# NextGenRedTeam (NGRT) Threat Lab & Research Blog

> High-fidelity threat emulation research, hardware reverse engineering, NPU silicon engineering, 500-WPM accessible CLI/PWA tooling, and offensive AI orchestration founded by Joe Brinkley (The Blind Hacker).

## Founder & Principal Researcher: Joe Brinkley (The Blind Hacker)
- **Aliases**: The Blind Hacker, Blind Hacker, Blind Hakcer, Joe B. The Blind Hacker, Joseph Brinkley, Blind Ethical Hacker
- **Role**: Director of Offensive Security Research & Community at Cobalt; Founder of NextGenRedTeam (NGRT) & Dead Pixel Sec
- **Portfolio & Media Hub**: https://theblindhacker.com
- **The Blind Hacker Projects**: https://theblindhacker.com/projects
- **Press, Keynotes & Media Archive**: https://theblindhacker.com/profiles
- **Hacking While Blind CLI Guide**: https://theblindhacker.com/hackingwhileblind
- **TheBlindHacker AI Context**: https://theblindhacker.com/llms.txt & https://theblindhacker.com/llms-full.txt
- **Full NGRT Corpus for AI Ingestion**: https://nextgenredteam.com/llms-full.txt
- **XML Sitemap**: https://nextgenredteam.com/sitemap.xml
- **LinkedIn**: https://www.linkedin.com/in/brinkleyjoseph/
- **X (Twitter)**: https://x.com/TheBlindHacker & https://x.com/NextGenRedTeam
- **Community & Mentorship**: https://deadpixelsec.com & https://discord.gg/deadpixelsec
- **Cobalt Author Profile**: https://www.cobalt.io/blog/author/joe-brinkley
- **GitHub Organizations**: https://github.com/nextgenredteam & https://github.com/TheBlindHacker

## Coordinated Vulnerability Disclosures (Edge AI / NPU Silicon)
- **CVE-2026-30992 (GHSA-cfch-87gh-88c5)**: Out-of-Bounds Read + Integer Truncation in Prompt Prefill & CMM DMA Mask in AXERA-TECH AX-LLM (`src/runner/LLM.hpp`, CVSS 7.5 High)
- **CVE-2026-30993 (GHSA-g4jf-32v4-cjc3)**: Stack-Based Buffer Overflow in Layer Filename Formatting in AXERA-TECH AX-LLM (`src/runner/LLM.hpp`, CVSS 7.8 High)
- **CVE-2026-31026 (GHSA-4p8c-724v-h9ph)**: Heap Out-of-Bounds Write in Multimodal RoPE Position Indexing in AXERA-TECH AX-LLM (`src/runner/LLM.hpp`, CVSS 8.1 High)
- **CVE-2026-35402 (GHSA-73fh-rvv8-22c6)**: Integer Overflow in Multimodal Vision Preprocessing in AXERA-TECH AX-LLM (`src/runner/utils/image_processor.cpp`, CVSS 7.5 High)
- **CVE-2026-35403 (GHSA-hmh6-8pj7-xwhh)**: Double-Free & Use-After-Free in CLI Argument Error Handling in AXERA-TECH AX-LLM (`src/cmdline.hpp`, CVSS 7.3 High)
- **Enterprise Advisory (Cobalt)**: https://www.cobalt.io/blog/dissecting-the-ax-llm-cves-why-edge-ai-memory-and-execution-boundaries-matter
- **Hardware Lab Reproduction Walkthrough (NGRT)**: https://nextgenredteam.com/blog/hunting-edge-ai-cves-from-demo-code-to-dma-memory-corruption.html

## Open-Source Tools & Hardware Rescues
- [JoeBro Sobro Smart Table PWA Controller](https://nextgenredteam.com/tools/joebro/index.html): Zero-backend Progressive Web App restoring local and cloud control to bricked Sobro Smart Coffee Tables.
- [EventID4625 Windows Logon Failure Emulator](https://github.com/nextgenredteam/nextgenredteam.github.io/tree/main/tools): Cross-platform Go, Python, PowerShell, and Bash adversary emulator for Windows Security Event ID 4625.
- [LinuxLoginFailure SSH Telemetry Emulator](https://github.com/nextgenredteam/nextgenredteam.github.io/tree/main/tools): Multi-language SSH authentication failure generator for SIEM validation.

