A researcher says attacks chaining 4 vulnerabilities is hacking unpatched boxes.