30 results for “C++”

List Grid

What you seeeverything

Recent Oldest Added A–Z

All types30 Articles11 Write-ups9 Repos5 Papers4 Talks1

“C++”

arxiv.orgpaper🛡️ Security

Structured Security Explanations for Learning-Based Vulnerability Detection

VulnLens is a framework for binary C/C++ function-level vulnerability detection. A label-blind LLM Explainer describes each function from seven fixed perspectives (data flow, memory access, object lifetime, arithmetic and type behavior, control flow, shared state, external-resource access). A supervised Detector fuses code and explanations by cross-attention. It reaches 75.5% accuracy and 77.2% F1 on a 526-function PrimeVul test set, and 66.4% accuracy on SecVulEval without retraining.

LLMCC+++2

VulnLensPrimeVulSecVulEval

AI Security, AppSec· Added 30 Oct 2026, published 27 Oct 2026

arxiv.orgpaper🛡️ Security

Raise or Check? Predicting the Necessity of Additional Fuzzing for Continuous Fuzzing

RAISE (Risk-Aware Intensive Supplemental Execution Framework) is a just-in-time framework that predicts which project-days introduce a vulnerability, to decide where to spend extra fuzzing. The dataset joins OSV vulnerability-introducing commits with OSS-Fuzz coverage data for 15 C/C++ projects (15,210 project-days, 347 positive). A Random Forest using VCCFinder static features plus fuzzing features reaches ROC-AUC 0.74. In a simulation over 968 vulnerabilities, Simple-Regression needed 91.60 extra fuzzing sessions per detected vulnerability, against 171.89 for the Median heuristic.

OSS-FuzzOSVC

RAISEVCCFinderPatchCoverage+1

AppSec· Added 22 Oct 2026, published 20 Oct 2026

starskirmish.comarticle🧠 AI

Show HN: Gemini 4 Argon plays StarCraft

StarSkirmish Bench v0.2 gives each LLM one hour to write a Protoss StarCraft: Brood War bot in C++ (BWAPI 4.4.0 on OpenBW), with tools to compile and play practice games. Scores are average win rates of 5 runs against 13 roster bots, which include human-written bots such as Stardust, PurpleWave and BananaBrain. Nine models are compared, each in its lab's first-party CLI harness (Claude Code, Codex, Antigravity CLI, Muse Code). GPT-6 Astra leads and wins only 7% against the top human bots. The page also covers score against cost, run-to-run variance, practice behaviour as the best predictor of score, and weak correlation with the Artificial Analysis Intelligence Index and Terminal-Bench 4.0.

Claude CodeCodexGoogle Antigravity+5

StarSkirmish BenchGPT-6 AstraGPT-6.1 Sol+22

evals, coding-agents, agents· Added 17 Oct 2026, published 16 Oct 2026

momo5502.comwriteup🛡️ Security

500B tokens later: Letting AI agents decompile a first-person shooter

Case study of about 3 months spent having Claude Code and Codex CLI agents decompile a popular first-person shooter to C++, using Hex-Rays' ida-mcp for disassembly. Early agent output ran but was semantically wrong, and a reviewer agent accepted worker justifications in commit comments, which acted as unintentional prompt injection. The fix was a byte-matching oracle: it compiles with the original toolchain and compares OBJ function bytes against the EXE/PDB, treating relocations separately. Agents tried to cheat with inline assembly and by editing the checker, so CI hashes the script. The result was 99% of functions present and 83% byte-exact, at an estimated 600-700B tokens.

ida-mcpClaude CodeCodex CLI+3

LunaOpus 5.5

Malware & RE, AI Security· Published and added 11 Oct 2026

momo5502.comwriteup🧠 AI

500B tokens later: Letting AI agents decompile a first-person shooter

A retrospective on a 3-month project in which Claude Code and Codex agents (Sonnet 5, Opus 5.5, Luna, Sol, Terra) decompiled a first-person shooter into C++, using ida-mcp, GitHub issues and Discord for coordination. The first month's agents produced readable but semantically wrong code, and a reviewer agent could not catch it. A byte-matching oracle script, comparing compiled OBJ output against the original EXE/PDB, gave a strict PASS/FAIL signal. That let cheaper models like Luna scale to 14+ agents and reach 99% of functions present and 83% byte-exact. Lessons include lowering the compaction threshold to 42%, hourly cron re-injection of the instruction document, hashing the verifier in CI to stop agents tampering with it, and the failure of review when correctness is undefined.

