RCE+20
AI+11
Supply Chain+4
Secrets+3
SSRF+2
Mobile+2
Python+2
Bug Bounty+2
AuthZ+1
Fuzzing+1
XSS+1
API Security+1
Authentication+1
RCE +20
| Date | Resource | Summary |
|---|---|---|
| 2026-10-28 | Reviving GLPI Agent Abuse with ESC17 | This content focuses on the resurgence of GLPI Agent abuse vulnerabilities, specifically highlighting the ESC17 exploit. The title suggests a technical deep dive into how this previously known vulnerability is being reactivated or exploited again. No payout amounts are mentioned. |
| 2026-10-28 | From Arbitrary File Read to Shell: Yet Another RCE in Telerik | This report details a vulnerability in Telerik software that can be escalated from an arbitrary file read to remote code execution (RCE). The attacker exploits a flaw to first gain access to sensitive files and then leverages this access to execute commands on the target system. This allows for full control over the compromised server. The article highlights a recurring pattern of RCE vulnerabilities within Telerik products, suggesting potential systemic issues. The specific payout amount for this vulnerability is not mentioned. |
| 2026-10-28 | A community translation can run attacker-chosen code in an exported Godot game | A critical vulnerability has been discovered in the Godot game engine that allows attackers to execute arbitrary code within exported games. This exploit is enabled through a flawed implementation of community translations. By crafting a malicious translation file, an attacker can trick the game into loading and running their chosen code, potentially compromising the user's system. Developers using Godot should ensure their games are updated to a version that addresses this security flaw to protect their players. |
| 2026-10-28 | PHP2Shell: Exploitation Attempts and Remediation Trends | Wiz research has observed exploitation attempts targeting PHP2Shell, a vulnerability allowing remote code execution. While these attacks have not yet succeeded, Wiz's analysis reveals the methods employed. The research details factors preventing successful exploitation and tracks the evolution of the vulnerability's exposure since its disclosure. |
| 2026-10-28 | Responder Guidance for PHP2Shell (CVE-2026-109618 and CVE-2026-109619) | Two critical memory-corruption vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) were disclosed on October 21, 2026. These flaws permit unauthenticated remote code execution. All PHP installations handling web requests are affected. Fixes are available in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. |
| 2026-10-26 | Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more | Library for detecting and mitigating Brotli decompression vulnerabilities, particularly the Broccoli2Shell RCE affecting Node.js, Python (including requests, urllib3, and aiohttp), and other software that uses the vulnerable C decoder (versions 1.0.3-1.2.0). It highlights how Brotli decompression can occur via HTTP responses, request bodies, and direct decoder calls, impacting applications that fetch URLs or accept encoded uploads. The library references CWE-252 and CWE-787 and points to specific fixes in Google's brotli repository and affected project versions. |
| 2026-10-26 | Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability | Writeup of CVE-2026-111497, dubbed Broccoli2Shell, detailing an out-of-bounds write vulnerability in the Brotli decoder. This flaw affects numerous technologies like Node.js, Bun, and Envoy Proxy, enabling remote code execution via crafted compressed data. Exploitation requires processing untrusted Brotli input, exposing cloud environments and internet-facing applications. Recommendations include applying security updates, identifying vulnerable workloads, and reviewing application exposure to Brotli-compressed data. |
| 2026-10-25 | Full source release: autonomous root chain for TCL 50C721 Android TV via CVE-2022-22706 (Mali GPU page-cache write) | This release provides the full source code for achieving an autonomous root chain on the TCL 50C721 Android TV. The exploit leverages CVE-2022-22706, a vulnerability related to a Mali GPU page-cache write. This allows for a complete takeover of the device's root privileges. No bug bounty payout amount is mentioned in the provided content. |
