The Blog post about "Revisiting Cross Session Activation attacks" is now also public. Lateral Movement with code execution in the context of an active session?Here you go.
A critical double-free vulnerability has been discovered in the pipapo set module of the Linux kernel’s NFT subsystem. An unprivileged attacker can exploit this vulnerability by sending a specially crafted netlink message, triggering a double-free error with high stability. This can then be leveraged to achieve local privilege escalationץ
Just found [zorrochain.foundation](https://zorrochain.foundation), and it’s building a governance infrastructure that’s fully airgap-compatible.
No token, no speculation — just a system using entropy harvesting, offline ID, QR/USB syncing, and vault-based consensus.
No idea if it’s being audited, but conceptually it’s interesting for people thinking about zero-trust systems in collapse conditions.
Microsoft's security team has announced a new process mitigation policy to protect against file system redirection attacks. "Redirection Guard, when enabled, helps Windows apps prevent malicious junction traversal redirections, which could potentially lead to privilege escalation by redirecting FS operations from less privileged locations to more privileged ones.
The GPS Leak No One Talked About: Uffizio’s Silent Exposure
Source: https://reporter.deepspecter.com/the-gps-leak-no-one-talked-about-uffizios-silent-exposure-03b5dfb23556
How I Discovered a Libpng Vulnerability 11 Years After It Was Patched
Source: https://blog.himanshuanand.com/posts/discovered-a-libpng-vulnerability-11-years-after-it-was-patched/
État de l’art sur le phishing Azure en 2025 (partie 2) – Étendre l’accès
Source: https://mobeta.fr/etat-de-lart-sur-le-phishing-azure-en-2025-partie-2-etendre-lacces/
I covered a fascinating post by Alexander Moch at ERNW about a boot-level Linux vulnerability that lets attackers inject code from the initramfs debug shell. Even with Secure Boot and encryption, a few key presses can drop you to a shell and allow persistent malware to be added.
Luckily, the fix is simple and involves kernel parameters. I break it down here:
https://nerds.xyz/2025/07/linux-initramfs-security-flaw-secure-boot-bypass/
Curious what others are doing to harden this layer.
How can a single .zip file show completely different content to different tools? Read my write up on HackArcana’s “Yet Another ZIP Trick” (75 pts) challenge about crafting a schizophrenic ZIP file.
Applocker bypass on Lenovo machines – The curious case of MFGSTAT.zip
Source: https://oddvar.moe/2025/07/03/applocker-bypass-on-lenovo-machines-the-curious-case-of-mfgstat-zip/
Finnish hacker Harri Hursti hacks U.S.voting machine on live podcast
Source: https://techstartups.com/2024/09/25/finnish-hacker-harri-hursti-hacks-u-s-voting-machine-on-live-podcast/
