RCE +13
| Date | Resource | Summary |
|---|---|---|
| 2026-10-14 | Vghost (CVE-2026-74580): Linux kernel vhost stale IOTLB cache leading to universal LPE and Guest-to-Host escape vector | The Linux kernel's vhost component suffers from a vulnerability (CVE-2026-74580), dubbed "Vghost." This flaw stems from a stale IOTLB cache. Exploiting Vghost allows for universal Local Privilege Escalation (LPE) within a guest system and also enables a guest-to-host escape vector. This means attackers can gain elevated privileges and potentially break out of virtualized environments. |
| 2026-10-14 | We Let AI Fuzz Adobe Reader for a Week. It Found a Critical Zero-Day CVE-2026-81983 | An AI-powered fuzzing tool was used to test Adobe Reader for a week. This process successfully identified a critical zero-day vulnerability, now designated as CVE-2026-81983. The AI's ability to discover this previously unknown flaw highlights the effectiveness of automated security testing in uncovering significant vulnerabilities in widely used software. |
| 2026-10-14 | Playing It SFAPE: Code Execution in Isolated User Mode | This article, "Playing It SFAPE," discusses the evolution of Windows security, moving beyond the simple user-mode/kernel-mode distinction. While mitigations like SMEP and PatchGuard increased difficulty, Virtualization-Based Security (VBS) fundamentally changed the landscape. VBS introduces new complexities where code execution can transcend traditional boundaries in ways not previously seen, implying deeper, more sophisticated security challenges. The content does not mention a specific bug bounty payout amount. |
| 2026-10-13 | LG webOS sync-demo Preauth RCE | This content describes a critical Pre-authentication Remote Code Execution (RCE) vulnerability found in LG's webOS operating system, specifically within the `sync-demo` component. This means an attacker could potentially execute arbitrary code on a vulnerable LG smart TV without needing any prior authentication. The summary title itself highlights the severity of this security flaw. No bug bounty payout amount is mentioned in the provided text. |
| 2026-10-13 | CVE-2026-91768: FastCGI allowed_clients compared only 96 of an IPv6 address's 128 bits | Writeup of CVE-2026-91768, a partial comparison vulnerability in PHP-FPM's `listen.allowed_clients` directive that allowed connections from 4,294,967,296 IPv6 addresses when only one was specified. Introduced in 2014, the flaw persisted until September 2026 due to incomplete IPv6 address comparisons within the `fcgi_is_allowed` function. The vulnerability, which could be exploited remotely without authentication, allowed bypassing access controls by comparing only 12 out of 16 bytes of IPv6 addresses, effectively treating an exact match as a /96 prefix match. |
| 2026-10-13 | I Found a $90k Remote Code Execution Vulnerability in Google | Writeup detailing a $90,000 RCE vulnerability discovered in Google's DevSite OAuth flow. The vulnerability arose from a Flask session cookie containing a pickle-serialized object that included the OAuth client secret. This secret was reused as the Flask `SECRET_KEY`, allowing an attacker to forge session cookies and execute arbitrary Python code via the `pickle.loads` function during the OAuth callback processing. The writeup covers session cookie analysis, pickle deserialization vulnerabilities, and the chain from exposed secrets to unauthenticated RCE, highlighting specific affected Google domains. |
| 2026-10-12 | Telegram Desktop vulnerability allowed any user file to be stolen | Library for understanding a Telegram Desktop vulnerability that enables arbitrary file reads. The attack chain exploits a local socket communication flaw, allowing command injection and the use of an internal `interpret://` URI scheme. This scheme, intended for release publishing, reads specified files and sends them to a channel without authorization checks, enabling theft of sensitive user data like session keys. |
| 2026-10-10 | A JPEG, a Race, and a Ghost: Breaking Discourse's Image Pipeline | Library detailing two vulnerabilities in Discourse's default configuration: a cache poisoning attack leading to CSP bypass and JavaScript execution for anonymous users via a modified `color_scheme_id` cookie, and an arbitrary file read stemming from a TOCTOU race condition in the image upload pipeline, exploitable with Trust Level 0 and involving ImageMagick and GhostScript. |
| 2026-10-10 | MXC - a sandboxed code execution system | Library for sandboxed code execution on Windows, Linux, and macOS. MXC supports multiple containment backends like ProcessContainer, LXC, and Bubblewrap, governed by detailed filesystem, network, and UI policies. It offers Rust, .NET, and Node SDKs for integrating into applications, along with diagnostics to aid in policy tuning and troubleshooting access-denied failures. The system allows for provisioning, starting, executing, and deprovisioning persistent containers, providing fine-grained control over untrusted workloads. |
