Alexandre Cheron

Catching Credential Guard Off Guard - SpecterOps Uncovering the protection mechanisms provided by modern Windows security features and identifying new methods for credential dumping.

Catching Credential Guard Off Guard specterops.io/blog/2025/10...

r-tec Blog | Bypass AMSI in 2025 This blog post will shed some light on what's behind AMSI (roughly, but hopefully easy to understand) and how you can still effectively bypass it - more than four years later.

Bypass AMSI in 2025 #AMSI www.r-tec.net/r-tec-blog-b...

13-Year-Old Redis Flaw Exposed: CVSS 10.0 Vulnerability Lets Attackers Run Code Remotely Redis fixes 13-year CVSS 10 flaw allowing Lua script-based remote code execution in all versions.

13-Year-Old Redis Flaw Exposed: CVSS 10.0 Vulnerability Lets Attackers Run Code Remotely #Redis #RCE thehackernews.com/2025/10/13-y...

One Token to rule them all - obtaining Global Admin in every Entra ID tenant via Actor tokens #Microsoft #EntraID dirkjanm.io/obtaining-gl...

ksmbd - Fuzzing Improvements and Vulnerability Discovery (2/3) #Fuzzing blog.doyensec.com/2025/09/02/k...

Kernel-hack-drill and a new approach to exploiting CVE-2024-50264 in the Linux kernel Some memory corruption bugs are much harder to exploit than others. They can involve race conditions, crash the system, and impose limitations that make a researcher's life difficult. Working with suc...

Kernel-hack-drill and a new approach to exploiting CVE-2024-50264 in the Linux kernel #Linux #Kernel a13xp0p0v.github.io/2025/09/02/k...

WinRAR zero-day exploited to plant malware on archive extraction A recently fixed WinRAR vulnerability tracked as CVE-2025-8088 was exploited as a zero-day in phishing attacks to install the RomCom malware.

WinRAR zero-day exploited to plant malware on archive extraction. #WinRAR #0day www.bleepingcomputer.com/news/securit...

Project Zero: From Chrome renderer code exec to kernel with MSG_OOB
googleprojectzero.blogspot.com/2025/08/from...

ReVault flaws let hackers bypass Windows login on Dell laptops ControlVault3 firmware vulnerabilities impacting over 100 Dell laptop models can allow attackers to bypass Windows login and install malware that persists across system reinstalls.

ReVault flaws let hackers bypass Windows login on Dell laptops www.bleepingcomputer.com/news/securit...

SonicWall urges admins to disable SSLVPN amid rising attacks SonicWall has warned customers to disable SSLVPN services due to ransomware gangs potentially exploiting an unknown security vulnerability in SonicWall Gen 7 firewalls to breach networks over the past...

SonicWall urges admins to disable SSLVPN amid rising attacks #SonicWall www.bleepingcomputer.com/news/securit...

Hackers Exploit SharePoint Zero-Day Since July 7 to Steal Keys, Maintain Persistent Access Active SharePoint exploits since July 7 target governments and tech firms globally, risking key theft and persistent access.

Hackers Exploit SharePoint Zero-Day Since July 7 to Steal Keys, Maintain Persistent Access #0day thehackernews.com/2025/07/hack...

CVE-2025-1729 - Privilege Escalation Using TPQMAssistant.exe

CVE-2025-1729 - Privilege Escalation Using TPQMAssistant.exe

trustedsec.com/blog/cve-202...

Applocker bypass on Lenovo machines – The curious case of MFGSTAT.zip This blogpost is about a minor discovery I made regarding a writeable file inside the Windows folder that is present on Lenovo machines. Initially when I found it I thought it was only a handful of…

Applocker bypass on Lenovo machines – The curious case of MFGSTAT.zip oddvar.moe/2025/07/03/a...

Chinese Hackers Exploit Ivanti CSA Zero-Days in Attacks on French Government, Telecoms Chinese hackers exploited Ivanti CSA zero-days, targeting French government, media, and telecom sectors in September 2024.

Chinese Hackers Exploit Ivanti CSA Zero-Days in Attacks on French Government, Telecoms thehackernews.com/2025/07/chin... #Ivanti #0day

Over 1,200 Citrix servers unpatched against critical auth bypass flaw Over 1,200 Citrix NetScaler ADC and NetScaler Gateway appliances exposed online are unpatched against a critical vulnerability believed to be actively exploited, allowing threat actors to bypass authe...

Over 1,200 Citrix servers unpatched against critical auth bypass flaw #Citrix www.bleepingcomputer.com/news/securit...

Instagram ads mimicking BMO, EQ Bank are finance scams Instagram ads impersonating financial institutions like Bank of Montreal (BMO) and EQ Bank (Equitable Bank) are being used to target Canadian consumers with phishing scams and investment fraud. Some ...

