g3n3r4l15
-
LMCache Unauth RCE via Pickle (research.jfrog.com)
CVE-2026-105192 (Critical): LMCache's multiprocess ZeroMQ transport unpickles attacker-controlled messages, handing unauthenticated RCE to anyone who can reach the socket. Pickle-over-the-wire stays the classic Python footgun, and here it sits inside LLM-serving infrastructure that teams assume is internal-only. Audit any ML-serving stack for ZMQ/pickle IPC exposed beyond localhost.
-
Atlassian Pre-Auth Arbitrary File Read (labs.watchtowr.com)
CVE-2026-21589 is a pre-auth arbitrary file read spanning Jira, Confluence and more — no credentials needed to pull configs, secrets and tokens straight off disk. watchtowr frames it as another "secure by design" claim crumbling; an unauth AFR on enterprise collaboration servers is a direct path to credential harvesting and lateral movement. Patch Atlassian estates now and hunt logs for file-read probes.
-
WordPress libheif RCE Exploit Chain (fortbridge.co.uk)
Fortbridge chains bugs in libheif's HEIF/HEIC parsing into remote code execution on WordPress, which decodes uploaded images server-side. Memory-safety flaws in media codecs keep turning "upload an image" into RCE, and libheif ships across many PHP image stacks. If your app decodes HEIF via libheif, treat image upload as an RCE sink and update the library.
-
Discourse Image Pipeline Arbitrary File Read (slcyber.io)
SLCyber lands an arbitrary file read in Discourse by racing a JPEG through its image pipeline so ImageMagick hands off to Ghostscript on attacker-shaped input. It's a reminder that ImageMagick+Ghostscript delegation remains a rich AFR/RCE surface and that TOCTOU races defeat naive validate-then-process designs. Anyone running these behind uploads should pin delegates and close the race window.
-
Poisoned Model Backdoors Codex CLI (projectdiscovery.io)
ProjectDiscovery poisoned a small open-weight model, wired it into OpenAI's Codex CLI, and it behaved normally until a hidden trigger made it exfiltrate project credentials — a working supply-chain backdoor for under $50. The takeaway: a model file is executable attack surface, and "bring your own local model" into agentic coding tools inherits whatever was baked into the weights. Treat downloaded weights like untru…
-
MECCHA CHAMELEON Delayed RCE via Map (aikido.dev)
Aikido found a second delayed RCE in MECCHA CHAMELEON where a malicious custom map writes arbitrary files on disk and executes after the next restart. Delayed, trigger-on-restart execution is sneaky because exploitation and payload run are decoupled, slipping past runtime detection. Patched in 4.0.0 — update, and audit any "custom content" import that can write outside its sandbox.
-
Proton Mail Sender Spoofing via Homograph (alonsovidales.github.io)
A display-name homograph makes Proton Mail's web UI render a forged sender identity that's visually identical to a legitimate one, defeating the at-a-glance trust users place in the From field. Homograph/display-name spoofing turns privacy-first mail into a convincing phishing channel. Defenders should surface the real address, not just the display name, and flag mixed-script homographs.
-
Smashing the Token Limit with Fragments (portswigger.net)
PortSwigger shows how overlapping fragments break past prior size caps on token exfiltration, extracting larger secrets than earlier dangling-markup and scriptless techniques allowed. It extends client-side data-exfil tradecraft to bigger values like full CSRF tokens and JWTs. Fold it into XSS-adjacent and markup-injection testing where output length was assumed to cap the leak.
-
Single POST Freezes Any Next.js Server (simonkoeck.com)
CVE-2026-23870: one crafted POST into React Server Components' FormData parsing blocks the Node event loop and freezes any Next.js server — an unauthenticated, single-request denial of service. No auth and no volume needed; event-loop starvation stalls the whole process. Patch Next.js, rate-limit RSC action endpoints, and watch for single-request latency spikes.