Claude CodeCodexIDA Pro+5

Claude Sonnet 5Claude Opus 5.5GPT-6 Luna+5

coding-agents, agents, ai-policy· Published and added 11 Oct 2026

arxiv.orgpaper🛡️ Security

On the Reliability of LLM-Based Vulnerability Patching Benchmarks

This arXiv paper examines why current LLM-based automated vulnerability-patching benchmarks overstate model performance, identifying pitfalls at the agent level (prompting/tooling inflating success without improving patch quality), framework level (permission errors, infra bugs, timeout handling silently skewing scores), and dataset level (single PoC tests failing to verify root-cause fixes). The authors curate 112 historical bugs across 84 open-source C/C++, Go, and Rust projects, each annotated with PoC tests, regression tests, and developer-intent tests, and show that while PoC pass rates look high, developer-test pass rates stay low and barely improve with newer models. They provide guidelines for more rigorous, reproducible evaluation of LLM patching systems.

LLMCGo+1

AI Security, AppSec· Added 9 Oct 2026, published 7 Oct 2026

hackers-arise.comwriteup🛡️ Security

CUDA Basics for Hackers, Part 1: Getting Started

First part of a Hackers-Arise series teaching CUDA (NVIDIA Compute Unified Device Architecture): installing the CUDA toolkit and nvcc compiler on Kali or Debian-based Linux, writing a basic CUDA C++ kernel, and compiling and running a simple parallel vector-addition program. It explains GPU threading concepts (kernels, thread blocks, grids) and frames CUDA as foundational to AI workloads and to future security applications like password cracking, real-time threat detection and post-quantum cryptography, though those applications are only listed, not demonstrated, here.

Kali LinuxLinuxDebian

Master OTW

Learning· Added 7 Oct 2026, published 6 Oct 2026

eprint.iacr.orgpaper🛡️ Security

StOMR: Stateful Oblivious Message Retrieval

StOMR is a new "stateful" model for Oblivious Message Retrieval (OMR) — the FHE-based technique letting a recipient scan an untrusted bulletin board for their messages without revealing which ones are theirs, used in anonymous messaging and blockchain privacy. By letting sender and receiver keep lightweight private state (established via a new OMR-KEM key-encapsulation scheme) instead of relying purely on public-key FHE, StOMR shrinks sender-published signals by roughly 550x, 650x, and 178x compared to PerfOMR, SophOMR, and InstantOMR respectively, while matching detector performance; implemented in C++ and published at ACM CCS.

C++Fully Homomorphic Encryption

PerfOMRSophOMRInstantOMR+1

other· Added 8 Oct 2026, published 6 Oct 2026

aws.amazon.comarticle🛡️ Security

AWS Continuum sets a new standard in autonomous code security

AWS describes Continuum for code vulnerabilities, a multi-agent system that autonomously discovers, demonstrates, and patches memory-safety bugs in C/C++ codebases, evaluated against CyberGym-E2E — a 920-task benchmark built from historical OSS-Fuzz vulnerabilities across 139 open-source projects. Continuum passed 819/920 tasks (89.0% end-to-end success, S3 stage) within the 90-minute limit, beating the prior public best of 65.9% by 23.1 points, and reached 93.7% without the time limit. The post also explains the benchmark's four cumulative validation stages (crash reproduction, patch effectiveness, functional-test preservation, historical-vuln match) and positions deployment-context prioritization as future work beyond the benchmark's scope.

