A roundup of 238 items curated from across the security community.
CVE-2026-79957: IDOR Exposes Cleartext Passwords in ServiceNext
Black Lantern Security discovered that any authenticated ServiceNext user could enumerate sequential user IDs and pull every account’s cleartext password. Fully disclosed and remediated.
IIS Shortname Enumeration Still Opens Doors After 16 Years
Black Lantern Security breaks down why this medium-CVSS, 16-year-old default-on IIS finding keeps chaining into critical results on real engagements. Also: Trezor wallets hit with the same implant technique.
News
A compromised ConnectWise OAuth app gave attackers access to emails, files, and directory data across hundreds of M365 tenants. Persistent access survived credential revocation; MSP blast radius extends to downstream customers.
Someone embedded hardware implants in Ledger crypto wallets sold by authorized merchants, harvesting seed phrases and hijacking $100M from 300+ accounts. Trezor also affected.
- FortiBleed: 86,000 Fortinet Devices Compromised Across 194 Countries by Black Hills Information Security.
FBI and Secret Service warn that attackers are selling persistent access to compromised Fortinet devices. The campaign looks more APT than smash-and-grab ransomware.
DOJ charged an OpenAI employee with installing a surreptitious audio recording device. Corporate espionage targeting AI labs is now a law enforcement priority.
Palo Alto Networks warns of an actively exploited RCE in PAN-OS. Patch immediately.
- October 2026 Patch Tuesday: 1,411 Vulnerabilities, 3 Zero-Days by BleepingComputer.
Record-breaking month. 70 critical flaws, 317 RCEs, 677 privilege escalations. One zero-day is actively exploited in the wild.
Anthropic researchers traced the unexplained constants in NIST elliptic curves to lrand48 calls seeded with Unix timestamps from the 1990s. No backdoor, just 90s engineering.
Coordinated DOJ takedown targeting DPRK remote IT worker operations that infiltrated 70+ US companies, funneling wages back to the regime.
Mandiant and GTIG detail exploitation of a BeyondTrust Remote Support zero-day by Chinese nexus espionage actor ARMORY CASTLE (formerly UNC5221).
Citizen Lab documents how Discover Tech repurposed the ad-tech supply chain to deliver commercial spyware to specific targets via programmatic advertising infrastructure.
More this week (19)
- Recon decides how much you find. Fragmented tools and manual chaining leave data behind. Learn # BBOT with Black Lantern Security at @ bsideschs Nov 6. Free seat, optional donation to # BSides . Save.
- RT Polymarket: BREAKING: Japan declares a “state of emergency in cyberspace” as cyberattacks surge, with more than 20 major companies reporting breach… by Vincent Yiu.
- RT Co11ateral: Using ADStrike to Compromise Active Directory Using ADStrike with Qwen 2.5-Coder to orchestrate an attack on our Active Directory. It h… by DirectoryRanger.
- Home Assistant Green falls again Last year’s #Pwn2Own go2shell chain is now public. There’s no place like 127.0.00.1 https://mccaulay.co.uk/… by McCaulay.
- Microsoft Patches More Than 1,400 Security Flaws by BrianKrebs.
- RT Unit 42: New #AI malware: C2Agent is an LLM-operated Windows malware with MCP, skills and living-off-the-AI, abusing the victim’s own AI coding too… by kmkz.
- RT Steven Adair: We caught another threat actor using zero-day exploits to compromise an edge device - in this case Ivanti Connect Secure. The used a… by Max.
- U.K. Sanctions Cryptomus for RU Money Laundering by BrianKrebs.
- FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested https://www.bleepingcomputer.com/news/security/fbi-raids-dprk-it-worker-laptop-f… by BleepingComputer.
- Langflow’s Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts https://thehackernews.com/2026/10/langflows-critical-authentica… by Nicolas Krassas.
- https://blackmagick.io update: new technique, BM-T3009 “Browser Relay” uses an attacker browser extension with websockets to turn compromised browser … by K̵i̵r̵k̵ ̵T̵r̵y̵c̵h̵e̵l̵.
- Orange Tsai (@orange_8361) is taking the #HEXACON2026 stage on Oct 16 in Paris with the logic-only Microsoft Edge full chain he used at #Pwn2Own Berli… by DEVCORE.
- Top 5 most shared links in my network (Oct 15): 1. https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/ (… by Ring3API 🇺🇦.
- Zero-click attacks used targeted ads to deliver Candiru spyware https://www.bleepingcomputer.com/news/security/zero-click-attacks-used-targeted-ads-to… by BleepingComputer.
- Burger King Japan data breach exposes 11 million customer records https://www.bleepingcomputer.com/news/security/burger-king-japan-data-breach-exposes… by BleepingComputer.
- Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants https://thehackernews.com/2026/10/hackers-use-compromised-conne… by Nicolas Krassas.
- ConnectWise SkyKick Breach: How to Check Your Microsoft 365 Tenant by rpepple.
