Nyx Labs Blog https://nyx-labs.org/blog/ Research notes, defensive patterns, and security fieldwork from Nyx Labs. en Reclaiming Clean Syscalls in Userland https://nyx-labs.org/blog/reclaiming-clean-syscalls/ https://nyx-labs.org/blog/reclaiming-clean-syscalls/ Detecting userland EDR hooks and reclaiming clean Windows syscall stubs through surgical patching, section remapping, and fresh ntdll mapping. Wed, 27 May 2026 00:00:00 GMT Malware Development Binary Exploitation https://nyx-labs.org/blog/binary-exploitation/ https://nyx-labs.org/blog/binary-exploitation/ A practical field guide to command injection, overflows, ROP, format strings, and heap exploitation with annotated C and pwntools examples. Thu, 14 May 2026 00:00:00 GMT Binary Exploitation Ghost HTTP Methods: How HTTP Verb Mutation Bypasses Modern WAFs across Middleware Layers https://nyx-labs.org/blog/ghost-http-methods/ https://nyx-labs.org/blog/ghost-http-methods/ How legacy HTTP method overrides create a dangerous disagreement between edge security controls and application middleware. Wed, 29 Oct 2025 00:00:00 GMT Security Research Split-Brain JSON: Exploiting Parser Disagreement Across Validation Boundaries for Privilege Escalation https://nyx-labs.org/blog/split-brain-json/ https://nyx-labs.org/blog/split-brain-json/ How inconsistent duplicate-key handling can make gateways and backend services reach different security decisions for one JSON payload. Tue, 07 Oct 2025 00:00:00 GMT Security Research