Desk · Labs & reverse engineering

Research

Technical deep dives, reproducible tests, and tool evaluations.

Articles: 177
Topics: 20
Page: 22 / 23

Illustration of ephemeral workload credentials replacing long-lived API keys in non-human identity management

Non-Human Identity Management: Why Ephemeral Credentials Are Replacing Static API Keys

Service accounts, CI/CD runners, workload certificates and AI-agent principals form a sprawl traditional joiner-mover-leaver programs never governed.

Jul 15 · 6 min

Conceptual illustration of a Jenkins-style CI/CD controller at the center of a software factory, with pipeline lines to code, cloud, and artifacts and a cracked supply-chain link on one plugin package

stableResearch Jenkins Vulnerability

Jenkins Plugin Security: Hardening the CI/CD Supply Chain Before Attackers Do

*A conceptual view of Jenkins as the high-privilege control plane of the software factory—and of plugins as the supply-chain links that can break it.*

Jul 15 · 7 min

Data graphic: the DarkSword iOS 18 exploit chain uses 6 vulnerabilities, drawn as a flow from one Safari visit through JavaScriptCore CVE-2025-31277, CVE-2025-43529 , ANGLE CVE-2025-14174 , dyld CVE-2026-20700 and the XNU kernel CVE-2025-43510 / 43520 to data exfiltrated in minutes, with each flaw's reported patch band. It affects iOS 18.4 to 18.7, has no persistence a reboot clears the chain , is used by UNC6353, UNC6748 and PARS Defense, and the advice is to patch to iOS 26.3 or newer at least 18.7.3 on 18.x and enforce Lockdown Mode for high-risk users.

stableResearch Ios Exploit

DarkSword: Pure-JavaScript iOS 18 Watering-Hole Full Chain Used by Multiple Actors

The chain moves from Safari RCE through sandbox escape to kernel read/write, exfiltrates data within minutes, then cleans up and exits with no user interaction.

Jul 15 · 8 min

Data graphic: SharePoint zero-day CVE-2026-56164, scored 9.8 Critical by NVD against Microsoft's 5.3 Moderate for the same flaw, with the fixed build thresholds for SharePoint Server 2016 16.0.5561.1001 , 2019 16.0.10417.20175 and Subscription Edition 16.0.19725.20434 . A timeline shows exploitation and patches on Jul 14, 2026 and the CISA KEV federal due date of Jul 17, 2026, three days later; SharePoint Online is not affected, and the verdict reads: patching alone is not proof of cleanliness, so hunt first, then harden.

stableResearch Microsoft Sharepoint

Microsoft SharePoint Zero-Day CVE-2026-56164 Under Active Attack: On-Prem Farms Face Unauthenticated Privilege Escalation

Microsoft and CISA confirmed exploitation on 14 July 2026 and shipped same-day patches. SharePoint Online is unaffected; self-hosted farms need action now.

Jul 15 · 6 min

Illustration of enterprise DHCP server infrastructure under elevated risk during Microsoft July 2026 Patch Tuesday

stableResearch Patch Tuesday

Microsoft July 2026 Patch Tuesday Hits Record 622 CVEs With Critical DHCP Server RCEs

Roughly triple June's previous record, the release is led by CVE-2026-50518, an unauthenticated Windows DHCP Server RCE rated Exploitation More Likely.

Jul 15 · 8 min

Data graphic: CVE-2026-55944, an unauthenticated remote code execution flaw in Dynamics NAV and Business Central On Premises, scores 9.8 CVSS 3.1, Critical : one crafted login request with no credentials triggers CWE-502 unsafe deserialization and code execution on the ERP host. Microsoft rates exploitation More Likely, there is no public PoC and it is not on CISA KEV as of mid-July; NAV 2018 is fixed from build 11.0.50704.0, Business Central SaaS is not listed as affected, and the advice is to apply the July 2026 updates and keep NAV / BC login endpoints off the internet.

stableResearch Microsoft Dynamics

CVE-2026-55944: Critical Unauthenticated RCE Hits Microsoft Dynamics NAV and Business Central On Premises

Patched in the record July 2026 Patch Tuesday, the flaw puts finance, supply-chain and operations systems at risk wherever ERP login endpoints remain reachable.

Jul 15 · 6 min

Editorial illustration of an AD FS server with a forged SAML assertion hovering above it in a data center

stableResearch Golden Saml

Why Golden SAML Still Haunts Hybrid Identity: Hardening AD FS Token-Signing Keys and DKM Access

Golden SAML still threatens hybrid identity via AD FS token-signing keys. Learn how to harden DKM access, detect key theft, and lock down federation servers.

Jul 15 · 6 min

Illustration of chained SonicWall SMA1000 zero-days CVE-2026-15409 SSRF and CVE-2026-15410 code injection from internet exposure to full appliance compromise.

stableResearch Sonicwall Sma 1000

SonicWall SMA1000 Zero-Days CVE-2026-15409 and CVE-2026-15410 Actively Exploited; Patch Alone Is Not Enough

CISA set a July 17 remediation deadline, but patching alone leaves an already-compromised appliance in place — credential rotation and hunting are mandatory.

Jul 15 · 6 min