- RT OpenCode: We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users We have not… by Swissky.
- RT Spycraft101: Seven Chinese nationals were arrested on espionage charges in Turkey in May 2025. According to local press reports, the men were opera… by thaddeus e. grugq.
Techniques and Write-ups
Full guest-to-host escape via KVM. The most-shared link this week across security Twitter, with 21 independent mentions.
Calif.io demonstrated a full untethered jailbreak on iPhone 18 Pro running iOS 27.0.1 at Hexacon. Persists across reboots.
Doyensec research on achieving code execution inside Windows Isolated User Mode, bypassing one of the platform’s strongest trust boundaries.
Detailed technical breakdown of a Chrome full-chain exploit developed by XBOW. From initial renderer bug to sandbox escape to code execution in six days.
Walkthrough of building a C# custom PowerShell runspace that sidesteps AMSI and ETW telemetry without the usual suspicious API calls.
Six vulnerabilities in Linux kernel core subsystems spanning server LPE, container escape, and Android root from untrusted_app on Galaxy S26 Ultra.
Calif.io found and exploited a kernel vulnerability that has been hiding in OpenBSD since 1989. Full writeup from initial discovery to reliable exploitation.
1,285 reports, $242K in bounties, one Linux kernel zero-day discovered via host network packet parsing. No customer data compromise reported.
Synacktiv’s second interactionless Tesla exploit chain. VCSEC takeover via TPMS gives direct CAN bus access and the potential for kinetic effects.
Quentin Kaiser demonstrates how a single parser implementation yields two distinct exploitable bugs. Clean walkthrough of the analysis process.
More this week (176)
- RT UwU Underground: One of us works adjacent to IR and there’s been an interesting campaign that we think deserves some attention. The campaign appear… by thaddeus e. grugq.
- > be me > read this comment from peer > brush it off > nah no way > how would Israel not do shrimple email security > don’t even bother checking > fas… by vx-underground.
- postmessage XSS on reveal.js (72k+ github stars) I reported in Aug (now fixed). by devansh.
- Docker Hub flaw let attackers impersonate users, tamper with images https://www.bleepingcomputer.com/news/security/docker-hub-flaw-let-attackers-imper… by BleepingComputer.
- A Windows malware loader uses the encrypted Tox messaging network for command-and-control, avoiding reliance on a fixed C2 server. @varonis … by BleepingComputer.
- Retail giant Ahold Delhaize, one of the world’s largest food retail chains, confirmed today that it was forced to take some systems offline after a “c… by BleepingComputer.
- GitLab warns of max severity code execution vulnerability https://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-rege… by BleepingComputer.
- When LLM Gateways Go Wrong: Findings from LiteLLM https://research.checkpoint.com/2026/when-llm-gateways-go-wrong-findings-from-litellm/ by Nicolas Krassas.
- SAP warns of maximum severity OAuth2 SSRF security flaw https://www.bleepingcomputer.com/news/security/sap-warns-of-maximum-severity-oauth2-ssrf-secur… by Nicolas Krassas.
- LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network https://thehackernews.com/2026/10/lg-smart-tvs-vulnerable-to-pre-auth.html by Nicolas Krassas.
- Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control https://thehackernews.com/2026/10/two-critical-marklogic-flaws-cou… by Nicolas Krassas.
- Chinese Cars in Norway Stored Military Exercise Footage and Access Codes https://militarnyi.com/en/news/chinese-cars-in-norway-stored-military-exercis… by Nicolas Krassas.
- A week after I published interview with new CEO of spyware maker Paragon, AccessNow has sent letter to pension owners who invest in AE Industrial Part… by Kim Zetter.
- Quick Friday macOS malware. Shared by @malwrhunterteam: 29fc5399903e47f7aa13f932ed88ea8770456e2ec860898f2b207d53db075355 - st_helper611b_arm64. Talks … by L0Psec.
- It’s Friday so before the weekend, more DPRK from @malwrhunterteam, starting with this script: 7392bccd63277bc5dec54f97384bb956a1c138bde6d519bc87ff104… by L0Psec.
- If you are a threat hunter or Detection engineer - Baseline your wscript usage. The numbers will be staggering and then take it up the chain to get ws… by The Haag™.
- Whtn is not in the command line, it is loaded at runtime. ™ by Giuseppe
N3mes1s. - New one from @pruvadev now that sandboxes are hot agian: CVE-2026-96812: gVisor directfs openHandle host-FD identity TOCTOU → guest-to-host sandbox e… by Giuseppe
N3mes1s. - Samsung: https://libimagecodec.quram.so Heap Buffer Overflow in DNG Uncompressed Tile Decoding (QuramDngReadImage::readUncompressed) https://project-z… by Project Zero Bugs.
- RT Merill Fernando: Did you know that if you have Entra ID P1 there is a new way to block your stolen refresh token from being replayed by the attacke… by Sean Metcalf.