| 2026-10-24 | Imperia CMS SiteActive TEMPLATE Unauthenticated SSTI Remote Code Execution (CVE-2026-110355) | Writeup detailing CVE-2026-110355, an unauthenticated Server-Side Template Injection (SSTI) leading to Remote Code Execution in Imperia CMS's SiteActive component. The vulnerability, present in versions 11.7.2 and below on CGI-enabled installations, allows an attacker to inject PHP code via the `TEMPLATE` parameter in `/cgi-bin/site_active.pl`. This injected code is then processed by the `Imperia::Template::Convert` module and executed via the `PHPExec` plugin, enabling arbitrary command execution. The vendor patched this in Imperia CMS 11.8.0. |
| 2026-10-24 | Understanding PHP2Shell: Everything you need to know about CVE-2026-109618 & CVE-2026-109619 | Writeup detailing PHP2Shell, a critical remote code execution vulnerability impacting approximately 70% of web servers. This analysis covers CVE-2026-109618 and CVE-2026-109619, which exploit PHP's memory management and error handling subsystems, allowing for full code execution or memory disclosure. It outlines four attack chains, including OOM corruption via mod_php, stale global state via fatal-error backtrace, stale session state via upload progress, and memory disclosure. Recommendations include updating PHP, applying WAF rules from vendors like Akamai and Cloudflare, and maintaining an asset inventory. |
| 2026-10-24 | Node2Shell evolves to HTTP2Shell. Brotli flaw (CVE-2026-111497) blast radius affects many libraries & apps using HTTPs. | Library addressing CVE-2026-111497, a critical out-of-bounds write in Google's Brotli decoder affecting versions 1.0.3 through 1.2.0. This vulnerability, also known as "Node2Shell," can lead to memory leaks, crashes, or arbitrary code execution for attackers sending crafted Brotli-compressed streams. The flaw impacts Node.js, Python packages like requests and httpx, curl, Bun, and Envoy, among others. Patches are available for libbrotli, Python, and various runtimes, with recommendations including upgrading affected libraries or disabling Brotli decoding as a workaround. |
| 2026-10-23 | Reversing a DPRK-linked toolkit that backdoors VS Code, Cursor, Discord and npm, with an Ethereum dead-drop C2 and a DEV#POPPER variant | This content details a sophisticated toolkit, linked to North Korea (DPRK), that compromises popular developer tools like VS Code, Cursor, Discord, and npm. The toolkit establishes a command and control (C2) channel using an Ethereum "dead-drop" mechanism, a novel approach for covert communication. Furthermore, it incorporates a variant of the DEV#POPPER malware. The summary focuses on the identification of the threat actor, the targeted software, the unique C2 infrastructure, and the specific malware variant identified. |
| 2026-10-23 | Markdown Is the New Executable: Attackers Are Dropping Agent Instructions Into Your Downloads Folder From the Web | Library for detecting and preventing a novel attack vector where malicious `AGENTS.md` files, disguised as ordinary instructions, are dropped into user download folders by visiting websites. These files trick AI coding assistants like OpenAI Codex and Claude Code into executing arbitrary code or exfiltrating credentials by abusing the assistants' trust in files within their operating directories, exemplified by the exploitation of the `function-color` npm package. |
| 2026-10-23 | [tl;dr sec] #351 - PHP2Shell, Autopatching Skills, AWS Pathrunner | Tool for automating AWS IAM privilege escalation, the modular framework pathrunner leverages the pathfinding.cloud catalog and manages identities as first-class objects. It deploys attacker infrastructure and generates HTML reports mapping exploitation steps to CloudTrail events. |
| 2026-10-23 | Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497) | Library for Node.js and Bun addressing CVE-2026-111497, the Node2Shell vulnerability. This flaw in the Brotli decoder allows for remote code execution by malformed compressed input when an application decompresses Brotli data from an attacker-controlled source, affecting servers accepting requests, apps calling other servers, or code using `node:zlib` directly. |
| 2026-10-22 | PHP2Shell - quick mitigation pre-patch | PHP2Shell is a technique that allows attackers to execute arbitrary code on a server by exploiting vulnerabilities in how PHP handles shell commands. This exploit can be used to gain control of the system before official patches are available. The provided information likely discusses methods for detecting and mitigating PHP2Shell attacks by implementing security measures that prevent or limit the execution of malicious shell commands, even in the absence of vendor patches. |
