mad31k (@mad31k) profile picture

mad31k

@mad31k
Joined June 2020
  • Tweets13
  • Following166
  • Followers116
2Media
Photo by mad31k (@mad31k)Photo by mad31k (@mad31k)
CVE-2026-85844 is patched: a Windows Kerberos authentication bypass (CVSS 9.8). Thanks @msftsecresponse for the fix! Write-up in 2027, unless someone beats me to it and I can stay lazy. msrc.microsoft.com/update-gu…
5
24
1
137
21,837
The critical Xen Orchestra vulnerability we discovered is now public and being actively exploited. If you have Xen Orchestra exposed to the internet (you really shouldn’t), patch now. docs.vates.tech/security-adv…

VSA-2026-062: Empty-object login token | Vates VMS Documentation

2026-11-10 / Critical severity / Xen Orchestra and Xen Orchestra Appliance affected.

docs.vates.tech
1
2
844
Publicly disclosing the bluehammer exploit, at the time of writing this, this vulnerability is still unpatched. Full PoC source can be found here - deadeclipse666.blogspot.com/…
22
153
31
906
278,943
It appears the latest Windows update is preventing folder deletion via the ::$INDEX_ALLOCATION trick with the DeleteFile APIs. This update makes chaining arbitrary file delete to LPE far more difficult - deleting C:\Config.Msi::$INDEX_ALLOCATION is no longer possible.
Image from mad31k (@mad31k)
2
270
Load more