We tested Bring Your Own Vulnerable Driver (BYOVD) against a fully hardened Windows 11 25H2 endpoint with MDE and ASR in Block mode. Nine publicly known vulnerable drivers still loaded and ran, killing Defender's PPL-protected processes.

Read Article →

Technical Research22 July 20266 min read

The State of Exposed VPNs in Europe

We ran a Europe-wide responsible disclosure campaign to find organizations still exposed to known VPN vulnerabilities, trace the vulnerable devices to their owners, and get them patched. Around 800 organizations assessed. Only a minority responded.

Technical Research18 July 20265 min read

wp2shell (CVE-2026-63030 & CVE-2026-60137): Unauthenticated SQL Injection in WordPress Core

wp2shell chains a REST API batch route confusion with a SQL injection in WP_Query into unauthenticated blind SQLi, now patched in WordPress Core. RCE is possible but not automatic. It needs a cracked admin password and plugin uploads enabled. Here is the real chain and how to patch it.

Advisory29 May 202612 min read

TIBER-EU and DORA: What Financial Institutions Need to Understand Before the Notification Arrives

DORA is live. TLPT regulatory standards are active. Notifications are being sent. Here is what financial institutions in the EU need to understand about TIBER-EU before the letter arrives.

Advisory25 May 202610 min read

NIS2 Compliance in Portugal: Evidence Over Documentation

Decree-Law 125/2025 is in force. We break down what Article 27 requires, what CNCS auditors actually check, and where organisations in Portugal are failing.

Technical Research24 May 202614 min read

Killing EDR visibility at the kernel: BYOVD

Most EDRs rely on kernel callbacks to see what happens on an endpoint. We show how BYOVD attacks zero those callbacks, why ML detection does not save you, and what defenders should actually do about it.

Technical Research18 May 20268 min read

ACL Abuse Havoc, a BOF toolkit for AD ACL exploitation via Havoc C2

We're releasing acl-abuse-havoc, an open-source BOF toolkit for abusing Active Directory ACL misconfigurations through Havoc C2. The centrepiece is acl-shadow, a full Shadow Credentials attack chain that runs entirely in-memory.