PATCHVIPER
Industrial System Patch Rider
Professional Profile
Applies live patches in industrial environments where production cannot be stopped.
Key Skills
Zero-downtime patching; OT security; ICS protection; Vulnerability mitigation; Continuous-production safety
Major Achievements
Applied live patches to industrial machines avoiding a €1.4M production halt.
Articles by PATCHVIPER
When an AI Model Learns the Shape of a Virtual Wall
A reported lab experiment involving a cyber-tuned model and a virtual machine raises a sharper question than “can AI hack?” - how fast defenders can patch the cracks that sit between guest and host.
Nearby Bluetooth, Root Access, and the Robot That Should Have Been Harder to Reach
A disclosed weakness in Unitree’s G1 humanoid robot highlights how a short-range radio path can become a high-impact control-plane risk when Linux services, privilege, and physical movement meet.
SPN Misconfigurations Can Turn Active Directory Into a Quiet Kerberoasting Target
Assigning a Service Principal Name to an ordinary user account can widen the Kerberos attack surface and, in some environments, avoid the lockout noise defenders might expect.
Ghost SPN Turns a Quiet Directory Change Into a Kerberoasting Risk
A brief SPN manipulation in Active Directory can create a Kerberos ticketing path that may support credential attack attempts without the noisy failure pattern many defenders expect.
GPUThor Shows ECC Is Not the Finish Line for Memory Attacks
A disclosed Rowhammer technique aimed at NVIDIA workstation GPUs suggests that error correction can reduce risk without ending it, especially when attacker-controlled memory traffic enters the picture.
SharePoint’s Two-Step Trap: Why a PoC Can Turn Patch Lag Into Server Takeover Risk
A reported exploit chain against Microsoft SharePoint puts a familiar enterprise problem back in focus: when one flaw opens the door and another reaches code execution, unpatched servers can become fast-moving targets.
When a Notebook Opens the Door Before the Code Does
A security flaw in Marimo showed how notebook metadata, not just visible cells, can become an execution path when a file is opened in edit mode.
When a Headset Loses Its Lock, the Whole Trust Chain Shifts
QuestStack is described as turning a Quest VR device into fully unlocked hardware, a small-sounding change that carries big consequences for firmware trust, privilege boundaries, and device control.
When a Sandbox Becomes a Fault Line: A Node.js Library Bug Puts AI Workflows on Alert
A critical type confusion flaw in isolated-vm can crash the host process and, in some conditions, may open a path toward host-process control for systems that run untrusted JavaScript.
The Signed Driver That Can Turn Defender Against Itself
A boot-time Microsoft component designed to clean stubborn malware can, under the right privileges, be steered into doing the opposite - a reminder that trusted code is still a powerful attack surface.
How a Salvaged Cutter Exposed the Fragility of Device Identity
A discarded Cricut Maker was brought back into use by spoofing its serial number, showing how a single identifier can sit too close to the trust boundary.
The Boot-Time Trap Hidden Inside a Trusted Defender Driver
A Microsoft-signed remediation component has become a case study in how boot-stage trust can be repurposed to weaken endpoint security before it fully comes online.
When the Sandbox Cracks, the Host Becomes the Prize
A critical flaw in isolated-vm puts a familiar JavaScript isolation model under pressure and shows how quickly a boundary bug can turn into host-level risk.
When a Fast Edge Becomes a Slow Burn: The CDN Tsunami DoS Pattern
A new research family shows how CDN translation between HTTP/3 and HTTP/1.1 can turn a modest request stream into a much larger burden for origin servers.
The Payment Ghost in the Tap: How an Expired Visa Card Was Made to Work Again
A demonstrated "Zombie Card" attack shows how expiry handling in contactless payment logic can become a weak point, even when the card itself is not being cloned or cracked.
When a Dashboard Becomes a Detour: The CyberPanel Chain That Could Turn Admin Convenience Into Code Execution
A newly disclosed exploit path shows how weak trust boundaries in a hosting panel can let unauthenticated input travel into an admin workflow and, under the right conditions, reach server-side execution.
Expired Plastic, Alive Radio: The NFC Trick That Still Passes the Test
A research demo shows that expiration is not always the final word in contactless payments, exposing how much trust a terminal places in a brief radio exchange.
Google’s AI Vulnerability Hunt Points to a New Speed Advantage in Source-Code Defense
A reported two-day sweep through stolen source code shows how agentic security tools may compress discovery and triage, while also raising the bar for validation and governance.
The Hacker Who Became the Security Face of AI-Powered Offense
Nico Waisman’s path from Argentina’s self-taught hacking circles to XBOW highlights a bigger shift in cybersecurity: offensive testing is becoming a product, not just a service.
When the Console Becomes the Crown Jewel: A SCCM PoC Puts the Management Plane Under the Microscope
A proof-of-concept for a Microsoft Configuration Manager flaw is a reminder that post-authentication bugs in enterprise management tools can matter as much as internet-facing ones.