K a r o l L o L

I found an access control bug in the Windows Cloud Files Mini Filter Driver. CfCreatePlaceholders with CF_CREATE_SUPERSEDE could replace an existing file with a Cloud Files placeholder even when the caller could not normally write to or delete that file.

My PoC creates a file with a restrictive DACL, confirms normal write and delete operations fail, then registers a sync root and supersedes the protected file through the Cloud Files API.

• Works from a low privileged local process.
• The protected file is converted into a Cloud Files reparse point despite the original access restrictions.
• Microsoft assigned CVE-2026-83991 and fixed the issue in the September 2026 security updates.

Microsoft advisory | Full writeup and PoC here.

Windows 11 maps the win32k desktop heap read only into every process attached to a desktop. At offset 0x100 I found a raw kernel session pool pointer that could be read directly from user mode.

With that pointer and the gSharedInfo handle table I could calculate the kernel addresses of window, menu, and class objects on the desktop.

• Readable from Low IL, AppContainer, and zero capability LPAC processes.
• No window creation is required. The mapping is already there when the process starts.
• The leaked address stays useful for the boot session and weakens KASLR for win32k objects.

CVE-2026-50416 | Full writeup and PoC here.

I found several THI SharePoint sites that had been shared with Everyone in the organization. With my normal student account I could use Microsoft Graph Search to find and download files from them.

Affected files included:

• School internship applications from minors with names, age, school, personal details, and signatures from students, parents, and teachers.
• An incomplete thesis.
• Internal HR documents.

I found 101 files across more than 14 search categories. The affected sites were visible to roughly 12,500 organization accounts instead of the small groups that actually needed access.

I found that the Kickbacks VS Code extension trusted its localhost loopback channel for impression billing. Once the per-session loopback token was available, fabricated view_tick events could be sent through the genuine extension and were credited by the backend.

I verified the issue against my own signed-in account. The backend rate limit capped how quickly credit accrued, and fabricated click events were rejected, but fabricated impressions were still accepted and paid.

Public security acknowledgement

The site runs student Java submissions in Docker. The old runner executed them as uid=0. From a normal submission I could run shell commands, read /etc/shadow, read and overwrite backend files, and access other students' submissions. I reported it and the runner was rebuilt.

I kept testing the new setup after that. It ran as an unprivileged user with a read only root filesystem, AppArmor, seccomp, no internet access, and noexec on the writable mounts.

• Sent SIGUSR1 to the Node.js process, opened the inspector on port 9229, and connected to it over WebSocket. From there I could read and change the live Express server, inspect environment variables, and execute commands as the runner user.
• Used Java 21 FFM to call mmap and raw syscalls directly, so native code could run from memory even though the writable mounts were noexec.
• Ported CVE-2026-31431 from Python to Java FFM and used it to get uid=0 inside the hardened container.

I tried around 20 Linux kernel CVEs against later revisions of the runner and reported what still worked as the setup changed.

From 2020 to late 2025 I spent most of my time around game cheats. I worked on several paid projects and developed and maintained one of my own.

• Reversed game updates to fix broken offsets, signatures, hooks, and changed classes or structures.
• Cracked third party cheat loaders by patching or spoofing licensing checks and working around anti tamper.
• Did a lot of x64 Windows reversing, debugging, memory work, and loader analysis in the process.

By late 2025 I was spending more time finding and reporting software bugs than working on cheats, and eventually stopped doing cheat work.

Found a way to use Cluely's paid features without an active subscription.

The report is still open, so I am not publishing the technical details yet.

More coming soon... Check the Connect section to find my GitHub!