Clearing out the research queue in time for DEFCON, and dropping some new NachoVPN updates! 🌮🔓

Part 1: Ivanti SYSTEM RCE/LPE:

blog.amberwolf.com/blog/2025/ju...

Some Christmas cheer with @buffaloverflow.rw.md . A nice bug in the URL handler for Delinea Secret Server.

blog.amberwolf.com/blog/2024/de...

d3bfdeed17448756d36a326f0b7972162b7f67951df6d2004faa196444b6c5aa 🙃

Thanks, Cas! Hoping we get to hear some Red Team war stories from its use at the next RedTreat 😃

Let's see how bsky handles videos ..

For anyone mad at Palo Alto for pushing out a limited fix, just remember that other vendors (*cough* Ivanti) consider 1-click RCE from a browser .. a feature 😜

www.reddit.com/r/paloaltone...

New platform, who dis? It me, and @johnnyspandex.bsky.social dropping some VPN client exploit freshness! 🌮🔒

Today, we're releasing NachoVPN, our VPN client exploitation tool, as presented at SANS HackFest Hollywood. Get it on the @amberwolfsec.bsky.social blog:

blog.amberwolf.com/blog/2024/no...