This will be mostly rambling disguised as a technical walkthrough. I will touch on certain topics such as hardware roots of trust, signed image formats, Qualcomm boot stages, Android Verified Boot, UEFI, measured boot, and remote evidence (remote attestation). My idea is that I will briefly introduce the concepts and […]

Research by: Jaromír Hořejší (@JaromirHorejsi) We first noticed a ransomware family called StopAndProtect in the middle of May 2026. Further analysis of the infrastructure reveals that the infection chain starts with a ClickFix social-engineering technique, which prompts victims to execute a PowerShell command. This leads to two stages of additional […]

# Recovering Encrypted LLM Reasoning Traces A few days ago, a paper named “Stealing Reasoning Traces from Proprietary LLM APIs” was published. It describes a simple, yet super elegant way to recover encrypted LLM reasoning traces. Naturally, I had to try it. ## Background AI labs like OpenAI and Anthropic […]

We closely monitor the detection mechanisms employed by EDR sensors to better understand how they identify suspicious activity. Recently, we observed that one of the major players in the EDR market takes an interesting approach to walking thread call stacks: rather than implementing a custom unwinder, it uses the built-in […]

# You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?)) Suddenly, you’re in a room. You look around – oh, you’re surrounded by other new starters at your new job. Yes, it’s Monday, and you’re being onboarded. You know the drill – it’s the typical enterprise “please don’t be […]

For the past year, the ransomware conversation has centered on concentration: a handful of dominant RaaS operations controlling most of the damage, and a shrinking pool of active groups fighting over the same territory. The State of Ransomware Q2 2026 report from Check Point Research shows that picture starting to shift. The […]

TALOS-2026-2427 CVE-2026-49177 An out-of-bounds read vulnerability exists in the IppQualifyAddresses function of the Microsoft Windows tcpip.sys driver. A specially crafted I/O request packet (IRP) can cause an arbitrary out-of-bounds read, potentially leading to information disclosure or a denial-of-service condition. The versions below were either tested or verified to be vulnerable […]

Since early 2026, Check Point Research has tracked a wave of the **Operation Dream Job** campaign. This wave primarily targeted the defense sector worldwide, with a particular emphasis on companies operating in the aerospace and aviation industries. We observed the threat actor distributing modified PDF viewers designed to execute malicious payloads embedded […]

_By Yarden Porat, Check Point Research_ We set out to break **Cloudflare Code Mode**, and ended up breaking **Cloudflare Workers** too. We did both by targeting **workerd**, the runtime beneath both: an in-process sandbox that relies entirely on V8 to isolate untrusted code. We found five memory-corruption bugs in workerd’s native C++ (the “glue” […]

Researcher **Published:** Thursday, 6 August 2026 at 22:00 UTC **Updated:** Thursday, 6 August 2026 at 22:00 UTC Gareth Heyes – gareth.heyes@portswigger.net – @garethheyes **It’s quite common for webmail clients to render untrusted CSS in a trusted UI. They attempt to make this safe using CSS sanitization. In this paper I’m […]