Now that we’re past the sensational headline, let’s be real. This is the first post in a series about using AI/LLMs to do security work. I know, I know. Everybody and their grandma is using AI for this nowadays. Every time I’m opening up any kind of social media, I […]

Researcher **Published:** Tuesday, 25 August 2026 at 14:24 UTC **Updated:** Tuesday, 25 August 2026 at 14:24 UTC I was on my laptop, as I often am when there’s rubbish on telly, and found myself wondering what characters are allowed in a tag. I knew they had to begin with “a-zA-Z”, […]

# AWS EKS forensics: data sources and investigation tooling Investigating a compromise in Amazon EKS means piecing together evidence spread across three layers: the managed Kubernetes control plane, the worker nodes, and the surrounding AWS services. This article maps the data sources an EKS cluster exposes for digital forensics and […]

**Research by: Jiří Vinopal** **(**@vinopaljiri **)** What if a **trusted security component** could be repurposed into an **attacker-controlled** kernel primitive? What if a **signed Microsoft remediation driver** could be instructed to execute arbitrary **file** and **registry** operations from **Ring 0** – **without** exploits, vulnerabilities, or memory corruption? In this publication, […]

### Uh oh! There was an error while loading. Please reload this page. / **security-research** Public # [Initial Disclosure] AMD | ZEN 1 ## Package tbd ## Affected versions tbd ## Patched versions tbd ## Description ### Affected Vendor / Project: AMD ### Affected Product: Zen 1 CPU ### Private […]

This will be mostly rambling disguised as a technical walkthrough. I will touch on certain topics such as hardware roots of trust, signed image formats, Qualcomm boot stages, Android Verified Boot, UEFI, measured boot, and remote evidence (remote attestation). My idea is that I will briefly introduce the concepts and […]

Research by: Jaromír Hořejší (@JaromirHorejsi) We first noticed a ransomware family called StopAndProtect in the middle of May 2026. Further analysis of the infrastructure reveals that the infection chain starts with a ClickFix social-engineering technique, which prompts victims to execute a PowerShell command. This leads to two stages of additional […]

# Recovering Encrypted LLM Reasoning Traces A few days ago, a paper named “Stealing Reasoning Traces from Proprietary LLM APIs” was published. It describes a simple, yet super elegant way to recover encrypted LLM reasoning traces. Naturally, I had to try it. ## Background AI labs like OpenAI and Anthropic […]

We closely monitor the detection mechanisms employed by EDR sensors to better understand how they identify suspicious activity. Recently, we observed that one of the major players in the EDR market takes an interesting approach to walking thread call stacks: rather than implementing a custom unwinder, it uses the built-in […]

# You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?)) Suddenly, you’re in a room. You look around – oh, you’re surrounded by other new starters at your new job. Yes, it’s Monday, and you’re being onboarded. You know the drill – it’s the typical enterprise “please don’t be […]