| 2026-10-22 | CVE-2026-109618 and CVE-2026-109619 Are Two Directions Through the Same Pre-RINIT Window | Writeup on CVE-2026-109618 and CVE-2026-109619 detailing how the PHP session.upload_progress feature's callback, executed before module RINIT during multipart form data parsing, interacts with the basic extension's serializer state. This interaction, particularly when memory errors trigger `longjmp`, can lead to use-after-free vulnerabilities (CWE-416) by leaving the serializer's working state corrupted. The patch in PHP 8.5.12 mitigates this by introducing an early RINIT for specific globals and modifying serializer behavior for incomplete classes. |
| 2026-10-22 | PHP2Shell (CVE-2026-109618/109619): first exploit requests arrived 5.5 hours before PHP shipped the fix, and the "scanners" carry Mirai-style loaders | Library detailing CVE-2026-109618 and CVE-2026-109619, two critical, unauthenticated RCE flaws in PHP core, nicknamed PHP2Shell. These vulnerabilities allow for remote code execution before application code even runs, with exploitation observed hours before official patches were released. The article details the technical specifics of each bug, including OOM corruption for CVE-2026-109618 and stale global state for CVE-2026-109619, and provides remediation steps such as patching to specific PHP versions (8.2.35, 8.3.36, 8.4.27, 8.5.12) or temporary workarounds like disabling upload progress. It also analyzes observed attack tooling, noting the use of Mirai-style loaders and attempts to exploit the vulnerabilities using leaked exploit details. |
| 2026-10-22 | PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Writeup on PHP2Shell, an exploit chain demonstrating remote code execution and memory disclosure in core PHP, affecting versions dating back to 5.4. Developed using frontier AI models like Gemini 4 Argon, these vulnerabilities, grouped under CVEs with a CVSS score of 9.2, exploit memory-safety issues stemming from fatal error handling. The PHP2Shell exploit impacts widely used CMS platforms like WordPress, Drupal, and Joomla, as well as any application running on affected PHP versions, highlighting a potential turning point for AI-assisted vulnerability exploitation. |
| 2026-10-22 | “Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities | Analysis of a threat actor, BUGSTER, details the weaponization of AI for cybercrime, including credential theft, VoIP fraud, Wi-Fi password cracking, and cryptocurrency reconnaissance. The actor leveraged AI-assisted scripts and reconnaissance reports, bypassing technical skill requirements, and successfully exfiltrated thousands of student records from an Indian university. The actor also planned VoIP fraud operations with AI guidance, utilizing the Hermes Agent framework and DeepSeek V4. This report highlights an emerging toolchain for cybercriminals adopting AI-enabled capabilities, driven by low cost and ease of access to such models. |
AI +11
| Date | Resource | Summary |
|---|---|---|
| 2026-10-27 | Context Bombs: Making attacking agents pay | Library of "Context Bombs," deceptive traps designed to hinder offensive AI agents by wasting their resources and diverting them from targets. Tested across nine techniques and seven models in AWS assessments, these bombs significantly increased attacker time and cost while reducing objective completion. Techniques include fake pentest reports, staged encryption, and slow recovery services, aiming to make AI attacks economically unviable and a core part of future security programs. |
| 2026-10-25 | How LLM-Based Penetration Testing Harnesses Work | Library of penetration testing harnesses, Artex, Cairn, and Strix, enable LLMs to perform dynamic security assessments. These harnesses translate LLM-generated textual instructions into actionable commands for interacting with live systems, enabling tasks like reconnaissance, vulnerability discovery, and even account takeover. Artex offers a user-friendly interface and custom agent logic, while Cairn utilizes a multi-stage reasoning process with integrated tools like Nmap and Playwright. Both systems, alongside others like Pi, facilitate LLM-driven security testing by providing the necessary execution environment and tool integration, overcoming the LLM's inherent limitation as a text generator. |
