PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Intego X9: Never trust my updates

blog.quarkslab.com | research | #vulnerability-research | #privilege-escalation | #macos | #vulnerability | #antivirus | #intego | #xpc | #toctou
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Part three of Quarkslab's Intego series: chaining an XPC authentication bypass in the com.intego.netupdated daemon with another flaw to reach root, highlighting weak validation in macOS XPC mechanisms.
Published
Collected

Related coverage

research · blog.quarkslab.com
Milking the last drop of Intego - Time for Windows to get its LPE
Quarkslab discloses a Windows LPE in Intego 3.0.0.1: the Optimization module deletes files as SYSTEM without validating directory junctions, chaining the Config.msi trick to reach SYSTEM privileges.
research · blog.quarkslab.com
Avira: Deserialize, Delete and Escalate - The Proper Way to Use an AV
Quarkslab details three Avira Internet Security flaws — arbitrary file delete (CVE-2026-27748), insecure deserialization (CVE-2026-27749) and a TOCTOU folder delete — two escalate to SYSTEM.
research · blog.quarkslab.com
Intego X9: Why your macOS antivirus should not trust PIDs
Part two of Quarkslab's Intego series: combining Ghidra static analysis with Frida tracing to show how a PID reuse race can bypass XPC authentication checks on privileged macOS services.
research · blog.quarkslab.com
Intego X9: When your macOS antivirus becomes your enemy
First part of Quarkslab's Intego series: several vulnerabilities compromise all Intego applications on macOS (CVE-2026-26224, CVE-2026-26225), whether installed standalone or as a bundle.
research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
High · vulnerability · codeberg.org
cowcups: CUPS cups-fontpath Local Privilege Escalation (LPE) to Root PoC
Demonstrates an effective local root privilege escalation chain in default CUPS environments by abusing printer discovery and Ghostscript font search paths.
Back