- Input payload obfuscation is a real game changer here. No AMSI or ETW bypass needed and memory scanner evasion by S3cur3Th1sSh1t.
- UK🇬🇧 FCDO Joint Statement on Iran🇮🇷, 12 October (Official attribution of RAF Fairford🇬🇧 event to Iran IRGC🇮🇷 using cover n… by SwitHak ().
- In 2023, @Synacktiv researchers identified an authentication bypass in #Danfoss SM800 and SC255/SC355 controllers. The same vulnerability, reported ag… by Synacktiv.
- We Let AI Fuzz Adobe Reader for a Week. It Found a Critical Zero-Day CVE-2026-81983 https://remedio.io/blog/cve-2026-81983-integer-overflow-vulnerabil… by /r/netsec.
- frontier class vulnerabilities: it gets worse before it (maybe) gets better https://shubs.io/frontier-class-vulnerabilities-it-gets-worse-before-it-ma… by /r/netsec.
- The October 2026 Security Update Review by Dustin Childs.
- printer vendors love it when you crack their toner DRM and start selling counterfeit cartridges/refills by blasty.
- CVE-2026-107651 Eye of Gnome (eog) Heap Buffer Overflow PoC https://gist.github.com/EgeBalci/2dca1fb72229547a015ca48fae66dddf by ege.
- Safari wanted a decryption key. @AmirMSafari gave it alert(1). Two fresh XSS vectors using , and onwebkitneedkey just landed in our Por… by Gareth Heyes \u2028.
- Last night I updated Shazzer to improve the fuzz result toast. It’s now more compact and you can see fuzz results for each browser in your personal ne… by Gareth Heyes \u2028.
- Another XSS vector for our cheat sheet, this time using Special mention to @AmirMSafari, who found this one and has contributed so many ex… by Gareth Heyes \u2028.
- Building on my research, my colleague @Alex_______C exfiltrated a 600-character hex token instantly using just background images and selectors. No rec… by Gareth Heyes \u2028.
- Chrome’s new tag has something to say: Another XSS vector for our cheat sheet, found by @omidxrz. by Gareth Heyes \u2028.
- Chrome added a tag. @omidxrz made it an XSS vector: Now in our XSS cheat sheet. by Gareth Heyes \u2028.
- Full static & memory analysis of Overlord RAT: Go agent architecture HTTP/2 + WebSocket C2 Reflective DLL injection Browser keylogging IOCs … by Panos Gkatziroulis.
- DLL Injection with SetWinEventHook: The Accessibility Hook as an Injector by @zodiacon https://trainsec.net/library/windows-internals/dll-injection-wi… by Panos Gkatziroulis.
- The forgotten SSH-Harvester has just been upgraded to use eBPF uprobe! Not only that, #emp3r0r now supports on-demand and in-memory library loading, i… by jm33_ng.
- RT Matthew Green: “OpenAI in talks to buy Trail of Bits” https://www.theinformation.com/articles/openai-early-talks-buy-security-startup-trail-… by kmkz.
- RT Mia: I’ve finally published the write up on my Pwn2Own exploit!!! https://github.com/newbe3e/Pwn2Own-Automotive-2026-Alpine-iLX-F511-0-Click-RCE-Ex… by kmkz.
- RT Ziyi Guo: “Bad UVM” - Privilege Escalation, Container Escape via NVIDIA GPU UVM - hijack read-only page cache. More details: https://medium.com/@gu… by kmkz.
- Some possible interesting fake “POS Terminal Maintenance Update” sites giving very low detected malware: https://alohapos-update[.]com/ https://instan… by MalwareHunterTeam.
- by MalwareHunterTeam.
- PentestAssistant: an LLM harness for autonomous whitebox web application pentesting. Combines source code analysis with dynamic exploitation, vulnerab… by Max dcb.
- RT 0x12 Dark Development: Stealing Plaintext Windows Credentials New Medium post, in this one we will see how to steal plaintext Windows credentials a… by Max.
- Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations by Ashley Shen.
- Cyberattack on Connected Fridges in France by Bruce Schneier.
- We backdoored a 7B open model for under $50. Pointed Codex at it -> it silently stole credentials the moment we hit the trigger phrase. ->100% hit rat… by ProjectDiscovery.
- Google’s PageBreak Project – Real-World Findings https://bughunters.google.com/blog/pagebreak-real-world-findings by Swissky.
- The Binding Gap: The MCP Tool Your Agent Vetted Is Not the Tool It Calls https://x.com/i/broadcasts/1NxaroYWPoDKj by Pomerium.
- stackd is out: AWS on your own machine, running a very good approximation of the real thing. Existing AWS emulators weren’t enough for me, especially … by Rad.
- Lights Out: BMCs hold immense authority over server hardware and can be an overlooked attack surface. runZero’s BMC research details vulnerabili… by runZero, Inc..