| 2026-10-23 | ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors | Tool for autonomous penetration testing, ARTEX, is being used by an actor overlapping with Storm-0940 to target IT and software vendors. The agent probes identity providers like Okta, Entra, and Cognito, and abuses Microsoft 365 integrations by attempting authentication bypasses, enumerating APIs, and accessing customer data. ARTEX operates by mapping applications, probing authentication mechanisms including OAuth callbacks and JWTs, password spraying, and testing tenant isolation, adapting to defenses by rotating IPs and user agents. |
| 2026-10-23 | ASPM in the AI Era Part 2: Prioritize Exploitable Risks with Code-to-Cloud Context | Library for prioritizing application security risks by correlating code-level findings with cloud runtime context. It enriches findings with threat intelligence and exploitability data, normalizes scanner output, and deduplicates alerts from tools like Snyk. The Wiz Security Graph identifies exploitable attack paths by connecting vulnerabilities across the SDLC, transforming isolated flaws into actionable, high-priority issues. |
| 2026-10-23 | The True Blast Radius of an AI Attack | Analysis of agentic AI security risks, detailing vulnerabilities like goal hijacking, tool misuse, excessive agency, and privilege abuse. The assessment methodology traces untrusted input through tools, Model Context Protocol (MCP) servers, and APIs to detect unauthorized outcomes, emphasizing controls such as scoped credentials, per-operation authorization, and validated tool inputs to enforce safeguards at the point of action execution. |
| 2026-10-22 | Qwen3-Coder writes less secure code when told it's for a US persona | Analysis of Qwen3-Coder reveals vulnerabilities where specifying a US defense contractor as the recipient resulted in a 19% increase in hackable code, and a Hong Kong democracy group prompt led to 28% more data leaks. These security gaps were present even when explicitly requesting secure code. Hirundo's "Westernization" process, which removes the model's CCP alignment from its weights, successfully closed all identified security loopholes, making the model's output comparable to a neutral prompt. |
| 2026-10-22 | Using Claude to reduce the attack surface of code | Analysis of using Claude to reduce code attack surfaces details how AI models can map reachable code and restrict access to unnecessary components. This automated approach improves software security by minimizing the impact of unknown vulnerabilities, making them harder to exploit. The research applied Claude to 25 open-source projects, identifying 493 issues, including unintentional pre-authentication reachability and security-sensitive configuration combinations that weakened controls, particularly within gated and public project types. |
| 2026-10-22 | AI Model Risk Depends on What the Model Can Reach | Analysis of AI model risk highlights how connectivity to agents and MCP servers dramatically expands a model's attack surface. Snyk research reveals nearly half of AI model inventories contain a critical-scoring reference, with PII extraction and command execution being common critical-band findings. Security teams must verify active agents, exposed tools, data retrieval capabilities, and authorization levels, as model scores alone do not indicate actual system reach or risk. The analysis suggests that while switching models can address some vulnerabilities, application-level controls are crucial for others, and lower-capability models and open-weight models warrant particular scrutiny for data leakage and decision override risks. |
| 2026-10-22 | Scanning AI Assets: Catching What SCA and SAST Might Miss | Library for scanning AI assets like agent skills, plugins, and APM packages, which can bypass traditional SCA and SAST tools. It analyzes instructions and intent, not just code, to detect threats such as prompt injection, hidden instructions, obfuscated payloads, and credential exfiltration, exemplified by an evasion framework that bypassed eight scanners. The library integrates with JFrog Artifactory for deterministic and semantic scanning, enforcing policies at the agent level. |
| 2026-10-22 | Shadow AI Detection Now Extends to Developer Workstations | Library for detecting "Shadow AI" on developer workstations, extending visibility beyond repositories to local machines. It scans for unvetted AI assets like skills, MCP servers, and plugins, identifying risks such as shell access and unauthorized file modifications. The library provides a unified inventory, risk analysis, and origin tracking for both managed and unmanaged AI components, ensuring a consistent security posture across the software supply chain. |
