Mastodawn

Another vulnerability in iOS 26.5 with a clear and reproducible crash, registers control, primitive and PoC confirmed, and possibly a working exploit... who knows... ;)

Alexandre Borges Jun 16

Zombie COTables: Resurrecting Freed Memory to Escape VirtualBox:

https://blog.exodusintel.com/2026/06/15/zombie-cotables-resurrecting-freed-memory-to-escape-virtualbox/

#vulnerability #exploitation #exploit #virtualbox #cybersecurity #infosec #informationsecurity

Zombie COTables: Resurrecting Freed Memory to Escape VirtualBox - Exodus Intelligence

By Luca Ginex Overview This blog post discusses a use-after-free vulnerability that we found in VirtualBox in 2025. This vulnerability was patched on Oracle Critical Patch Update – January 2026. The vulnerability was also presented, along with others, at OffensiveCon 2026. This post describes the exploitation process for the vulnerability on a Linux system. First, a ... Read more Zombie COTables: Resurrecting Freed Memory to Escape VirtualBox

Exodus Intelligence

Alexandre Borges Jun 2

Malwoverview 8.0.2 has been released:

https://github.com/alexandreborges/malwoverview

To install it:

python -m pip install -U malwoverview[all]

#malware #threathunting #informationsecurity #infosec #vulnerability #cve #dfir

Alexandre Borges May 31

Bypassing SSL Pinning on Play Store AVDs without Frida

https://www.mfumis.com/posts/bypassing-ssl-pinning-on-play-store-avds-without-frida/

#cybersecurity #informationsecurity #frida #mobiledevice #infosec #mobilesecurity #mobile

Bypassing SSL Pinning on Play Store AVDs without Frida

📲 🔓 Bypassing SSL Pinning on Play Store Android Device Emulators without Frida

Mateo Fumis (hackermater)

Alexandre Borges May 31

Authenticated RCE via Argument Injection in Gogs (NOT FIXED):

https://www.rapid7.com/blog/post/ve-authenticated-rce-via-argument-injection-gogs-unfixed/

#cybersecurity #vulnerability #rce #informationsecurity #exploitation

Authenticated RCE via Argument Injection in Gogs (NOT FIXED)

Rapid7 researchers found that Gogs allows authenticated users to achieve RCE on the server by creating a pull request with a specially crafted branch name. More in our latest analysis blog.

Rapid7

Alexandre Borges May 31

Red Team Tactics: Utilizing Syscalls in C# - Prerequisite Knowledge:

https://jhalon.github.io/utilizing-syscalls-in-csharp-1/

Red Team Tactics: Utilizing Syscalls in C# - Writing The Code:

https://jhalon.github.io/utilizing-syscalls-in-csharp-2/

#cybersecurity #programming #csharp #informationsecurity #redteam

Red Team Tactics: Utilizing Syscalls in C# - Prerequisite Knowledge

Over the past year, the security community - specifically Red Team Operators and Blue Team Defenders - have seen a massive rise in both public and private utilization of System Calls in windows malware for post-exploitation activities, as well as for the bypassing of EDR or Endpoint Detection and Response.

Jack Hacks

Alexandre Borges May 30

Striga: Lifting x86 to LLVM IR with Python:

https://secret.club/2026/05/21/striga.html

#python #reversing #llvm #informationsecurity #infosec #cybersecurity