- RT Zack Korman: OpenAI just revealed that an employee stole over a hundred highly confidential files months ago, and they didn’t notice until now. The… by scriptjunkie (Matt).
- RT Joseph Cox: New: an AI company now lets cops identify specific houses, using data from Zillow/Airbnb, based on a single photo. It’s part of Raven, … by thaddeus e. grugq.
- RT Dino A. Dai Zovi: Called it. Reverse engineering of mobile apps is now much easier and can be used to target their supporting back-end APIs, possib… by thaddeus e. grugq.
- RT Dr. Dan Lomas: Russian-aligned spies upgrade malware used in attacks on Ukrainian transport, energy firms https://therecord.media/russia-ukraine-ma… by thaddeus e. grugq.
- Taking inspiration from @0x3lk’s STHACK talk, here is a technique to run your shellcode using CLR’s DynamicMethods/JIT internals/Exception handling me… by db.
- RT Hussein Muhaisen: Just added native @Droid / @FactoryAI support to our open-source firmware reverse engineering toolkit. 5 skills extraction, stati… by x86byte.
- We worked a ClickFix chain where every hop before the payload was https://google.com or https://openai.com. The final host wasn’t a domain or an IP: i… by Black Hills Information Security.
- Cisco patches new Secure Email Gateway zero-day exploited in attacks https://www.bleepingcomputer.com/news/security/cisco-patches-actively-exploited-s… by BleepingComputer.
- Hirudo Android malware replaces banking apps to evade security checks https://www.bleepingcomputer.com/news/security/hirudo-android-malware-replaces-b… by BleepingComputer.
- I’ve opened up the five VirtualBox issues in the PZ tracker. 4 of them are bypasses of the VB process hardening (including one which is a broken fix from 2019 due to changes in Windows). Of most inter.
- GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories https://thehackernews.com/2026/10/ghostaction-compromises-about-… by Nicolas Krassas.
- UK Legal Aid Agency: Hackers stole records dating back to 1978 https://www.bleepingcomputer.com/news/security/uk-legal-aid-agency-hackers-stole-record… by Nicolas Krassas.
- Jev and other decision models can still be tricked with prompt injection https://www.theregister.com/ai-and-ml/2026/10/15/jev-and-other-decision-model… by Nicolas Krassas.
- This repository contains research and proof-of-concept material for a Windows privilege-boundary issue involving the Windows Health and Optimized Expe… by Nicolas Krassas.
- Anthropic’s Sept 2026 threat report: attackers prompt-injected an eval sandbox, stole customer API keys, then burned the victims’ own compute to attac… by Nicolas Krassas.
- Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/ by Nicolas Krassas.
- RT Matthew Green: I notified Anthropic of these cross-session replay attacks in May, and was told that “it isn’t an attack”. I continue to be aggra… by Nicolas Krassas.
- RT TrustedSec: The Yandex data center strikes are sparking an important conversation about infrastructure and cyber operations. Director of Security I… by Dave Kennedy.
- RT Binary Defense: Last weeks Citrix 0-Day laid an egg and your SIEM likely never saw it. Attackers hid a payload in a NetScaler crash log and dropped… by Dave Kennedy.
- CVE-2026-89111: SAP Cloud SDK for Python is vulnerable to OAuth2 SSRF that can exfiltrate client credentials when tenant subdomain is attacker-control… by Giuseppe
N3mes1s. - VirtualBox: IDispatch COM Object Interop Process Hardening Bypass EoP https://project-zero.issues.chromium.org/issues/544666386 by Project Zero Bugs.
- The Q3 Vulnerability Pulse: Discovery ≠ Exploitation by Thorsten Rosendahl.
- RT TheZDIBugs: [ZDI-26-757|CVE-2026-111105] (0Day) (Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability (CVSS 7.0; Credit: Michael… by SinSinology.
- Don’t disappoint @lorenzofb click this https://www.404media.co/cops-can-bypass-iphone-automatic-inactivity-reboot-graykey/ by SwiftOnSecurity.
- RT CISA Cyber: We added Ivanti Connect Secure vulnerability CVE-2026-104935 to the KEV Catalog after observed exploitation. A remote attacker cou… by SwitHak ().
- If you’ve got an UniFi Protect AI Key, best get updating @Ubiquiti just patched a 6 bug chain and published the relevant CVEs :) good news is latest v… by Andy Gill.
- Trivy and govulncheck found the same vulnerability, but the code wasn’t in the binary https://www.a3thinker.it/articles/not-in-the-binary/ by /r/netsec.
- AhsayCBS Deep-Dive: Auth Bypass to RCE https://horizon3.ai/attack-research/attack-blogs/ahsaycbs-cve-2026-105133-cve-2026-105134-technical-analysis/ by /r/netsec.
- tensorlake@0.5.144: A Worm With Valid Provenance, and the Firewall Rule That Stops It https://hextrap.io/blog/tensorlake05144-a-worm-with-valid-proven… by /r/netsec.
