Technical research and advisories from OFFCEPT operators.https://offcept.comenhttps://offcept.com/blog/byovd-detection-preventionhttps://offcept.com/blog/byovd-detection-preventionWe tested Bring Your Own Vulnerable Driver against a fully hardened Windows 11 25H2 endpoint with MDE and ASR in Block mode. Publicly known vulnerable drivers still loaded and ran, killing Defender's PPL-protected processes.Sat, 08 Aug 2026 00:00:00 GMTTechnical Researchhttps://offcept.com/blog/european-vpn-exposure-notificationhttps://offcept.com/blog/european-vpn-exposure-notificationWe ran a Europe-wide responsible disclosure campaign to find organizations still exposed to known VPN vulnerabilities, trace the vulnerable devices to their owners, and get them patched. Around 800 organizations assessed. Only a minority responded.Wed, 22 Jul 2026 00:00:00 GMTTechnical Researchhttps://offcept.com/blog/wp2shell-wordpress-core-sqlihttps://offcept.com/blog/wp2shell-wordpress-core-sqliwp2shell chains a REST API batch route confusion with a SQL injection in WP_Query into unauthenticated blind SQLi, now patched in WordPress Core. RCE is possible but not automatic. It needs a cracked admin password and plugin uploads enabled. Here is the real chain and how to patch it.Sat, 18 Jul 2026 00:00:00 GMTTechnical Researchhttps://offcept.com/blog/tiber-eu-dora-financial-institutionshttps://offcept.com/blog/tiber-eu-dora-financial-institutionsDORA is live. TLPT regulatory standards are active. Notifications are being sent. Here is what financial institutions in the EU need to understand about TIBER-EU before the letter arrives.Fri, 29 May 2026 00:00:00 GMTAdvisoryhttps://offcept.com/blog/nis2-portugal-compliancehttps://offcept.com/blog/nis2-portugal-complianceDecree-Law 125/2025 is in force. We break down what Article 27 requires, what CNCS auditors actually check, and where organisations in Portugal are failing.Mon, 25 May 2026 00:00:00 GMTAdvisoryhttps://offcept.com/blog/byovd-kernel-edr-blindnesshttps://offcept.com/blog/byovd-kernel-edr-blindnessMost EDRs rely on kernel callbacks to see what happens on an endpoint. We show how BYOVD attacks zero those callbacks, why ML detection does not save you, and what defenders should actually do about it.Sun, 24 May 2026 00:00:00 GMTTechnical Researchhttps://offcept.com/blog/acl-abuse-havochttps://offcept.com/blog/acl-abuse-havocWe're releasing acl-abuse-havoc, an open-source BOF toolkit for abusing Active Directory ACL misconfigurations through Havoc C2. The centrepiece is acl-shadow, a full Shadow Credentials attack chain that runs entirely in-memory.Mon, 18 May 2026 00:00:00 GMTTechnical Research