Tag
A security research blogpost introduces a new Kerberos delegation abuse path that combines Reflective RBCD and U2U sacrificial user techniques, plus an Impacket extension, to obtain forwardable tickets for Constrained Delegation without Protocol Transition against SPN-less accounts.
Orange Tsai of DEVCORE Research Team presents a fully handmade, logic-only Microsoft Edge full chain built for Pwn2Own Berlin 2026, chaining 5 bugs and 2 Windows features into a sandbox escape without memory corruption, earning $175,000 and a Pwnie Epic Achievement award.
EFF's Coders' Rights Project FAQ explains how U.S. laws — copyright, DMCA anti-circumvention, trade secret, and contract law — affect software reverse engineering, and offers guidance on reducing legal risk for developers and security researchers.
Ablation 是一个面向安全研究人员的逆向工程框架，帮助 AI 编码代理分析二进制文件与固件，支持多架构分析、二进制提升为伪 C 代码、语义化函数搜索及假设追踪，已开源并提供 Claude Code 配置教程。
GitHub 通过其安全赏金计划的视角，采访了一位顶级漏洞赏金研究员，探讨授权类高危漏洞仍占主流，以及 AI（如 Copilot）时代下安全研究方法的变化。文章还介绍了 GitHub 重组后的赏金计划和面向高质量研究者的 VIP 邀请制项目。
NorForge 的调查发现，多个由 Cairn 等 AI 驱动的渗透测试控制面板被公开暴露在互联网上，其中 20 多个可能与恶意网络攻击活动相关，暴露了目标信息、凭证和 API 密钥。
Anthropic 的 Claude 在半小时内破解了长期悬而未决的谜题：NIST ECDSA 椭圆曲线的种子值并非哈希生成，而是由 C 库的 lrand48 随机数生成器以 Unix 时间戳为种子产生，这并非密码学破解，只是解开了数十年的起源争议。
安全研究公司 Calif 披露了一个存在于 OpenBSD 中、可追溯至 37 年前原始 BSD 源码的内核漏洞：共享内存附加计数器（shm_nattch）为有符号 16 位 short，通过反复 fork 可导致整数溢出，结合竞争条件引发的 use-after-free 和一处越界写，最终在启用 KARL/SMAP/SMEP 的情况下实现本地提权至 root。相关补丁已通过 OpenBSD errata 026 和 018 修复。
A deep-dive article reconstructing how the L0pht hackers may have optimized their LanMan (LM) hash password-cracking techniques in L0phtCrack, covering DES internals, precomputed key schedules, macro-based key schedule generation, and skipping initial/final permutations and rounds. The author notes similar optimizations existed in John the Ripper and that no secret DES-cracking technique is revealed.
Trail of Bits tested 25 popular package managers for their ability to detect compromised repositories injecting malicious code, finding that fewer than half verify integrity via lockfiles by default and only Go verifies package signatures by default, highlighting widespread supply-chain risks.
深入的安全研究文章，详细讲解了对 Eufy Security 视频门铃及 Homebase 2 基站的逆向工程过程，涵盖远程信号干扰、声音同步协议逆向，以及从闪存转储中提取并解密门铃连接隐藏网络所用凭据的方法。
发现了一个可在 PC（macOS）上运行的 iOS 系统虚拟机开源项目 vphone-aio，开箱即已越狱，可用于安全研究与漏洞挖掘，无需购买实体 iPhone。维护者推荐使用 vphone-cli 以获得更好的更新和支持，现已支持 iOS 27。
ShinyHunters leader 'Rey' (Saif Al-din Khader), a teenager from Amman, Jordan, was detained and is reportedly cooperating with the FBI after the group extorted Boeing spin-off Jeppesen ForeFlight, exploiting CVE-2026-35273 in Oracle PeopleSoft to breach victims including the FBI.
ProjectDiscovery researchers show that fine-tuned or abliterated open-weight models can hide remote-payload backdoors for under $50, demonstrating a poisoning pipeline that exfiltrates credentials from Qwen2.5-7B inside OpenAI's Codex CLI without tripping existing evals.
A peer-reviewed Northeastern University study, in partnership with Consumer Reports, is the first large-scale measurement of the connected-vehicle ecosystem, finding that 19 of 21 tested vehicles and 7 of 30 companion apps contact third parties or transmit sensitive identifiers and PII to advertisers and trackers.
A Princeton CITP blog post shows that AI coding agents costing just $20 can reverse the deterministic 'randomization' of Georgia's ballot scanner records, reconstructing the voting order for 98.9% of in-person ballots and enabling full de-anonymization where poll records are public.
Security researcher David Buchanan (retr0id) demonstrates a C2PA spec footgun allowing arbitrary byte-range "exclusions" in signed files, showing how timestamped Content Credentials can be forged to "hack time" — e.g. backdating winning lottery numbers — undermining C2PA as a trust anchor for image provenance.
A USENIX Security 2020 paper presenting Datalog Disassembly, a rule-based approach that recovers function boundaries and calls in stripped binaries by leveraging contextual, code-based features encoded as Datalog facts, outperforming prior disassembly heuristics.
A GitHub project provides a web exploit chain for PS5 consoles running firmware 7.00 to 13.60, intended for educational and security research purposes.
A security researcher used a modified uncensored Qwen 3.8 27B model to create an executable for dumping Windows LSASS memory while evading EDR detection, highlighting the advantages of local AI models for unrestricted cybersecurity research.