Privilege Escalation

Nightmare Eclipse in September 2026: Five New PoCs Test Windows' Trust Boundaries

Nightmare Eclipse's latest Windows PoCs target Defender, CrowdStrike, Kaspersky, Avast, and NVIDIA. What is confirmed, what is not, and how to respond.

IPV6_FRAG_ESCAPE: The Linux Container Escape Your CVE Scanner May Miss

IPV6_FRAG_ESCAPE is a Linux kernel 6.12 privilege escalation with public PoC code, no CVE at disclosure time, and a practical path from container user to host root.

pedit COW & DirtyClone: Two New Linux Root Exploits That Bypass On-Disk Integrity Checks

CVE-2026-46331 and CVE-2026-43503 both corrupt the Linux page cache via network subsystems to grant root — bypassing file integrity tools like AIDE and Tripwire without touching files on disk.

RoguePlanet: Nightmare Eclipse's New Windows Defender LPE PoC After the June 2026 Patch

RoguePlanet is the latest public Nightmare Eclipse proof-of-concept targeting Microsoft Defender. The code points to a race condition that turns Defender cleanup behavior into SYSTEM execution.

SSH-keysign-pwn: The Nine-Year Linux Kernel Flaw

CVE-2026-46333 (ssh-keysign-pwn) is a nine-year-old Linux kernel race condition that lets an unprivileged local user steal SSH host keys and dump /etc/shadow. Root command execution is also possible on specific configurations.

BloodHound CE: Map Active Directory Attack Paths to Domain Admin (2026)

Run SharpHound, read attack graphs, abuse ACL misconfigurations and Kerberoastable accounts — step-by-step path to Domain Admin in Active Directory.

Dirty Frag & Copy Fail: Two New Linux Kernel Vulnerabilities Grant Root Privileges

Two new Linux kernel vulnerabilities — Dirty Frag (CVE-2026-43284/43500) and Copy Fail (CVE-2026-31431) — enable local privilege escalation to root on nearly all major distros. What users and admins need to know.

ADCS Abuse with Certipy: From Low-Priv User to Domain Admin via Certificate Services

Active Directory Certificate Services is installed in most enterprise networks — and almost always misconfigured. Here's how attackers exploit ESC1 through ESC8 with Certipy, and how to detect and stop them.

Linux Privilege Escalation: Attack Techniques and How to Detect Them

A complete guide to Linux privilege escalation — SUID abuse, sudo misconfig, cron hijacking, capabilities, and kernel exploits. Includes auditd rules, Sigma, Wazuh, and Sentinel KQL detections.

Shadow Credentials: Account Takeover Without a Password

Shadow Credentials abuse msDS-KeyCredentialLink via DACL misconfiguration to add a rogue certificate, authenticate via PKINIT, and extract NT hashes — no password required.

When Your Defender Becomes the Attacker: How Trusted Windows Processes Get Weaponized

Windows Defender and other high-privilege system processes are increasingly targeted by attackers. Learn how security tools become attack surfaces — and what you can do about it.

Active Directory Attacks: The Complete Attack Path Guide

A structured guide to Active Directory attack techniques — from BloodHound enumeration through Kerberoasting, LSASS dumping, ADCS abuse, and Shadow Credentials to Entra ID pivot. Every technique with detection coverage.