TL;DR Local privilege escalation in current production xhunter1.sys v2023.12.7.78, the kernel driver behind XIGNCODE3 anti-cheat. Standard user account → interactive SYSTEM shell via three Writ...

TL;DR CVE-2026-15430 — improper access control in xhunter2.sys v2026.6.1.192 (Wellbia XIGNCODE3). The previous driver — xhunter1.sys v2023.12.7.78, covered in Hunting the Hunter and still shipp...

TL;DR PCTCore64.sys, a kernel driver shipped with the discontinued PC Tools Internet Security suite, exposes a device interface that any user-mode process can open without authentication. IOCTL 0x...

TL;DR Wellbia’s XIGNCODE3 anti-cheat driver xhunter1.sys exposes an IRP_MJ_WRITE command interface that hands a PROCESS_ALL_ACCESS handle to any caller for any process — including Protected Proces...

Hardcoded constants in offensive tools become detection signatures. Static strings that seem harmless during development persist in logs, network traffic, and file systems, creating reliable indica...

TL;DR K7RKScan.sys exposes a process termination IOCTL to user-mode without sufficient caller or target validation. This flaw enables attackers to terminate arbitrary processes from kernel mode, b...