PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

AD Group Risks: Hidden Powers of Account Operators

semperis.com | blog | #ai-security | #exploitation | #experiment | #ai-agent | #security | #porting
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

# AD Group Risks: Hidden Powers of Account Operators * AD Security 101 * Aug 28, 2026 * Read 5 MIN * What can Account Operators actually do? * Why does the Account Operators group become dangerous...
Published
Collected

Related coverage

blog · semperis.com
AD Group Risks: Hidden Powers of Account Operators
Account Operators looks harmless without 'admin' in its name, yet it grants broad control over domain identities—here is how attackers abuse it to escalate.
blog · xbow.com
A Vulnerability Is a Hypothesis. An Exploit Is the Proof.
Every security team runs on one scarce resource: the attention of those who can fix things. Only an exploitable bug is worth interrupting an engineer for.
blog · xbow.com
XBOW Built a Chrome Full-Chain Exploit Affecting a Billion Users in Six Days
XBOW recently discovered and built a Chrome full-chain exploit affecting an estimated billion users globally.
tool · hunt.io
Inside a PaperCut Attacker’s AI Toolkit: Agent Instructions, Exploit Code, a Second RCE, and Victims Across 45+ Countries
A PaperCut attacker left their open directories exposed. We reconstruct the AI-driven exploitation pipeline, a second XML-RPC RCE path, and chisel persistence from the operator's own server.
blog · portswigger.net
Implementing Tic Tac Toe with 170mb of HTML - no JS or CSS
Gareth Heyes builds Tic Tac Toe using only HTML and Chrome's experimental popover feature — no JavaScript or CSS — by brute-force generating 170MB of markup covering every possible game state.
blog · blog.trailofbits.com
Your AI agent fixed the bug, but what else did it change?
We’re publishing patching-bugs and regression-hunt, two plugins that let engineers delegate patch development and regression checks to agents.
Back