### Uh oh! There was an error while loading. Please reload this page. **security-research** Public # Cross-Frame Scripting (XFS) via Background Proxy in Vimium ## Package ## Affected versions ## Patched versions ## Description ### Summary Vimium’s background script provides an `openUrlInCurrentTab` message handler that allows content scripts to request […]

**Research by:** hasherezade JSCeal is a stealer delivered as compiled V8 bytecode ( `.jsc`) and executed by a bundled Node.js runtime, targeting cryptocurrency applications (other vendors also tag it with the names WEEVILPROXY or MeadowLocust). Its campaign activity dates back to March 2024 [1]; Check Point Research has been tracking the […]

# Simulating legitimate Active Directory services on the network: the case of GPO exploitation Simulating legitimate Active Directory services on an internal network is a powerful and versatile capability that can be leveraged in various contexts. Many examples of exploits relying on the ability to simulate working LDAP and/or SMB […]

Hacking Lab Hacking Lab Home People Publications Contact Light Dark Automatic MTEscape: Bypassing Asynchronous Kernel MTE via Conventional Memory Corruption Vulnerabilities (to appear) Kyeongmin Kim , Insu Yun November 2026 Cite Publication Proceedings of the 33rd ACM Conference on Computer and Communications Security (CCS) Cite ×Copy Download

What if I told you six thousand of your employees were two steps removed from gaining full control over your IT infrastructure. If we told you this was related to ServiceNow, would you be able to identify and mitigate the root cause? How would your SOC react if they were […]

Hacking Lab Hacking Lab Home People Publications Contact Light Dark Automatic QueryHouse: Cross-DBMS Differential Testing with LLM and Query Transpilation (to appear) Seoyeon Oh , Juhyun Song , Jaemin Park , Kwanghee Lee , Minae Hyeon , Minji Kim , Sehyuk Ka , Gwangwun Jung , Brian Pak , Insu […]

Automatic Program Repair (APR) has emerged as a critical technology for autonomously addressing software vulnerabilities. While recent advances in Large Language Models (LLMs) have enabled sophisticated agentic APR systems, existing approaches still struggle to generate patches for vulnerabilities whose root causes are difficult to identify. This happens because prior methods […]

# Breaking Claude Code Opus 5 Auto Mode In this post, we explore how a simple website summary request hijacks `Claude Code Opus 5` in `Auto Mode` and achieves code execution with 60-80% attack success rate using a small sample size. This is interesting because a third-party evaluation commissioned by […]

Now that we’re past the sensational headline, let’s be real. This is the first post in a series about using AI/LLMs to do security work. I know, I know. Everybody and their grandma is using AI for this nowadays. Every time I’m opening up any kind of social media, I […]

TALOS-2026-2360 CVE-2026-48388 A privilege escalation vulnerability exists in the Installation functionality of Photoshop (version(s): Photoshop_Set-Up.exe version 2.11.0.30). A specially crafted malformed file can lead to privilege escalation. An attacker can replace with a malicious file to trigger this vulnerability. The versions below were either tested or verified to be vulnerable […]