Vulnerability Research
-
FreeBSoD: Leveraging Language Models to Find and Exploit Kernel Bugs (Part 2 of 2)
Part two of the FreeBSoD series walks through two LLM-assisted exploit chains that escape a FreeBSD jail — a stack overflow paired with a stack infoleak to beat canaries and KASLR, and a heap overflow paired with pipe-file type confusion to defeat SMEP/SMAP — plus the staged L0-L4 pipeline that made the model effective.
read more → -
FreeBSoD: Leveraging Language Models to Find and Exploit Kernel Bugs (Part 1 of 2)
Part one of a two-part series on AI-assisted kernel vulnerability research. Covers the methodology used to find roughly eight FreeBSD kernel vulnerabilities with Claude Code, including deep research for bug patterns, CodeQL and semgrep variant hunting, a KASAN feedback loop, and the stack overflow that became CVE-2026-3038.
read more → -
Analyzing a Modern Linux Kernel Vulnerability (CVE-2023-0266)
Deep dive into CVE-2023-0266, a race condition vulnerability in the Linux kernel sound subsystem that was exploited in-the-wild against Android devices. Exploring the technical details of how 32-bit/64-bit compatibility layers introduced a use-after-free condition.
read more → -
Local Privilege Escalation Vulnerability in Ant Media Server (CVE-2024-32656)
Disclosure of a local privilege escalation vulnerability in Ant Media Server arising from an unauthenticated JMX remote management interface accessible to unprivileged local users, enabling code execution as root.
read more → -
DoubleQlik: Bypassing the Fix for CVE-2023-41265 to Achieve Unauthenticated Remote Code Execution
Patch diffing Qlik's fix for CVE-2023-41265 revealed an exact string comparison against "chunked" in the proxy's new header validation. Sending "tchunked" instead reintroduces the CL.TE request tunneling issue, and a HEAD request to a font path reaches it unauthenticated. Tracked as CVE-2023-48365.
read more → -
ZeroQlik: Achieving Unauthenticated Remote Code Execution via HTTP Request Tunneling and Path Traversal
Full technical writeup of CVE-2023-41265 and CVE-2023-41266 in Qlik Sense Enterprise for Windows. Chaining an HTTP request tunneling flaw in the C# proxy service with a path traversal authentication bypass to impersonate the sa_repository service account and achieve unauthenticated remote code execution via external program tasks.
read more → -
Palo Alto Networks GlobalProtect Remote Code Execution Vulnerability (CVE-2022-0016)
Disclosure of CVE-2022-0016 in the Palo Alto Networks GlobalProtect VPN client. The Connect Before Logon feature spawned an embedded browser on the Windows login screen, and escaping it yielded code execution as SYSTEM before any user authenticated.
read more →