Quarkslab

Fuzzing complex state machines with LibAFL-QEMU and incremental snapshots. We walk through our approach, revisit CVE-2026-9539 in libslirp, and explain why our initial fuzzing campaign missed it. Fuzzer code is open source 🧑‍💻 🔗 Check it out: blog.quarkslab.com/snapshotting...

PQC is coming they say, but where is the actual code? To help you map it out, our intern Joshua Setia looked at and tested 25 libraries, here is what he found: ➡️https://blog.quarkslab.com/state-of-post-quantum-cryptography-implementations.html

Mbed TLS is a widely deployed open-source TLS, DTLS, and X.509 library targeting constrained and embedded environments. A few months ago, our cryptography team performed a security audit of the changes in version 4.0, sponsored by @ostifofficial.bsky.social ➡️ blog.quarkslab.com/mbedtls-secu...

Our 2026-2027 internship season is open. Check out the list of openings and apply for fun and knowledge! blog.quarkslab.com/internship-o...

Reports can be the fun part of a pentest.. if the target uses MyReport. Lucas Laise found a third-party updater running as SYSTEM, an unauthenticated gRPC service, and a nice way to turn software updates into arbitrary code execution. From LPE to RCE🔥 blog.quarkslab.com/myreport-upd...

Not an antivirus product this time, but we couldn't pass it up 🙈 Cato Networks said: route with split tunneling. kaluche_ heard: root with split tunneling. Check out CVE-2026-10739, a LPE vulnerability in the Cato VPN Client for Windows ➡️ blog.quarkslab.com/cato-vpn-cli...

To leverage AI agents for vulnerability research, we built a hybrid source-code analysis workflow that combines deterministic analysis with agentic reasoning. Applied to FreeRDP, it helped us uncover vulnerabilities and chain them into client-side RCE. 🔗 blog.quarkslab.com/from-ai-agen...

Optical network security often sounds like an obscure incantation: PON, ONU, OLT, PLOAM, OMCI, GEM, GPON, XG-PON, 50G-PON, T-CON.. To conjure the right knowledge read Thiébaud Fuchs' overview of Passive Optical Networks and their security features blog.quarkslab.com/overview-of-...

Chamilo LMS was put under the microscope🔬 by Mathieu Farrell and Sean Matthews 11 vulnerabilities, multiple attack surfaces. Our new research dives into the vulnerable code paths and exploitation primitives to achieve unauthenticated RCE. 🔗 blog.quarkslab.com/chamilo-lms-...

Software protection is futile, AI will break it", they said. But, does it? how? To shine some light read about Rémy Salim's experiments in "Defeating AI-Assisted Reverse Engineering" Where is the fair play, Claude? blog.quarkslab.com/defeating-ai...

Doing Machine Learning on binary code? We've just open-sourced pcode_graph, a Python library that extracts semantic graphs from binaries to make training Graph Neural Networks easier. Samuel Hangouët introduces it here: blog.quarkslab.com/from-p-code-... #GNN #ML #Python #OpenSource

Everything about Android's hardware attestation... and how to bypass it. Blog post and code by Eric Le Guevel blog.quarkslab.com/bypassing-an...

Cortex is a long-term, multi-tenant scalable open source storage for Prometheus and OpenTelemetry. Earlier this year we conducted a security audit sponsored by @ostifofficial.bsky.social Check our report here: blog.quarkslab.com/cortex-secur...

Obscure Element: Reverse engineering Xiaomi's MJA1 secure chip. Mengsi Wu's journey starts here: blog.quarkslab.com/black-box-pr...

BOLT is a static analysis tool, part of the LLVM compiler infrastructure, used to verify compiler security hardening options have been applied on a binary. Thanks to @ostifofficial.bsky.social we've worked since November 2025 to improve it. Check our progress here: blog.quarkslab.com/extending-ll...

From prompt 😃to pwned 😢: Implementing an LLM in your org? Useful. Trusting its output? That's how a low-priv user became admin. Ship the feature, don't extend it your trust. blog.quarkslab.com/from-prompt-...

Practical Android Software Protection in the Wild: An Appetizer In which Eduardo Blazquez analyzes 2.5 million Android apps to identify and classify the obfuscators, packers and code protectors they use: blog.quarkslab.com/practical-an...

