Remediation track
Step-by-step patch playbooks, written by operators who’ve shipped the fix.
Linux · 4 guides
Baron Samedit — the sudo heap overflow, end to end
Heap buffer overflow in sudo's argument parsing hands any local user root. Detect the vulnerable build, patch without breaking PAM, and prove it across 2,000 hosts.
RegreSSHion: the OpenSSH RCE that came back from 2006
A signal-handler race in sshd (sshd(8)) that was fixed in 2006 and then quietly un-fixed. Patch sshd, or apply the mitigations where you cannot reboot immediately.
Dirty Pipe — overwriting the unwritable, and putting a stop to it
A kernel pipe bug lets unprivileged users scribble over read-only files — including SUID binaries. Here's how to find it and patch the kernel.
xz / CVE-2024-3094 — detect, root, and re-image
Malicious xz builds backdoored sshd via a hidden test fixture. You can't 'patch' a backdoor — confirm exposure, then re-image from a known-good source and rotate everything.
Windows Server · 12 guides
N-central auth bypass: patch the server, then hunt what it left behind
The N-able N-central auth bypass that handed attackers the master keys to MSP estates over one weekend. Patch to 2026.3.1.7, then hunt the persistence the patch won't remove.
LDAP relay : sign your LDAP, bind your channels
Intercepted NTLM authentication, forwarded to your domain controller's LDAP service, becomes a valid login without knowing a single password. Enforce LDAP signing and channel binding, and the trick dies on the doorstep.
ADIDNS spoofing: one wildcard record that answers for everyone
Any low-privilege domain account can register a wildcard (*) DNS record in AD-integrated DNS and answer every unresolved query on the network. Claim the wildcard yourself, lock down the zone, and quieten the relay paths.
CVE-2026-50522: patch, hunt, then rotate the machine keys
Unauthenticated RCE in on-prem SharePoint via a forged security token. Patching is step one; if the box was exposed, the ASP.NET machine keys need rotating too, in the right order.
ESC1: when your certificate server mints domain admin on request
A certificate template that lets any domain user write their own name on the request is a domain admin factory. Build subjects from AD, scope who can enrol, and keep NDES from becoming your Tier 0.
Authenticated Users Can Add Domain Computers: zero the quota, delegate the join
By default, any domain user can join up to 10 computers to your AD. It's the opening move of noPac, RBCD and relay chains. Set the quota to zero, tighten the user right, and delegate joins properly.
Certighost: patch the CA, then kill the chase fallback
The AD CS flaw where the requester picked which server the CA phoned to verify them. Patch, then disable the chase fallback on anything that doesn't need it.
Pre-Windows 2000 computer accounts: delete the dead, rotate the living
Staged computer accounts whose password is the computer name in lowercase, or blank. Delete the inactive ones, rotate the live ones from the machine itself, and fix it with anything except the Reset Account button.
Null sessions on domain controllers: confirm, then close the enumeration
Anonymous enumeration of Active Directory over SMB null sessions: sometimes a genuine legacy leftover, sometimes by-design noise about pipes a DC needs to keep. Confirm what actually answers, then close the data leak without breaking the domain.
PetitPotam: patch, then break the relay
The NTLM coercion that turns one RPC call into a domain admin certificate. Patch the DCs, then make the relay fail: HTTPS and EPA on AD CS web enrolment, or remove the role outright.
LLMNR turn it off, then keep it off
LLMNR and NBT-NS will hand your NTLMv2 hash to anyone who answers first - Responder's favourite party trick since 2014. Here's the actual fix, and how to stop it quietly turning itself back on.
PrintNightmare — patch, then switch the print spooler off
The Print Spooler RCE/priv-esc that turned any domain user into SYSTEM. Patch, then disable the spooler on anything that never prints.
OpenSSL & TLS · 1 guide
Heartbleed — the memory-disclosure classic, for the record
Still finding Heartbleed lurking in embedded/legacy appliances? Patch OpenSSL, rotate the keys, reissue the certs.
Node.js, npm & runtimes · 1 guide
Spring4Shell — class loader shenanigans, defused
Spring's data binding let attackers write a webshell through the class loader. Bump Spring, and tighten up the runtime.
PostgreSQL & Redis · 1 guide
Redis RESTORE RCE: patch again, then take RESTORE away
Authenticated RCE chains against every supported Redis line, demoed against the May security releases everyone patched to. Upgrade to this week's releases, then take the RESTORE command away from anyone who doesn't strictly need it.
WordPress · 1 guide
wp2shell: patch WordPress, then check who got there first
Pre-authentication RCE in WordPress core: no plugin, no login, stock install. Update to 7.0.2 / 6.9.5 / 6.8.6 immediately, then hunt for whoever got there before the patch.
Network & security appliances · 1 guide
Check Point SmartConsole auth bypass: patch, then go hunting
The Check Point management server login that took the caller's word for who they were. Patch the Jumbo Hotfix, lock down Trusted Clients, and check whether someone got in before you.
Rails & Active Storage · 1 guide
KindaRails2Shell: upgrade Rails, then rotate every secret it could have read
A crafted 'image' upload makes Rails' image processor read any file on the server and hand it back as pixels, secrets included. Upgrade Active Storage, block untrusted libvips operations, and rotate everything the app process could read.
Email & SMTP · 2 guides
Mail spoofing: anyone can write your return address
SMTP never checks the return address, so anyone on the internet can send mail as your domain. I did exactly that to a client on a recent engagement, and they had no clue it was me. Here's how to test yours and what actually closes it (spoiler: not your mail server).
Open mail relay: your server, the internet's spam cannon
A mail server that forwards mail from anyone, to anyone, is a free spam cannon for the internet's least pleasant people, and it's your IP reputation that pays. Found one on my latest client engagement; here's how to test yours and close it.