Each feed is checked for new posts. Every post is read, and those that belong here join the catalog. What Trove read and did not keep stays on file, not shown.
XM Cyber researchers detail a four-stage exploit chain in Microsoft SCCM (Configuration Manager) that lets any unprivileged domain user achieve SYSTEM-level remote code execution on the primary site server: a missing authorization check on the AdminService UploadExtensionInChunks endpoint (CVE-2026-47301), a weak code-signing check that accepts any commercial certificate, a "CabSlip" Zip-Slip-style path traversal in CAB extraction giving arbitrary file write, and DLL hijacking of adsource.dll loaded by the SYSTEM-level SMS Executive service. Microsoft patched the RBAC bypass in July 2026, but the rest of the chain remains exploitable via the built-in Operations Administrator role until a full fix in ConfigMgr 2609 (October 2026); the article also gives log-based detection guidance (AdminService.log DirectoryNotFoundException/HTTP 500 patterns) and interim mitigations.
XM Cyber announces two open-source offensive tools: FAInd my XPC (also called XPC Hunter), which automates discovery and proof-of-exploit for macOS privileged XPC services that authorize callers by code-signing identity alone — bypassing this via AMFI code-signing cache priming and sealed NIB resource swapping to achieve unauthenticated root code execution, using Claude for LLM-driven reverse engineering of daemon interfaces; and pOliCI plus a CLI Signing Helper (a fork of the OCI CLI with instance-principal authentication support), which parse Oracle Cloud Infrastructure IAM policies to compute effective permissions and identify privilege-escalation paths. Both tool sets were debuted at BlackHat USA 2026 Arsenal and DEF CON 2026.
macOSClaudeOracle Cloud Infrastructure+3
XM Cyber
Offensive Security, Cloud & Infra, AI Security· 2026-07-30T12:51:55+00:00
An XM Cyber analysis of the 2026 Verizon DBIR, which for the first time ran attack-graph analysis across real environments to model post-compromise privilege escalation rather than just initial access vectors. Key findings cited: exploitation of vulnerabilities overtook credential theft as the top initial-access vector (31%), 83% of privilege-escalation incidents involved no vulnerability, 16% of organizations had an 80%+ chance a low-privilege attacker could reach a key admin account, and only 26% of CISA KEV vulnerabilities were fully remediated in 2025 (down from 38%) with median remediation time up to 43 days. The piece argues security programs over-invest in patching (which addresses only ~10% of escalation techniques) versus privilege/permission hygiene (which addresses ~65%), and recommends attack-path "choke point" remediation and prioritized patching over patch-everything approaches.
XM Cyber researchers detail a macOS privilege escalation technique that lets a standard user disable EDR/MDM agents without admin credentials by exploiting stale kernel CDHash trust caches combined with NIB payload injection to impersonate trusted, code-signed application components. Once inside the trusted process context, the attacker uses an AppleScript-to-JXA-to-Objective-C runtime bridge (loading OSAKit.framework, forging Block_layout/objc_msgSend structures) to call unauthenticated privileged XPC methods like runProcessWithCommand: and ceaseSystemExtensionWithReply:, forcing security products to disable or remove themselves. The authors built an open-source scanner, XPC Hunter, to find this exposure across installed macOS apps at scale and recommend fixing it via xpc_connection_set_peer_code_signing_requirement() or SecCodeCheckValidity() peer validation.
macOSEDRXM Cyber
Offensive Security, Malware & RE, Mobile Security· 2026-06-24T19:01:21+00:00
xmcyber.comwriteup
