From Debian 13 output
# cat /sys/devices/virtual/dmi/id/board_name
AKN79C-140P-IMR
# cat /sys/devices/virtual/dmi/id/board_vendor
SU
| No | Type | Board Manufacture | Board Type |
| 1 | Lenovo IdeaPad Gaming 3 15ARH7 | LENOVO | LNVNB161216 |
| 2 | Advan Workplus AI Heritage (Model: L26B-R72S1) | SU | AKN79C-140P-IMR |
To find out manufacture model of your main board
windows PowerShell
C:\windows\system32> Get-CimInstance Win32_BaseBoard | Format-List Manufacturer, Product, Version
Manufacturer : SU
Product : AKN79C-140P-IMR
Version : Version 1.0
Debian
# cat /sys/devices/virtual/dmi/id/board_name
AKN79C-140P-IMR
# cat /sys/devices/virtual/dmi/id/board_vendor
SUSU stands for Sixunited (Shanghai Sixunited Intelligent Technology Co.
To find out NVME model
Debian
# apt install nvme-cli
...
# nvme id-ctrl /dev/nvme0 | grep -E 'mn|fr'
mn : HS-SSD-WAVE(P) 256G
fr : SN17027
frmw : 0x1a
mntmt : 373
mnan : 0
mnsudmq : 0
It is Hiksemi wave(p) 256GB, safe running temperature 70°C. NVMe SSD already has APST enabled and is configured to use its deepest power-saving state, PS4.
Mobile Verification Toolkit (MVT) is a tool to facilitate the consensual forensic analysis of Android and iOS devices, for the purpose of identifying traces of compromise. The Mobile Verification Toolkit (MVT) was developed by the Amnesty International Security Lab. Note: mvt is not removal tools.
Here are common known spyware can be trace by MVT:
Install python
# apt install python3 python3-venv sqlite3 libusb-1.0-0 libimobiledevice-utils usbmuxd pipx
Install adb for android
# apt install -y android-sdk-platform-tools android-sdk-platform-tools-common
Create virtual python
$ pipx ensurepath
Success! Added /[home_user]/.local/bin to the PATH environment variable.
Consider adding shell completions for pipx. Run 'pipx completions' for
instructions.
You will need to open a new terminal or re-login for the PATH changes to take
effect. Alternatively, you can source your shell's config file with e.g.
'source ~/.bashrc'.
Otherwise pipx is ready to go!
Install mvt
$ pipx install mvt
installed package mvt 2026.11.2, installed using Python 3.13.5
These apps are now globally available
- mvt
- mvt-android
- mvt-ios
⚠️ Note: '/[home_user]/.local/bin' is not on your PATH environment
variable. These apps will not be globally accessible until your PATH is
updated. Run `pipx ensurepath` to automatically add it, or manually modify
your PATH in your shell's config file (e.g. ~/.bashrc).
done!
$ ls ./.local/bin/
mvt mvt-android mvt-iosTo update mvt
$ pip3 install --upgrade mvt
Add virtual python binary
$ echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc
$ source ~/.bashrc
$ mvt version
MVT - Mobile Verification Toolkit
https://mvt.re
Version: 2026.11.2
You have not yet downloaded any indicators, check the `download-iocs`
command!Download / Update spyware indicators
$ mvt download-iocs
MVT - Mobile Verification Toolkit
https://mvt.re
Version: 2026.11.2
You have not yet downloaded any indicators, check the `download-iocs`
command!
[mvt.common.updates] Downloaded indicators "NSO Group Pegasus
Indicators of Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_AmnestyTec
h_investigations_master_2021-07-18_nso_pegasus.stix2
[mvt.common.updates] Downloaded indicators "Predator Spyware
Indicators of Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_intellexa_predator_predator.stix2
[mvt.common.updates] Downloaded indicators "RCS Lab Spyware
Indicators of Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_2022-06-23_rcs_lab_rcs.stix2
[mvt.common.updates] Downloaded indicators "Stalkerware
Indicators of Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_AssoEchap_
stalkerware-indicators_master_generated_stalkerware.stix2
[mvt.common.updates] Downloaded indicators "Surveillance campaign
linked to mercenary spyware company" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_AmnestyTec
h_investigations_master_2023-03-29_android_campaign_malware.stix2
[mvt.common.updates] Downloaded indicators "Quadream KingSpawn
Indicators of Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_2023-04-11_quadream_kingspawn.stix2
[mvt.common.updates] Downloaded indicators "Operation
Triangulation Indicators of Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_2023-06_01_operation_triangulation_operation_triangulation
.stix2
[mvt.common.updates] Downloaded indicators "WyrmSpy and DragonEgg
Indicators of Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_2023-07-25_wyrmspy_dragonegg_wyrmspy_dragonegg.stix2
[mvt.common.updates] Downloaded indicators "Wintego Helios
Indicators of Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_AmnestyTec
h_investigations_master_2024-05-02_wintego_helios_wintego_helios.stix2
[mvt.common.updates] Downloaded indicators "NoviSpy (Serbia)
Indicators of Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_AmnestyTec
h_investigations_master_2024-12-16_serbia_novispy_novispy.stix2
[mvt.common.updates] Downloaded indicators "EagleMsgSpy
Indicators of Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_2024-12-25_eaglemsgspy_eaglemsgspy.stix2
[mvt.common.updates] Downloaded indicators "Candiru
(DevilsTongue) Indicators of Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_candiru_candiru.stix2
[mvt.common.updates] Downloaded indicators "ResidentBat
Indicators of Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_ResidentBat_residentbat.stix2
[mvt.common.updates] Downloaded indicators "Cellebrite Indicators
of Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_cellebrite_cellebrite.stix2
[mvt.common.updates] Downloaded indicators "DarkSword Indicators
of Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_2026-03-30_darksword_darksword.stix2
[mvt.common.updates] Downloaded indicators "Coruna Indicators of
Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_2026-03-03_coruna_cryptowaters_coruna.stix2
[mvt.common.updates] Downloaded indicators "Morpheus Indicators
of Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_2026-04-23_ips_morpheus_morpheus.stix2
[mvt.common.updates] Downloaded indicators "BTMOB Indicators of
Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_2026-05-26_btmob_btmob.stix2
[mvt.common.updates] Downloaded indicators "Spyrtacus Indicators
of Compromise" to
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_2026-04-09_sio_spyrtacus_spyrtacus.stix2
$ mvt version
MVT - Mobile Verification Toolkit
https://mvt.re
Version: 2026.11.2
Indicators updates checked recently, next automatic check in 12 hoursMVT installation done.
