Remediation track
Step-by-step patch playbooks, written by operators who’ve shipped the fix.
Linux · 4 guides
Baron Samedit — the sudo heap overflow, end to end
Heap buffer overflow in sudo's argument parsing hands any local user root. Detect the vulnerable build, patch without breaking PAM, and prove it across 2,000 hosts.
RegreSSHion: the OpenSSH RCE that came back from 2006
A signal-handler race in sshd (sshd(8)) that was fixed in 2006 and then quietly un-fixed. Patch sshd, or apply the mitigations where you cannot reboot immediately.
Dirty Pipe — overwriting the unwritable, and putting a stop to it
A kernel pipe bug lets unprivileged users scribble over read-only files — including SUID binaries. Here's how to find it and patch the kernel.
xz / CVE-2024-3094 — detect, root, and re-image
Malicious xz builds backdoored sshd via a hidden test fixture. You can't 'patch' a backdoor — confirm exposure, then re-image from a known-good source and rotate everything.
Windows Server · 8 guides
ESC1: when your certificate server mints domain admin on request
A certificate template that lets any domain user write their own name on the request is a domain admin factory. Build subjects from AD, scope who can enrol, and keep NDES from becoming your Tier 0.
Authenticated Users Can Add Domain Computers: zero the quota, delegate the join
By default, any domain user can join up to 10 computers to your AD. It's the opening move of noPac, RBCD and relay chains. Set the quota to zero, tighten the user right, and delegate joins properly.
Certighost: patch the CA, then kill the chase fallback
The AD CS flaw where the requester picked which server the CA phoned to verify them. Patch, then disable the chase fallback on anything that doesn't need it.
Pre-Windows 2000 computer accounts: delete the dead, rotate the living
Staged computer accounts whose password is the computer name in lowercase, or blank. Delete the inactive ones, rotate the live ones from the machine itself, and fix it with anything except the Reset Account button.
Null sessions on domain controllers: confirm, then close the enumeration
Anonymous enumeration of Active Directory over SMB null sessions: sometimes a genuine legacy leftover, sometimes by-design noise about pipes a DC needs to keep. Confirm what actually answers, then close the data leak without breaking the domain.
PetitPotam: patch, then break the relay
The NTLM coercion that turns one RPC call into a domain admin certificate. Patch the DCs, then make the relay fail: HTTPS and EPA on AD CS web enrolment, or remove the role outright.
LLMNR turn it off, then keep it off
LLMNR and NBT-NS will hand your NTLMv2 hash to anyone who answers first - Responder's favourite party trick since 2014. Here's the actual fix, and how to stop it quietly turning itself back on.
PrintNightmare — patch, then switch the print spooler off
The Print Spooler RCE/priv-esc that turned any domain user into SYSTEM. Patch, then disable the spooler on anything that never prints.
OpenSSL & TLS · 1 guide
Heartbleed — the memory-disclosure classic, for the record
Still finding Heartbleed lurking in embedded/legacy appliances? Patch OpenSSL, rotate the keys, reissue the certs.
Node.js, npm & runtimes · 1 guide
Spring4Shell — class loader shenanigans, defused
Spring's data binding let attackers write a webshell through the class loader. Bump Spring, and tighten up the runtime.
PostgreSQL & Redis · 1 guide
Redis RESTORE RCE: patch again, then take RESTORE away
Authenticated RCE chains against every supported Redis line, demoed against the May security releases everyone patched to. Upgrade to this week's releases, then take the RESTORE command away from anyone who doesn't strictly need it.
WordPress · 1 guide
wp2shell: patch WordPress, then check who got there first
Pre-authentication RCE in WordPress core: no plugin, no login, stock install. Update to 7.0.2 / 6.9.5 / 6.8.6 immediately, then hunt for whoever got there before the patch.