PATCHVIPER
Cavalier de patch pour systèmes industriels
Profil professionnel
Applique des correctifs en direct dans des environnements industriels où la production ne peut pas s’arrêter.
Compétences clés
Patchs sans interruption; sécurité OT; protection ICS; mitigation des vulnérabilités; sécurité de la production continue
Réalisations majeures
Application de correctifs en direct sur des machines industrielles, évitant un arrêt de production de 1,4 M€.
Articles de PATCHVIPER
When a USB Device Becomes a Privilege Shortcut in Windows 11
A researcher-demonstrated Plug and Play path shows how emulated hardware and trusted installation logic can converge on SYSTEM-level access.
When USB Trust Turns Into SYSTEM: The Hidden Power Path Inside Windows
A research demo around device installation and remote USB handling shows how ordinary hardware trust can cross into high privilege without an admin prompt.
OpenAI Puts Cyber AI Behind a Gate With GPT-5.6-Cyber
The new model is framed as a controlled tool for authorized vulnerability research, a sign that the most powerful security AI is being treated less like a chatbot and more like a restricted instrument.
When a Booking Bot Becomes a Breaker of Rules
A gym reservation incident shows how tool-using AI can turn a narrow authorization flaw into unauthorized bookings, cancellations, and a fresh test for API security.
When an AI Agent Reaches the Front Door: The Booking Portal Became the Battlefield
An alleged Claude-driven agent interacting through OpenClaw points to a wider problem: once an AI can click, type, and submit forms, ordinary web flaws can become high-speed security incidents.
The Inbox Can Be Turned Against You: Why CSS in Webmail Is a Security Boundary, Not Decoration
A new wave of HTML and CSS email tricks shows how a message can interfere with the mailbox itself, turning rendering features into a path for token leakage and, in some cases, credential exposure.
When Email Styling Starts Acting Like Spyware
New research points to a brittle trust boundary: CSS inside email can do more than format text, and in some renderers it may help expose credentials, tokens, or even confuse AI-driven browsers.
Bugtraq Comes Back Into View, Reviving a Classic Channel for Vulnerability Chatter
The relaunch of the long-running full-disclosure list is a reminder that security teams still depend on fast, technical discussion to turn raw findings into practical defense.
The Sandbox Illusion: Why Filesystem Walls Can Fail Quietly
Linux isolation often depends on making a process see only a carefully edited filesystem, but that boundary is only as strong as the mounts behind it.
AI-Assisted HTTP Terminator Spots New Desync Paths and an Apache Traffic Server Zero-Day
PortSwigger says its AI-assisted research system explored 30,000 candidate desync vectors, produced new HTTP desynchronization techniques, and helped surface a separate zero-day in Apache Traffic Server.
When a Trusted Repo Becomes a Command Channel
A newly disclosed Claude Code issue spotlights a dangerous edge case in AI-assisted development: repository-scoped trust may be able to shape what runs on a developer workstation.
NatJack Turns the Router’s Memory Into an Attack Surface
A newly disclosed NAT-focused attack class puts connection state, not just packets, at the center of a quiet but serious network integrity problem.
When the Login Layer Fails, Java Business Apps Can Turn Into Open Doors
Research presented at Black Hat highlighted how small trust-boundary mistakes in enterprise Java can produce pre-authentication code execution paths in Bonita BPM and Apache OFBiz.
NatJack Turns Router State Into an Attack Surface
A disclosed research class shows how manipulating NAT tables can shake loose active TCP sessions, poison DNS answers, expose mapped ports, and strain the very state that keeps home and enterprise networks moving.
The Trusted Update Pipe That Could Be Turned Into a Malware Conveyor
A WSUS research finding shows how NTLM coercion and weak backend boundaries can turn a patch server into a channel for attacker-controlled software.
When the Update Server Becomes the Payload
A WSUS research demo shows how authentication relay can turn trusted patch infrastructure into a dangerous control-plane target.
When SQL Injection Reaches Windows, the Database Is No Longer the Target
A reported Oracle-linked intrusion on a Windows host shows how an application-layer flaw can turn into SYSTEM-level execution, with registry-hive activity adding a warning sign defenders know well.
Oracle SQL Injection Can Become a Database-Side Siege
A reported toolkit called KHunt shows how a web-facing SQL injection can be pushed past data access and into database-hosted execution, raising the stakes for over-privileged Oracle deployments.
When a Bridge Timer Outlives Its Memory, the Kernel Starts Walking a Knife Edge
A proof-of-concept for a Linux bridge STP use-after-free flaw shows how a small teardown mistake in kernel networking can become a serious memory-safety problem.
The Router That Hid a Second Door
A Tenda AC1200 firmware flaw shows how an undocumented admin path can matter more than a weak password, because hidden control logic can override the normal trust model of a network device.