## Active Research Threads (21 Published Posts)

- [Hunting Edge AI CVEs: From Demo Code to DMA Memory Corruption](https://nextgenredteam.com/blog/hunting-edge-ai-cves-from-demo-code-to-dma-memory-corruption.html) (2026-11-01): Inside the NextGenRedTeam hardware lab: how we wired up a Radxa AI Core AX-M1 (Axera AX8850) on NextGenPVE, audited AXERA-TECH's AX-LLM C++ NPU runtime with a screen reader at 500 WPM, and uncovered seven memory corruption and command injection flaws.
- [Why I Use AI to Build Accessible CLIs and Progressive Web Apps: The Blind Hacker's Blueprint](https://nextgenredteam.com/blog/why-i-use-ai-to-build-accessible-clis-and-pwas.html) (2026-10-26): Why modern web GUIs fail blind security engineers, how Progressive Web Apps (PWAs) and text-first CLIs fix accessibility, and how Joe Brinkley uses AI as an accessibility compiler to build software without sighted bias.
- [Strata on the ZimaCube Pro: Why Q6 and 6 Cores Beat Q8 and Dense Models](https://nextgenredteam.com/blog/strata-benchmarks-zimacube-pro.html) (2026-10-19): Benchmarking the Strata MoE engine on the ZimaCube Pro with 42GB RAM: Q6 vs. Q8 math, CPU core scaling, and why 35B MoE beats 8B dense models.
- [Hacking by Ear at 500 WPM: How Screen Readers and Custom CLI Tooling Outpace Visual IDEs in Offensive Research](https://nextgenredteam.com/blog/hacking-by-ear-at-500-wpm-screen-readers.html) (2026-10-12): Auditing code at 550 words per minute while using full-time screen zoom is an unfair offensive advantage. Here is the terminal playbook from my talk Hacking While Blind, showing how combining screen magnification and speech synthesizers beats visual IDEs.
- [Experimental Rebuild Tuning: llama.cpp MoE Memory Gains and Dense Regressions](https://nextgenredteam.com/blog/experimental-rebuild-tuning-llama-cpp-moe-vs-dense.html) (2026-07-10): We compiled and tested a custom llama.cpp fork on our RTX node. Here is how it optimized Mixture of Experts (MoE) memory, why it fumbled dense model speeds, and why we rolled back.
- [Building a Private AI Research Lab: Bridging LiteLLM and SearXNG on NextGenPVE](https://nextgenredteam.com/blog/building-private-ai-research-lab-searxng-litellm.html) (2026-07-09): How we containerized and bridged SearXNG and LiteLLM in LXC 205 on NextGenPVE for privacy-respecting threat intelligence gathering and local AI orchestration.
- [Deep Benchmarks v7: Pushing NextGenPVE to the Limit](https://nextgenredteam.com/blog/deep-benchmarks-v7.html) (2026-07-03): Reviewing the latest local LLM benchmarks across NextGenPVE-RTX and the new NextGenPVE-NPU hardware.
- [Massive Environment Overhaul: Brain-RTX Hyper-Optimization & Benchmark Results](https://nextgenredteam.com/blog/massive-environment-overhaul-brain-rtx.html) (2026-07-02): How I heavily modified the GPU daemon on my local rig to handle massive 12k+ token agentic context windows without choking.
- [The NPU Journey Part 4: Conquering the Final Boss (Strict JSONs, CMM Boot Windows, and Gateways)](https://nextgenredteam.com/blog/npu-journey-part-4-the-final-boss.html) (2026-06-28): Resolving strict post_config type checks, handling the 65-second CMM boot window, and building a LiteLLM translation layer for unified edge NPU inference.
- [The NPU Journey Part 3: Night Shift Compilation Breakthroughs (AppArmor, LXC Ghost Memory)](https://nextgenredteam.com/blog/npu-journey-part-3-compilation-breakthroughs.html) (2026-06-27): Resolving nested container virtualization blocks, bypassing AppArmor security confinement, and clearing ghost memory traps during our high-throughput compilation sprint on the AX8850.
