# AWS EKS forensics: data sources and investigation tooling Investigating a compromise in Amazon EKS means piecing together evidence spread across three layers: the managed Kubernetes control plane, the worker nodes, and the surrounding AWS services. This article maps the data sources an EKS cluster exposes for digital forensics and […]

**Research by: Jiří Vinopal** **(**@vinopaljiri **)** What if a **trusted security component** could be repurposed into an **attacker-controlled** kernel primitive? What if a **signed Microsoft remediation driver** could be instructed to execute arbitrary **file** and **registry** operations from **Ring 0** – **without** exploits, vulnerabilities, or memory corruption? In this publication, […]

### Uh oh! There was an error while loading. Please reload this page. / **security-research** Public # [Initial Disclosure] AMD | ZEN 1 ## Package tbd ## Affected versions tbd ## Patched versions tbd ## Description ### Affected Vendor / Project: AMD ### Affected Product: Zen 1 CPU ### Private […]

This will be mostly rambling disguised as a technical walkthrough. I will touch on certain topics such as hardware roots of trust, signed image formats, Qualcomm boot stages, Android Verified Boot, UEFI, measured boot, and remote evidence (remote attestation). My idea is that I will briefly introduce the concepts and […]

Research by: Jaromír Hořejší (@JaromirHorejsi) We first noticed a ransomware family called StopAndProtect in the middle of May 2026. Further analysis of the infrastructure reveals that the infection chain starts with a ClickFix social-engineering technique, which prompts victims to execute a PowerShell command. This leads to two stages of additional […]

# Recovering Encrypted LLM Reasoning Traces A few days ago, a paper named “Stealing Reasoning Traces from Proprietary LLM APIs” was published. It describes a simple, yet super elegant way to recover encrypted LLM reasoning traces. Naturally, I had to try it. ## Background AI labs like OpenAI and Anthropic […]

We closely monitor the detection mechanisms employed by EDR sensors to better understand how they identify suspicious activity. Recently, we observed that one of the major players in the EDR market takes an interesting approach to walking thread call stacks: rather than implementing a custom unwinder, it uses the built-in […]

# You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?)) Suddenly, you’re in a room. You look around – oh, you’re surrounded by other new starters at your new job. Yes, it’s Monday, and you’re being onboarded. You know the drill – it’s the typical enterprise “please don’t be […]

For the past year, the ransomware conversation has centered on concentration: a handful of dominant RaaS operations controlling most of the damage, and a shrinking pool of active groups fighting over the same territory. The State of Ransomware Q2 2026 report from Check Point Research shows that picture starting to shift. The […]

TALOS-2026-2427 CVE-2026-49177 An out-of-bounds read vulnerability exists in the IppQualifyAddresses function of the Microsoft Windows tcpip.sys driver. A specially crafted I/O request packet (IRP) can cause an arbitrary out-of-bounds read, potentially leading to information disclosure or a denial-of-service condition. The versions below were either tested or verified to be vulnerable […]