Labs

Medium

CVE

Execution

EDR, Sysmon, Windows

PHP2Shell: Cross-Request Use-After-Free in PHP Core enables Pre-Auth RCE

PHP2Shell groups four related memory-safety bugs under two critical CVEs (CVE-2026-109618 and CVE-2026-109619, both CVSS v4.0 9.2) in the PHP […]

Learn more

Medium

Campaign

Persistence

EDR, Sysmon, Windows

RedFlick: Star Blizzard's New Single-Click Delivery Chain for the CosmicPulse Backdoor

The CosmicPulse delivery chain ends with an MSI installer that establishes persistence by creating three scheduled tasks disguised as legitimate […]

Learn more

Medium

Campaign, CyberCrime, LOLBin

Defense Evasion

EDR, Sysmon, Windows

Deno as a LOLRuntime: ClickFix Campaign Evades Controls and Steals Credentials

A widespread ClickFix campaign compromises WordPress sites to display fake Cloudflare prompts, tricking victims into running PowerShell that installs Deno […]

Learn more

Medium

Bypass

Privilege Escalation

EDR, Sysmon, Windows

ShieldCrash - ShieldBreak/CVE-2026-69414 bypass

ShieldCrash (CVE-2026-XXXXX) is a critical improper-permission-validation vulnerability that allows any authenticated low-privileged user to escalate to SYSTEM/root privileges on affected […]

Learn more

Medium

Bypass

Credential Access

Windows

The Diagnostic Loophole: Extract Secure Credentials from Windows Kernel Live Dumps

Elevated PowerShell diagnostic commands trigger kernel live dumps, writing LSASS process memory to disk. Attackers steal these cached credentials offline, […]

Learn more

Medium

Campaign, CyberCrime, Malware

Discovery, Execution

EDR, Sysmon, Windows

Deep Dive into Snow Flurry campaign: Edgecution Persistence and the "Headless Process Clean Up"

The Snow Flurry campaign leverages Edgecution persistence through scheduled tasks. It features an automated "Headless Process Clean Up" mechanism to […]

Learn more

Medium

CVE

Privilege Escalation

Windows

Certighost to Domain Takeover: AD CS chase referrals weaponized for Domain Controller impersonation.

Certighost (CVE-2026-54121) is a critical improper-authorization vulnerability in Microsoft Active Directory Certificate Services (AD CS) that allows any low-privileged authenticated […]

Learn more

Medium

Bypass

Execution, Privilege Escalation

EDR, Sysmon, Windows

LegacyHive: Windows ProfSvc enabling cross-user registry Hive Loading

LegacyHive is a Windows local privilege-escalation zero-day that abuses the User Profile Service’s registry hive-loading logic to redirect or expose […]

Learn more

Medium

Campaign, Malware

Defense Evasion

EDR, Sysmon, Windows

ClickFix to StealC: ResiLoader weaponizes pcdhost.sys BYOVD driver to achieve ring-0 code execution

ResiLoader drops the vulnerable pcdhost.sys driver in a BYOVD attack, using its kernel privileges to kill AV/EDR processes before hollowing […]

Learn more

Medium

Campaign

Defense Evasion

EDR, Sysmon, Windows

GentleKiller: Inside The Gentlemen RaaS EDR‑Killer Framework and Its BYOVD Driver Arsenal

The emerging Gentlemen RaaS equips its affiliates with the GentleKiller EDR‑killer framework and third‑party BYOVD tools to systematically disable more […]

Learn more