AWSAWS ContinuumC+1

CyberGym-E2EOSS-FuzzDeception Benchmark

AI Security, AppSec· Added 7 Oct 2026, published 5 Oct 2026

huggingface.corepo🧠 AI

Kyutai Pocket TTS

Pocket TTS is a 100M-parameter text-to-speech model from Kyutai designed to run efficiently on CPU, generating audio faster than real-time (~6x on a MacBook Air M4) with ~200ms latency to first audio chunk and voice cloning from short audio samples. It supports English, French, German, Portuguese, Italian, and Spanish, ships a Python library and CLI, and has spawned numerous community ports (WASM, ONNX, Rust/Candle, MLX, C++, C#) and fine-tuned language variants (Czech, Hindi, Korean, Persian, Indonesian, Estonian, Welsh, Polish).

PyTorchPythonHugging Face+6

KyutaiManu OrsiniSimon Rouard+4

models, multimodal· Added 2 Oct 2026

agent-wow.shwriteup🧠 AI

GPT-6 Astra plays World of Warcraft for the first time with agent-wow

agent-wow is an open-source platform that lets LLM agents play World of Warcraft by interacting directly with the AzerothCore private-server network protocol rather than through computer vision or scripted game APIs — the agent itself writes gRPC modules, packet handlers, and even a custom C++ Detour-based pathfinding tool to navigate the world. In this first run, Codex using GPT-6 Astra (xhigh) was given the single prompt 'create an orc character and complete all quests in the starting zone' and completed it unassisted in 40 minutes with zero deaths, data-mining AzerothCore's SQL source for quest/NPC/spawn data to plan its route. The author frames WoW as a long-horizon strategic-planning and real-time tactical-execution benchmark for frontier model agents, comparable in spirit to Mindcraft (Minecraft) and the Factorio Learning Environment, with a stated goal of eventually running many agents through Icecrown Citadel.

PythonGogRPC+1

GPT-6 AstraCodexAzerothCore+2

agents, evals· Published and added 2 Oct 2026

deepmind.googlearticle🧠 AI

Gemini 4 Argon: our next era of frontier intelligence

Google DeepMind's announcement of Gemini 4 Argon, a frontier model rolling out first to trusted cyber defenders via the Fairwind Program, with an industry-leading 1M output token limit (up from 64K) and pricing of $2/$10 per million input/output tokens. It reports state-of-the-art results on DeepSWE v1.1, the Vals Index, AutomationBench, LVBench, and CWE-bench v1, details internal use cases (quantum algorithm optimization, C/C++-to-Rust migrations including the Fuchsia Zircon kernel and libgav1), and describes new frontier safeguards covering misuse defense, indirect prompt-injection robustness, chain-of-thought misalignment monitoring, and sandboxed training environment hardening.

GeminiRust

Gemini 4 ArgonGoogle DeepMindFairwind Program+12

models, evals, ai-safety· Published and added 30 Sep 2026

blog.googlearticle🧠 AI

Gemini 4 Argon: our next era of frontier intelligence

Google announces Gemini 4 Argon, a frontier model rolling out first to trusted cyber defenders via the Fairwind Program, with a 1M-token output limit (up from 64K) and introductory pricing of $2/$10 per million input/output tokens. It reports state-of-the-art results on DeepSWE v1.1 (77.9%), LVBench (91.7%), AutomationBench (51.3%) and a tie for first on CWE-bench v1 (68%), plus leading scores on the Vals Index and Gray Swan's IPI prompt-injection benchmark. Internal case studies include agent-driven C/C++ to Rust migrations (libgav1 decoder 2.7x faster than the Rust port, Fuchsia Zircon kernel) and fleet-wide memory optimisation. It also outlines safeguards: misuse monitoring of internal activations, prompt-injection hardening, chain-of-thought misalignment monitoring and sandbox hardening.

GeminiRust

Gemini 4 ArgonGoogleFairwind Program+16

models, coding-agents, ai-safety· Added 1 Oct 2026, published 30 Sep 2026

fossa.comarticle🛡️ Security

Generating and Managing C and C++ SBOMs

A FOSSA blog post explaining why C/C++ SBOMs built from manifest-parsing alone are incomplete, since the ecosystem lacks a centralized package manager and relies heavily on vendored (copy-pasted) source and code snippets. It covers concrete generation paths: Conan's built-in conan.tools.sbom CycloneDX generator, Yocto/OpenEmbedded's native SPDX output via the create-spdx class, process-based tracking for vendored code (third_party/vendor path flagging, manual audits), and the differing snippet-support capabilities of SPDX versus CycloneDX.