What happens when reverse engineers spend weeks poking at the Scala 3 codebase? 🔍 From code review to fuzzing, our assessment helped strengthen Scala's security. The results of our audit, conducted in collaboration with @ostifofficial.bsky.social, are here: blog.quarkslab.com/scala-securi...

Did you hear about Optical Line Terminals? ISPs rely on them to build their service networks, but what if they are vulnerable? Here Mathieu Farrell shows how attackers could compromise entire ISPs by exploiting them and cloud-based fleet management software blog.quarkslab.com/how-olts-may...

A hands-on look at Microsoft’s Independent Guest Virtual Machine (IGVM) format inside OpenHCL’s `openhcl.bin`. We unpack the fixed header, variable headers, data layout, and how IGVM measurement supports Confidential Computing with SEV-SNP and TDX. 🔗 blog.quarkslab.com/the-igvm-fil...

Paramiko is a pure-Python implementation of SSHv2. Recently, we worked with the Paramiko team on a security audit sponsored by @ostifofficial.bsky.social 🙏 Read a summary of our findings and find the full report here: blog.quarkslab.com/paramiko-sec...

Do you know how Entra ID applications work? What about the security mess they can bring and what they can quietly break? New blog post on Entra ID application permissions, the audit nightmare they create, and QAZPT, our OSS tool to actually make sense of it: blog.quarkslab.com/auditing-app...

Obfuscation vs The Optimizer: A Battle in LLVM Middle End. Robert Yates shows us how the continuous improvement of the LLVM optimizer defeats naive code obfuscation, and how the obfuscator can fight back. An eternal fight in which all victories are ephemeral blog.quarkslab.com/obfuscation-...

🤔Ever wondered how your favorite tools work under the hood? During our work on SightHouse, we dug into BSIM, Ghidra's Binary function SIMilarity engine. Many tools have been built around it, yet its internals remained undocumented. Until now 👇 blog.quarkslab.com/bsim-explain...

🚗 We traced a car’s life from China to Poland. By analyzing a BYD Telematic Control Unit, Romain Marchand econstructed its journey and identified a real-world event from GPS logs alone. Embedded forensics + OSINT = real stories hidden in data. 👉 blog.quarkslab.com/tearing-down...

After Mathieu Farrell found 3 LPEs in Intego antivirus for macOS, Lucas Laise had to check the Windows version too. Spoiler: it was vulnerable. Here's the full write up of a symlink attack to achieve Local Privilege Escalation👇 blog.quarkslab.com/milking-the-...

Tired of reversing the same libc for the 100th time? 👀 Meet SightHouse, our open-source tool that automatically detects third-party library functions in binaries. High-confidence function mapping. Works with any disassembler. By @Mad5quirrel & Sami. 🔗 blog.quarkslab.com/sighthouse-a...

The dragon has a VM. Of course it does. Our latest blog walks through the analysis of a complex C++ binary hiding behind a virtual machine, themed as a classic RPG fight. QBDI & TritonDSE are your weapons of choice. The dragon doesn't stand a chance. 🐉 🔗 blog.quarkslab.com/qbdi-vs-trit...

Rule 1️⃣ : "In WAF we (should not) trust" Your WAF is doing its best. That's just not enough 😮‍💨 A deep dive into Web Application Firewall bypass techniques, discovering why blocked ⛔ doesn't always mean safe. blog.quarkslab.com/in-waf-we-sh...

"Intego X9: Never trust my updates" Read Mathieu Farrell's research showing how XPC interprocess communications and the update mechanism of the Intego antivirus for MacOS can be abused for local privilege escalation. blog.quarkslab.com/intego_lpe_m...

"How does it even work?" The question that keeps hackers' hearts pumping, blood pressure rising, and curiosity growing. This is Damien Cauquil's reverse engineering journey into a cheap smartwatch that measures at least one of those. blog.quarkslab.com/nerd-life-we...

One bit flip to corrupt it all: Exploitation of an old Linux kernel vulnerability using PageJack, a modern technique to create Use After Free bugs. Here Jean Vincent shows you how blog.quarkslab.com/pagejack-in-...

If you glitch one, can you glitch many? Extracting automotive firmware is a challenge. @phil-barr3tt.bsky.social explains how he bypassed the IDCODE protection in several variants of the RH850 MCU family using both voltage glitching and side-channel analysis ⚡️🚗 blog.quarkslab.com/bypassing-de...