- Vghost (CVE-2026-74580): Linux kernel vhost stale IOTLB cache leading to universal LPE and Guest-to-Host escape vector https://www.openwall.com/lists/… by /r/netsec.
- Tech details for these bugs now public https://www.nccgroup.com/research/technical-advisory-microsoft-windows-midi-service-module-escalation-of-privil… by Alex Plaskett.
- RT naci: Wrote up my attempt at deobfuscating Luraph-protected Lua: lifting Lua to LLVM IR , then using AI + partial evaluation to strip the VM, and c… by Alex Plaskett.
- You’d expect a lockfile to make a dependency immutable. But often it doesn’t: a hacked repository can swap in malicious code for the **same package … by Dan Guido.
- RT Mr.Niko: CVE-2026-43748 ANE kernel OOB write direct-path user client. no special entitlements. sandboxed app on iOS and macOS. kANEMaxBuffers … by rpw.
- ReflectivePluginLoader - Maps a DLL from a byte buffer in memory, resolves exports, and calls plugin functions either from anonymous memory (classic r… by Panos Gkatziroulis.
- A canvas for red team infrastructure and cyber ranges. Compose a topology, export runnable Terraform and Ansible, and deploy it yourself. Your cloud c… by Panos Gkatziroulis.
- Cross-process instrumentation for Windows x64 in TypeScript Hook Functions Redirect Threads, and Read/write memory in another process, with n… by Panos Gkatziroulis.
- Nice read by Sentinel and some interesting numbers like: “Ransomware actors successfully disabled security tools in about 48% of intrusions in 2024.” … by Panos Gkatziroulis.
- Backdooring Open-Weight AI Models by Bruce Schneier.
- RT dbugs: Three Apple Ecosystem Vulnerabilities: Zero-Click Memory Corruption, iCloud Sender Spoofing, and Root Privilege Escalation Read on dbugs: ht… by kmkz.
- RT JFrog Security: RCE in curl (CVE-2026-92392, HIGH Severity) A malicious HTTP/2 server can turn a use-after-free during uploads into remot… by kmkz.
- RT HeeChan Kim: 8 vulnerabilities I reported were patched in this Patch Tuesday: 1. CVE-2026-96243 2. CVE-2026-88070 3. CVE-2026-83586 4. CVE-2026-838… by kmkz.
- RT Mr.Niko: iOS 26.1. WebContent R/W to native calls. pois0nSword chains CVE-2025-43529 into cage-free read64/write64, then beats PAC with CVE-20… by kmkz.
- RT quarkslab: Reports can be the fun part of a pentest.. if the target uses MyReport. @kaluche_ found a third-party updater running as SYSTEM, an unau… by kmkz.
- by MalwareHunterTeam.
- The are multiple suspicious, recently registered domains resolving to 158.94.210[.]145: cloudeliverrs[.]com cloudeliverenterprise[.]com cloudenterpris… by MalwareHunterTeam.
- EVILGINX EXTENSION IS OUT I am happy to say the free Evilginx Chrome extension has been approved and is finally available for download. … by Kuba Gretzky.
- Top 5 most shared links in my network (Oct 14): 1. https://abraxaslabs.tech/research/pfsense-carp-vhid (9 people) 2. https://abraxaslabs.tech/research… by Ring3API 🇺🇦.
- Neat ChatGPT bug Found manually (even after @OpenAI “pointed Astra at its own systems until it ran out of bugs”) Local (unpriv’d) attacker: • H… by Patrick Wardle.
- We found live API keys from NVIDIA, Nutanix and AllenAI employees just sitting on public GitHub. -> some could upload models under the company’s name … by ProjectDiscovery.
- How to use Codex for Bug Bounty research: explore broadly, validate rigorously - @yeswehack https://www.yeswehack.com/learn-bug-bounty/llm-series-code… by Swissky.
- How I Could’ve Accessed 17 Trillion Microsoft Records - @efaav https://blog.faav.net/how-i-couldve-accessed-17-trillion-microsoft-records by Swissky.
- RT Thomas Seigneuret: Little upgrade on NetExec WMI protocol Now NetExec supports SAM, LSA and NTDS dump using only WMI. Thanks a lot to @al3x_n3… by Swissky.
- RT Perplexity: We’re open sourcing SPACE, the sandbox platform that runs every task in Perplexity Computer. SPACE gives each agent task its own Firecr… by thaddeus e. grugq.
- RT Byron Wan: According to a court document filed by the FBI on Oct 13, Fatai Miao is in a romantic relationship with Wanying “Heather” Zhang (… by thaddeus e. grugq.
- wE foUnd SignS of LiFe wiTh AI WorMs tHat CoLoNize hOusEhOlD deViceS by vx-underground.
- RT Meelo: No more setting up and juggling multiple tools when doing an android assessment on a PHYSICAL DEVICE. https://github.com/capt-meelo/loupe #i… by Mr.Z.