| 2026-10-10 | Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578) | Walkthrough of PaperCut pre-auth RCE chain and patch bypasses, including WT-2026-0143, WT-2026-0144 (CVE-2026-82077), CVE-2026-82078, and CVE-2026-81578. The analysis details how vulnerabilities and subsequent patch bypasses were discovered and chained, culminating in an unauthenticated remote code execution exploit against PaperCut's print management software. |
| 2026-10-09 | How We Found Thousands of Exposed NVIDIA GPUs and a Way to Disrupt Them (CVE-2026-47483) | Writeup detailing CVE-2026-47483, a high-severity vulnerability in NVIDIA DCGM Exporter that enables unauthenticated attackers to cause denial of service and information disclosure by triggering uncontrolled resource consumption. Researchers discovered over 2,000 exposed GPU servers online, revealing significant NVIDIA hardware like Blackwell, H100s, and consumer RTX cards, often hosted by neocloud providers. NVIDIA released a security bulletin for CVE-2026-47483, which has a CVSS score of 8.2. |
| 2026-10-09 | A Single POST Freezes Any Next.js Server | Writeup of CVE-2026-23870 detailing a Denial of Service vulnerability in React Server Components. This vulnerability, found in React versions prior to 19.0.6, 19.1.7, and 19.2.6, allows an attacker to freeze a Next.js server by crafting a single POST request with numerous nested form data pointers. The issue stems from React's inefficient parsing of nested form data, causing excessive CPU usage and making the server unresponsive to legitimate requests. The fix involves optimizing the form data parsing to scan fields only once per request, preventing the exponential complexity. |
| 2026-10-08 | CVE-2026-102489 Deep-Dive: Zammad Session Leak to RCE | Writeup of CVE-2026-102489 detailing a session hijack vulnerability in Zammad. This vulnerability, when triggered by a crafted WebSocket request, leaks session cookies from error messages, allowing attackers to obtain valid admin session cookies. These cookies can then be used to write arbitrary files to the application directory, specifically by overwriting the password reset email template, leading to remote code execution as the `zammad` user through Ruby's ERB rendering. |
Mobile +4
| Date | Resource | Summary |
|---|---|---|
| 2026-10-11 | A story of wifi secrets, UART lockdowns and a damaged flash memory chip | Library for dissecting Eufy HomeBase 2 firmware (version 3.4.2.2h). Details firmware extraction challenges, including damaging flash memory and recovering data with 7z. Explores reverse engineering the Wi-Fi credential generation algorithm for OCEAN_XXXXXX, analyzing U-Boot, and discussing filesystem quirks for debugging. Covers techniques like using spring clips for SPI reads, desoldering flash memory, and leveraging Ghidra and radare2. |
| 2026-10-10 | Show HN: Carrier-Explode: iPhone, Pixel and Galaxy carrier settings decoded | "Carrier-Explode" is a new project that decodes carrier settings for iPhones, Pixels, and Galaxies. This tool aims to shed light on how these configurations work across different devices and carriers, offering a deeper understanding of network management and customization. The project's release highlights a community effort to demystify a complex aspect of mobile device operation. |
| 2026-10-09 | Loupe: An Android Console in the Browser | Library that centralizes Android assessment tools in a Chromium tab, utilizing WebUSB to connect to devices without requiring local installations of adb, scrcpy, or frida-tools. Loupe features a mirrored screen, logcat viewer with filtering, file browser with previews for SQLite databases, an app manager, and a Frida interface that automates frida-server deployment and execution, supporting older scripts by restoring the Java bridge. It also includes a proxy configuration for intercepting traffic directly on the device. |
| 2026-10-08 | Presenting DiagNG: After QCSuper, a new open-source initiative for freeing up mobile baseband Diag protocols | Tool, DiagNG, is a GUI-based successor to QCSuper for capturing 2G/3G/4G/5G air interface logs in PCAP/GSMTAP format, compatible with Wireshark. It supports Qualcomm Snapdragon basebands and NR/5G RRC logs using the GSMTAP v3 protocol. DiagNG leverages GTK 4/Adwaita for its UI, Flatpak for Linux integration, and an asynchronous architecture with components like ADB and ModemManager, incorporating Kaitai Struct for protocol definitions and a Rust daemon for privileged operations. |
Supply Chain +3
| Date | Resource | Summary |
|---|---|---|
| 2026-10-14 | Codex CLI installs a persistent, self-updating background daemon by default | The Codex CLI by default installs a persistent, self-updating background daemon. This daemon runs continuously in the background and updates itself automatically. The content does not mention any bug bounty payout amounts. |
| 2026-10-11 | GitHub Actions leaking secrets when Miri output is cached | Library issue where Miri's environment variable caching in the `target/` directory, combined with GitHub Actions' caching mechanism, can expose secrets to pull requests. This vulnerability, observed in projects utilizing Miri with cached `target/` directories, allows malicious actors to extract sensitive information through CI caches. A fix limits Miri to preserving only specific `CARGO_*` environment variables and `OUT_DIR`, mitigating the risk. |