NOTE: steps below does not tested, and may different output depends on your android phone.
You MUST enable developer option and debug on your Android phone. Connect your android phone using usb cable.
create directory for forensic
$ mkdir -p ~/forensics/{evidence/android,working/android,reports/android}
Pull your data from android phone
$ adb bugreport ~/forensics/evidence/android/bugreport.zip
Scan your data to find evidence of spying malware
$ mvt-android check-bugreport -o ~/forensics/reports/android/ ~/forensics/evidence/android/bugreport.zip
Find out the result on folder ~/forensics/reports/android/
known CVE-2026-109618 and CVE-2026-109619
Description: PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Offical debian patch
source: https://security-tracker.debian.org/tracker/CVE-2026-109618
The steps are
# php -v
PHP 8.4.26 (cli) (built: Sep 24 2026 17:16:18) (NTS)
Copyright (c) The PHP Group
Built by Debian
Zend Engine v4.4.26, Copyright (c) Zend Technologies
with Zend OPcache v8.4.26, Copyright (c), by Zend Technologies
# apt update && apt upgrade -y
...
# php -v
PHP 8.4.27 (cli) (built: Oct 21 2026 07:53:46) (NTS)
Copyright (c) The PHP Group
Built by Debian
Zend Engine v4.4.27, Copyright (c) Zend Technologies
with Zend OPcache v8.4.27, Copyright (c), by Zend Technologies
# systemctl restart apache2# systemctl restart php8.4-fpm Warning: for server running Debian 11 24/7 and lower, please upgrade to Debian 12 to get patch!
If you can not upgrade your os these are minimum php version had been patched:
If your php below those version e.g. php 7.4, these are configuration for emergency:
# Limit request body size to 2MB (adjust based on your app's actual needs)
LimitRequestBody 2097152
# if you use php-fpm
pm.max_requests = 1 if using PHP-FPM
http {
client_max_body_size 2m;
}
server.max-request-size = 2048
<configuration>
<system.webServer>
<security>
<requestFiltering>
<requestLimits maxAllowedContentLength="2097152" />
</requestFiltering>
</security>
</system.webServer>
</configuration>
example.com {
route {
request_body {
max_size 2MB
}
php_fastcgi localhost:9000
}
}
tune.http.maxrequest
Symptom: windows boot show 2 option, windows 10 and windows recovery
Assume: partition windows 11 has been replace with windows 10.
i used these steps to downgrade win 11 to win 10 (fresh install)
Find windows recovery / old windows i.e. windows 11
C:\Windows\system32>bcdedit /enum
Windows Boot Manager
--------------------
identifier {bootmgr}
device partition=\Device\HarddiskVolume2
path \EFI\Microsoft\Boot\bootmgfw.efi
description Windows Boot Manager
locale en-US
inherit {globalsettings}
default {current}
resumeobject {b9a24d5c-cf4c-11f1-88b8-fa1143ace85b}
displayorder {current}
{7c1da856-b085-11ec-bcd2-a47027794018}
toolsdisplayorder {memdiag}
timeout 30
Windows Boot Loader
-------------------
identifier {current}
device partition=C:
path \Windows\system32\winload.efi
description Windows 10
locale en-US
inherit {bootloadersettings}
recoverysequence {b9a24d5e-cf4c-11f1-88b8-fa1143ace85b}
displaymessageoverride Recovery
recoveryenabled Yes
isolatedcontext Yes
allowedinmemorysettings 0x15000075
osdevice partition=C:
systemroot \Windows
resumeobject {b9a24d5c-cf4c-11f1-88b8-fa1143ace85b}
nx OptIn
bootmenupolicy Standard
Windows Boot Loader
-------------------
identifier {7c1da856-b085-11ec-bcd2-a47027794018}
device unknown <-----------------------------------
path \WINDOWS\system32\winload.efi
description Windows 10
locale en-US
inherit {bootloadersettings}
recoverysequence {7c1da857-b085-11ec-bcd2-a47027794018}
displaymessageoverride Recovery
recoveryenabled Yes
isolatedcontext Yes
allowedinmemorysettings 0x15000075
osdevice unknown
systemroot \WINDOWS
resumeobject {7c1da855-b085-11ec-bcd2-a47027794018}
nx OptIn
bootmenupolicy StandardRemove windows recovery / old windows
C:\Windows\system32>bcdedit /delete {7c1da856-b085-11ec-bcd2-a47027794018}
The operation completed successfully.Restart your laptop to test it.
We dont want windows 10 upgrading to windows 11
or copy this to notepad and save as no_win11.reg
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
"TargetReleaseVersion"=dword:00000001
"ProductVersion"="Windows 10"
"TargetReleaseVersionInfo"="22H2"then right click to file and merge