RoguePlanet CVE-2026-50656 Poseidon Thread UUID File I/O Saturation in RP_ Temp Dir

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the creation of UUID-named files within RoguePlanet staging directories (RP_<UUID>) under the %TEMP% path. This activity is indicative of Poseidon thread I/O saturation, a technique used to artificially extend the TOCTOU (Time-of-Check to Time-of-Use) race condition window against the Microsoft Defender service (MsMpEng.exe) as part of an exploit for CVE-2026-50656.