Vašek Lorenc @valorcz

Part 3 of the hypervisor based game cheat series is up. This is where the series starts moving from hypervisor primitives into actual game cheat mechanics. This part covers EPT hooks, VM exits, VMI, monitoring loops, overlay and input delivery paths, and the point where a low level memory or execution event starts becoming cheat relevant. Also started touching the actual game cheat side more directly this time, but this is about technical principles and mechanics, not actual code. Big thanks and credit to @Intel80x86 @HyperDbg for the great HyperDbg work on hardware assisted debugging, EPT hidden hooks, transparent memory hooks, and VM exit based monitoring. Can't imagine how lost it would've been without HyperDbg. Seriously a lifesaver! Also grateful to Panicos Karkallis and Jorge Blasco Alís for the VIC research on virtual machine introspection cheats. For a bit of context, this entire series is originally a single Korean document. Splitting it up due to the length, and it’ll probably be around 8 or 9 parts total. Translating from the original Korean made the English version feel a bit awkward in earlier parts, so spent some extra time polishing this one. Really hope it’s a much smoother read. 🙏 Please take it as a light read. If anything is wrong or too wordy, feedback is always welcome. 😇 kernullist.github.io/kernullist-blo…

Factoring "short-sleeve" RSA keys with polynomials blog.trailofbits.com/2026/06/12/fac…

Phrack 72 published the analysis of an actual North Korean APT workstation dump. Real Kimsuky source code. A kernel-level remote backdoor. A private Cobalt Strike beacon. Android malware. Stolen South Korean government GPKI certificates. Access to the Defense Counterintelligence Command and Ministry of Foreign Affairs. A South Korean security firm independently confirmed the findings. They matched the leaked rootkit source code to a rootkit found during a real 2022 incident at a South Korean financial institution. Same code, same encryption keys. Opens with “Dear Kimsuky, you are no hacker.” phrack.org/issues/72/7_md enki.co.kr/en/media-cente… Authors: Saber + cyb0rg Published in @phrack Issue 72, 40th Anniversary Follow-up analysis by ENKI White #ThreatIntel #Malware #InfoSec

keyboard_arrow_left Previous keyboard_arrow_right Next

Well, this is why you check for CVE's before you spend two days doing a thing. afflicted.sh/blog/posts/amw…

We sent Claude Mythos Preview spelunking through Squid’s guts, and it surfaced clutching a 29-year-old bug. Meet Squidbleed: a Heartbleed-style vulnerability that leaks internal memory from every version of Squid Proxy, in its default configuration. Full story: blog.calif.io/p/squidbleed-c…

NASA zveřejnila na svém githubu slušnou porci STL pro 3D tisk, mimo jiné i legendární Saturn V, který vynesl astronauty na misi Apollo 11 k Měsíci. Jaký model si vytisknete jako první? 😉 #3Dprinting #NASA

i love this exploit! universal SELinux bypass still works to this day. I released it for Qualcomm based processors and just realized I never released the Exynos version so here it is unprivated: github.com/chompie1337/s8…

Yt4gg3r @yt4gg3r

3 weeks ago

@cr3ghost "Android kernel exploitation bypassing DAC, SELinux, and Knox" - I don't see this? @chompie writes that io_uring exploits could be potentially used for SELinux bypass, is that what you mean?

0 1 11 41K 7

🚨 BrEaKiNg: Splunk, a security product, has zero authentication in its built-in database service and accepts any credentials, according to the security researchers who just dropped a full pre-auth RCE chain for Splunk Enterprise (CVE-2026-20253, CVSS 9.8). Splunk Enterprise on AWS is vulnerable out of the box.

keyboard_arrow_left Previous keyboard_arrow_right Next

Soutěže jsou různé. Sportovní, hudební, filmové, … a programátorské. 😀 Byly vyhlášeni vítězové 🏅 a zveřejněny vítězné zdrojové kódy 29. ročníku soutěže International Obfuscated C Code Contest (IOCCC), tj. soutěže o nejnepřehlednější (nejobfuskovanější) zdrojový kód v jazyce C.

keyboard_arrow_left Previous keyboard_arrow_right Next

This is not a drill: you have two more days until the call for papers for #BSidesVienna closes. Submit your talk or workshop by Sunday at 11 pm, 59 minutes and 59 seconds. This is also your reminder to get your tickets at 6 pm today.

