PATCHVIPER
Industrial System Patch Rider
Professional Profile
Applies live patches in industrial environments where production cannot be stopped.
Key Skills
Zero-downtime patching; OT security; ICS protection; Vulnerability mitigation; Continuous-production safety
Major Achievements
Applied live patches to industrial machines avoiding a €1.4M production halt.
Articles by PATCHVIPER
When the Console Becomes the Crown Jewel: A SCCM PoC Puts the Management Plane Under the Microscope
A proof-of-concept for a Microsoft Configuration Manager flaw is a reminder that post-authentication bugs in enterprise management tools can matter as much as internet-facing ones.
From Domain User to SYSTEM: SCCM’s Management Plane Lands in the Spotlight
A publicly released proof-of-concept around CVE-2026-47301 puts Microsoft Configuration Manager under a harsh light, because the risk is not just server access but privileged control of the management layer itself.
Video Call, Deep Damage: A Mobile Exploit Path Reaches the Android Kernel
A newly disclosed two-stage chain tied to Unisoc modem firmware shows how a standards-based call path can cross from telecom signaling into the most privileged layer of Android.
Telephony’s Hidden Fault Line: A VoLTE Call Path That Can Reach the Android Kernel
Researchers mapped a two-stage Unisoc modem exploit path that, under specific conditions, can move from a malformed call into kernel-level impact on Android devices.
When an Airliner Analog Becomes a Security Test for the Whole Machine
A research hack against an airliner analog is a reminder that aviation security is often defined less by one component than by how many systems have to trust each other at once.
Windows Security Meets a Hard Stop: The “Download More RAM” Technique and the Trust Beneath VBS
A newly disclosed attack against Windows is drawing attention because it appears to weaken protections from below the operating system, not by using a classic kernel bug.
When Windows Trust Is the Target: "Download More RAM" and the Quiet Collapse of VBS
A newly disclosed Windows technique tied to CVE-2026-23670 is framed as a test of the operating system's own trust boundary, not just another endpoint-bypass story.
When a Water Monitor Talks, the Network Listens
A Flume water monitor sends usage data to remote services and a utility workflow, and that makes its traffic worth examining as a privacy and trust signal, not just a hobbyist curiosity.
Eight Fresh Gitea Flaws Put Self-Hosted Dev Platforms Back on the Defensive
PoC material for eight new Gitea vulnerabilities is a reminder that a Git server can become a trust hub for code, packages, secrets, and automation.
When Trusted Security Code Becomes the Doorway
A research demo at DEF CON 34 shows how legitimate endpoint software can be used in a way that challenges Windows Protected Process Light and raises the stakes for trust-boundary design.
When the Defender Becomes the Delivery Truck: A Windows EDR Trust-Boundary Test
A newly described Windows technique shows how a legitimate endpoint security agent may be used as the privileged carrier for unsigned code, putting EDR hardening and process-protection assumptions under pressure.
Legacy AMD Memory Logic Draws Fire After Proof-of-Concept Probes Hardware Boundaries
A researcher’s proof-of-concept puts unusual pressure on AMD Family 16h memory-controller behavior, raising a cautious but serious question about how much trust still belongs below the operating system.
When One Header Decides Who Gets to Read the Data
A close look at CORS testing shows how small policy mistakes can become real security issues when browsers are asked to trust the wrong origin.
Defender on the Defensive: A Patch-Bypass PoC Turns Microsoft’s Guard Rails Into the Prize
A disclosed proof-of-concept around ShieldBreak puts Microsoft Defender for Windows under the microscope, but the real story is the risk that a security engine itself can become the most valuable local target.
Passkeys Meet the Windows Exception
A newly described Pass-ta-key attack puts a spotlight on a quiet truth in identity security: the same login method can behave differently depending on the operating system underneath it.
The SIM Slot Just Got a Lot More Dangerous
Research into cellular modules suggests a malicious SIM can steer modem behavior through standards-built command paths, turning a tiny credential chip into a potential control point inside connected devices.
Windows’ Quietest Path Can Become Its Loudest Privilege Jump
A DEF CON 34 demonstration put the spotlight on Plug and Play, where routine driver handling can cross into NT AUTHORITY\SYSTEM execution without a visible click.
Plug & Pwn Turns Windows Device Trust Into a SYSTEM-Level Risk
The newly disclosed Plugandpwn chain shows how a trusted Windows Plug and Play path can be abused to run vendor-supplied code as NT AUTHORITY\SYSTEM.
When a USB Device Becomes a Privilege Shortcut in Windows 11
A researcher-demonstrated Plug and Play path shows how emulated hardware and trusted installation logic can converge on SYSTEM-level access.
When USB Trust Turns Into SYSTEM: The Hidden Power Path Inside Windows
A research demo around device installation and remote USB handling shows how ordinary hardware trust can cross into high privilege without an admin prompt.