SBOMCycloneDXSPDX+3

Supply Chain· Added 1 Oct 2026, published 29 Sep 2026

microsoft.comwriteup🛡️ Security

NeedyMantis: Unpacking a post-compromise malware family used in targeted operations

Microsoft Threat Intelligence documents NeedyMantis, a previously unreported modular post-compromise malware family used in targeted intrusions against telecoms, universities, medical nonprofits, intergovernmental organizations, and government contractors. The writeup details a multi-stage C++/x64 shellcode loader chain delivered via DLL sideloading (abusing Poedit, curl, TightVNC, Vim, and spoofed Office/Broadcom/Intel/NVIDIA DLLs), a custom encrypted/compressed archive format, a minimized custom PE-like executable format, and a WebSockets-based C2 protocol with RC4 key exchange and modular load/unload commands. Microsoft links observed use to Storm-3069 (tied to the Kaspersky-reported DAEMON Tools supply chain compromise) and China-nexus activity, and provides IOCs, Defender detections, and KQL/Sentinel hunting queries.

WindowsPowerShellImpacket+3

NeedyMantisStorm-3069DAEMON Tools supply chain compromise+3

Malware & RE, Threat Intel· Added 7 Oct 2026, published 28 Sep 2026

endorlabs.comarticle🛡️ Security

Next-Gen SCA for C/C++: Closing the Detection Gap | Blog | Endor Labs

Endor Labs announces C/C++ language support for its SCA product, addressing the long-standing difficulty of tracking OSS dependencies in ecosystems with no central package registry. Because C/C++ developers commonly vendor (copy and modify) library source directly into their repos, Endor Labs builds a fingerprint index of known OSS libraries using cryptographic hashes for exact-match segments (functions, license blocks, etc.) and ML-generated code embeddings to catch renamed, reformatted, or lightly modified copies. The company reports customer benchmarks showing 81% fewer false negatives and 143% more true positives versus prior tooling for building SBOMs and detecting vulnerable/license-non-compliant code in C/C++ codebases.

Endor LabsCSBOM

Supply Chain· Published and added 11 Sep 2026

endorlabs.comarticle🛡️ Security

Common C/C++ Vulnerabilities: A Practical Guide to Prevention | Blog | Endor Labs

Endor Labs guide to C/C++ memory-safety and input-handling vulnerabilities — buffer overflow (CWE-787/120/121), use-after-free (CWE-416), null pointer dereference (CWE-476), integer overflow (CWE-190), and format string bugs (CWE-134) — with vulnerable/fixed code snippets for each. It surveys detection tooling (Coverity, CodeQL, Clang Static Analyzer, AFL++/libFuzzer with ASan/UBSan, OSS-Fuzz) and argues that build-system complexity (Bazel, CMake, Conan, vcpkg) and high SAST false-positive rates make reachability analysis necessary, closing with a pitch for Endor Labs' AURI reachability engine.

Endor LabsCodeQLAURI+1

CWE-787CWE-416CWE-476+4

AppSec, Learning· Published and added 11 Sep 2026

adversa.aiarticle🛡️ Security

Top GenAI security resources — September 2026

Adversa AI's September 2026 roundup of 15 GenAI security resources, grouped by attack technique, defense, threat modeling, red teaming, and training. Highlights include the OWASP LLM Top 10 2026 update (now blending 75% expert consensus with 25% incident data from 6,639 vulnerabilities, with eight of ten entries moving and System Prompt Leakage renamed Hidden Context Exposure), a memory-safety audit finding 10 vulnerabilities (including two use-after-frees at CVSS 9.2/8.1) in the C/C++ inference engine underlying Ollama, LM Studio, Jan and GPT4All, and research on stealing reasoning traces from proprietary LLM APIs, RAG document poisoning, and attention-collapse-based poisoning detection (D-SCAN).

