g3n3r4l9
-
Node2Shell: Brotli Decoder Out-of-Bounds Write (hacktron.ai)
CVE-2026-111497, also called HTTP2Shell, is an out-of-bounds write in a Brotli decoder shared by Node.js, Python, Bun, Envoy and .NET. Any service that decompresses attacker-supplied Brotli bodies is exposed, so the bug crosses runtimes and proxies at once. The post lists who is affected and the fixed versions: patch the runtime and the edge proxy, not just the app.
-
SMS of Death: Zero-Click Android Phone Crash (smsofdeath.com)
A single malformed WAP Push SMS crashes com.android.phone. It needs no interaction, works remotely and drops emergency calls, so it is a reliable remote DoS against the telephony stack. The fix is in the October 2026 Android security update; unpatched devices remain exposed.
-
CVE-2026-106378: on macOS, Chrome's sandboxed GPU process still had an allowed WindowServer connection and an inherited event-posting permission. That was enough to inject keystrokes and launch apps outside the sandbox. A good reminder that sandbox policy has to cover OS-level IPC and inherited entitlements, not just syscalls and files.
-
Ghost Auth Bypass Wipes Members' Votes (escape.tech)
CVE-2026-103288 chains two flaws so that any logged-in member can delete every member's likes on comments. It surfaced only by testing as several low-privilege users and checking what each could do to data it did not own. This is a cross-user authorization (BOLA) case that single-session scanning misses.
-
Project Zero: Emergency Patching Beyond the Release Cycle (projectzero.google)
Project Zero argues that emergency patch speed is limited by testing and delivery, not triage or development. It surveys four fast paths: feature flags (Apple disabling Group FaceTime in 2019), filtering (Android's Intent Firewall), alternate update channels (Play Protect, APEX) and hotpatching (Linux Livepatch, Windows hotpatch). The caveats: channels that dlopen downloaded code need strict origin verification, and…
-
Prompt Poisoning Kubernetes Operations Agents (aikido.dev)
Abdel Sghiouar argues "prompt poisoning" describes attacker text planted in data an agent reads, such as application logs, better than "prompt injection" does. An LLM has no parameterized-query equivalent to separate instructions from data. In Kubernetes, the blast radius comes from over-broad RBAC and secrets in readable environment variables. The piece cites an earlier Gemini CLI issue-triage workflow leak where t…
-
Rust in Peace: Incremental C++ to Rust (calif.io)
Calif's first post in a defensive series. Instead of a full rewrite, it replaces critical, vulnerable C++ components with Rust behind memory-safe bindings, using interop tools such as cxx, bindgen, Diplomat and Crubit to handle type conversion and ownership across the boundary. This is a practical way to shrink memory-safety attack surface in a production codebase that cannot stop shipping.
-
Neo Triage: Automated Finding Reproduction (projectdiscovery.io)
ProjectDiscovery's Neo Triage simulates incoming reports and scanner findings against your real assets to reproduce them, compressing hours of manual validation into minutes. For teams drowning in bug bounty and scanner backlogs, the pitch is triage at the speed of discovery. How safe "safe simulation" really is should be checked before you point it at production.
-
Cloud Security Is More Than Best Practices (senayakut.com)
An argument that cloud security cannot be reduced to control lists, configuration checklists and best-practice to-dos. Checklists are a baseline; real security depends on understanding your own environment and threat model.
g1thub4
-
Trojanized Claude Code Extension: Detection Scanner (github.com)
On 2026-10-29 (09:27–20:35 UTC) the Cursor marketplace served an [email protected] build that Anthropic did not publish. It plants an SSH key and persistence, then opens a reverse tunnel to 134.209.82[.]225. Updating to 2.1.314 removes the extension but not what it planted, so anyone who installed it that day should run this read-only macOS/Linux checker and its 7 Sigma and 4 YARA rules, then block the C…
-
PHP2Shell In the Wild: Honeypot Telemetry (gist.github.com)
A 26-hour capture across six PHP-backed web personas (22–24 October) recorded 30 pre-script OOMs and 11 worker crashes (ten SIGSEGV, one SIGABRT). The traffic included leak-stage payloads, distributed fixed-length probes from a single /24, serializer probes and large chunked uploads. No RCE or usable memory disclosure was confirmed, and every OOM request returned HTTP 200, so status codes alone will not show who got…
-
VulnCheck Initial Access Community Exploits (github.com)
VulnCheck open-sourced part of its Initial Access Intelligence: Go exploits built on go-exploit for unauthenticated, network-reachable bugs in routers, VPNs and self-hosted services. Where possible each ships with a target verifier, version scanner, PCAPs, Suricata/Snort/YARA/Sigma rules, Nmap scripts, vulnerable Docker Compose labs and Censys/Shodan/FOFA queries, covering both red-team validation and detection engi…
-
Steal My Bitcoin CTF Full-Chain PoC (github.com)
A public, single-file, standard-library Python reproduction of a full Steal My Bitcoin CTF solve against PHP 8.4.26 on Alpine. It builds each request itself, verifies every leak before moving to the next stage, and records the raw HTTP bytes. Useful for studying how a multi-stage PHP memory exploit is sequenced and checked.