A roundup of 265 items curated from across the security community.

BBOT 3.0: Rust-Powered Recon with 15x Faster DNS

The biggest BBOT release ever. Core DNS and HTTP engines rewritten from scratch in Rust, delivering 15x faster DNS resolution and FFUF-class directory brute-forcing without leaving the BBOT process. New modules, native SIEM outputs, ASN targeting via the BBOT.IO API Hub, and reworked scoping. Free and open source.

Read more

News

Japanese telecom giant KDDI confirms a data breach affecting 12 million customer records, one of the largest telecommunications breaches in recent years.

KrebsOnSecurity reveals that a cybersecurity startup is run by individuals with felony convictions for fraud and identity theft, raising questions about vetting in the industry.

NowSecure research finds that Transsion devices, which dominate the African mobile market, include telemetry that sends user data to servers in China without meaningful consent.

International law enforcement operations result in 5,800 arrests of suspected cybercriminals across multiple countries, targeting fraud rings and money laundering networks.

A negotiator who acted as intermediary for the BlackCat/ALPHV ransomware gang has been convicted, marking another win in dismantling the group’s support network.

An operator behind the Ryuk ransomware campaign enters a guilty plea. Ryuk targeted hospitals and critical infrastructure during 2019-2021.

OpenAI expands its bug bounty to reward researchers who find jailbreak techniques and safety bypasses in its models, signaling a shift toward adversarial AI safety testing.

The European Union formally sanctions named GRU officers for conducting cyberattacks against Polish critical infrastructure, including energy grid operations.

European retailer Lidl confirms a breach impacting customer data. Details of the scope and affected regions are still emerging.

CISA’s postmortem reveals a contractor published dozens of internal credentials, including AWS GovCloud keys, in a public GitHub repo for nearly six months before being notified.

More this week (22)

Techniques and Write-ups

CVE-2026-6307: a single V8 bug yields full Chrome renderer RCE with arbitrary read/write and V8 sandbox escape. No heap spray needed, works across 40+ Chrome versions. Full Nebula Security writeup.

A detection-focused breakdown of modern call stack spoofing techniques used to evade EDR, with a hardware-breakpoint-based approach to identify and defeat spoofed stacks.

A new System Integrity Protection bypass on the latest macOS beta demonstrated by researchers Csaba Fitzl and Gergely Kalman. Allows circumventing Apple’s kernel-level file protection.

CVE-2026-53359, a use-after-free in KVM’s x86 emulator that has existed for 16 years. Used as a 0-day in Google’s kvmCTF program, it allows a guest VM to escape to the host.

CVE-2026-43499, a stack use-after-free in the Linux kernel’s futex subsystem dating back 15 years. PoC on GitHub achieves local privilege escalation to root.

CVE-2026-55607: a prompt-injection attack exploits .git worktree confusion in Claude Code’s sandbox to achieve arbitrary code execution outside the sandbox boundary. Full writeup and PoC available.

Verichains demonstrates an ASLR-independent remote code execution on nginx 1.30.0 using just two bytes, achieving a call to system() without needing an infoleak.

First full-chain browser-to-kernel RCE on Android 17, chaining a Firefox JIT bug (CVE-2026-10702) with a kernel exploit. Earned $92,000 through Google’s bug bounty.

Critical unauthenticated RCE in the Windows HTTP protocol stack. Successful exploitation yields kernel-level code execution. ZDI’s analysis shows detection may be as hard as exploitation.

Researchers found valid code-signing certificates with private keys inadvertently shipped inside public NuGet and npm packages. Attackers could use them to sign malware as trusted software.

More this week (204)

Tools and Exploits

A new userland rootkit technique leveraging Windows filesystem filter drivers to intercept and modify I/O at the kernel boundary without loading a traditional kernel driver.

A set of Beacon Object Files for lateral movement through Windows service abuse. Covers service creation, modification, and execution with minimal on-disk footprint.

New Cobalt Strike release with updated features for adversary simulation. Continues to be the industry standard C2 framework for red team operations.

Browser-based dashboard for Graph API post-exploitation. Handles token ingestion, device code phishing, and keyword searches across SharePoint and OneDrive in one interface.

Latest Sigma release adds 20 new rules covering TanStack supply-chain attacks, CVE-2026-41089, and Copy Fail, plus 61 rule updates and expanded AV detection coverage.

A Rust-based static vulnerability scanner using Tree-sitter parsers with pattern-based detection and taint flow analysis. All rulesets included with no paid account needed.

Cloudflare releases Drop, a tool that uses AI to convert any web page into clean structured data. Useful for threat intelligence pipelines and automated OSINT collection.

PoC using a legitimately Microsoft-signed Defender kernel driver to kill arbitrary EDR processes. No BYOVD needed since the driver is already trusted by Windows.

PowerShell toolkit for forensic analysis of Microsoft 365 and Entra ID environments. Covers sign-in logs, audit trails, and identity-related incident response workflows.

More this week (9)