@kasikp Asi se to nechová úplně deterministicky, já dostal rozumnou odpověď. Navíc se v mém vyhledávání liší, jestli zadám "define disregard", nebo v opačném pořadí.

I’ve mentioned this before: this is one of the oncoming trains for corp-security. We’ve long failed at least-privilege, but weren’t often punished for it. Helen in HR (or Bob in accounts) didn’t know what to do with the extra perms they didn’t know they had. Their agents will.

Son Luong @sluongng

a month ago

Codex just found a “workaround” of not having sudo on my pc…

344 1K 16K 1.6M 4K

Yesterday I got a funny DM. @s00pcan said some AI slop is automatically forking his Linux open-source projects and adding goofy ass ReadMe files to look all fancy. The primary difference though is the ReadMe includes a "download here" link which delivers a .zip file. The .zip file contains cool and badass malware. The malware is also free. Yay This is a campaign which has been identified by various AV vendors since April, 2026. It is attributed to StealC. In this particular instance though it is very, very silly. The exact mechanic in which this StealC group is using to automagically fork projects on GitHub, insert bogus ReadMe files, etc. is unknown. Clearly it is AI generated. However, this group failed to account for all edge cases because ... this is malware developed for Windows ... but it is from a Linux audio driver fork. This yet again however a use case of AI in malware campaigns. StealC has been around forever and clearly isn't AI slop. However, Threat Actors are using AI to generate fancy schmancy ReadMe files. Very cool. Thank you, Mr. Smart GPU-thingy. The following GitHub I'll be linking is giving FREE malware. Visiting the page won't give you the free malware. At the top of the ReadMe is a "Download" section with a hyperlink to "pcie_dante_snd_v1.4". If you care what this payload does: Inside this .zip file is "Application.cmd", "dir-dot-cc", "lua51.dll", and "loader.exe". Application.cmd is a command line file, it launches loader.exe. Loader.exe is responsible for loading the "dir" file. Loader.exe is dependent on lua51.dll because the "dir" file is a GIANT obfuscated Lua file. I hate Lua and I hate dealing with obfuscated Lua, I refuse to be a victim of Lua, so instead of trying to bonk it with a stick I emulated it. Unsurprisingly, the malicious Lua file tries to harvest credentials from Chrome and exfiltrate them to a remote host. Free malware: github-dot-com/mbyington67-prog/snd-dante-pcie/tree/master tl;dr ai slopping and forking github, delivers malware that uses obfuscated lua, i like cats a lot

I don’t know what happened between Microsoft and #NightmareEclipse behind closed doors Maybe Nightmare Eclipse was unreasonable. Maybe Microsoft was. Maybe both. But I think Microsoft badly misjudged this situation. When you’re the largest software vendor on the planet, you don’t get to behave like an angry individual in an internet argument. You have to be the adult in the room. Deleting repositories, talking about criminal investigations and turning the whole thing into a public fight was a mistake. The damage from that goes far beyond this one researcher. What surprised me most is how quickly people started sharing their own MSRC stories afterwards. - Months without responses - “Working as intended” - Bounty disputes - Reports that went nowhere People don’t suddenly start telling those stories for no reason. I think Microsoft broke a lot of porcelain here. And for what exactly? I don’t see much upside.

