November 10, 2025 at 10:44 PM
#CVE-2025-59287
Spun up a WSUS instance on a W2k25. (Build 10.0.26100 - unpatched since aug)
Interestingly Microsoft.UpdateServices.Internal.Authorization.EncryptionHelper.DecryptData did not use the vulnerable BinaryFormatter class but the XmlSerializer.
#KB5070881 is not installed.
Spun up a WSUS instance on a W2k25. (Build 10.0.26100 - unpatched since aug)
Interestingly Microsoft.UpdateServices.Internal.Authorization.EncryptionHelper.DecryptData did not use the vulnerable BinaryFormatter class but the XmlSerializer.
#KB5070881 is not installed.
October 27, 2025 at 8:14 AM
#CVE-2025-59287
Spun up a WSUS instance on a W2k25. (Build 10.0.26100 - unpatched since aug)
Interestingly Microsoft.UpdateServices.Internal.Authorization.EncryptionHelper.DecryptData did not use the vulnerable BinaryFormatter class but the XmlSerializer.
#KB5070881 is not installed.
Spun up a WSUS instance on a W2k25. (Build 10.0.26100 - unpatched since aug)
Interestingly Microsoft.UpdateServices.Internal.Authorization.EncryptionHelper.DecryptData did not use the vulnerable BinaryFormatter class but the XmlSerializer.
#KB5070881 is not installed.
Pretty interesting read if you're into deception-based security.
scholarspace.manoa.hawaii.edu/items/88cd00...
scholarspace.manoa.hawaii.edu/items/88cd00...
‘It's Not Paranoia If They're Really After You’: When Announcing Deception Technology Can Change Attacker Decisions
As organisations continue to adopt deception technology, adversaries are becoming aware of this technology. Little is known, however, about how this awareness changes the attacker’s behaviour as they ...
scholarspace.manoa.hawaii.edu
February 20, 2025 at 9:30 PM
Pretty interesting read if you're into deception-based security.
scholarspace.manoa.hawaii.edu/items/88cd00...
scholarspace.manoa.hawaii.edu/items/88cd00...
Even chatgpt and deepseek are unable to keep track of the amount of brackets writing lisp.
February 13, 2025 at 9:02 PM
Even chatgpt and deepseek are unable to keep track of the amount of brackets writing lisp.
Reposted by 0x401
When I see my favs
February 12, 2025 at 2:12 AM
When I see my favs
If you ever see a suspicious file creation/modification/deletion event with the parent process ntoskrnl.exe, there is a high chance it was done over SMB. Look for SMB connections (445/TCP) and on other devices connecting to an SMB share on that device (\\machinename\path)
February 6, 2025 at 8:40 PM
If you ever see a suspicious file creation/modification/deletion event with the parent process ntoskrnl.exe, there is a high chance it was done over SMB. Look for SMB connections (445/TCP) and on other devices connecting to an SMB share on that device (\\machinename\path)
I'm sick of seeing public keys with mdrfckr in their comment.
February 6, 2025 at 6:57 PM
I'm sick of seeing public keys with mdrfckr in their comment.
