memguard

MemGuard Software enclave for storage of sensitive information in memory. This package attempts to reduce the likelihood of sensitive data being exposed when in memory. It aims to support all major operating systems and is written in pure Go. Features Sensitive data is encrypted and authenticated...

rosemary

Rosemary Cross-platform kernel-level pivoting platform over QUIC. No TUN/TAP. No proxychains. No proxy settings. Rosemary transparently intercepts traffic on remote hosts at the kernel level: no proxy settings, no TUN/TAP devices, no proxychains. Agents connect back to the server over QUIC. You...

psc

psc psc ps container is a fast process scanner that uses eBPF iterators and Google CEL to query system state with precision and full container context. Why psc? Fast Kernel-Level Access with eBPF Iterators psc uses eBPF iterators to read process and file descriptor information directly from kerne...

KernelFlirt

KernelFlirt Windows kernel-level debugger with an OllyDbg/IDA Pro-style interface. Designed for security research, reverse engineering, and malware analysis in VM environments VMware. Architecture Host machine VM Windows 10, testsigning ┌──────────────────┐ TCP:31337 ┌──────────────────┐ IOCTL...

mcpguard-dynamic

MCPGuard-Dynamic Kernel-level sandboxing for LLM agent tool calls made through the Model Context Protocol MCP. MCPGuard sits as a transparent proxy between an MCP client the agent / runner and an MCP server subprocess, applying three layered defenses to every tool invocation. The lowest layer is...

fim-ebpf

FIM-eBPF: File Integrity Monitoring with eBPF A lightweight eBPF program to monitor file creation and modification events on Linux. This tool leverages eBPF Extended Berkeley Packet Filter to trace file operations directly from the kernel, providing high-performance monitoring with minimal...

CVE-2026-79830

A vulnerability in HPE NonStop Kernel Level Thread Model Lib can cause stack buffer overflow which can allow arbitrary code execution...

CVE-2026-79830 HPE NonStop Kernel Level Thread Model Lib - Stack buffer overflow vulnerability

A vulnerability in HPE NonStop Kernel Level Thread Model Lib can cause stack buffer overflow which can allow arbitrary code execution...

CVE-2026-79830

A stack buffer overflow vulnerability exists in the HPE NonStop Kernel Level Thread Model Lib (component T1132 ), which could allow an attacker to achieve arbitrary code execution . The vulnerability poses a risk of memory corruption , denial of service (DoS) , and stack overflow . HPE has releas...

EUVD-2026-102001

A vulnerability in HPE NonStop Kernel Level Thread Model Lib can cause stack buffer overflow which can allow arbitrary code execution...

CVE-2026-19569

An integer overflow vulnerability exists in the Zephyr RTOS kernel's dynamic_object_create() function within kernel/userspace/userspace.c. The system fails to check for unsigned wrap-around when computing backing allocations for dynamically allocated kernel objects and thread stack elements. An u...

CVE-2026-19569: Integer Overflow or Wraparound

dynamicobjectcreate in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kernel object as objsizegetotype + size, and for thread stack elements as STACKELEMENTDATASIZEsize a round-up plus fixed overhead, without checking either expression for unsigned...

Step-by-Step Malware Development: Evading EDR from Loaders to the Kernel

These are the workshop materials for "Step-by-Step Malware Development: Evading EDR from Loaders to the Kernel", presented at DEF CON 34 and BSidesLV 2026. This workshop explores custom malware development, EDR Architecture and Evasion, C2 customization, and kernel-level techniques using Elastic...

Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot

Check Point Research has disclosed a technique that uses Microsoft Defender's own legitimately signed boot-time remediation driver to perform arbitrary kernel-level file and registry operations on Windows systems ranging from Windows 7 through Windows 11 25H2, with no software flaw exploited and ...

CVE-2026-9492: Exposed IOCTL with Insufficient Access Control

The MBStorage DRAM lighting control module within Gigabyte Control Center GCC developed by GIGABYTE Technology has an Improper Access Control vulnerability. Authenticated local attackers can send specific IOCTL commands through the driver MyPortIOx64.sys bundled with the module, thereby arbitrari...

Rosemary 1.2.0

Rosemary is a cross-platform transparent tunneling platform designed for network pivoting. Unlike traditional tools that rely on TUN/TAP interfaces or require per-application proxy configuration like proxychains, Rosemary intercepts traffic at the kernel level...

protection

🛡️ protection Kernel-level abuse protection for container...

CVE-2025-47407

Memory corruption while creating a process on the digital signal processor due to allocation failure at the kernel level...

CVE-2025-47407

Memory corruption while creating a process on the digital signal processor due to allocation failure at the kernel level...

Rosemary 1.0.3

Rosemary is a cross-platform transparent tunneling platform designed for network pivoting. Unlike traditional tools that rely on TUN/TAP interfaces or require per-application proxy configuration like proxychains, Rosemary intercepts traffic at the kernel level...