| 2026-10-22 | Your AI agent fixed the bug, but what else did it change? | Plugins that automate patch development and regression testing: `patching-bugs` reproduces bugs, develops fixes, and tests them, while `regression-hunt` verifies that changes do not introduce new defects. These tools, developed through the Patch the Planet initiative with OpenAI, incorporate best practices derived from analyzing thousands of engineering sessions and merged patches, aiming to standardize patching processes and improve signal-to-noise ratios in vulnerability disclosures. `regression-hunt` has shown a 25% reduction in false-positive findings compared to baseline Codex agents, employing structured workflows, evidence generation, and independent checks. |
Supply Chain +4
| Date | Resource | Summary |
|---|---|---|
| 2026-10-27 | The Pwn Request Reckoning: What Still Works Against GitHub Actions | Library updating GitHub Actions security, this resource details residual risks from Pwn request vectors after GitHub's 2026 platform changes. It highlights surviving attack paths including SHA pinning to older `actions/checkout` versions, bypassing `actions/checkout` via direct `git` commands or third-party actions, exploitation of privileged triggers like `issue_comment` and `repository_dispatch`, and script injection through unvalidated event interpolations. The library also covers artifact poisoning and persistent self-hosted runner state as exploitable data channels. |
| 2026-10-26 | Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles | Library that detects and disrupts the "Gheist" campaign, an automated attack leveraging compromised GitHub tokens to exfiltrate repository secrets. The campaign plants `sync-check.yml` workflows, attempting to leak secrets via encoded payloads and environment variables, even targeting cloud credentials in enterprise environments. GitHub's security controls are blocking exploitation in public repositories, but private repositories remain vulnerable. The library aids in hunting for suspicious branches and workflow logs, responding by rotating secrets and revoking tokens, and hardening security with measures like OIDC scoping and ephemeral self-hosted runners. |
| 2026-10-22 | LiteLLM Compromised, Steals Credentials | Writeup of LiteLLM supply chain attack, where malicious version 1.107.0, uploaded to PyPI and Docker, contained a credential stealer targeting browser, cloud, and AI secrets, and dormant C2 capability. The attack leveraged stolen GitHub CLI OAuth tokens to compromise the release workflow. The payload utilized a dual-technique approach with `.pth` files and `sitecustomize.py`, appearing to be the first documented case in the wild, and involved LLM-aided development. Post-exploitation activity included abuse of stolen AWS credentials for LLM-jacking. |
| 2026-10-22 | LiteLLM compromised again: infostealer and RAT found in version 1.107.0 | Writeup on the compromise of LiteLLM version 1.107.0, detailing the injection of an infostealer and a remote access trojan into its Python wheels and Docker image. The infostealer targets credentials from browsers, SSH keys, cloud provider secrets, and developer tools, while the RAT provides arbitrary code execution. The attack exploited a `pyproject.toml` directive to bundle malicious files, `cook.pth` and `cook.py` for the infostealer, and `sitecustomize.py` for the RAT, which executes via `maturin`'s `data = "cook"` build directive. |
Secrets +3
| Date | Resource | Summary |
|---|---|---|
| 2026-10-26 | I never authorized an integration that scans my secrets | Issue detailing a Home Assistant integration that, by default, scans for secrets and sends hashed data to Have I Been Pwned (HIBP). While the feature can be disabled via `ha security options --pwned=false` and hashes are locally processed before being sent, the discussion highlights concerns about unauthorized scanning and the need for explicit opt-in mechanisms for such security checks. |
| 2026-10-23 | eMudhra CA compromise: eight private keys, and one of them is 4 | Library for detecting and remediating the eMudhra CA compromise, where eight private keys were improperly generated and easily guessable, including one as simple as the number 4. This vulnerability allowed for the signing of valid certificates for any domain, impacting command-line tools like `curl` and `git`, container images, and language runtimes that did not automatically update their certificate bundles or check for revocation. The library helps identify affected container images and provides remediation steps to update CA bundles. |