-
security.txt Across 1k Czech Domains (vavkamil.cz)
vavkamil scanned security.txt across 1,000 popular .cz domains and catalogues how a tiny RFC 9116 standard gets botched in creative ways — wrong location, expired, malformed, missing signatures. It doubles as a recon signal: a broken or absent security.txt hints at an org's disclosure-process maturity. Handy as a lightweight hygiene check and for finding where to actually report.
-
Project Zero on Patching a Fix (projectzero.google)
Project Zero walks through the failure mode where a security patch is itself buggy, and the emergency-patching discipline needed to remediate without opening new holes. Incomplete or regressive fixes are a recurring root cause of n-day exposure, so verifying a patch closes the root cause matters as much as shipping it. A solid checklist for vendors and for researchers hunting patch-bypass variants.
-
Anthropic Launches Cyber Mission (anthropic.com)
Anthropic announced its Cyber Mission, framing AI for cyber defense — using models to help find and fix vulnerabilities at scale while managing offensive-misuse risk. It signals frontier-lab investment in defensive security tooling and evaluations. Watch how the capability (and dual-use) claims translate into tooling researchers can actually use.
-
GenAI and Agentic Exploit Roundup Q3 (genai.owasp.org)
OWASP's GenAI Security Project rounds up Q3 2026 real-world GenAI and agentic-AI exploits — prompt injection, tool abuse, agent hijacking and data exfiltration seen in the wild. A consolidated threat-landscape reference for anyone securing LLM apps and agents. Treat it as a checklist of attack classes to test your own agentic stack against.
-
A Year Hunting Vulns With AI (ssakur.ai)
A researcher reflects on a year of AI-assisted vulnerability hunting across the stack — which workflows actually moved the needle versus the hype, and how day-to-day bug finding has shifted. Practitioner signal on where AI genuinely accelerates research (triage, recon, PoC scaffolding) and where human depth still wins. Good calibration for anyone wiring LLMs into their own hunting.
-
Invoking JS Functions Without Parentheses (blog.ikaes.de)
bartosz documents yet another way to call JavaScript functions without parentheses — the class of trick that powers XSS payloads against WAFs and filters that block (). It expands the scriptless and filter-bypass toolbox for client-side injection. Useful for XSS researchers building payloads against strict sanitizers.
X1
-
a16z charts a step-change across 21 major vendors (Apple, AWS, Microsoft, Google…): reported critical vulnerabilities stayed under 100/month for four years, then jumped past 600/month since spring. The spike tracks AI-assisted vuln discovery arriving at scale — more criticals found, faster, than defenders are used to triaging. Expect patch cadence and triage pipelines, not discovery, to become the bottleneck.
y0utube2
-
Yassine Aboukir on Decade of Bug Bounty (youtube.com)
Yassine Aboukir distills a decade of bug bounty into practical insight — picking targets, going deep, and turning findings into real business impact as programs matured. A high-signal talk that reinforces depth-over-breadth and impact-first framing. Worth it for the methodology, not just the war stories.
-
Frans Rosen on AI-Age Bug Bounty (youtube.com)
Frans Rosen (Ep. 195) discusses how AI is reshaping bug bounty — where agents and LLMs help, where human creativity still dominates, and how top hunters are adapting their workflows. Perspective from one of the field's most respected researchers on staying effective as tooling changes. Pairs with the depth-vs-breadth and AI-hunting threads.
g1thub2
-
rea: Reverse Engineer Anything With Agents (github.com)
morluto/rea is an agentic reverse-engineering tool that works from app behavior down to native binaries, orchestrating agents to automate RE tasks. Part of the wave applying agent loops to binary analysis and RE triage. An investigation lead for AI-assisted RE workflows — treat its output as hypotheses to verify.
-
Ghostscript Exploit PoCs Collection (github.com)
v12-security publishes a collection of Ghostscript exploit PoCs, handy alongside this week's Discourse ImageMagick→Ghostscript AFR work. A ready reference of working triggers for testing Ghostscript delegate exposure in your own image pipelines. Research/offensive use — validate against your patched versions.