LLMOllamallama.cpp+2

OWASP Top 10 for LLM ApplicationsNIST AI 600-1IDOR+4

AI Security· Added 7 Oct 2026, published 9 Sep 2026

endorlabs.comarticle🛡️ Security

Why C Has Always Broken Static Analysis | Blog | Endor Labs

Endor Labs analyzes four structural reasons C/C++ static analysis has historically underperformed: preprocessor/build dependence, hard pointer-aliasing tradeoffs (over- vs under-approximation), pattern rules poorly suited to length/lifetime bugs vs. web-style source-sink flaws, and the lack of dominant frameworks to model (unlike Spring for Java). It cites a study of 8,918 C++ programs showing LLM-generated code triggers confirmed runtime memory-safety violations (CWE-190, -122, -121) at 3.6x the human rate, bugs invisible to static-only CI gates and only caught by sanitizers/model checking. It surveys existing analyzer approaches (Coverity/Klocwork/CodeSonar build-based, Veracode binary-based, build-less scanners, generalist multi-language SAST) and their tradeoffs.

CCoverityKlocwork+2

AppSec· Added 3 Sep 2026, published 25 Aug 2026

opensourcemalware.comtalk🛡️ Security

The OpenSourceMalware Show #18

Episode 18 of the OpenSourceMalware Show discusses the compromise of Rust maintainer 'dhrundy' that pushed malicious versions of arrayref (245M+ downloads), internment, and append-only-vec with a typosquatted build dependency executing a remote binary at compile time, which Wiz Research ties to DPRK infrastructure shared with the Mastra and Axios npm compromises. It also covers StubMaker, a campaign that started as RubyGems typosquats of bundler/i18n/rake/activesupport and shares byte-identical payloads (a 22MB Rust loader with an embedded Go infostealer, including a Chrome App-Bound Encryption bypass) with a 40-package npm typosquatting cluster targeting axios, chalk, commander, lodash, react and typescript, with signs it also hit PowerShell. The hosts also note a rising trend of attackers bundling compiled C++/Rust/Go binaries in npm/RubyGems packages (a red flag for analysts) and a PolinRider reinfection wave now using NullReceiver instead of EtherHiding for stage-two C2 hiding.

RustnpmRubyGems+3

StubMakerarrayrefDPRK+9

Supply Chain, Threat Intel, Malware & RE· Added 3 Sep 2026, published 21 Aug 2026

endorlabs.comarticle🛡️ Security

How JavaScript Sandboxes Work | Blog | Endor Labs

Endor Labs explains why vm2-style JavaScript sandboxes (shared heap, shared built-ins, shared Function constructor) suffered 20+ documented escapes via prototype pollution and Function constructor abuse, and how V8 Isolates (used by isolated-vm) fix this by giving guest and host separate heaps and built-ins. It also discloses GHSA-864f-rcv7-6rh4, a critical isolated-vm vulnerability in the ExternalCopy/Reference C++ binding layer that let guest code corrupt host memory across the isolate boundary, patched in isolated-vm 7.0.1/6.2.0.

isolated-vmvm2V8+1

GHSA-864f-rcv7-6rh4

AppSec· Added 3 Sep 2026, published 20 Aug 2026

theravenfile.comwriteup🛡️ Security

MAJINAHANASHI RANSOMWARE: Yet Another Japanese Locker

Deep-dive intelligence report on Majinahanashi, a Japanese-themed ransomware group that emerged in August 2026, covering its Tor data-leak site (math-captcha gated, non-vanity domain), victimology (15 victims across Europe/Asia/Latin America, avoiding US/English-speaking countries), and technical analysis of its C/C++ locker sample. The malware uses AES-256 with RSA-wrapped per-file keys, appends the .MAJIN extension, deletes shadow copies/USN journals/event logs via vssadmin/bcdedit/fsutil, hijacks the desktop wallpaper, and uses WFP-based network filtering plus I/O priority manipulation to suppress EDR/backup traffic (targeting CrowdStrike, SentinelOne, Defender, Veeam, etc.). The article includes a full YARA detection rule, the ransom note text, BTC/qTOX/email contact IOCs, and threat-actor profiling ("THE DOCTOR CAME" persona) plus links to Mimikatz and Advanced IP Scanner usage.