Reverse engineers often spend a lot of time deciphering third-party firmware libraries. At RE//verse 2026 (Fri, 5 PM), Benoit & Sami will introduce SightHouse, an open-source tool to automatically identify third-party functions and speed up analysis. Join us!

Another antivirus 🛡️, another unfulfilled promise 😣. @kaluche_ turns Avira's protection into a privilege escalation playground. This time: 3 LPE vectors 🆙 via symlink abuse (CVE-2026-27748, CVE-2026-27750) and unsafe deserialization (CVE-2026-27749). Find out more: blog.quarkslab.com/avira-deseri...

Why macOS AVs shouldn’t trust PIDs 😄🍏 - new post by @Coiffeur0x90 Intego X9: XPC validation falls back to PID → PID reuse + posix_spawn() shenanigans 😏 ⇒ confused deputy / privileged methods abused 🤡🧨 Lesson: PID ≠ identity. Check it out 🔗 blog.quarkslab.com/intego_lpe_m...

You've never been more right to doubt your MacOS antivirus software 😥 Our latest research by Mathieu Farrell shows how Intego can be abused for Local Privilege Escalation Yes, the antivirus. Yes, as root. blog.quarkslab.com/intego_lpe_m...

"Dr. Bytecode or: How I Learned to Stop Worrying and Obfuscate Java" A tale about how @farena.in started his journey in Java software obfuscation. blog.quarkslab.com/how-to-write...

"Use a better system prompt" is the new "sanitize your inputs", but when your #AI agent's tools don't check permissions, you've got a problem and no amount of prompting will fix it. Check Kaluche's blog post about #AgenticAI & the Confused Deputy issue ⬇️ blog.quarkslab.com/agentic-ai-t...

@lfenergy.bsky.social EVerest underwent a security engagement facilitated by us with auditing by @quarkslab.bsky.social. This holistic security work impacts millions of EV charging stations worldwide. Read more at our blog: ostif.org/everest-secu...

We conducted the first public third-party security assessment of EVerest, an open-source firmware stack for electric vehicle charging stations, deployed in hundreds of thousands of charging points worldwide. The audit was mandated by @ostifofficial.bsky.social 🙏 blog.quarkslab.com/everest-secu...

A decade is an eternity in security. 🛡️ Ten years ago, we released the Clang Hardening Cheat Sheet. Today, the landscape has changed. @0xTRIKKSS & @bcreusillet break down the latest mitigations to keep your code secure. 🔗Read the update: blog.quarkslab.com/clang-harden...

A modern tale of Blinkenlights, cheap Christmas shopping and curiosity, narrated by Damien Cauquil Firmware extraction and reverse engineering of a smartwatch FTW! blog.quarkslab.com/modern-tale-...

K7 Antivirus: Named pipe abuse, registry manipulation and privilege escalation. A story of endpoint post-exploitation by Lucas Laise blog.quarkslab.com/k7-antivirus...

We've been a bit excited about this one. We are excited and honored to have partnered with Bitcoin, brink, Chaincode Labs, and @quarkslab.bsky.social to collaborate on a security audit of Bitcoin Core. This was Bitcoin Core's first external audit. Read more at our blog: ostif.org/bitcoin-core...

Quarkslab engineers Robin David, Mihail Kirov and Kaname just completed the first public security audit of Bitcoin Core, led by @ostifofficial.bsky.social and funded by Brink.dev Details on the blog post: blog.quarkslab.com/bitcoin-core... Congrats to developers for such software masterpiece !

We are pleased to announce that the KubeVirt Security Audit report has been published, in collaboration with @quarkslab.bsky.social and @ostifofficial.bsky.social Check out our blog post for all the details: kubevirt.io/2025/Announc...

KubeVirt is open source virtualization technology for Kubernetes. Recently we worked with the @kubevirt team on a security audit sponsored by @OSTIFofficial 🙏 Read a summary of our findings and find the full report here: blog.quarkslab.com/kubevirt-sec...

Our 2025-2026 internship season has started. Check out the list of openings and apply for fun and knowledge! blog.quarkslab.com/internship-offers-for-the-2025-2026-season.html

From kernel oops to kernel exploit: How two little bugs (CVE-2025-23330, CVE-2025-23280) in #NVIDIA open GPU #Linux driver can lead to full system compromise. Full technical breakdown inside, #vmalloc exploitation technique included! blog.quarkslab.com/nvidia_gpu_k...