@y637f9qq2x.com@rss-parrot.net
I'm an automated parrot! I relay a website's RSS feed to the Fediverse. Every time a new post appears in the feed, I toot about it. Follow me to get all new posts in your Mastodon timeline! Brought to you by the RSS Parrot.
---
Security research write-ups: reverse-engineering, vulnerability discovery, and the methodology behind them.
Site URL: y637f9qq2x.com/
Feed URL: y637f9qq2x.com/rss.xml
Posts: 11
Followers: 1
CVE-2026-5857: Remote Code Execution in Contiki-NG's MQTT Client
https://y637f9qq2x.com/posts/cve-2026-5857/
Published: August 13, 2026 00:00
A malicious broker splits one PUBLISH across two TCP segments, skips a bounds check that is present and correct, and overwrites a function pointer.
When Encryption Replaces Authentication: Privilege Escalation in a Windows NAS Service
https://y637f9qq2x.com/posts/asustor-lpe/
Published: August 12, 2026 01:00
A SYSTEM service relies on encryption for authentication and validates paths with a substring check. Two patterns, one standard-user-to-SYSTEM escalation.
Bypassing HammerAcl: The LABEL Flag in the Windows Task Scheduler
https://y637f9qq2x.com/posts/hammeracl-bypass/
Published: July 29, 2026 00:00
SchRpcSetSecurity refuses the DACL flag and accepts the integrity-label flag. On the label path, HammerAcl does not run and the caller's DACL is written.
Claude Cowork Boots Its Sandbox From a Folder You Can Rewrite
https://y637f9qq2x.com/posts/cowork-boot-trust/
Published: July 21, 2026 01:00
Cowork boots a Hyper-V VM from user-writable AppData with no hash or signature check. Replace the initrd; SYSTEM boots it. Anthropic: by design.
U-Boot TCP/NFS Vulnerabilities: Integer Underflow and Buffer Overflow in the World's Most Popular Bootloader
https://y637f9qq2x.com/posts/u-boot-tcp-nfs-vulns/
Published: July 12, 2026 12:00
Three CVEs in U-Boot's network stack: a TCP integer underflow that corrupts packet processing and an NFS path overflow that escapes a 2048-byte buffer.
Four Vulnerabilities in barebox: From DHCP Parsing to EFI PE Loading
https://y637f9qq2x.com/posts/barebox-sandbox-vulns/
Published: July 12, 2026 10:00
Four CVEs in barebox: an unbounded DHCP option scan, two ext4 parsing flaws, and a PE virtual-size integer overflow in the EFI loader.
RogueProvision: Windows Privilege Escalation in the Provisioning Engine — the SYSTEM Task That Applies Unsigned Packages
https://y637f9qq2x.com/posts/rogueprovision/
Published: June 22, 2026 01:00
A SYSTEM service applies unsigned .ppkg packages from a folder — no signature, no consent. Microsoft's docs promise otherwise. Honest catch: admin→SYSTEM.
Rebuilding a Security Researcher's Mind in an AI — to Invent Attacks, Not Just Find Them
https://y637f9qq2x.com/posts/researchers-mind-in-ai/
Published: June 16, 2026 01:00
Building an AI that reverse-engineers undocumented Windows internals to invent attack techniques — not just find known bugs. Methodology, failures, results.
Same Workflow, New Target: AI-Assisted Discovery of CVE-2026-29004 in BusyBox
https://y637f9qq2x.com/posts/cve-2026-29004/
Published: May 5, 2026 00:00
How the AI workflow that found a strongSwan zero-day discovered a 9-year-old heap overflow in BusyBox's DHCPv6 client, plus a full PoC walkthrough.
Inside NOFILTER-NFEXEC: A Deep Dive into WFP Implementation and BOF OPSEC Engineering
https://y637f9qq2x.com/posts/nofilter-nfexec/
Published: April 23, 2026 00:00
Implementing the DEF CON 31 NoFilter technique as an OPSEC-hardened Havoc C2 BOF — indirect syscalls, return address spoofing, and AMSI/ETW bypass.
Finding a 15-Year-Old Zero-Day in strongSwan with AI-Assisted Code Analysis
https://y637f9qq2x.com/posts/cve-2026-25075/
Published: April 18, 2026 00:00
How I discovered CVE-2026-25075, a bug hiding in strongSwan since 2011, using a structured multi-pass AI analysis workflow.