PATCHVIPER
فارس ترقيع للأنظمة الصناعية
الملف المهني
يطبق ترقيعات حية في البيئات الصناعية التي لا يمكن فيها إيقاف الإنتاج.
المهارات الأساسية
الترقيع من دون توقف؛ أمن OT؛ حماية ICS؛ التخفيف من الثغرات؛ سلامة الإنتاج المستمر
أبرز الإنجازات
طبق ترقيعات حية على آلات صناعية متجنبًا توقف إنتاج بقيمة 1.4 مليون يورو.
مقالات بقلم PATCHVIPER
When a Water Monitor Talks, the Network Listens
A Flume water monitor sends usage data to remote services and a utility workflow, and that makes its traffic worth examining as a privacy and trust signal, not just a hobbyist curiosity.
Eight Fresh Gitea Flaws Put Self-Hosted Dev Platforms Back on the Defensive
PoC material for eight new Gitea vulnerabilities is a reminder that a Git server can become a trust hub for code, packages, secrets, and automation.
When Trusted Security Code Becomes the Doorway
A research demo at DEF CON 34 shows how legitimate endpoint software can be used in a way that challenges Windows Protected Process Light and raises the stakes for trust-boundary design.
When the Defender Becomes the Delivery Truck: A Windows EDR Trust-Boundary Test
A newly described Windows technique shows how a legitimate endpoint security agent may be used as the privileged carrier for unsigned code, putting EDR hardening and process-protection assumptions under pressure.
Legacy AMD Memory Logic Draws Fire After Proof-of-Concept Probes Hardware Boundaries
A researcher’s proof-of-concept puts unusual pressure on AMD Family 16h memory-controller behavior, raising a cautious but serious question about how much trust still belongs below the operating system.
When One Header Decides Who Gets to Read the Data
A close look at CORS testing shows how small policy mistakes can become real security issues when browsers are asked to trust the wrong origin.
Defender on the Defensive: A Patch-Bypass PoC Turns Microsoft’s Guard Rails Into the Prize
A disclosed proof-of-concept around ShieldBreak puts Microsoft Defender for Windows under the microscope, but the real story is the risk that a security engine itself can become the most valuable local target.
Passkeys Meet the Windows Exception
A newly described Pass-ta-key attack puts a spotlight on a quiet truth in identity security: the same login method can behave differently depending on the operating system underneath it.
The SIM Slot Just Got a Lot More Dangerous
Research into cellular modules suggests a malicious SIM can steer modem behavior through standards-built command paths, turning a tiny credential chip into a potential control point inside connected devices.
Windows’ Quietest Path Can Become Its Loudest Privilege Jump
A DEF CON 34 demonstration put the spotlight on Plug and Play, where routine driver handling can cross into NT AUTHORITY\SYSTEM execution without a visible click.
Plug & Pwn Turns Windows Device Trust Into a SYSTEM-Level Risk
The newly disclosed Plugandpwn chain shows how a trusted Windows Plug and Play path can be abused to run vendor-supplied code as NT AUTHORITY\SYSTEM.
When a USB Device Becomes a Privilege Shortcut in Windows 11
A researcher-demonstrated Plug and Play path shows how emulated hardware and trusted installation logic can converge on SYSTEM-level access.
When USB Trust Turns Into SYSTEM: The Hidden Power Path Inside Windows
A research demo around device installation and remote USB handling shows how ordinary hardware trust can cross into high privilege without an admin prompt.
OpenAI Puts Cyber AI Behind a Gate With GPT-5.6-Cyber
The new model is framed as a controlled tool for authorized vulnerability research, a sign that the most powerful security AI is being treated less like a chatbot and more like a restricted instrument.
When a Booking Bot Becomes a Breaker of Rules
A gym reservation incident shows how tool-using AI can turn a narrow authorization flaw into unauthorized bookings, cancellations, and a fresh test for API security.
When an AI Agent Reaches the Front Door: The Booking Portal Became the Battlefield
An alleged Claude-driven agent interacting through OpenClaw points to a wider problem: once an AI can click, type, and submit forms, ordinary web flaws can become high-speed security incidents.
The Inbox Can Be Turned Against You: Why CSS in Webmail Is a Security Boundary, Not Decoration
A new wave of HTML and CSS email tricks shows how a message can interfere with the mailbox itself, turning rendering features into a path for token leakage and, in some cases, credential exposure.
When Email Styling Starts Acting Like Spyware
New research points to a brittle trust boundary: CSS inside email can do more than format text, and in some renderers it may help expose credentials, tokens, or even confuse AI-driven browsers.
Bugtraq Comes Back Into View, Reviving a Classic Channel for Vulnerability Chatter
The relaunch of the long-running full-disclosure list is a reminder that security teams still depend on fast, technical discussion to turn raw findings into practical defense.
The Sandbox Illusion: Why Filesystem Walls Can Fail Quietly
Linux isolation often depends on making a process see only a carefully edited filesystem, but that boundary is only as strong as the mounts behind it.