Instagram ads mimicking BMO, EQ Bank are finance scams
www.bleepingcomputer.com/news/securit...

CISA Warns of Active Exploitation of Linux Kernel Privilege Escalation Vulnerability CISA warns CVE-2023-0386 is being actively exploited, impacting Linux systems via OverlayFS. Patching is urgent.

CISA Warns of Active Exploitation of Linux Kernel Privilege Escalation Vulnerability thehackernews.com/2025/06/cisa... #Linux

Apple Zero-Click Flaw in Messages Exploited to Spy on Journalists Using Paragon Spyware Apple patched zero-day flaws exploited to deploy Paragon’s Graphite spyware targeting journalists and civil society, raising global spyware concerns.

Apple Zero-Click Flaw in Messages Exploited to Spy on Journalists Using Paragon Spyware thehackernews.com/2025/06/appl... #Apple

Streaming Zero-Fi Shells to Your Smart Speaker In October 2024, RET2 participated in the “Small Office / Home Office” (SOHO) flavor of Pwn2Own, a competition which challenges top security researchers to c...

Streaming Zero-Fi Shells to Your Smart Speaker |
Exploiting the Sonos Era 300 with a Malicious HLS Playlist blog.ret2.io/2025/06/11/p...

Found in the wild: 2 Secure Boot exploits. Microsoft is patching only 1 of them. The publicly available exploits provide a near-universal way to bypass key protections.

Found in the wild: 2 Secure Boot exploits. Microsoft is patching only 1 of them arstechnica.com/security/202...

Microsoft OneDrive File Picker Flaw Grants Apps Full Cloud Access — Even When Uploading Just One File OneDrive’s OAuth flaw grants full cloud access via vague prompts + insecure tokens = user data risk.

Microsoft OneDrive File Picker Flaw Grants Apps Full Cloud Access — Even When Uploading Just One File thehackernews.com/2025/05/micr...

Breaking the Sound Barrier Part I: Fuzzing CoreAudio with Mach Messages Guest post by Dillon Franke, Senior Security Engineer ,  20% time on Project Zero Every second, highly-privileged MacOS system daemons...

Breaking the Sound Barrier Part I: Fuzzing CoreAudio with Mach Messages googleprojectzero.blogspot.com/2025/05/brea...

Supercharging Ghidra: Using Local LLMs with GhidraMCP via Ollama and OpenWeb-UI Reverse engineering binaries often resembles digital archaeology: excavating layers of compiled code, interpreting obscured logic, and…

Supercharging Ghidra: Using Local LLMs with GhidraMCP via Ollama and OpenWeb-UI
medium.com/@clearblueja...

Apple 'AirBorne' flaws can lead to zero-click AirPlay RCE attacks ​A set of security vulnerabilities in Apple's AirPlay Protocol and AirPlay Software Development Kit (SDK) exposed unpatched third-party and Apple devices to various attacks, including remote code exec...

Apple 'AirBorne' flaws can lead to zero-click AirPlay RCE attacks www.bleepingcomputer.com/news/securit...

iOS and Android juice jacking defenses have been trivial to bypass for years New ChoiceJacking attack allows malicious chargers to steal data from phones.

iOS and Android juice jacking defenses have been trivial to bypass for years arstechnica.com/security/202...

Ghosting AMSI: Cutting RPC to disarm AV In this post, we explore how to bypass AMSI’s scanning logic by hijacking the RPC layer it depends on — specifically the NdrClientCall3…

Ghosting AMSI: Cutting RPC to disarm AV medium.com/@andreabocch...

Linux io_uring PoC Rootkit Bypasses System Call-Based Threat Detection Tools ARMO shows io_uring-based rootkits evade Falco, Tetragon, and Defender, risking Linux runtime security.

Linux io_uring PoC Rootkit Bypasses System Call-Based Threat Detection Tools thehackernews.com/2025/04/linu...

CVE-2025-24054 Under Active Attack—Steals NTLM Credentials on File Download Windows flaw CVE-2025-24054 actively exploited since March 19 to leak NTLM hashes via phishing attacks.

CVE-2025-24054 Under Active Attack—Steals NTLM Credentials on File Download
thehackernews.com/2025/04/cve-...

Task Scheduler– New Vulnerabilities for schtasks.exe UAC bypass, metadata poisoning, and log overflow vulnerabilities in Windows Task Scheduler reveal new tactics for defense evasion and privilege escalation

Task Scheduler– New Vulnerabilities for schtasks.exe cymulate.com/blog/task-sc...

Critical Apache Roller Vulnerability (CVSS 10.0) Enables Unauthorized Session Persistence Apache Roller flaw CVE-2025-24859 keeps sessions active after password changes, risking persistent access.

Critical Apache Roller Vulnerability (CVSS 10.0) Enables Unauthorized Session Persistence thehackernews.com/2025/04/crit...