My notes on IT-Security and tech
Newsletter 2026-10-27
Another Week, another round.
This time the theme seems to be threat actor writeups, with a few outliers like SpecterOps and their article on NTLM relaying despite LDAP and SMB signing.
Trail of Bits looked at the integrity checks of several package managers and found that some could use a few more checks to improve security. Since we have seen a lot of supply chain attacks this year, anything that reduces the attack surface is helpful.
…Newsletter 2026-10-20
Another Week, another round. Quite a few mobile-related articles sneaked into my feed this time, by coincidence.
Zscaler, among others, observed the use of the LLM pentesting framework ARTEX to attack South Korean targets.
Point Wild has presented the Android malware trend report for Q3. It looks like the landscape has evolved and more AI is being used as well.
Starlabs analyzed the YuanKong Android RAT. It uses WebSockets for C2 communication, as well as certificates that stay the same across the whole family. According to Starlabs, this allows other samples to be attributed to the same family quite reliably.
…Newsletter 2026-10-13
Another week, another round.
g3tsyst3m explains the difference between module stomping and function stomping, where shellcode is written directly into an already-loaded exported function in the target process, without loading new modules or allocating new memory. Typical detection markers like CreateRemoteThread or VirtualAllocEx can be avoided by choosing a function the target process calls regularly anyway. The whole thing is implemented as a complete BOF for Adaptix C2, including PIC shellcode from the Crystal Palace toolchain that can run position-independently anywhere.
…Newsletter 2026-10-06
Another week, another round.
Unit42 gives an insight into the risks that (AI-based) operators in Kubernetes clusters can pose when not properly secured.
A Mac ARM infostealer is now also being used on older Intel-based Macs. IRU took a closer look at the new variant.
Quarkslab presents their setup for AI vulnerability research, built around a deterministic core with LLMs acting as reviewer, hypothesis generator, and PoC developer.
…Newsletter 2026-09-29
Another week, another round.
Greynoise has detected exploitation of ZyXEL and WordPress vulnerabilities that led to data exfiltration from several government organizations. Among other things, 17 different AMSI bypass approaches were used. Greynoise included the attackers’ tools in the article, which were used to search for cleartext credentials among other things.
SpecterOps introduces CiliumHound, a tool for visualizing Cilium network policies graphically in BloodHound.
Zscaler takes a look at Vidar, which has added virtual machine detection and custom stream ciphers for string obfuscation.
…Newsletter 2026-09-22
Another week, another round. This time, coincidentally, with two entries each from Quarkslab and Datadog.
Quarkslab introduces a new tool for generating code flow graphs from binary data.
Searchlight Cyber took a look at the JavaScript engine Goja. Written in Go, as the name might suggest, it is used in tools like Grafana and Nuclei among others. They found an RCE vulnerability that could be reliably exploited across multiple tools.
…Newsletter 2026-09-14
Another week, another round.
A small missing check with devastating consequences. A missing signature verification led to roughly $1.1 million in crypto being stolen in total.
Acronis has published a very detailed analysis of a multi-stage infection chain. The final payload appears to be the SparkRAT malware, though the Acronis team stops short of direct attribution due to a lack of sufficient evidence.
Rapid7 analyzed a curl-based RAT targeting South Korean entities and attributed it to North Korean APTs. The core components are an SSH keylogger and a backdoor placed in HA-Proxy, used to silently manipulate network traffic, intercept credentials, and inject scripts into websites.
…Newsletter 2026-09-08
Another week, another round.
Lukas Maar from Calif describes, in a four-part series, what a portable path from untrusted_app to root on bootloader-locked Android devices can look like, with the goal of requiring as few adjustments as possible per OEM, kernel, chipset, or device. This is the first article in the series.
SpecterOps has released a whole batch of skills for agents, with some interesting ones in there.
TrustedSec has written down how to investigate AWS WAF logs, and a new tool came out of it in the process.
…Newsletter 2026-09-01
Another week, another round
Pointwild analyzed Plikanlocker, a locker malware with Telegram-based control and data exfiltration. Using Telegram as the command channel brings a cloud service into play that apparently doesn’t raise immediate alarms everywhere, and it saves the operator the need for dedicated C2 infrastructure.
Insinuator has a new tool for parsing TIA files. TIA Portal (Totally Integrated Automation Portal) is software for deploying updates to PLCs.
Quarkslab looked at measures to make reversing of legitimate software harder in the age of AI. The willingness of models to come up with “creative solutions” showed itself here as well.
…Newsletter 2026-08-25
Another week, another round.
Mandiant presents what AVDH (Agentic Vulnerability Discovery Harness) has been doing for them and how it fits into the existing AI landscape alongside CodeMender.
