CVE-2026-73014 (PLUSONE): Reading Another User’s Files Through the Windows Data Sharing Service
A standard user gets the contents of a file its own permissions deny, because another user who also could not read it added them to a sharing token.
Read637th Research Lab
Spare no frontier technology.Build overwhelming capability.
Featured
CVE-2026-5917: OS Command Injection in libgit2’s SSH Backend
libgit2’s libssh2 backend quotes the repository path but escapes nothing. One quote in the path can run commands on an SSH server that gives a shell.
ReadCVE-2026-5857: Remote Code Execution in Contiki-NG’s MQTT Client
A malicious broker splits one PUBLISH across two TCP segments, skips a bounds check that is present and correct, and overwrites a function pointer.
ReadCVE-2026-18759: Privilege Escalation in ASUSTOR Backup Plan
ASUSTOR Backup Plan’s Windows service ABP_VSS_Service treats encryption as authentication and checks paths with a substring test. Standard user to SYSTEM.
ReadClaude Cowork Boots Its Sandbox From a Folder You Can Rewrite
Cowork boots a Hyper-V VM from user-writable AppData with no hash or signature check. Replace the initrd; SYSTEM boots it. Anthropic: by design.
ReadU-Boot TCP/NFS Vulnerabilities: Integer Underflow and Buffer Overflow in the World’s Most Popular Bootloader
Three CVEs in U-Boot’s network stack: one unchecked TCP header length that gives two reads past the packet, and an NFS path overflow past a 2048-byte buffer.
ReadFour Vulnerabilities in barebox: From DHCP Parsing to EFI PE Loading
Four CVEs in barebox: an unbounded DHCP option scan, two ext4 parsing flaws, and a PE virtual-size integer overflow in the EFI loader.
ReadRogueProvision: A SYSTEM Task That Applies Unsigned Provisioning Packages (admin to SYSTEM, declined by MSRC)
A SYSTEM service applies unsigned .ppkg packages from a folder with no signature and no consent. Microsoft’s docs promise otherwise. Honest catch: admin→SYSTEM.
ReadRebuilding a Security Researcher’s Mind in an AI: the Method, the Rig, and What It Cannot Do Yet
Building an AI that reverse-engineers undocumented Windows internals and raises its own hypotheses. The method, the rig, and the limit it has not crossed.
ReadSame Workflow, New Target: AI-Assisted Discovery of CVE-2026-29004 in BusyBox
How the AI workflow that found a strongSwan zero-day discovered a 9-year-old heap overflow in BusyBox’s DHCPv6 client, plus a full PoC walkthrough.
ReadFinding a 15-Year-Old Zero-Day in strongSwan with AI-Assisted Code Analysis
How I discovered CVE-2026-25075, a bug hiding in strongSwan since 2010, using a structured multi-pass AI analysis workflow.
ReadLatest
CVE-2026-73014 (PLUSONE): Reading Another User’s Files Through the Windows Data Sharing Service
A standard user gets the contents of a file its own permissions deny, because another user who also could not read it added them to a sharing token.
CVE-2026-5917: OS Command Injection in libgit2’s SSH Backend
libgit2’s libssh2 backend quotes the repository path but escapes nothing. One quote in the path can run commands on an SSH server that gives a shell.
CVE-2026-5857: Remote Code Execution in Contiki-NG’s MQTT Client
A malicious broker splits one PUBLISH across two TCP segments, skips a bounds check that is present and correct, and overwrites a function pointer.
CVE-2026-18759: Privilege Escalation in ASUSTOR Backup Plan
ASUSTOR Backup Plan’s Windows service ABP_VSS_Service treats encryption as authentication and checks paths with a substring test. Standard user to SYSTEM.