Windows USB Driver Elevation of Privilege Vulnerability Patched by Microsoft

SLEEPWALKER side-loaded into ESET's AV agent and left zero network trace. It sits dormant until one crafted packet wakes it, running inbound-only with no hardcoded domains. Perimeter logs stay clean. → Compiled June 2024, discovered August 2026 → 23-instruction custom bytecode, AES-256-CCM encrypted commands → Six C2 transports including VMware VMCI, bypassing the physical NIC Attribution unknown. Tradecraft points to a targeted operation. Check your ESET agent folder for dpapi.dll where it shouldn't be. Full YARA rule and PowerShell scanner in the primary analysis. Link in the post. https://lnkd.in/d7ydNeYk

Routine kernel notifications deserve more security attention than they usually get. In the demonstrated RMI4 path, a KOBJ_REMOVE uevent becomes the place where freed slab bytes can cross into userspace. The interesting point is not that uevents are inherently dangerous. It is that ordinary observability mechanisms can become disclosure channels when lifecycle assumptions fail underneath them. That changes how defenders should think about telemetry. A stream such as uevents, audit records, journald messages, or eBPF events is not only evidence about system behavior. It can also expose unexpected data when a producer formats stale state. For incident response, the question is therefore two-sided: what did the system report, and was the reporting path itself operating on valid data? **In practical terms, it is a good time to:** - capture uevents around RMI4 device removal in a controlled test system and inspect NAME fields for abnormal data - inventory local services or agents that consume kernel device events through udev or netlink - correlate unusual device-event payloads with kernel warnings from KASAN, SLUB, journald, or the kernel ring buffer - preserve raw event data during reproduction so allocator artifacts are not lost in normalized logs Do your incident procedures treat kernel-generated telemetry as trustworthy evidence by default? #LinuxSecurity #ThreatDetection #IncidentResponse #KernelSecurity #SecurityOperations https://lnkd.in/e-ZbCza5

Memory forensics reveals what attackers tried to hide — even after they've covered their tracks. When analyzing a memory dump during incident response, process listing is your critical first step. Volatility 3 provides several plugins to reconstruct the process landscape from volatile memory: • windows[.]pslist — Lists active processes with PID, PPID, creation time, and exit time • windows[.]pstree — Displays parent-child process relationships in tree format • windows.cmdline — Extracts full command-line arguments for each process • windows[.]psscan — Pool tag scanning to find hidden/unlinked processes What to hunt for during analysis: • Unexpected parent-child relationships (explorer.exe spawning cmd.exe or powershell.exe is suspicious) • Misspelled system process names (scvhost.exe instead of svchost.exe — classic masquerading) • Orphaned processes where the PPID points to a terminated parent • svchost.exe not parented by services.exe (major red flag for process injection) • Processes appearing in psscan but missing from pslist (evidence of DKOM/unlinking) Command-line arguments often reveal the real story: encoded PowerShell, LOLBins abuse (certutil, mshta, regsvr32), or lateral movement tools. Compare your process tree against known-good baselines for the environment. Memory analysis catches techniques that evade traditional disk forensics — process injection (T1055) and masquerading (T1036) leave traces in RAM even when they're designed to be stealthy. The attacker may have deleted their payload from disk, but the process structure, command line, and memory artifacts remain. #DFIR #MemoryForensics #IncidentResponse #ThreatHunting #DigitalForensics

USENIX Security 2026: KERAT mines atomicity rules for check-use pairs on Linux and FreeBSD shared fields, then FSM-walks LLVM IR. 351 real bugs, 65 confirmed, 10 CVEs. Most kernel TOCTOU is another thread, not a double-fetch.

A researcher showed how a malicious LLM could take over the GPU host running it. Agents run on two machines: the harness and the inference server. That server has privileged access. Real case: CVE-2025-9141. vLLM passed tool-call args to eval

One of our security researchers at Delphos Labs, Kamil Leoniak, hung the Windows kernel with a USB device that serves a single malformed descriptor. We reported it to MSRC. On July 23 they responded that they do not consider it a bug and closed the case without a fix, so there is no CVE and no patch. The path was surfaced during an automated Delphos review of usbvideo.sys, the USB Video Class driver that ships with Windows, then confirmed by hand. The bug is that the validator accepts a descriptor that cannot advance the parser. USB descriptors are length-prefixed, and DumpAndValidateAllDescriptorsEx walks them by adding bLength to the cursor. The old generic validator rejected bLength=0 because it checked whether advancing the pointer would actually move it forward. The newer path, behind the feature flag Feature_Servicing_UvcDescriptPointerFix and enabled by default on the tested build, checks only that the length fits in the remaining buffer. Zero fits, validation returns success, and the caller advances by zero bytes. 34 bytes of configuration descriptor were enough. One VideoControl interface, a valid class-specific VC header, a vendor-specific descriptor with bLength=0, and two bytes of padding to keep the caller's bounds check true. It has to arrive as a single-function device. A composite device with an Interface Association Descriptor routes through usbccgp.sys first, and usbccgp strips anything with bLength under 2 before usbvideo.sys ever sees it. A Teensy 3.2 enumerating as a plain UVC device reaches the driver directly. One core pinned at 100% in kernel mode, USB enumeration stopped system-wide, unplugging did not recover it because the thread was stuck in driver code, and normal reboot was blocked. Reproduced three times from a clean boot. Full writeup on the Delphos Labs blog: https://lnkd.in/eKUupWHv

Exciting times at Delphos Labs. For those of you following the developments in foundation models - especially big releases like Open AI's GPT 6 Astra, Anthropic's Mythos: these new models claim native capability to process binary software with high fidelity. Delphos is getting bleeding edge, state of the art performance _without_ these models: using our proprietary AI tool chain. Momentum is building fast, and we are excited to share all our developments with you in our blog. For the non-security-research folks out there - our core offering enables us to process raw binary programs with no access to source code and identify: what does your software do, how does it work, are there vulnerabilities. And more. This is thanks to our amazing team of engineers pushing the boundaries of what is possible when you simply give agents the right tools at the right time.

MmMapIoSpace Returns NULL: Tracing the Real Kernel Mechanism Through ntoskrnl Tracing exactly why MmMapIoSpace returns NULL on Windows 11 past the commonly cited explanations and into undocumented page table ownership checks inside the kernel. https://lnkd.in/eAWMEjYw

Black Duck Signal brings real-time vulnerability detection to Claude through an MCP server for AI-assisted development workflows. https://buff.ly/jFQRp89 Black Duck #BlackDuck #MCPServer #MCP

Security telemetry can prove that something went wrong without proving what an attacker can do with it. KASAN identified the invalid access in this Landlock race. That is exactly what sanitizers are valuable for: surfacing memory behavior that normal testing may miss. But the finding still has to be interpreted carefully before it becomes an exploit claim. This distinction matters in both engineering and executive reporting. **In practical terms, it is a good time to:** - preserve sanitizer traces with the exact kernel commit or package build used during testing - correlate memory-safety findings with the triggering syscall sequence rather than severity labels alone - document whether a finding demonstrates a read, write, crash, privilege change, or boundary bypass - avoid marking “active exploitation” unless supported by separate evidence #ThreatDetection #LinuxSecurity #OpenSource #SecurityOperations https://lnkd.in/ejHZhTQ6