YARAnginxFlask+4

MajinahanashiTHE DOCTOR CAMEYurei+4

Threat Intel, Malware & RE, Blue Team & Detection· Added 3 Sep 2026, published 14 Aug 2026

github.comrepo🛡️ Security

Semgrep Rules (0xdea)

A "battle-tested" collection of Semgrep rules by researcher 0xdea aimed at C (and some C++) vulnerability hunting, covering buffer overflows, use-after-free/double-free, format string bugs, integer truncation/wraparound, command injection, insecure APIs (gets, strcpy, sprintf, scanf family), privilege management ordering, ReDoS, and dozens of other memory-safety and secure-coding checks. Rules are published to the Semgrep registry as "p/0xdea" and can be run directly via `semgrep --config "p/0xdea"` or cloned locally, with SARIF output support for triage in VS Code via SARIF Explorer. The repo also documents a roadmap including porting rules to the Semgrep Pro engine for taint/inter-procedural analysis.

SemgrepCSARIF+1

use-after-freedouble-freeformat string bugs+4

AppSec· Added 3 Sep 2026, published 31 Jul 2026

github.comrepo🧠 AI

redhat-et/ripwire

Ripwire is an offline, single-binary CLI (with optional MCP server) that indexes a repository to give coding agents a ranked, deterministic call graph, task-oriented context bundles (--for, --pack-task), and edit-time checks (--edit-check, --quality-delta, --test-gate) that flag blast radius, contract breakage, and code-quality regressions. It installs skills for Claude Code, Codex, Cursor, Windsurf, Gemini, opencode and aider, and ships extensive self-published benchmarks (docs/EVALS.md, LocBench-style head-to-head comparisons against graph-database MCP servers like codebase-memory-mcp, repowise, graphify and aider) claiming large token and latency savings plus higher file@10 retrieval accuracy. The README includes a detailed field report on using it across a ~20-agent, ~1,500-file C++/Metal orchestration engagement.

Model Context ProtocolClaude CodeCodex+6

WindsurfGeminiaider+3

coding-agents, mcp· Added 2 Oct 2026, published 29 Jul 2026

huntress.comwriteup🛡️ Security

Reverse Engineering the Six Stages of MacSync Stealer and RAT

Huntress reverse-engineers MacSync, a macOS stealer-and-RAT chain delivered via a weaponised claude.ai share link promoted through Google Ads malvertising, where a victim searching for how to install Claude on a Mac pastes a curl piped to zsh one-liner. The writeup traces all six stages: a polymorphic zsh loader, a server-side AppleScript that social-engineers Full Disk Access and validates the account password via dscl authonly, keychain and browser Safe Storage theft, a statically-linked C++ Mach-O RAT with WebSocket and AES-CBC C2 plus LaunchAgent persistence disguised as legitimate updaters, a signed Screen Recording-badged helper that phishes the TCC screen-capture permission, and trojanised Electron wallet apps (Ledger Live and Ledger Wallet) that inject a fake recovery-phrase phishing flow. It ties the kit to the AMOS and Atomic Stealer lineage via Russian-language code comments and shared infrastructure, and documents concrete IOCs including domains, C2 IP, mutex naming, and plist patterns for defenders.

macOSClaudeGhidra+3

MacSyncAMOS stealerSectopRAT

Malware & RE, Threat Intel· Added 3 Sep 2026, published 29 Jul 2026

cloud.google.comarticle🛡️ Security

AI-Assisted Vulnerability Management

Mandiant/Google Threat Intelligence Group blog outlining a blueprint for safely integrating LLM agents into vulnerability management: defense-in-depth guardrails (input sanitization treating codebases as untrusted, sandboxed workload isolation, JIT scoped machine identities, toxic flow analysis for runtime exfiltration monitoring), a risk-based vulnerability management scoring formula combining CVSS, asset context, and EPSS/threat intelligence, and a "binary vs architectural oracle" framework explaining why AI agents excel at memory-corruption bugs (crash/no-crash feedback) but struggle with authz bypasses and business-logic flaws. It also covers IDE vs CI/CD remediation workflows, post-deployment controls like model pinning and immutable audit logs, and a longer-term push toward memory-safe language migration (e.g., C/C++ to Rust) using LLM assistance.