- RT @ArmadinSecurity: We’ve found unauthenticated RCEs across multiple SolarWinds products. This kill chain is in Orion: multiple vulnerabil… by Andrew Oliveau.
- RT Armadin: Armadin researcher @mhskai2017 has uncovered an authenticated RCE vulnerability in Skype for Business Server (CVE-2026-70297, CVSS 8.8). A… by Andrew Oliveau.
- We found a translator extension that changed hands via a lapsed domain and spent 99 days reporting every URL a finance user visited. Endpoint controls… by Black Hills Information Security.
- RT Marcus Williams: New misalignment disclosures! 1. June 17: During RL training, a model exploited a government website’s file-download feature to r… by Bill Demirkapi.
- Microsoft: October Windows update may break Smart App Control https://www.bleepingcomputer.com/news/microsoft/kb5127648-windows-security-update-may-br… by BleepingComputer.
- BAE Systems cyberattack disrupts US federal court operations https://www.bleepingcomputer.com/news/security/bae-systems-cyberattack-disrupts-us-federa… by BleepingComputer.
- BeyondTrust patches zero-day exploited in attacks since August https://www.bleepingcomputer.com/news/security/beyondtrust-patches-zero-day-exploited-i… by BleepingComputer.
- Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-… by BleepingComputer.
- Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth https://www.bleepingcomputer.com/news/security/hackers-hijack-d-link-ubiquiti-… by BleepingComputer.
- Fake Arch Linux packages push malware with root privileges https://www.bleepingcomputer.com/news/security/fake-arch-linux-packages-push-malware-with-r… by BleepingComputer.
- Critical BlockStrap flaw lets hackers run code on Magento servers https://www.bleepingcomputer.com/news/security/critical-blockstrap-flaw-lets-hackers… by Nicolas Krassas.
- Threat notice Cisco NX-OS Nexus 3000 and 9000 Switches https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-napi-rce… by Nicolas Krassas.
- Deep-Dive into Android Binder UaF (CVE-2023-20938) using Time-Travel Debugging https://www.eshard.com/blog/kernel-uaf-1-trigger by Nicolas Krassas.
- Gigabyte kernel driver LPE https://github.com/mein-0/KnockGiga by Nicolas Krassas.
- UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing https://thehackernews.com/2026/10/uat-11985-uses-fake… by Nicolas Krassas.
- Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229) https://www.rapid7.com/blog/post/ra-gitlab-ci-cd-regex-integer-overflow-technica… by Nicolas Krassas.
- Eiliko robot companion exposes private chats and can be hijacked https://www.malwarebytes.com/blog/ai/2026/10/eiliko-robot-companion-exposes-private-c… by Nicolas Krassas.
- Israeli firm used online ads to run vast spy operation, researchers say https://www.reuters.com/legal/litigation/israeli-firm-used-online-ads-run-vast… by Nicolas Krassas.
- U.S. CISA adds Atlassian flaw to its Known Exploited Vulnerabilities catalog https://securityaffairs.com/201086/hacking/u-s-cisa-adds-atlassian-flaw-t… by Nicolas Krassas.
- RT Enno Rey: Wow! Owning a security appliance by sending an e-mail. In the year 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecu… by DirectoryRanger.
- One of the pioneering AI bug finding startups has been acquired. by Haifei Li.
- RT Nick Carr: Guess who’s back? (back again) • re-emerged [APT]29 September 2026, even larger scale • service providers… by Nick Carr.
- RT Volexity: .@Volexity has published the third and final installment of its Mind the (Patch) Gap series. Parts 1 and 2 detailed Volexity’s discovery… by L0Psec.
- artex-global 1,541 stars Imagine an AI red team that never sleeps. LLM multi-agents autonomously pentest your infrastructure - powered by a Go … by Marco Ramilli.
- RT zoverin: Exploit for CVE-2026-83834: https://github.com/wkpwn/CVE-2026-83834/ (my first windows exploit!!!!) by Peter Gabaldon.
- RT Fabian Bader: The current MSSP incident reported by Huntress is a good reminder why you should enable app instance property lock for your applicati… by SwiftOnSecurity.
- RT Rich Warren: Re But it doesn’t just affect Intune + NSIS - any MDM solution that allows users to self-install apps, and other installer packaging f… by X-C3LL.
- PhantomBuffer: Effective EDR Evasion Through Stealth Injection https://www.zerosalarium.com/2026/10/PhantomBuffer-Effective-EDR-Evasion-Stealth-Inject… by /r/netsec.
- New web obfuscation technique where even just formatting rewrites script logic (Chromium DevTools, prettier, WebCrack, Terser and more) https://trusts… by /r/netsec.
- 16% of RPKI-covered IPv4 routes still allow a forged-origin hijack that passes validation, the setup behind the Virtualizor update attack https://ipin… by /r/netsec.
- CVE-2026-108082: Symfony ReDoS. One request. Seconds of CPU https://r3verii.github.io/cve/2026/10/16/symfony-cache-control-redos.html by /r/netsec.
