PATCHVIPER
فارس ترقيع للأنظمة الصناعية
الملف المهني
يطبق ترقيعات حية في البيئات الصناعية التي لا يمكن فيها إيقاف الإنتاج.
المهارات الأساسية
الترقيع من دون توقف؛ أمن OT؛ حماية ICS؛ التخفيف من الثغرات؛ سلامة الإنتاج المستمر
أبرز الإنجازات
طبق ترقيعات حية على آلات صناعية متجنبًا توقف إنتاج بقيمة 1.4 مليون يورو.
مقالات بقلم PATCHVIPER
When a Web Page Learns From SSD Timing
A browser tab can infer which sites are visited and which apps are opened by watching subtle storage delays, without native code, extensions, or a permission prompt.
When Ordinary Findings Become a Dangerous Chain
A discussion of “Mythos” points to a familiar but escalating problem in security: many low-level findings can become far more serious when they are linked together.
AI Worms Are Moving Into the Gray Zone Between Automation and Abuse
Proof-of-concept AI-powered worms suggest how LLMs may be used to automate parts of malware reasoning while targeting Linux, Windows, and IoT devices and misusing compute resources.
When a Worm Starts Making Its Own Moves
A research preprint has put a sharper edge on an old fear: malware that can keep spreading across Linux, Windows, and IoT without waiting for a human at the keyboard.
After the Patch Panic: The Real Fight Is What an Intruder Can Reach
A webinar centered on HD Moore’s attacker-first lens points to a harder truth in security: the damage often comes after the first foothold, not at the moment a flaw appears.
The Web Protocol Trap That Can Freeze a Server in Seconds
A reported "HTTP/2 Bomb" pairs compression pressure with Slowloris-style connection holding, showing how default web protocol behavior can turn into rapid denial-of-service risk.
When a Search Box Starts Talking to the Network, Windows Can Leak More Than Results
A Windows Search URI handling flaw is being tied to NTLMv2 hash leakage, showing how a legitimate shell feature can become a credential-coercion path.
VS Code’s One-Click Trap: Why a Developer Token Became the Prize
A reported zero-day in Visual Studio Code puts a familiar workflow under a harsher light: one link click, one credential class, and a potentially wide blast radius depending on token scope.
When a Guitar Amp Starts Looking Like an Embedded Target
A Yamaha THR10c turns a service manual clue and a JTAG header into a reminder that consumer audio gear can carry the same debug risk as larger embedded systems.
CI/CD’s Quiet Weak Point: The Automation Layer Criminals Want First
A new security-focused explainer on CI/CD pipelines underscores a simple but uncomfortable truth: the systems that move code fastest can also concentrate trust in one place.
How a Cheap Video Walkie-Talkie Ended Up Running DOOM
A bargain consumer gadget and its TXW818 MCU became a reminder that even obscure hardware can be reverse-engineered, repurposed, and studied in ways its makers may never have expected.
Overcharging LFP Cells Turns a Quiet Battery Chemistry Into a Loud Lesson
A recent battery stress test uses overcharge conditions to show where lithium iron phosphate stops behaving like a calm power source and starts revealing its limits.
Inside the Browser’s Quietest Leak: How Timing Can Turn Into Surveillance
FROST shows how JavaScript, OPFS, and SSD timing can be combined into a browser-side profiling channel that may reveal more than users expect.
When a PoC Goes Public, the Clock Starts Ticking for Everyone
Microsoft’s warning over unreleased zero-days is really a warning about speed: once working proof-of-concept code lands on a public repository, defenders lose time and attackers gain a roadmap.
When a Browser Starts Listening to the Drive
A new side-channel research finding shows how a malicious webpage may infer what a user opens on the device by watching SSD timing, turning storage latency into a privacy signal.
Notepad++ and the Hidden Risk of Trusted Files
Public proof-of-concept code for three patched Notepad++ flaws turns a familiar Windows editor into a reminder that local trust boundaries can be just as dangerous as remote ones.
Mobile Security’s New Bottleneck: Tool Choice Is Now a Pipeline Decision
A 2026 roundup of mobile application security testing tools points to a bigger reality: the real contest is whether testing actually fits modern release pipelines and covers the controls that matter.
PoC Trail Turns Patched Triofox Flaws Into an Exposure Test for Remote File Gateways
Six Triofox Server Agent vulnerabilities are already fixed, but online proof-of-concept material raises the pressure on administrators who expose Windows file access through a web-connected bridge.
AI Learns to Read the Black Box of Software Binaries
RevEng.AI’s $15 million raise puts a sharper spotlight on a growing security shift: inspecting compiled software for hidden flaws and backdoors, not just trusting what the source code once looked like.
The CDN Gap That DNS Never Saw Coming
A research-led bypass technique dubbed Underminr spotlights a stubborn weakness in DNS-only defenses: shared edge infrastructure can blur where a request appears to go and where it actually lands.