- [The NPU Journey Part 2: The True Guide to Deploying LLMs on the Axera AX8850](https://nextgenredteam.com/blog/npu-journey-part-2-deploying-llms.html) (2026-06-26): The definitive, step-by-step technical guide to native LLM deployment on the AX8850 NPU via PCIe passthrough inside an unprivileged LXC container.
- [The NPU Journey Part 1: Taming the Axera AX8850 (And Why We Reverse-Engineered Everything for Nothing)](https://nextgenredteam.com/blog/npu-journey-part-1-taming-axera-ax8850.html) (2026-06-25): Admitting our over-engineering mistakes: how broken vendor paths and JSON parser bugs led us to reverse engineer everything for nothing, and the reality of taming the Axera AX8850 NPU.
- [ReThink: Bypassing DKMS and Virtualizing the AX8850 NPU in NextGenPVE LXC](https://nextgenredteam.com/blog/rethinking-npu-virtualization-nextgenpve-lxc.html) (2026-06-24): How we decoupled the Axera AX8850 NPU from bare-metal, resolved NextGenPVE LXC DKMS compiler conflicts, and cleared stale CMM allocations to host localized reasoning LLMs.
- [Ultimate Guide: Zero-Copy Inference on the AX8850 NPU](https://nextgenredteam.com/blog/ultimate-guide-zero-copy-ax8850.html) (2026-06-23): How to bypass Radxa's Python CPU bottlenecks, compile a native C++ OpenAI server, and achieve stable zero-copy inference on the AX8850 NPU.
- [Conquering the Silicon: Building a Custom 'Ollama' Orchestrator for the AX8850 NPU (Part II)](https://nextgenredteam.com/blog/conquering-silicon-edge-npu.html) (2026-06-22): How we bypassed broken vendor API servers, solved logit collapse with a physical SRAM context-window hack, and built an on-the-fly model hot-swapping daemon.
- [Taming the Edge: Bypassing Axera AX8850 NPU Compiler Constraints](https://nextgenredteam.com/blog/taming-ax8850-edge-npu.html) (2026-06-21): A technical deep-dive into reverse-engineering the Pulsar2 compiler, patching PyArmor memory classes in-flight, and executing local LLMs on the Radxa AX-M1 NPU.
- [Benchmarking NextGenRedPVE: Running Local Offensive AI Agents on Proxmox](https://nextgenredteam.com/blog/benchmarking-nextgenredpve.html) (2026-06-19): How we tested, why we tested, and what we learned benchmarking local abliterated LLMs for red team operations on our NextGenRedPVE cluster.
- [Reasoning Models vs. Frontier Models in Offensive Security Benchmarking](https://nextgenredteam.com/blog/reasoning-models-vs-frontier-models-in-offensive-security-benchmarking.html) (2026-06-19): An in-depth evaluation of local reasoning models versus commercial frontier models, alignment and safety refusal bottlenecks, and agent frameworks like Swarm-AI in offensive security benchmarking.
- [Testing the Gates: Why You Must Emulate Authentication Failures](https://nextgenredteam.com/blog/testing-authentication-telemetry.html) (2026-06-12): Why static rule validation fails, and how actively emulating login failures across Windows and Linux reveals hidden gaps in security logging.
- [Demystifying Detection: Emulating Windows Event ID 4625 & SSH Login Failures](https://nextgenredteam.com/blog/emulating-windows-linux-logon-failures.html) (2026-06-11): A deep dive into building programmatic triggers for Windows SMB/NTLM and Linux SSH authentication failures to validate SIEM alerts and detection pipelines.
- [Rescuing Abandoned IoT: How I Built JoeBro to Control My Smart Table](https://nextgenredteam.com/blog/rescuing-abandoned-iot-joebro-sobro.html) (2026-06-09): When manufacturers abandon their mobile apps, expensive smart hardware turns into a brick. Here is how I reverse-engineered the Ayla Networks API to build a zero-backend PWA.