Triagz Early Beta Release is now live!
Introducing the first platform that can transform your endpoint machine into Agentic with just a single click for comprehensive endpoint analysis and research.
We support all three platforms!
Check it out here: triagz.com
Good Morning! Just published a blog post diving into Windows Kernel LFH exploitation in the latest Windows 24h2 build, Focusing on controlled allocations to achieve arbitrary read/write in the kernel.
r0keb.github.io/posts/Modern-(…
The embargo (12:00 UTC 2025-06-10) is over, let's start a thread on Hydroph0bia (CVE-2025-4275), a trivial SecureBoot and FW updater signature bypass in almost any Insyde H2O-based UEFI firmware used since 2012 and still in use today.
English writeup: coderush.me/hydroph0bia-pa…
with offensivecon around the corner, i figured id write another post on linux kernel exploitation techniques - this time i cover the world of page table exploitation! enjoy 🤓
sam4k.com/page-table-ker…
Two new side-channel attacks against Apple CPUs that can leak sensitive data from the processor's memory
SLAP (Speculation Attacks via Load Address Prediction) and FLOP (False Load Output Predictions)
predictors.fail
Nice paper! 🔥 No fix implemented, AFAIK.
Like the general idea that leaking the address of an exploit-controlled object of one type effectively means leaking the address of an object of another chosen type, as we can put the latter object onto the same page via cross-cache.
Nice paper! 🔥 No fix implemented, AFAIK.
Like the general idea that leaking the address of an exploit-controlled object of one type effectively means leaking the address of an object of another chosen type, as we can put the latter object onto the same page via cross-cache.
New attack on x86 secure enclaves, specifically AMD SEV this time. SEV is AMD's answer to Intel TDXs.
Basically tricking the CPU into thinking the DRAM is a different size, causing physical address aliasing, which can then be exploited
🆕 Check out our latest publication on DMA attacks via SD cards! 💾
The article was written by our researcher Gesser.
➡️ swarm.ptsecurity.com/new-dog-old-tr…
Outrageous technique: barely legal use of x86 CPU instruction enables you to catch and 𝗰𝗮𝗻𝗰𝗲𝗹 impeding pagefault before it actually happens.
③: catch PAGE_GUARD or invalid access
⓪: do previously illegal reads at high IRQL, safely
#vpgatherqq#vpscatterqq scatter/gather
Created a blog post explaining physical memory primitives, how they can be exploited and how we can abuse the address translation mechanism to access any memory on a system as well as inject code into any process.
0dr3f.github.io/Demystifying_P…
SLUBStick: Arbitrary Memory Writes through Practical Software Cross-Cache Attacks within the Linux Kernel
A paper by Lukas Maar, @notbobbytables, et al. about exploiting slab memory corruptions via a cross-allocator attack targeting user page tables.
stefangast.eu/papers/slubsti…
8K Followers 399 FollowingWindows Internals enthusiast, Interested in hardware design & low-level programming. An active developer of @HyperDbg debugger.
https://t.co/TUALkTusHt
47 Followers 2K Followingليس ولكم نزال فلكم ولي خسارة / لستم بي قتال ولا انا فيكم قصارة /انا السان اللهب المقاص عصارة/
نحو المساح هل قفارة / انا الصحراء لي بكم نضارة
1K Followers 125 FollowingSecurity Professional and Researcher with over a decade of experience. I'm fairly low profile, but share useful info from time to time.
3K Followers 3K FollowingAdventurer. Takes a lot of photos, calls many places home. VP of research @VulnCheck. Former research director at @Rapid7 / @metasploit. Opinions mine. She/her.
538 Followers 7K FollowingCybertection is your choice for all security software, but our specialty is always going to be antivirus software. We are your digital bodyguard.
2 Followers 43 FollowingA mathematician, researcher, surfer, literature/cinema nerd who dabbles in cryptography, languages, art history, philosophy, simple living and Zen. I also code.
13 Followers 15 FollowingProviding SoC developers and OEMs with an Open Source reference trusted code base that complies with the relevant Arm specifications.
5K Followers 375 FollowingCurrently Senior Windows Core OS Engineer, Windows Internals Enthusiast and Book author, tennis lover, currently working for MS. Opinions and tweets are my own.
48K Followers 452 FollowingSecurity researcher with a focus on hardware & firmware. I occasionally publish stuff on YouTube. Co-founder of @hextreeio. Contact: [email protected]
12K Followers 1 FollowingWe strive to reimagine vulnerability research, program analysis, and security education as it exists today. An @RPISEC corporation.
9K Followers 0 FollowingLinks related to Linux kernel security and exploitation.
Maintained by @andreyknvl and @a13xp0p0v.
Also on https://t.co/GVE11dpBb8 and https://t.co/YpxPWXnA6Z.
13K Followers 1K Followingzero-fucks-given infosec research | contacts: https://t.co/AB3QnrPja0 | 🇺🇦 Ukraine needs your help to kill Ruϟϟian zombies: https://t.co/58pTGiK8iv
965 Followers 53 FollowingThe UEFI Forum advances globally-adopted firmware specifications through enhanced security to the evolution of devices, firmware and operating systems.
62K Followers 286 FollowingA kiwi coding mimikatz & kekeo
github: https://t.co/eS3LVgU6i0
Head of security services @banquedefrance
Tweets are my own and not the views of my employer
3K Followers 123 FollowingTweets from @zx2c4. Security Research & Consulting. Support WireGuard development via https://t.co/x6Y8S0VFRw https://t.co/dodHzVeb15 . Or hire us.
49K Followers 339 FollowingSecurity researcher in Google Project Zero. Author of Attacking Network Protocols. Tweets are my own etc. Mastodon: @[email protected]
17K Followers 0 Followingsecret club is a not-for-profit reverse-engineering group; publishing new research on popular software.
No ads, no cookies, just research.
12K Followers 649 FollowingKilling bug classes and breaking exploits as part of @msftsecresponse. Adding more entropy to the Internet. https://t.co/J8GCGurGP3
83K Followers 16 FollowingTrend Zero Day Initiative™ (ZDI) is a program designed to reward security researchers for responsibly disclosing vulnerabilities.
7K Followers 259 FollowingSecurity researcher and reverse engineer. Interested in Windows kernel development, low-level programming, static program analysis and cryptography.
47K Followers 2K FollowingChief Technical Innovation Officer @crowdstrike. Windows Internals author and trainer. He/Him. RTs are not endorsements, opinions are my own.
21K Followers 278 FollowingI find and exploit 0day, develop OSes, hypervisors and emulators, design massively parallel data structures and code, and do precision machining! Optimization❤️
8K Followers 399 FollowingWindows Internals enthusiast, Interested in hardware design & low-level programming. An active developer of @HyperDbg debugger.
https://t.co/TUALkTusHt
12K Followers 46 FollowingIndustry leading provider of exclusive zero-day vulnerability intelligence, exploits, defensive guidance, and vulnerability research trends.
19K Followers 2K Following🔬Founder & CEO @Binarly_io, #codeXplorer, #efiXplorer, @REhints and "Rootkits and Bootkits" book. Previously worked at Nvidia, Cylance, Intel, ESET, Yandex.