pe-sieve

Intro PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches...

NovaHypervisor

NovaHypervisor 描述 NovaHypervisor 是一个基于 x64 Intel 主机的防御性虚拟机监控器。该项目的目标是通过保护防御产品（防病毒/端点防护）和内核内存结构，并防止未经授权的内核内存访问，来抵御基于内核的攻击（无论是通过“自带易受攻击驱动”（BYOVD）还是其他方式）。 NovaHypervisor 使用 C++ 和汇编编写，设计兼容 Windows 10 及更高版本。有关如何使用它的更多信息，请参阅设置部分。 !重要 该虚拟机监控器已在 Windows 11 25H2 和多个 Windows 10 版本上测试过。 如果遇到问题，请在检查是否已有未解决的...

memguard

MemGuard Software enclave for storage of sensitive information in memory. This package attempts to reduce the likelihood of sensitive data being exposed when in memory. It aims to support all major operating systems and is written in pure Go. Features Sensitive data is encrypted and authenticated...

Agent-Tesla-APC-Injection-Token-Manipulation-Registry-Persistence-Analysis

1. API nativa e inyección APC El volcado de memoria de x64dbg revela que Agent Tesla usa llamadas a la API nativa NT API para operaciones de bajo nivel, incluida la inyección APC llamada a procedimiento asíncrono. Funciones clave observadas: NtQueueApcThread – Inyecta código en un hilo de destino...

ifuncd-up

En respuesta a Hacker News Veo que vosotros, bromistas de el sitio naranjahn, me estáis poniendo las cosas difíciles. Haré algunas respuestas escogidas a continuación, pero primero ofrezco un desafío: enviaré $500 de mi propio dinero a la primera persona que pueda demostrar este ataque sin ifunc...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: media: dvbdev: The risk of out-of-memory access has been prevented. The dvbdev module contains a static variable used to store dvb minors. Its behavior depends on whether CONFIGDVBDYNAMICMINORS is set or not. When it is not set,...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: KVM: x86: Added SRCU protection for reading PDPTRs in getsregs2. Added read-side protection when reading PDPTR registers in getsregs2. Reading PDPTRs may trigger access to guest memory: kvmpdptrread - svmcachereg - loadpdptrs ...

cve-writeups-and-pocs

CVE-2026-80724 PoC y Write-up CVE-2026-80724 — Kernel de Linux ptp: vmclock: evitar que los mapeos de solo lectura se vuelvan escribibles Prueba de concepto completa + Write-up técnico Investigación de seguridad por Abdifatah Suruur suruur — colección de write-ups de CVE y PoCs para...

ShellcodeFluctuation

Shellcode Fluctuation PoC Una implementación de prueba de concepto para otra técnica de evasión en memoria que cifra y descifra cíclicamente el contenido del shellcode para luego hacerlo fluctuar entre la protección de memoria RW o NoAccess y RX. Cuando nuestro shellcode reside en páginas de...

HeapCrypt

HeapCrypt Cifrando el Heap mientras se duerme, enganchando y modificando Sleep con nuestra propia función que cifra el heap, se duerme un momento y luego descifra el heap: Cifrado xor del heap con clave de 16 bits : Descifrado xor del heap con clave de 16 bits : Referencias :...

USN-8726-1 linux, linux-aws, linux-aws-7.0, linux-gcp, linux-gke, linux-hwe-7.0, linux-realtime vulnerabilities

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been...

Astra Linux – Vulnerability in amd64-microcode

IOMMU improperly handles certain special address ranges with invalid device table entries DTEs. This may allow an attacker with privileges and a compromised Hypervisor to induce DTE faults to bypass RMP checks in SEV-SNP, potentially resulting in a loss of guest integrity...

CVE-2026-72279

A flaw was found in the KVM Kernel-based Virtual Machine component of the Linux kernel. KVM on arm64 architectures incorrectly maps the L1 Virtual Nested Control Register VNCR into the host stage-1, failing to respect read-only memory regions. This could allow a malicious guest to write to a...

CVE-2026-72155 mtd: spi-nor: swp: Improve locking user experience

In the Linux kernel, the following vulnerability has been resolved: mtd: spi-nor: swp: Improve locking user experience In the case of the first block being locked or the few first blocks, if the user want to fully unlock the device it has two possibilities: - either it asks to unlock the entire...

CVE-2025-31936

Improper handling of overlap between protected memory ranges for some IntelR XeonR 6 processors when using IntelR TDX within SMM may allow an escalation of privilege. SMM adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may...

EUVD-2026-55356

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: bound EDID block reads to the response buffer virtiogetedidblock validates the read offset only against the device-supplied resp-size field, never against the fixed-size resp-edid array. The EDID block index is driven...

SUSE-SU-2026:3166-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 bsc1243603. - CVE-2025-71302: drm/panthor: fix for dma-fence safe access...

CVE-2026-63830

A flaw was found in the Linux kernel's skmsg networking component. This vulnerability arises when the sg.copy bitmap, which controls memory access permissions, is not properly maintained during data transformations. This can allow a local attacker to bypass memory protection mechanisms, enabling...

SUSE-SU-2026:22755-1 Security update for the Linux Kernel (Live Patch 0 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.5.1 fixes various security issues The following security issues were fixed: - CVE-2025-71089: iommu: disable SVA when CONFIGX86 is set bsc1256615. - CVE-2026-23393: bridge: cfm: Fix race condition in peermep deletion bsc1260524. -...

CVE-2026-10669

Summary (CVE-2026-10669) : On Xtensa SoCs with CONFIG_XTENSA_MPU and CONFIG_USERSPACE, arch_buffer_validate() erroneously permits access when the buffer size rounds to a wrap of the 32-bit address space, bypassing MPU checks. This can let an unprivileged user-thread validate or copy memory it sho...