Unmasking SCCM Application Execution

This coverage gives security teams current context for monitoring, validation, and remediation.

A Project Zero write-up showing how a local network attacker can abuse Windows 10 WPAD/PAC proxy files, executed as JavaScript by jscript.dll, to achieve remote code execution.

Part 1 of SpecterOps' WSUS research: coercing a WSUS machine account into a relayed SQL session, then abusing stored procedures to forge malicious updates and target specific computers.

Learn about the anatomy of the SANDWORM_MODE infection chain mapped against the components of a modern AI CI/CD pipeline.

Device-code phishing abuses the OAuth RFC 8628 flow: victims enter codes on genuine Microsoft pages while tokens land with attackers — plus template comparisons and Netlas hunting patterns.

Viettel dissects the ToolShell SharePoint chain—CVE-2025-49704 deserialization RCE and CVE-2025-49706 auth bypass—actively exploited, with patch bypasses CVE-2025-53770/53771 and hunting guidance.