Blog.
Technical research and advisories from the operators who run our engagements. EDR evasion, Active Directory, exposed infrastructure, NIS2 and DORA.
BYOVD: Detection and Prevention on a Hardened Windows 11 Endpoint
We tested Bring Your Own Vulnerable Driver against a fully hardened Windows 11 25H2 endpoint with MDE and ASR in Block mode. Publicly known vulnerable drivers still loaded and ran, killing Defender's PPL-protected processes.
Read the articleThe State of Exposed VPNs in Europe
We ran a Europe-wide responsible disclosure campaign to find organizations still exposed to known VPN vulnerabilities, trace the vulnerable devices to their owners, and get them patched. Around 800 organizations assessed. Only a minority responded.
Read the articlewp2shell (CVE-2026-63030 & CVE-2026-60137): Unauthenticated SQL Injection in WordPress Core
wp2shell chains a REST API batch route confusion with a SQL injection in WP_Query into unauthenticated blind SQLi, now patched in WordPress Core. RCE is possible but not automatic. It needs a cracked admin password and plugin uploads enabled. Here is the real chain and how to patch it.
Read the articleTIBER-EU and DORA: What Financial Institutions Need to Understand Before the Notification Arrives
DORA is live. TLPT regulatory standards are active. Notifications are being sent. Here is what financial institutions in the EU need to understand about TIBER-EU before the letter arrives.
Read the articleNIS2 Compliance in Portugal: Evidence Over Documentation
Decree-Law 125/2025 is in force. We break down what Article 27 requires, what CNCS auditors actually check, and where organisations in Portugal are failing.
Read the articleKilling EDR visibility at the kernel: BYOVD
Most EDRs rely on kernel callbacks to see what happens on an endpoint. We show how BYOVD attacks zero those callbacks, why ML detection does not save you, and what defenders should actually do about it.
Read the articleACL Abuse Havoc, a BOF toolkit for AD ACL exploitation via Havoc C2
We're releasing acl-abuse-havoc, an open-source BOF toolkit for abusing Active Directory ACL misconfigurations through Havoc C2. The centrepiece is acl-shadow, a full Shadow Credentials attack chain that runs entirely in-memory.
Read the article