Archive
All articles, newest first. Page 29.
Lazarus Exploits Windows AFD.sys Zero-Day for SYSTEM: Third Time in Two Years
The North Korean group used CVE-2026-68820 for local privilege escalation to SYSTEM, deploying the FudModule 3.1 rootkit and Troy back…
French Cyber-Spies Used GitHub Code to Hack EncroChat
A reverse-engineering report reveals French malware targeting EncroChat was copied from GitHub. Thousands of convictions across Europe…
iOS: Coruna and DarkSword Proliferation Exposes 17,000 Domains to Risk
iVerify VP of Research Matthias Frielingsdorf revealed at Black Hat USA 2026 the unprecedented scale of a proliferation: roughly 17,00…
Shell in Cl0p's Crosshairs: Investigation Into Alleged 89GB Theft From PTC Systems
Shell confirms an investigation after the Cl0p ransomware group claimed theft of 89GB of technical data. The campaign targeting PTC Wi…
CVE-2026-55040: Active SharePoint Exploitation Within 48 Hours of PoC Release
Attackers are already exploiting CVE-2026-55040, a critical JWT authentication bypass in Microsoft SharePoint Server. The window betwe…
CVE-2026-32475: Elementor Pro ≤4.2.1 Exposed to Unauthenticated RCE
A critical CVSS 9.0 vulnerability in Elementor Pro allows unauthenticated PHP file upload. The fix sat ready for 34 days before releas…
DOUBLECUP: The Fake Steganography That Exposes Criminal Payloads to a Simple grep
The DOUBLECUP loader promises advanced steganography but hides PowerShell code in plaintext after the PNG file. Extractable with FINDS…
Windows: Localized Filename Bug Steals NTLM Credentials with a Single Click
CVE-2026-50508: A flaw in Windows localized filenames enables NTLM hash theft simply by opening a file or visiting a web page. Microso…
Fabric.js JSON Parsing Turns Attack Vector: SSRF Bug Discovered
CVE-2026-19504 in Fabric.js' loadFromJSON method enables SSRF attacks for sensitive data disclosure. The fix requires implementing a U…
Foxit PDF Reader: UAF Bug in Annotation Parser Enables Remote Code Execution
ZDI-26-604 (CVE-2026-13126) is a Use-After-Free in Foxit PDF Reader's Annotation object parsing. Opening a malicious PDF allows arbitr…
Safari UAF in JavaScriptCore: Apple Patches Already Available
CVE-2026-64715 in Safari's JavaScript engine enables remote code execution simply by visiting a malicious page. Patches were released…
NVIDIA TensorRT: ONNX Parsing Flaw Enables RCE with CVSS 7.8
CVE-2026-24268 strikes the ONNX parser in NVIDIA TensorRT.
BlueZ: A2DP Buffer Overflow Enables Root RCE After Pairing
ZDI-26-589 discloses a stack-based buffer overflow in the BlueZ Bluetooth stack's A2DP module, allowing remote code execution as root…
libwebsockets: RCE via HTTP/2 HPACK, Single-Line Patch Available
ZDI-26-590 discloses an unauthenticated remote code execution vulnerability in libwebsockets. A missing bounds check in the HTTP/2 HPA…
Windows Compatibility Appraiser: LPE Bug Escalates from LOCAL SERVICE to SYSTEM
ZDI-26-606 discloses a local privilege escalation vulnerability in the Microsoft Windows Compatibility Appraiser. Symbolic link manipu…
Home Assistant Green: Root RCE via Localhost Exploit Disclosed by ZDI
ZDI-26-561 reveals a command injection in the Home Assistant Green go2rtc process. The flaw allows arbitrary code execution as root fo…
SynkLoader Revives the Fake Lock Screen: How the Malware Works
Marcus Hutchins and Expel's research team discovered and analyzed SynkLoader, a modular malware combining Python, C, C# and PowerShell…
CVE-2026-65775: Microsoft Patches win32kfull UAF Discovered at Pwn2Own
Microsoft fixed CVE-2026-65775, a Use-After-Free in the Windows win32kfull driver discovered by Kentaro Kawane at Pwn2Own. The flaw en…
CVE-2026-18963: Keycloak Account Takeover in Seconds, Bypassing MFA
A critical flaw in Keycloak's password-reset flow lets an unauthenticated attacker seize any account — including admins — in roughly f…
AMD Confirms Two TPM 2.0 Flaws: False Attestations on Ryzen from 3000 Series to AI
Two vulnerabilities in AMD's TPM 2.0 firmware jeopardize the hardware attestation chain on Ryzen processors. Patched firmware has been…
ShinyHunters Hits 100+ Universities with Oracle Zero-Day CVSS 9.8
The ShinyHunters group exploited CVE-2026-35273, an unauthenticated RCE in Oracle PeopleSoft, against more than 100 organizations befo…
CVE-2026-18294: RCE in OriginLab Origin Viewer via Malformed OGW File
The CVE-2026-18294 vulnerability in OriginLab Origin Viewer's OGW parser enables remote code execution with a CVSS 7.8 score. Exploita…
Parallels RAS Client: Local Vulnerability Allows Escalation to SYSTEM
CVE-2026-18263 affects the RAS RDP Backend Service with a CVSS 7.8 score. An exposed dangerous function allows low-privilege code to e…
TeamPCP Exploits AI Supply Chain to Steal One Terabyte of Credentials
The TeamPCP campaign compromised GitHub Actions and PyPI packages between March and April 2026. Over 2,500 organizations potentially e…