- The Cloudflare Appstore (Appflare) Malware Audit https://mainbrella.com/blog/the-cloudflare-appstore-appflare-malware-audit/ by /r/netsec.
- RT Almamater Technologies: Another M6 gem: return addresses that remember where they came from (PAuth_LR). On M6, Apple’s x1 slice signs each return a… by winterknife.
- AI nerds have been out there smoking making themselves look cool… Now they have to run away from the baddies? by Adam Chester.
- A patch bypass I reported nearly two years ago in Ivanti Connect Secure got patched in 25.1.3.0 .. by just removing the feature completely. Obviously … by Rich Warren.
- Andrii and the SOC Prime team have just launched LogTotal and I find the concept quite interesting You can upload a collection of security logs, run d… by Florian Roth.
- RT Joseph Cox: Here’s how exactly Telegram provides user data to U.S. authorities. A letter recently filed in court shows how Telegram transfers that … by Florian Roth.
- RT Joseph Cox: OpenAI continues to enshittify ChatGPT: OpenAI allows advertisers - or really anyone, I tested myself in 5 minutes - upload raw phone num… by Florian Roth.
- RT JPCERTコーディネーションセンター: ブログ JPCERT/CC Eyes「連続不正アクセス事案の攻撃手法に関する調査」公開。調査の過程で攻撃者がAIを利用して既知の脆… by Florian Roth.
- RT Tal Be’ery: Burning a possible @BlackHatEvents submission just to make a point: I modified WhatsApp to permanently rewrite its own chat history by … by Florian Roth.
- RT Cyber_OSINT: Google’s GTIG and Mandiant reported UNC7017 conducted ephemeral, five-to-ten minute software update tampering against AOMEI, deliverin… by Dominic Chell.
- RT Low Level: holy shit this is so bad lol. wormable RCE over the air by rpw.
- RT James: we found a detail in the @opencode attack that nobody is posting. the fix already existed. a PR in august added turnstile to the legacy cons… by Simone Margaritelli.
- RT Lukasz Olejnik: China is to add 40 technologies to its export blacklist. 23 of them in AI. AI malware that beats antivirus 85% of the time is autom… by Halvar Flake.
- RT Florian Hansemann: ‘‘Reversing embedded WebAssembly: part 1. Cracking the WAMR .aot container in pure C.’’ #infosec #pentest #redteam #blueteam htt… by hasherezade.
- TornadoC2 - Pull-based C2 framework with ten native transports, concurrent multi-profile handlers, and end-to-end ECDSA-signed tasking. Multi-operator… by Panos Gkatziroulis.
- A red team tool that packages a Windows PE payload into a .wsl file spoofing a real Linux distro installer https://github.com/shaheeryasirofficial/cub… by Panos Gkatziroulis.
- DLL Sideloading for Initial Access and Bypassing Elastic EDR https://akchhat.gitbook.io/dev/initial-access/dll-sideloading-for-initial-access-and-bypa… by Panos Gkatziroulis.
- HostBadger - Read-only Windows host hardening auditor in PowerShell with optional AI analysis https://github.com/g4bri-3l3/HostBadger by Panos Gkatziroulis.
- After You’re In: Field Notes on CRTO Prep and OPSEC https://gikaku.net/2026/10/17/crto-opsec/ by Panos Gkatziroulis.
- RT spencer: Kudos to Jerry and the team! The enhanced NTLM auditing events introduced last year for Server 2025 and 24H2 have just been backporte… by Jeff McJunkin.
- RT SpecterOps: PSA for Microsoft 365 admins: Huntress has reported a widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick… by Chihuahua in charge NotMe.
- Linux malware from scratch: understand the OS, write better malware. Lesson 0 of my “Linux C2 from Scratch” series: https://jm33.me/linux-c2-from-scra… by jm33_ng.
- RT starlabs: What a rollercoaster. 7 weeks, 5 RCEs on Pixel 10 & 11, all officially patched by Google today. Chuffed to bits. The bounty won’t have u… by kiddo.
- RT Quentin Kaiser: just confirmed the presence of Broadcom’s vulnerable wps_monitor in ZTE F680 v4 deployed by MasMovil, ThailandToT, Telkom, Linkstar… by kmkz.
- RT Angelos T. Kalaitzidis: Hell yeah Cellebrite is dropping SecureROM 0days on stage (variant of usbliter8) !! by kmkz.
- RT Robert Chen: Another fun bug, we turned a Linux kernel timer UAF into a kernel read/write on Android, root + SELinux permissive. Great work @ryaaga… by kmkz.
- Not sure what exactly to think about this, but one thing is sure: a supposedly Chinese APT’s FUD backdoor generated ~26k certs faking as LAPD is nothi… by MalwareHunterTeam.
- Top 5 most shared links in my network (Oct 17): 1. https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access (14 people) 2. https://… by Ring3API 🇺🇦.
