

CVE-2026-65660 SharePoint EditingPageParser bypass via RegisterDirective.GetHtml quote rewrite, XamlServices memshell, and ToolPane on AddGallery.aspx for pre-auth RCE when anonymous view is on. Patch 11 Aug 2026. core-jmp.org/2026/10/sharepo… #anonymousaccess #ASPNET #CVE202665660 #deserialization #InsecureDeserialization #microsoft #RCE #SafeControls #SharePoint #ToolPane #UnauthenticatedRCE #Webshell