sbox

sbox - Compile-time AES string obfuscation for C++ Standard solutions rely on length + "" + string. That is trivial to reverse. sbox utilizes a constexpr AES-128 block cipher to mutate strings into high-entropy noise. The Story During the Neetcode "Encode and Decode Strings" challenge, I ported t...

peframe

======= peframe peframe is a open source tool to perform static analysis on Portable Executable malware and generic suspicious file. It can help malware researchers to detect packer, xor, digital signature, mutex, anti debug, anti virtual machine, suspicious sections and functions, macro and much...

static_asm

staticasm A header-only C++20 library for compile-time x86/x86-64 instruction encoding. This project is dual-licensed under the Boost Software License 1.0 and the MIT License. You may choose either license. Purpose Learning x86 assembly encoding in a practical and fun way Generating assembly...

Obfusk8

Obfusk8: C++17-Based Obfuscation Library Obfusk8 is a lightweight, header-only C++17 library designed to significantly enhance the obfuscation of your applications, making reverse engineering a substantially more challenging endeavor. It achieves this through a diverse set of compile-time and...

obfus.h

obfus.h obfus.h is a macro-only library for compile-time obfuscating C applications, designed specifically for the Tiny C tcc you can download it here - Tiny-C-Compiler/releases. It is tailored for Windows x86 and x64 platforms and supports almost all versions of the compiler. Very reliable armor...

CVE-2022-24713-POC

POC of CVE-2022-24713 on Ubuntu Install the current rust-regex package on Ubuntu. Then, clone this repo. Then, run cargo build. The regex dependency is set to the /usr/share/cargo/registry folder, so there will be no dependency issues. If the compilation takes an absurdly ridiculous long amount o...

WTSRM2

WTSRM2 This is a continuation to my original project WTSRM and the corresponding talk. This project was re-written in order to utilize C++17 in order to create a template that allows us to change the required functionality at compile time with ease! This is implemented as a header only file such...

nimvoke

nimvoke Indirect syscalls + DInvoke made simple. Designed to be imported directly into your own Nim projects, nimvoke uses macros to absract away the details of making indirect system calls and DInvoke-style delegate declarations. This library is meant to be easy to use and relatively op-sec...

CVE-2026-59989

Phalcon (PHP framework) versions 5.15.0 and earlier are vulnerable to a Server-Side Template Injection (SSTI) in the Volt compiler's join filter. The root cause is in resolveFilter within phalcon/Mvc/View/Engine/Volt/Compiler.zep, which inserts raw separator and array token values directly into g...

Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns

Malicious versions of the arrayref Rust crate and others executed a backdoor at compile time. The campaign's infrastructure overlaps with recent DPRK supply chain attacks, including Mastra and axios...

Script security bypass vulnerability in script-security

script-security 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations such as @CompileStatic and @TypeChecked that carry an extensions member, which causes Groovy to load and execute a script from the classpath at compile time, before the sandbox is applied. This ma...

CVE-2026-44294

A flaw was found in protobufjs. This vulnerability occurs because protobufjs, which compiles protobuf definitions into JavaScript JS functions, does not properly escape certain control characters in field names when generating JavaScript property accessors. A remote attacker could provide a...

EUVD-2026-31772

Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perlstudychunk in regcompstudy.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a lar...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Fortify: Fixed the compiletimestrlen function under UBSANBOUNDSLOCAL conditions. With CONFIGFORTIFY=y and CONFIGUBSANLOCALBOUNDS=y enabled, we observed a runtime panic when running Android’s Compatibility Test Suite CTS. This iss...

Compile-Time Security Analysis and Optimization of Sensitive String Producers

Content composition vulnerabilities remain among the most prevalent and persistent classes of security weakness in deployed software. Prior mitigations, including developer training, static analysis tools, and domain-specific template languages, each face diminishing returns; AI code generation...

Moving beyond Strings in Spring Data

If you've worked with data access in Java and especially with Spring Data for a while, then you are familiar with various Query and Update programming models. You write data access code. You refactor a property name. You run your tests. They fail. Your query strings? Still pointing to the old...

Chasing Elusive Memory Bugs in GPU Programs

Memory safety bugs, such as out-of-bound accesses OOB in GPU programs, can compromise the security and reliability of GPU-accelerated software. We report the existence of input-dependent OOBs in the wild that manifest only under specific inputs. All existing tools to detect OOBs in GPU programs...

libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time

libexpat through 2.5.0 allows recursive XML Entity Expansion if XMLDTD is undefined at compile time...

SUSE CVE-2022-50778

In the Linux kernel, the following vulnerability has been resolved: fortify: Fix compiletimestrlen under UBSANBOUNDSLOCAL With CONFIGFORTIFY=y and CONFIGUBSANLOCALBOUNDS=y enabled, we observe a runtime panic while running Android's Compatibility Test Suite's CTS android.hardware.input.cts.tests...

EUVD-2022-55783

In the Linux kernel, the following vulnerability has been resolved: fortify: Fix compiletimestrlen under UBSANBOUNDSLOCAL With CONFIGFORTIFY=y and CONFIGUBSANLOCALBOUNDS=y enabled, we observe a runtime panic while running Android's Compatibility Test Suite's CTS android.hardware.input.cts.tests...