| 2026-10-08 | Evolution of Web3 in Cloud Supply Chain Attacks | Analysis of Web3 in Cloud Supply Chain Attacks details how threat actors leverage decentralized blockchain architectures for command-and-control (C2) infrastructure, moving beyond static endpoints. Campaigns like ChainDrop and PolinRider demonstrate the exploitation of open-source dependencies to harvest cloud identity tokens and secrets. These attacks, attributed to state-sponsored actors like Alluring Pisces, utilize techniques such as EtherHiding and TxDataHiding across networks like TRON, Aptos, and Binance Smart Chain to dynamically update botnets and maintain persistence, bypassing traditional security controls. |
AI +3
| Date | Resource | Summary |
|---|---|---|
| 2026-10-14 | AI Agent Security: Best Practices for Safe Deployment | This document outlines six AI agent security best practices for teams using coding agents and MCP servers. Key recommendations include limiting the access of compromised agents to prevent widespread damage and implementing measures to detect and prevent credential misuse. The goal is to ensure the safe deployment and operation of AI agents. |
| 2026-10-10 | AI Agent Security: Six Controls From Nine Real Incidents | Library of controls for AI agent security, derived from nine real-world incidents between May 2025 and July 2026. Six core controls are detailed: sandboxing agents, scoping credentials, isolating agent configurations, logging all calls, scanning workspaces for secrets beforehand, and implementing deny-by-default policies. These controls address attack surfaces including the agent's host, its identity, and the agent itself, with specific examples of failures involving prompt injection, unchecked exit codes, and over-scoped permissions seen in incidents affecting services like Gemini CLI, Claude, Amazon Kiro, and Microsoft 365 Copilot. |
| 2026-10-09 | [tl;dr sec] #349 - Vulns & Exploits in the AI Era, Package Manager Sandboxing, Testing AI Sandboxes | Library of techniques for testing AI sandboxes, with specific mention of Vercel and Perplexity. This entry also covers improvements to Burp Suite's Turbo Intruder for HTTP/3 support, including new race condition methods like the Single Datagram Attack and QPACK blocked streams, and the HTTP/3 Adapter extension for broader Burp integration. Additionally, it details the Graphalgo campaign's spread to Terraform providers and Go Modules, and surveys how package managers like Homebrew, opam, Nix, and Bazel approach sandboxing install-time code. |
AuthZ +1
| Date | Resource | Summary |
|---|---|---|
| 2026-10-14 | The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk | Unit 42 analyzed a cyberattack on a European bank, revealing how an unsophisticated attack exposed a third-party risk. The incident highlights the importance of robust defenses against such threats. The analysis provides actionable strategies for organizations to detect and counter similar attacks, emphasizing the need to address vulnerabilities introduced through third-party relationships. |
Bug Bounty +1
| Date | Resource | Summary |
|---|---|---|
| 2026-10-13 | ‘I’m not the kind of person to rely on tooling’: Sn0rkY shares his Bug Bounty story and top tips | Bug bounty hunter Sn0rkY emphasizes the importance of manual testing over over-reliance on automated tools. In his story, he highlights that critical vulnerabilities are often missed by automated scanners. Sn0rkY shares his personal journey and offers top tips for aspiring bug bounty hunters, stressing the value of keen observation, deep understanding of systems, and persistent manual investigation to uncover unique and impactful bugs. |
XSS +1
| Date | Resource | Summary |
|---|---|---|
| 2026-10-09 | I found yet another way to invoke JavaScript functions without parentheses | Library that demonstrates a novel JavaScript function invocation technique without parentheses. This method abuses the `Error.prepareStackTrace` function, typically used for stack trace formatting, to generate arbitrary JavaScript functions. By manipulating `Array.prototype.toString` or `Object.prototype.message` via prototype pollution, attackers can control the generated code. The technique culminates in invoking these functions using methods like `valueOf` or string concatenation, potentially leading to arbitrary code execution, as seen in the provided exploit payload. |
Recon +1
| Date | Resource | Summary |
|---|---|---|
| 2026-10-08 | Beyond asset discovery. Real-life CrowdRecon use case explored | Library for structuring researcher reconnaissance data, turning raw findings into usable input for security teams. This tool, exemplified by a use case involving an old live marketing site, helps organizations identify forgotten or overlooked assets by comparing researcher observations with existing inventories, EASM platforms, and vulnerability scanner data. It facilitates decisions on whether to investigate further, assign ownership, update testing scope, or continue monitoring, providing valuable context beyond simple asset discovery. |