Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2023-10-03. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Our co-worker, @MochiNishimiya gave his intern, @peter_clowncs a patched & well-documented bug and with constraints: no NtQuery*, no PreviousMode.
This is what the intern did.
CVE-2023-36802, exploited a different way.
https://starlabs.sg/blog/2026/06-old-bug-harder-rules-exploiting-cve-2023-36802-without-the-usual-shortcuts/
Post summary
The tweet points readers to a blog post detailing a novel exploitation technique for CVE‑2023‑36802, but offers no detailed technical guide, patch info, or evidence of active attacks.
相変わらずインターンに求める課題のレベル高いですね
Old Bug, Harder Rules : Exploiting CVE-2023-36802 Without the Usual Shortcuts
https://starlabs.sg/blog/2026/06-old-bug-harder-rules-exploiting-cve-2023-36802-without-the-usual-shortcuts/
Post summary
The blog post focuses on a detailed exploitation technique for CVE-2023-36802, likely presenting a PoC or advanced method, but does not discuss active attacks, patches, or debunking.
#Analytics#Threat_Research
An analytical review of the main cybersecurity events (June 1-26, 2026) http://www.cyberpocket.org
1⃣. Old Bug, Harder Rules: Exploiting CVE-2023-36802 Without the Usual Shortcuts
https://starlabs.sg/blog/2026/06-old-bug-harder-rules-exploiting-cve-2023-36802-without-the-usual-shortcuts
// Type confusion bug in Microsoft’s Streaming Service
2⃣. Dissecting and Exploiting Linux LPE Variant: DirtyClone (CVE-2026-43503)
https://research.jfrog.com/post/dissecting-and-exploiting-linux-lpe-variant-dirtyclone-cve-2026-43503
// CVE-2026-43503 https://github.com/rafaeldtinoco/security/tree/main/exploits/dirtyclone is a workaround for Dirty Frag vulnerability in xfrm-ESP module, which is used to accelerate encryption operations in IPsec using ESP
3⃣. Patch the Planet: a Daybreak initiative to support open source maintainers
https://openai.com/index/patch-the-planet
4⃣. StrikeShark malware loader
https://securelist.com/strikeshark-campaign/120326
// malware loader used in StrikeShark campaign to deploy Cobalt Strike Beacons via DLL hijacking and encrypted stages
5⃣. NGINX ngx_http_v3_module vulnerability
https://my.f5.com/manage/s/article/K000161616
// CVE-2026-42530 https://github.com/0xBlackash/CVE-2026-42530
6⃣. BOD 26-04: Prioritizing Security Updates Based on Risk https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
7⃣. AMD will reinstate memory encryption on Ryzen 9000 CPUs through a BIOS update in July https://www.tomshardware.com/pc-components/cpus/amd-will-reinstate-memory-encryption-on-ryzen-9000-cpus-through-a-bios-update-in-july-tsme-is-coming-back-after-valuable-community-feedback
8⃣. libssh2 vulnerabilities
https://www.secure-iss.com/newsroom/libssh2-critical-vulnerabilities-rce-dos
// Out-of-Bounds Write via Unchecked packet_length in transport.c (CVE-2026-55200, CVE-2026-55199)
9⃣. HallWatch user mode detector
https://github.com/Zypherion-Technologies/HallWatch
// Usermode detector that catches indirect syscalls. Traps Hell's Hall, Tartarus' Gate, RecycledGate, VEH syscalls & more
🔟 AI SOC Evaluation Framework https://secops-unpacked.ai/asef/guide
Post summary
The post catalogs several CVEs, providing direct links to PoC code and exploit details, notes real-world exploitation via the StrikeShark loader, and mentions available workarounds or patches.
