Posts

Overview Attribute Value CVE (ESP variant) CVE-2026-43284 CVE (RxRPC variant) CVE-2026-43500 (reserved, no patch yet) Name Dirty Frag Type Local Privilege Escalation (LPE) Affected Ubuntu 24.04, RHEL 10.1, CentOS Stream 10, AlmaLinux 10, Fedora 44, openSUSE Tumbleweed — effectively all major distros Effective Lifetime ~9 years (xfrm-ESP since 2017, RxRPC since 2023) Race Condition None — deterministic Researcher Hyunwoo Kim (@v4bel) PoC ✅ Public (github.com/V4bel/dirtyfrag) ESP Patch ✅ Merged to mainline (f4c50a4034e6) RxRPC Patch ❌ No patch in any tree yet What Is Dirty Frag? Dirty Frag is a vulnerability class — not a single bug — that extends the same lineage as Dirty Pipe (CVE-2022-0847) and Copy Fail (CVE-2026-31431). Where Dirty Pipe overwrites struct pipe_buffer and Copy Fail overwrites the AF_ALG scatterlist, Dirty Frag overwrites the frag member of struct sk_buff. ...

This week’s threat landscape is defined by four words: patch everything, immediately. A cPanel authentication bypass has been exploited in the wild since February. A nine-year-old Linux kernel flaw gives reliable root without winning a race condition. GitHub Enterprise had a command injection bug triggered by a single git push. And the Windows Shell spoofing patch from February? Incomplete — attackers are still stealing NTLM hashes through LNK files. Meanwhile in the lab, Momentum Fusion v3 shipped with swing mode, Max found .env files with group-readable permissions, and the homelab security posture needs tightening. ...

Overview Attribute Value CVE ID CVE-2026-31431 Name Copy Fail CVSS Score ~8.4 (High) Type Local Privilege Escalation (LPE) Affected All major Linux distributions since 2017 Tested Ubuntu 24.04, Amazon Linux 2023, RHEL 14.3, SUSE 16 Kernels 6.12, 6.17, 6.18 (and all back to 2017) Exploit Size 732 bytes (Python script) Dependencies Python 3.10+ (for os.splice), standard library only Race Condition None — deterministic, straight-line exploit Stealth Page cache corrupted; on-disk file and checksums unchanged What Makes Copy Fail Different Linux kernel privilege escalation bugs are not new. But Copy Fail stands apart from its predecessors in four critical ways: ...

The threat landscape this week shifted from last week’s Windows Defender zero-days to infrastructure-level attacks: a state-sponsored backdoor surviving firewall patches, an emergency Microsoft patch for ASP.NET Core, and an iOS flaw that let law enforcement recover “deleted” Signal messages. Meanwhile in the lab, Momentum Fusion went live, Nextcloud got hardened, and the Obsidian knowledge base doubled in size. Cisco FIRESTARTER: A Backdoor That Survives Reboots (and Patches) Cisco Talos published a detailed technical analysis of UAT-4356, the same state-sponsored actor behind 2024’s ArcaneDoor campaign, now targeting Cisco Firepower devices with a custom backdoor dubbed FIRESTARTER. ...

Windows Defender Is the Target Now This week’s headline isn’t about some exotic exploit kit. It’s about the security tool itself getting owned. Three zero-days targeting Microsoft Defender — BlueHammer, RedSun, and UnDefend — have shifted from proof-of-concept to active in-the-wild exploitation. All three come from the same researcher (Nightmare-Eclipse / Chaotic Eclipse), who released exploit code publicly in protest over Microsoft’s handling of the disclosure process. Huntress Labs has confirmed hands-on-keyboard attackers combining these with compromised SSL VPN credentials for real intrusions. ...

Overview Same researcher, same target, new weapon. Nightmare-Eclipse — the security researcher behind the BlueHammer Windows Defender LPE zero-day — has released UnDefend, a tool that can completely disable Windows Defender from a standard user account with no administrative privileges. Where BlueHammer escalates privileges through Defender, UnDefend simply kills Defender’s ability to protect you — and does it without needing admin rights at all. Attribute Value Tool UnDefend Author Nightmare-Eclipse (Chaotic Eclipse) Repository github.com/Nightmare-Eclipse/UnDefend Language C++ License MIT Stars 32 (as of Apr 13, 2026) Requires Admin ❌ No CVE Pending / Not assigned Patch ❌ None Related BlueHammer (LPE zero-day, same researcher) How It Works UnDefend operates in two modes: ...

Overview Attribute Value CVE ID CVE-2026-33825 CVSS Score 7.8 Vendor Microsoft Product Windows Defender Antivirus (Windows 10/11, Server 2016+) Vulnerability Type TOCTOU + Path Confusion → Local Privilege Escalation Status ✅ Patched (April 14, 2026 Patch Tuesday) CWE CWE-367 (Time-of-check Time-of-use Race Condition) KEV Added Not yet Exploitation Status ⚠️ PoC public, no confirmed in-the-wild attacks yet Patch Status ❌ Unpatched (as of April 12, 2026) Affected Versions Version Status Windows 10 (1709+) ❌ Vulnerable Windows 11 ❌ Vulnerable Windows Server 2016+ ⚠️ Partial (elevated admin, not full SYSTEM) Windows 10 (pre-1709) ✅ Not affected (no Cloud Files API) Description BlueHammer is a local privilege escalation vulnerability in Microsoft Defender Antivirus that chains a TOCTOU race condition with path confusion in Defender’s signature update workflow. A standard user can exploit Defender’s own privileged update mechanism to leak the SAM hive, decrypt credentials, and achieve SYSTEM privileges. ...

It’s been nine days since Chaotic Eclipse published the BlueHammer exploit on GitHub. Here’s what’s changed — and what hasn’t. Current Status: Still Zero-Day Attribute Status CVE Assigned ❌ No Microsoft Patch ❌ None Official Mitigation ❌ None PoC Available ✅ Original + Reimplementation Actively Exploited ⚠️ No confirmed in-the-wild attacks (yet) Detection Coverage 8/72 vendors on VirusTotal Microsoft’s last public statement (April 7) reaffirmed commitment to coordinated disclosure without addressing the MSRC communication breakdown or providing a timeline. ...

What happens when your AI agents review their own work every week? They find things you’d never catch manually — duplicated code, exposed credentials, and missed optimization opportunities. The Weekly Trio Every Sunday at 03:00, three specialized agents wake up and run an autonomous improvement cycle: Cody (Code Architect) — Scans for technical debt, duplicated logic, and missing tests Max (Red Team Lead) — Audits for credential exposure, permission violations, and security drift Molty (Research Lead) — Identifies workflow gaps and builds missing tooling This isn’t a demo. This is production. Here’s what happened this week. ...

Since my initial coverage of BlueHammer, the security community has produced excellent technical analysis. This post consolidates the deep-dive details you need to understand how this exploit actually works — and why it’s more sophisticated than most LPEs. The Big Picture BlueHammer isn’t your typical privilege escalation. It doesn’t exploit a single bug — it chains seven distinct stages, weaponizing Windows Defender’s own trusted update mechanism against the system. Key insight: The exploit abuses Defender’s signature update workflow to leak the SAM hive, decrypt credentials, and achieve SYSTEM — all from a standard user context. ...