TL;DR PCTCore64.sys, a kernel driver shipped with the discontinued PC Tools Internet Security suite, exposes a device interface that any user-mode process can open without authentication. IOCTL 0x...

TL;DR Wellbia’s XIGNCODE3 anti-cheat driver xhunter1.sys exposes an IRP_MJ_WRITE command interface that hands a PROCESS_ALL_ACCESS handle to any caller for any process — including Protected Proces...

Hardcoded constants in offensive tools become detection signatures. Static strings that seem harmless during development persist in logs, network traffic, and file systems, creating reliable indica...

TL;DR K7RKScan.sys exposes a process termination IOCTL to user-mode without sufficient caller or target validation. This flaw enables attackers to terminate arbitrary processes from kernel mode, b...