Newsletter 2026-02-24
Welcome to the next week of articles I deemed interesting.
A pretty interesting phishing approach.
Talos looked into how to bypass Code Read-out Protection (RDP) by emulating a single thread to find vulnerabilities in the ModBus TCP implementation of the devices.
Usually it’s more articles around security and red teaming topics, but containerization also plays a significant role in modern environments. Even though dependencies that are installed separately from the OS package manager need to be checked independently since many security scanners struggle with that (at least that’s my last understanding, it might have changed), higher speed when building containers is also important in many places. Andrew Nesbitt shows in his article that most package managers (Cargo, Go, and Co.) for software development allow downloading dependencies separately.
The deep dive into LNK by Wietze Beukema gives an interesting look into the LNK format, presents four possible attack scenarios, and explains how to detect these attacks.
A JSON deep dive by Het Mehta. The article is from March 2025 and shows possible attacks on JSON parsers.
Searchlight Cyber took a closer look at OpenText Directory Services (OTDS) and went really deep to find a deserialization vulnerability. Very much worth reading, in my opinion.
Read you next time