Inside Microsoft's plan to kill PPLFault

This report analyzes two Windows security issues exploited by PPLFault and GodFault: an admin-to-PPL paging-based code-injection technique and a subsequent PPL-to-kernel escalation. It documents how build 25941 of Windows Insider Canary adds page-hash validation for remote-hosted images to mitigate the attack, describes debugging evidence of the failure mode, and notes public release of exploit code and mitigations (including NoFault and Elastic Defend updates).