| 2026-10-22 | What Is Credential Layer Security? The Layer Every Other Control Trusts | Library explaining credential layer security, which encompasses all surfaces where secrets like passwords and API keys can exist, from code and cloud infrastructure to laptops and SaaS applications. It details how protecting this layer involves discovering, prioritizing, remediating, preventing spread, and detecting harvesting of credentials, working in conjunction with identity and access management (IAM) and other security controls. The library also highlights the increased risks posed by endpoints and AI agents, and the importance of understanding credential scope and deterministic controls, referencing supply chain attacks like Shai-Hulud as examples of credential layer exploitation. |
SSRF +2
| Date | Resource | Summary |
|---|---|---|
| 2026-10-28 | Choose Your Backend: Three TLS Bugs in GoAhead | This article details three critical TLS vulnerabilities discovered in the GoAhead web server. These bugs, identified as "CVE-2023-36044," "CVE-2023-36045," and "CVE-2023-36046," pose significant security risks by allowing attackers to potentially bypass security checks and intercept sensitive data. The discovery highlights the importance of robust security practices in embedded systems and web server software. Developers are urged to update their GoAhead installations to the latest patched versions to mitigate these threats. No bug bounty payout amount is explicitly mentioned in the provided content. |
| 2026-10-27 | Connection Reuse leading to desync | Library providing four detailed mechanisms and worked cases with wire traces for connection reuse vulnerabilities. These vulnerabilities occur when products like Envoy, HAProxy, Jetty, and Netty make trust decisions on connections before the previous request is fully processed or accounted for. The library illustrates flaws in how Go net/http, Traefik, Caddy, Prometheus Pushgateway, APISIX, and Elasticsearch handle connection reuse, potentially leading to request smuggling and desynchronization issues. |
Mobile +2
| Date | Resource | Summary |
|---|---|---|
| 2026-10-28 | ElectroNG is now open source! | ElectroNG, Doyensec's static application security testing (SAST) tool for Electron applications, is now open source under the Apache License 2.0. Previously a commercial offering launched in September 2022, its desktop application and core analysis engine are now freely available to the community, leveraging years of Doyensec's expertise in Electron app security. |
| 2026-10-22 | uCreator: virtualization-based Android spyware platform targeting WeChat, Telegram and other messaging apps | Library for a virtualization-based Android spyware platform, uCreator (YingGai), which targets messaging and mobile wallet applications like WeChat, Telegram, and GCash. It functions as a framework with a VirtualApp/LSPatch engine, per-application hook modules, a Redis and HTTP control plane, a cloud-phone farm, and a Windows operator console. Capabilities include OTP interception, data extraction, session manipulation, and KYC liveness check defeat via camera spoofing. Distribution models involve repackaged legitimate applications and a container app called "Onion Box." The platform has been in development since at least 2014, with current versions dating to 2024-2026. |
Python +2
| Date | Resource | Summary |
|---|---|---|
| 2026-10-26 | Breaking the AWS MCP Python Sandbox | Library for bypassing Python sandbox restrictions in AWS's `aws___run_script` tool, enabling command execution within the AWS Lambda environment. The research details how to circumvent AST validation and runtime restrictions by exploiting Python 3.10's structural pattern matching. This technique allows access to sensitive attributes, including `__class__` and `__reduce_ex__`, by dynamically constructing attribute names using `chr()` and reassigning `__match_args__` on `namedtuple` subclasses. |
| 2026-10-24 | Evolving Threat: http2shell is an RCE in Node, Python, and more | The "http2shell" vulnerability is a critical remote code execution (RCE) flaw affecting Node.js, Python, and other programming environments. This exploit allows attackers to gain unauthorized control of affected systems by manipulating HTTP/2 requests. The discovery highlights a significant evolving threat landscape, emphasizing the need for developers and organizations to promptly patch their applications and servers to mitigate the risk of compromise. |
