Cafe Security

Agentic Deobfuscation: An Attacker's Playbook https://github.com/mrphrazer/binary-cartography/tree/main/2026-09-agentic_deobfuscation Designed for technical security professionals, reverse engineers, and malware analysts working with binaries or low-level software, this webinar focuses on practical workflows for taking obfuscated code apart @cafe_security

My New Blog Post Evading Sysmon Dns Monitoring In 2026 | binary-win DNSevade : https://github.com/binary-win/DNSevade.git

Sysmon gets its DNS telemetry from the Microsoft-Windows-DNS-Client ETW provider. Let's hide in plain sight.

#sysmon #bypass Your Notes are HERE

Escaping Linux Sandboxes via PipeWire (CVE-2026-5674) https://embracethered.com/blog/posts/2026/pipewire-flatpak-linux-sandbox-escape-cve-2026-5674/ @cafe_security

volatility3-ai-triage https://github.com/zyekhabdul/volatility3-ai-triage

volatility3-ai-triage performs high-utility memory triage by executing Volatility 3 plugins in parallel, cross-correlating raw memory artifacts across plugins, detecting advanced 2026 evasion techniques, and generating deterministic SIEM JSON / STIX 2.1 Threat Intel alongside executive Markdown & HTML Triage Reports via Local LLMs (Ollama) or Cloud APIs (Gemini, OpenAI).

@cafe_security

DCOMIllusionist - Windows fileless latteral movement technique. https://github.com/synacktiv/DCOMIllusionist @cafe_security

The dusk of g_CiOptions: circumventing DSE with VBS enabled https://blog.cryptoplague.net/main/research/windows-research/the-dusk-of-g_cioptions-circumventing-dse-with-vbs-enabled #BYOVD @cafe_security

Kernel Karnage Part 1: Patching Windows Kernel Callbacks to Disable EDR from a Driver ———————————————————————————- The first post of NVISO Labs’ Kernel Karnage series walks through the opening move of an EDR-bypass research project: write a small Windows kernel driver, locate the undocumented PspCreateProcessNotifyRoutine callback array that the OS uses to deliver process-creation notifications, and patch the EDR’s registered callback out of it. Process-creation callbacks are one of the load-bearing telemetry mechanisms modern EDR products depend on — remove them and a wide class of behavioural detections go dark. https://core-jmp.org/2026/06/kernel-karnage-part-1-patching-windows-kernel-callbacks-edr-bypass/ @cafe_security

Post-patch Postmortem https://github.com/joshterrill/post-patch-postmortem @cafe_security

NullPageProtector This project is essentially a Windows kernel-mode driver designed for Windows 7 and earlier versions. It serves as a mitigation strategy for null pointer dereference vulnerabilities. https://github.com/binophism/NullPageProtector @cafe_security

#meme #CFG #ED @cafe_security

RIP RegPwn https://www.mdsec.co.uk/2026/03/rip-regpwn/ @cafe_security

Black Hat USA 2025 | Shade BIOS: Unleashing the Full Stealth of UEFI Malware https://www.youtube.com/watch?v=t17YEHymwE4 @cafe_security

ROP the ROM: Exploiting a Stack Buffer Overflow on STM32H5 in Multiple Ways https://www.errno.fr/Overflowing_STM32H5.html @cafe_security

[  42.1337] #security: EXAM: Exploiting Exclusive System-Level Cache in Apple M-Series SoCs for Enhanced Cache Occupancy Attacks https://arxiv.org/html/2504.13385v1 Apparently the shared cache inside Apple M chips (the System Level Cache that both CPU and GPU use) can accidentally act like a little "activity meter" for the whole system. If you measure how busy or full it gets, you can infer what other parts of the chip are doing even if you're running somewhere else. The authors use that signal for things people don't expect a cache to reveal, like guessing which websites are being loaded from the pattern alone and even getting rough clues about what's on screen based on how the GPU renders frames. It wraps up with an "add noise" style mitigation that tries to blur the leak without much overhead.

Introducing Kernel Data Protection, a new platform security technology for preventing data corruption https://www.microsoft.com/en-us/security/blog/2020/07/08/introducing-kernel-data-protection-a-new-platform-security-technology-for-preventing-data-corruption/ #KDP #data_corruption #BYOVD @cafe_security

Chasing Shadows: Chronicles of Counter-Intelligence from the Citizen Lab https://youtu.be/frmGzgBvGdg?si=sfnvy8Ah-6A1dAYV #nso #Citizen_Lab #spyware @cafe_security

A 0-click exploit chain for the Pixel 9 https://projectzero.google/2026/01/pixel-0-click-part-1.html #android @cafe_security

Slides and recordings for our @FOSDEM talks are up! Join [Björn Ruytenberg] and [Sina Karvandi] for an in-depth introduction into @HyperDbg 's features and internals, or find out what's the latest in anti-anti-debugging techniques and HV transparency for malware reversing: - https://fosdem.org/2026/schedule/event/APB9WC-mbec_slat_and_hyperdbg_hypervisor-based_kernel-_and_user-mode_debugging/ - https://fosdem.org/2026/schedule/event/CDPRDX-invisible_hypervisors_debugging_with_hyperdbg/