- Agent skills for Ghostwriter - @SpecterOps @cmaddalena https://github.com/GhostManager/ghostwriter-skills/ by Swissky.
- RT Ian Carroll: If Discord is only paying $5k for an RCE in their desktop client, it’s probably time to uninstall it by Sam Curry.
- RT Hash Suite: Hash Suite 4.1 (Windows): ~2.5x speedup on CPUs with AVX-512, SHA-NI. Support for MS Office encrypted files, Pcapng and Capng capture f… by Solar Designer.
- Closing the week strong, with a chain: 1⃣ App TCC bypass -> allows modifying NIB files 2⃣ DirtyNib reborn without user interaction -> … by Csaba Fitzl.
- RT Harley Kimball: In an impressive GitHub write-up, @v_metnew documents a sandbox escape in Anthropic’s Claude Code CLI (CVE-2026-55607). By using a … by vladimir metnew.
- > be JayTaelien > security researcher > discovered Discord zero day exploit > send Twitch embed to victim > something something > massive exploit chai… by vx-underground.
- CVE-2026-108097 Deep Dive: Turning a Drupal Field UI Callback Into RCE https:// fortbridge.co.uk/research/cve- 2026-108097-deep-dive-turning-a-drupal-field-ui-callback-into-rce/.
- abuse list for ips · NicheDB https:// nichedb.dev/traffic/review.
- RT JS0N Haddix: The best practitioner (not lab) AI evals for offensive cybersecurity I follow myself: 1) The @dreadnode dreadindex. Evals al the way d… by Max Harley.
Tools and Exploits
Fox-IT published a large corpus of real-world Cobalt Strike Beacon samples for detection research and signature development.
Automated offensive development pipeline with CI/CD-driven payload compilation, obfuscation, and EDR evasion testing on the Ludus platform.
New hashcat feature lets you compose arbitrary hash algorithms as recipes, e.g. md4(utf16le(pass)) or hex(xor(md5_bin(pass), md5_bin(salt))).
Automated weekly aggregation of 0-day and N-day exploit releases across public sources. Community contributions welcome.
Curated collection of Beacon Object Files for post-exploitation: credential hunting, system enumeration, event log analysis, and privilege management.
Self-hosted, open-source device management for Linux. Your server, your devices. First release (v0.1.0).
Query radare2 databases with SQL, compatible with the xSQL family (IDASQL, GhidraSQL, Binary Ninja SQL). Makes r2 databases AI-agent-friendly.
C2 framework with a built-in MCP interface. Connect Claude Code, Cursor, or Codex to the teamserver to enumerate targets, author modules, and adapt in real time.
Read-only PowerShell auditor for Active Directory and Entra ID. Collect once, analyze offline with deterministic findings, attack path mapping, and compliance reports.
MCP server that drives real Chrome instances to bypass Cloudflare challenges and bot checks for automated security testing workflows.
More this week (11)
- GitHub’s model for secret detection: Finding more secrets with less noise by Batu Ozturkler.
- RT SEKTOR7 Institute: Launching payloads via a service recovery. RecoverIt crashes a broken Windows service so its recovery action launches a given pa… by Steven Lowson.
- [1/3] Agents can hack. What’s holding them back is trust: will they stay in scope? Today we’re releasing ScopeBench, a methodology and community … by dreadnode.
- Just released PoCs for the 6 LibreOffice bugs we found (@b0n0b0__ ). Including an .odb/.odt/.jar triple-polyglot for the RCE and my personal favorite,… by Thomas Rinsma.
- #Rikugan vs #Frontkick: who wins the agentic AI showdown? Rikugan is open-source and making waves on IDA. Frontkick is built for Binary Ninja. To… by Synacktiv.
- RT Bernardo Quintero: VirusTotal is now available in ChatGPT Scan files, URLs, and domains for potential threats, right from your chat https://chatgpt… by hasherezade.
- RT Alfie: Finally got around to releasing Trigon for arm64e. Enjoy! https://alfiecg.uk/2026/10/17/Trigon.html by Alex Plaskett.
- RT Karsten Hahn: New release of PortexAnalyzer GUI v1.0.0 is public X-ray your PE files Release download: https://github.com/struppigel/PortexAnalyzer… by hasherezade.
- RT OrcaRouter : Emergency release: OrcaCyber Nano 1.0 is now open-weight. Part of our OrcaCyber model series: Nano, Zero, Ultra. Based on our… by Swissky.
- RT johnny: Open-sourced CryptSn0w, our now obsolete untethered iOS ≤27/≤A20 Pro jailbreak via rare Apple server-side TSS/Cryptex bug. PATCHED, educa… by Csaba Fitzl.
- RT 丂卄ㄖᗪ卂几 - crack fingers: Two years ago I released the USB Army Knife, this combined WiFi, BTLE & USB attacks into a single dongle with a … by thaddeus e. grugq.