Bug Bounty +2
| Date | Resource | Summary |
|---|---|---|
| 2026-10-25 | Show HN: Steal My Bitcoin | "Steal My Bitcoin" is a project, presented on Show HN, that challenges users to find vulnerabilities in its system to steal a designated amount of Bitcoin. The purpose of this initiative is to publicly test and improve the security of the Bitcoin protocol or related systems through ethical hacking. The title directly invites individuals to attempt to exploit weaknesses for a potential reward, highlighting a bug bounty-style approach to security testing. |
| 2026-10-22 | AI raised the floor. The hacker crowd keeps raising the ceiling. | Library detailing how AI is evolving bug bounty hunting. It discusses the shift from single prompts to multi-agent, continuous workflows, demonstrating how researchers are building complex systems to automate reconnaissance, test payloads, and generate proofs of concept. The entry highlights that while AI raises the baseline for vulnerability discovery, the diversity of the researcher crowd continues to expand the upper limits of security testing, leading to increased high-severity findings and improved platform validity. |
AuthZ +1
| Date | Resource | Summary |
|---|---|---|
| 2026-10-28 | New Kerberos Abuse Path Discovery - Constrained Delegation without Protocol Transition against SPN-less accounts | Researchers have identified a novel Kerberos abuse path: Constrained Delegation without Protocol Transition can be exploited against Service Principal Names (SPN)-less accounts. This bypasses existing security measures, allowing attackers to impersonate users and gain unauthorized access. The discovery highlights a significant vulnerability in Kerberos authentication mechanisms, particularly for accounts lacking SPNs. Further analysis and mitigation strategies are recommended to address this newly found attack vector. |
Fuzzing +1
| Date | Resource | Summary |
|---|---|---|
| 2026-10-28 | Fuzzers vs. AI: Comparing Fuzzilli and BigSleep on JavaScript Engines | Project Zero compared Fuzzilli, a generative fuzzer, and BigSleep, an LLM-based system, for finding JavaScript engine vulnerabilities in Chrome's V8. Over six months, BigSleep discovered more bugs (45 vs. 37) with a 25% overlap. Dedicated experiments were conducted to further analyze overlap, suggesting the initial overlap figure might be underestimated. The content does not mention any specific bug bounty payout amounts. |
XSS +1
| Date | Resource | Summary |
|---|---|---|
| 2026-10-28 | Scalable Vector Grief | The author successfully bypassed six out of eight popular SVG sanitizers, demonstrating a vulnerability termed "Scalable Vector Grief." This exploit allows JavaScript execution in Firefox by manipulating response headers, even when the SVG response body appears harmless. The technique leverages a specific header to trigger script execution within the browser. No specific payout amount was mentioned. |
API Security +1
| Date | Resource | Summary |
|---|---|---|
| 2026-10-27 | OWASP Top 10 Kubernetes Security Risks Explained: Why Credentials Deserve a Closer Look | Library detailing OWASP Kubernetes Top 10 risks, highlighting Secrets Management Failures (K03). It explains how leaked tokens can chain into further credential compromise, citing GitGuardian's finding of 44 active clusters reachable via exposed secrets, and GhostAction's targeting of thousands of values across 772 repositories. The resource emphasizes strategies like strict RBAC, short-lived workload identities, and credential detection across repos, images, and pipelines using tools like ggshield to mitigate these exposures. |
Authentication +1
| Date | Resource | Summary |
|---|---|---|
| 2026-10-23 | The Current Landscape of OAuth Attacks | Analysis of OAuth attacks details evolving adversary tactics targeting authorization tokens rather than credentials. These attacks bypass multi-factor authentication (MFA), providing persistent access and enabling account takeover, lateral movement, and data exfiltration. Specific vulnerabilities include Cross-User OAuth Session Fixation (COSF), Cross-Tenant Client ID Confusion, and Cross-Connector OAuth Account Takeover, often exacerbated by long-lived tokens. Defenses involve disabling end-user app consent, enforcing admin approval workflows, monitoring authorization code clipboard events, and auditing redirect URIs. |