Varonis reported a vulnerability to Microsoft in Copilot Personal. Almost as interesting as the one-click data exfiltration itself is the timeline. It was reported in December 2025, and the patches were released on 18.08.2026, the same day as the article. With the time from publication to exploit getting shorter and shorter, I find that a bit of a stretch.
…Newsletter 2026-08-18
Another week, another round. This week a little later and a tad shorter.
A Security has discovered multiple vulnerabilities in Zoom that allow a remote attacker in a meeting to hit all participants with a zero-click RCE.
Talos has come across a new phishing framework. It works as live phishing, meaning the user directly enters their MFA for the attacker and essentially hands over access themselves.
Practical Security Analytics has shared their approach (tool-assisted) to adversary emulation. A good example of how red teaming doesn’t have to be purely about objective completion.
…Newsletter 2026-08-11
Another week another round:
A pretty interesting deep dive into browser fingerprinting from the Web Scraping Club.
Cyble has published their ransomware threat report for the first half of 2026. Germany and France are leading the statistics on cases in Europe.
SpecterOps has published a four-part series on WSUS, including a Ludus lab and new tooling. An important prerequisite here is that the WSUS server uses an external SQL database that is not running on the same server.
…Newsletter 2026-08-04
Another week, another round.
Starting with a GitHub repo today. This is another intentionally vulnerable project, and having drones as the target makes for a nice change.
A colleague sent me an interesting article about hidden instructions in Word documents. These are later interpreted by CoPilot in Word and transferred into new documents.
Another colleague sent me another article, covering an attack on EV charging infrastructure. There are significant security flaws in the charging stations, and according to the authors the vulnerabilities found can be applied to other manufacturers in a similar form. The blog has a variety of posts on charging infrastructure, so it’s worth having a browse.
…Newsletter 2026-07-28
Another week week, another round.
An interesting thought to design platforms to be safe not just for children but for people in general, with child protection added on top. The focus here is on doom scrolling, endless notifications, fake news, and so on. Things we consider unsuitable for children because they influence them also quite clearly influence adults.
Paradoxis found a CVE in Foxit PDF and published their writeup.
…Newsletter 2026-07-21
Another week, another round. There’s been a lot of AI content again this time, though it does make up a large portion of the news.
Elastic has analyzed a rapidly spreading new Malware-as-a-Service campaign. Teleputz relies on the increasingly popular ClickFix scheme for initial compromise. Reverse engineering is slowed down through garbage instructions in the code, and so far only a handful of C2 domains have been observed.
Mindgard has published a vulnerability in Codex (as of 16.07. it is still unpatched after a seven-month disclosure timeline). Codex searches for a Git executable in multiple locations within a project. If that executable is malicious, the consequences are fairly obvious.
…Newsletter 2026-07-14
Another week, another round. This time, the focus seems, by coincidence, to be more on escapes in various forms.
Synacktiv’s Paul Barbé presents a Helm template injection
SpecterOps has released a new LLM jailbreaking tool
The DFIR Report has analyzed and written up an Akira incident. A very detailed report, as usual, but also very exciting.
A short and crisp explanation of a container escape via IPv6, including a PoC
…Newsletter 2026-07-07
Another week, another round.
Socket looks at Polinrider’s approach, where Git history is deliberately manipulated and rewritten to the “main” branch via force push. This allows malicious commits to disappear among legitimate ones and the entire repo to appear OK.
Stepsecurity maintains some GitHub actions. These were initially only available for paying customers, but are now also available for open source projects. It might be worth taking a look at their overview if you need a specific action.
…Newsletter 2026-06-30
Another week with articles. Thanks to the high temperatures I wasn’t motivated to do anything else but read, which lead to some more links this week.
Quarkslab took a closer look at Xiaomi’s proprietary security chip as used in cameras. Methods used included, among others, I2C sniffing, flash dumping, and firmware analysis.
Praetorian’s setup for automated vulnerability analysis with AI was recently introduced. In the first part, the target was FreeBSD and the approach is explained in detail.
…Newsletter 2026-06-22
Another week, nother round
A VirtualBox escape through a use-after-free vulnerability, compiled by Luca Ginex.
FIFA apparently was busy awarding peace prizes and didn’t have time to test their central systems. For many football fans, probably a happy outcome.
Niels Provos versus frontier models.
I have to agree with Justin Bollinger here. I’ve always taken a detour around jq and maybe used Python’s json.tool or awk and cut to prepare and filter data.
Newsletter 2026-06-16
Another week with new articles.
Zoltan Madarassy and Alex Brown wrote another article for Elttam on what to watch out for in Go reviews.
Matthew Green looked at the reasoning blocks in LLMs and was able to derive secrets from the systems (with a bit of luck). Additionally, neither Claude nor GPT5x seem to use system prompts in API mode.
A comprehensive write-up of CVE-2026-23111. This is a use-after-free vulnerability caused by incorrect use of the exclamation mark.
…