IPV6_FRAG_ESCAPE: The Linux Container Escape Your CVE Scanner May Miss
IPV6_FRAG_ESCAPE is a Linux kernel 6.12 privilege escalation with public PoC code, no CVE at disclosure time, and a practical path from container user to host root.
Privilege Escalation
11 articles
pedit COW & DirtyClone: Two New Linux Root Exploits That Bypass On-Disk Integrity Checks
CVE-2026-46331 and CVE-2026-43503 both corrupt the Linux page cache via network subsystems to grant root — bypassing file integrity tools like AIDE and Tripwire without touching files on disk.
RoguePlanet: Nightmare Eclipse's New Windows Defender LPE PoC After the June 2026 Patch
RoguePlanet is the latest public Nightmare Eclipse proof-of-concept targeting Microsoft Defender. The code points to a race condition that turns Defender cleanup behavior into SYSTEM execution.
SSH-keysign-pwn: The Nine-Year Linux Kernel Flaw
CVE-2026-46333 (ssh-keysign-pwn) is a nine-year-old Linux kernel race condition that lets an unprivileged local user steal SSH host keys and dump /etc/shadow. Root command execution is also possible on specific configurations.
BloodHound CE: Map Active Directory Attack Paths to Domain Admin (2026)
Run SharpHound, read attack graphs, abuse ACL misconfigurations and Kerberoastable accounts — step-by-step path to Domain Admin in Active Directory.
Dirty Frag & Copy Fail: Two New Linux Kernel Vulnerabilities Grant Root Privileges
Two new Linux kernel vulnerabilities — Dirty Frag (CVE-2026-43284/43500) and Copy Fail (CVE-2026-31431) — enable local privilege escalation to root on nearly all major distros. What users and admins need to know.
ADCS Abuse with Certipy: From Low-Priv User to Domain Admin via Certificate Services
Active Directory Certificate Services is installed in most enterprise networks — and almost always misconfigured. Here's how attackers exploit ESC1 through ESC8 with Certipy, and how to detect and stop them.
Linux Privilege Escalation: Attack Techniques and How to Detect Them
A complete guide to Linux privilege escalation — SUID abuse, sudo misconfig, cron hijacking, capabilities, and kernel exploits. Includes auditd rules, Sigma, Wazuh, and Sentinel KQL detections.
Shadow Credentials: Account Takeover Without a Password
Shadow Credentials abuse msDS-KeyCredentialLink via DACL misconfiguration to add a rogue certificate, authenticate via PKINIT, and extract NT hashes — no password required.
When Your Defender Becomes the Attacker: How Trusted Windows Processes Get Weaponized
Windows Defender and other high-privilege system processes are increasingly targeted by attackers. Learn how security tools become attack surfaces — and what you can do about it.
Active Directory Attacks: The Complete Attack Path Guide
A structured guide to Active Directory attack techniques — from BloodHound enumeration through Kerberoasting, LSASS dumping, ADCS abuse, and Shadow Credentials to Entra ID pivot. Every technique with detection coverage.