How to APT EP. 6: Zero-FD Fileless Payload Execution via System V Shared Memory
Fileless ELF execution where the payload is never represented by a file descriptor, dentry, or key, at any point.
Sep 10, 2026
12 min
1,271 views How to APT EP. 5: Reusing the loader’s PIE base for userland exec
Every fileless loader leaves a recognizable footprint in /proc/pid/maps. This one reuses the address the kernel chose for its own loader, so the payload lands in the canonical PIE region rather than an absurd one. That removes one tell, the address, and leaves the rest.
Sep 10, 2026
10 min
538 views Analysis of a new windows unpatched 0day (cve-2026-62737)
The driver calls whatever you queue. a windows kloader device lets any caller deposit an (argument, callback) pair via a 16-byte ioctl and then executes that callback in kernel mode on demand, no validation, no whitelist, no access check. full poc, field-by-field walk of the ioctl surface (init / queue / register-monitor / fast-enter), and a straight impact take: arbitrary ring-0 control for whoever can open the device, gated only by the driver being resident (BYOVD) or shipped.
Aug 10, 2026
11 min
996 views How to APT EP. 4: : The Verifier Forgot It Was a Pointer: Commuted-Add Type Confusion and Container Escapes
An analysis of a Linux kernel BPF verifier type confusion vulnerability caused by premature early returns in commuted arithmetic. It demonstrates how an attacker with CAP_BPF can abuse untrusted pointer state divergence to leak kernel heap addresses and cross container boundaries.
Aug 10, 2026
13 min
363 views How to APT EP. 3: Owning Thread Execution with sched_ext Hashmaps
sched_ext lets custom BPF programs replace the core Linux CPU dispatcher. But when the entire attack surface of a rootkit is a 16-byte write to an already-trusted BPF hashmap, no EDR hook-monitor will ever see it coming. Here is how a custom scheduler becomes the ultimate process inventory and targeted starvation weapon.
Aug 8, 2026
15 min
326 views