https://felixbillieres.github.io/categories/research/Recent content in Research on Elliot BeltHugo -- gohugo.ioenfelix.billieres@ecole2600.com (Elliot Belt)felix.billieres@ecole2600.com (Elliot Belt)© 2026 Elliot BeltFri, 07 Aug 2026 00:00:00 +0000https://felixbillieres.github.io/posts/kerberloss-cve-2026-25177/Fri, 07 Aug 2026 00:00:00 +0000felix.billieres@ecole2600.com (Elliot Belt)https://felixbillieres.github.io/posts/kerberloss-cve-2026-25177/<p>Here is a service principal name:</p> <div class="highlight-wrapper"><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">cifs/DC1</span></span></code></pre></div></div> <p>And here is another one:</p> <div class="highlight-wrapper"><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">cifs/DC1‌</span></span></code></pre></div></div> <p>They are not the same string. The second one ends with <code>U+200C</code>, a zero width non-joiner. Three bytes, <code>e2 80 8c</code>, that your terminal, your browser and your eyes all agree to pretend do not exist.</p>