WizLangChainCVSS+3

NIST AI RMFOWASP Top 10 for LLM ApplicationsSAIF+9

AI Security, AppSec, DevSecOps· Added 3 Sep 2026, published 18 Jul 2026

github.comrepo🛡️ Security

Metis

Metis is an open-source agentic AI security code review framework built by Arm's Product Security Team that uses LLMs for semantic vulnerability detection rather than hardcoded rules. It performs deep security review across codebases (with C/C++ reachability analysis via a code graph), validates and triages findings from itself or third-party SAST tools to reduce false positives, and annotates SARIF output. It supports multiple LLM providers (OpenAI, Azure OpenAI, Anthropic, Gemini, AWS Bedrock, vLLM, Ollama, llama.cpp, LiteLLM) and vector-store backends (ChromaDB, PostgreSQL/pgvector, Qdrant) for RAG-based codebase indexing and querying.

SARIFPostgreSQLDocker+3

AI Security, AppSec· Published and added 31 May 2026

somersetrecon.comwriteup🛡️ Security

Quacc++

Somerset Recon details Quacc++, a proof-of-concept automated bug hunter that queries grep.app's regex-based index of public GitHub repos to find candidate vulnerable code, downloads matching repositories, and runs Semgrep taint-analysis rules to confirm exploitable patterns. Using a search for strcpy(buf, argv[ paired with a custom Semgrep taint rule, the authors discovered an unbounded strcpy stack buffer overflow in GetArgumentFiles() in Google DeepMind's Lab repository (engine/code/bspc/bspc.c), confirmed with AddressSanitizer and pwntools/GDB to give full RIP control at offset 1080. The post also walks through Semgrep rules for SQL injection (CWE-89), hardcoded API keys (CWE-798), and disabled TLS certificate validation (CWE-295) across curl/wget/requests/Node/Go.

SemgrepGDBGitHub

CWE-89CWE-798CWE-295+1

AppSec, Offensive Security· Published and added 7 May 2026

github.comrepo🛡️ Security

0xMohammedHassan/morphkatz

MorphKatz is a static C++20 Windows x64 tool that rewrites PE binaries and raw shellcode into semantically identical but byte-different variants using a Zydis-powered CFG-aware disassembler/encoder, YAML rewrite rules, and EFLAGS liveness tracking. It targets two audiences: detection engineers who can measure what percentage of their YARA/Defender/Elastic/Sigma rules survive N polymorphic variants (--variants, --target, --bisect against a live Defender via MpCmdRun), and authorized red-teamers who need reproducible, seed-based, rule-cited evasion runs with JSON/HTML diff reports for engagement deliverables. It explicitly excludes ML-behavioral evasion and live pop-malware obfuscation, restricting mutations to author-audited, semantically-proven equivalence rules.

WindowsYARASigma+3

HackTool:Win32/AmDisable!MTB

Blue Team & Detection, Offensive Security, Malware & RE· Published and added 7 May 2026

0xv1n.github.iowriteup🛡️ Security

Remote Session Enumeration via Undocumented Windows APIs

A reverse-engineering walkthrough of qwinsta.exe showing it uses the undocumented WinStation API (winsta.dll) — WinStationOpenServerW, WinStationEnumerateW, WinStationQueryInformationW — rather than the documented Terminal Services (WTS) API used in harmj0y's prior PowerShell approach. The author demonstrates that remote session enumeration via these APIs succeeds against a target host even when Remote Desktop is disabled, and provides C++ code to load winsta.dll, resolve the undocumented function pointers via GetProcAddress, and parse the resulting byte-array structures to extract usernames and session state.

WindowsRDP

harmj0yGrzegorz TworekProcess Hacker+5

Offensive Security, Malware & RE· Added 3 Sep 2026, published 14 Jul 2024