20May-26

CVE-2026-40369: Twelve Bytes to Escape the Browser Sandbox

TL;DR: CVE-2026-40369 is an unprivileged arbitrary 12-byte kernel write primitive in nt!ExpGetProcessInformation, reachable from any context that can call NtQuerySystemInformation, including Chrome, Edge and Firefox renderer sandboxes. In this post, I dissect the root cause and how to chain the primitive into a full LPE to lift a Medium-IL non-administrator process up to NT AUTHORITY\SYSTEM via NtCreateToken. I had originally prepared this bug for Pwn2Own Berlin. A couple of days before the contest,
Posted By
12May-26

AI Vulnerability Research and the Fuzzer Era Déjà Vu: Why the Numbers Are Only Half the Story

TL;DR A post by Alex Albert (Anthropic) claims that with the help of Claude Mythos, Mozilla fixed more security bugs in April 2026 than in the previous 15 months combined. Mozilla published the full breakdown: 271 of those bugs were found by Mythos, of which 180 were rated sec-high and 80 sec-moderate. The findings included sandbox escapes, race conditions, and UAFs. The severity distribution looks impressive, but tells a fraction of the story: not every bug is a security bug,...
Posted By
2Dec-25

Home-made LLM Recipe

It’s been a long time since I posted on my blog, and while many of you will expect something related to Windows vulnerability research or exploit development. I have to manage expectations, as this one will be on LLMs. Not because everyone is jumping on the AI bandwagon and I felt the urge to do so, but because over the past few years, I've transitioned from a purely technical role into something more hybrid, overlapping many different aspects of the...
Posted By
18Jan-24

OffSec EXP-401 Advanced Windows Exploitation (AWE) – Course Review

In November of last year, I took the OffSec EXP-401 Advanced Windows Exploitation class (AWE) at Black Hat MEA. While most of the blog posts out of there focus on providing an OSEE exam review, this blog post aims to be a day-by-day review of the AWE course content. OffSec Exp-401 (AWE) During the first day of AWE, the instructors shared with us the following slide: That’s to explain the “difficulty” of the course for each day. Needless to say, your mileage may...
Posted By
15Jun-23

Reverse Engineering Terminator aka Zemana AntiMalware/AntiLogger Driver

Recently, a threat actor (TA) known as SpyBot posted a tool, on a Russian hacking forum, that can terminate any antivirus/Endpoint Detection & Response (EDR/XDR) software. IMHO, all the hype behind this announcement was utterly unjustified as it is just another instance of the well-known Bring Your Own Vulnerable Driver (BYOVD) attack technique: where a legitimate signed driver is dropped on victims’ machine and later used to disable security solutions and/or deliver additional payloads. This technique requires administrative...
Posted By