Introducing PwnEscape 🦉: a full KVM guest-to-host escape via a Linux kernel networking flaw affecting industry standard hypervisors. CVE-2026-99999 went from untrusted VM code to host-kernel memory reads, controlled writes, and root command execution. More below:

pew pew.

How I Could've Accessed 17 Trillion Microsoft Records blog.faav.net/how-i-couldve-… :)

Introducing SpecterOps Skills: a public repository built to turn practitioner knowledge into reusable, reviewable workflows for AI-assisted security work. @zinic shares what we're building, why we're building it, and how you can contribute ➡️ ghst.ly/4ybT6ew

DEF CON 34 might be over, but the memories are not 🎉 Our recap video just dropped on the RTV YouTube channel, packed with highlights from the CTF, the talks, the workshops, and the community that made it all happen this year. If you were there, relive it. If you weren't, come see what all the hype was about. Go give it a watch 🔥 piped.video/g2kKCCzynxQ

🔥 This one is special! Honored to have shared it on the main stages at #BHUSA & #DEFCON. Now the full write-up, every detail, is finally public. 🥳 🤔 A signed Microsoft driver, used exactly as designed, turned into a Ring 0 primitive ➡️ no exploit, no CVE, no BYOVD... ☝️ Just reversing an undocumented protocol until a trusted #Defender driver hands you arbitrary file + registry ops from Ring 0 ➡️ 18 versions, one RC4 key, 15+ years unchanged. ⚒️ Then I wrote #BTR_CLI to prove it: github.com/Dump-GUY/BTR_CLI #BTR #Reversing #OffensiveSecurity #KernelSecurity

I found a previously undocumented passive Windows backdoor I’m calling SLEEPWALKER. Its defining feature is a custom command language with 23 instructions. Instead of receiving conventional commands, it runs encrypted bytecode programs that can combine scheduling, nested programs, staged payload delivery with SHA-256 verification, decompression, network communication and in-memory shellcode execution. The analyzed file is an unsigned DLL that masquerades as Microsoft's dpapi.dll, uses forged ESET metadata and activates only when side-loaded by ESET's Management Agent program ERAAgent.exe. SLEEPWALKER does not beacon or open an obvious listening port on its own. It monitors network traffic and stays dormant until it detects a specially crafted packet carrying an AES-256-CCM-protected task. It supports TCP, UDP, ICMP, SMB named pipes and VMware VMCI. VMCI can carry traffic directly between a VMware guest and host without using a conventional network interface. SLEEPWALKER also implements a DNS trigger that uses Base32 to carry encrypted tasks inside DNS labels, although the analyzed sample does not enable it. The full analysis documents the bytecode format, all 23 instructions, encryption, DNS encoding, trigger logic and network transports. It also includes IOCs, a YARA rule and a PowerShell scanner. If you believe you have been targeted by SLEEPWALKER or have found a related sample, please contact me. I created the SLEEPWALKER Analysis Toolkit to decode its bytecode, examine artifacts and safely reproduce its receiving pipeline without executing commands or transmitting data. If you suspect you've been infected, I am happy to share this toolkit with you, alongside a mitigation guide providing investigation steps and a remediation script for use after detection. r136a1.dev/2026/08/24/sleepw…