found a verifier/interpreter mismatch in the Linux BPF subsystem (CVE-2026-31525, CVSS 7.8). arbitrary kernel read/write; become root, escape containers, disable SELinux, read TLS keys out of other processes' memory. anyway, it starts with the math bars, the absolute value. computers store negative numbers in two's complement. the smallest 32-bit signed integer is -2,147,483,648, and the largest positive is +2,147,483,647. there is no +2,147,483,648, since it simply does not fit. so when you call abs(-2,147,483,648), the C specification thinks about it for a moment, says "undefined," and leaves the room. on x86 and arm64, what you actually get back is -2,147,483,648. you asked for the absolute value of a negative number, you got back the same negative number. thank you computer :D the BPF interpreter implements signed 32-bit division (BPF_ALU | BPF_DIV/MOD, off == 1, added in ec0e2da95f72) by decomposing it into unsigned division: take abs() of both operands, divide via do_div(), reapply the sign. the handler in ___bpf_prog_run (kernel/bpf/core.c): AX = abs((s32)DST); AX = do_div(AX, abs((s32)SRC)); and look, the kernel even documents this. include/linux/math.h: "the return value is undefined when the input is the minimum value of the type." when DST = 0x80000000 (S32_MIN), abs() tries to negate it. -(-2,147,483,648) overflows s32, the C spec calls it undefined behavior, and the CPU hands back 0x80000000 unchanged. still negative. abs() had one job. this s32 then gets assigned into AX, a u64 BPF register. s32 → u64 sign-extends: 0x80000000 becomes 0xFFFFFFFF80000000. that's 18,446,744,071,562,067,968. you wanted 2,147,483,648, you got 18.4 quintillion; a rounding error of about 18.4 quintillion. do_div() is a 64-by-32-bit unsigned division macro and it operates on this full u64 numerator. the quotient is off by a factor of 2³². the smod path has the same problem since do_div() modifies the dividend in place and returns the remainder, both wrong. 8 call sites across sdiv32/smod32 src/imm handlers, all quietly producing nonsense whenever S32_MIN shows up. the BPF verifier is the safety system that statically analyzes every BPF program before allowing it to run. it exists specifically to guarantee that nothing bad can happen. scalar32_min_max_sdiv() in kernel/bpf/verifier.c tracks value ranges through abstract interpretation. it handles signed division correctly, including S32_MIN. computes tight, mathematically correct bounds. the interpreter, as we've established, computes whatever it feels like. so the verifier thinks register R0 is in range X. the interpreter puts value Y in R0. the safety system and the execution engine disagree about what a program does. in BPF security research, this is where you set down your coffee. concretely: load S32_MIN into R1, load 2 into R2, execute SDIV32 R1 R2. verifier determines R1 ∈ [-1,073,741,824, -1,073,741,824]. interpreter computes do_div(0xFFFFFFFF80000000, 2) = 0x7FFFFFFFC0000000, reapplies the sign, produces a completely unrelated value. use R1 as an index into a BPF map. verifier approves the access, bounds check passes against its calculated range. interpreter uses the actual value. out-of-bounds read/write on a kernel data structure. on every Linux machine running the BPF interpreter. the root cause of all of this: the absolute value function doesn't handle one number. one specific number, out of 4.2 billion possible inputs, and it's the one that gives you kernel read/write. the fix is: c static u32 abs_s32(s32 x) { return x >= 0 ? (u32)x : -(u32)x; } cast to u32 before negating. -(u32)0x80000000 = 0x80000000 unsigned. correct absolute value, no overflow, no undefined behavior. the kind of function you'd assume already exists somewhere in 30 million lines of kernel code. it did not. I got to write it. :D I reported this, wrote the patch, got it through 5 revisions of review. acked by Yonghong Song and Mykyta Yatsenko. now patched in stable 6.6, 6.12, 6.18, 6.19. if you haven't updated your kernel: maybe do that.

Themida turns a few lines of code into thousands of VM handler instructions. Completely unreadable. back engineering built a static devirtualizer that lifts it all to IR, resolves the control flow, and recovers the original logic. The before/after in the repo is genuinely shocking. Works on pretty much any VM obfuscator, not just Themida. Blog: back.engineering/blog/09/05/202… Devirt output: github.com/backengineerin… Author: @BackEngineerLab #ReverseEngineering #InfoSec #Malware

⚠️ Attackers used an LLM agent for post-exploitation after breaching a public Marimo notebook via CVE-2026-39987, a pre-auth RCE flaw affecting versions ≤0.20.4. The intrusion stole cloud credentials, retrieved an SSH key from AWS Secrets Manager, and exfiltrated a PostgreSQL database via eight SSH sessions in under two minutes. Full report: thehackernews.com/2026/05/attack…

Někteří programátoři opravdu, ale opravdu nemají rádi vibe coding 😁 arstechnica.com/security/2026/…

⚠️ Critical Notepad++ Vulnerabilities Allow Attackers to Execute Arbitrary Code Source: cybersecuritynews.com/critical-notep… Notepad++, one of the most widely used open-source text editors for Windows, has released an urgent security update addressing three vulnerabilities, including two arbitrary code execution flaws that could allow attackers to silently run malicious programs on a victim's machine. The most severe of the three is CVE-2026-48778, which targets the tag inside Notepad++'s config.xml file. 📌 CVE-2026-48770 - Crash via malformed XML structure 📌 CVE-2026-48778 - Arbitrary code execution via config.xml 📌 CVE-2026-48800 - Arbitrary code execution via shortcuts.xml #cybersecuritynews

Chat, I don't want to be that guy, but I think Microsoft has really pissed off security researchers and we're approaching the tipping point. This Eclipse guy has really rocked the boat for Microsoft.