Cybersecurity, AI, etc.
Red teaming (offensive research, new TTPs, exploitation techniques, PoC releases, adversary simulation findings)
Security researchers at XM Cyber have publicly disclosed CVE-2026-39118, a macOS vulnerability that allows a standard (non-root) user to silently disable Endpoint Detection and Response (EDR) and Mobile Device Management…
Summary A critical authentication bypass vulnerability in SimpleHelp (CVE-2026-48558), a popular remote monitoring and management (RMM) platform, is being actively exploited to deploy “Djinn Stealer” — a previously undocumented cross-platform…
Summary Security firm Tenet Security has disclosed “agentjacking,” a novel attack class that enables threat actors to hijack AI coding agents — including Anthropic’s Claude Code and Cursor — by…
The FBI and CISA have issued an updated warning that Russian intelligence services are actively targeting Signal users through sophisticated phishing campaigns aimed at stealing backup recovery keys. The advisory,…
A critical privilege escalation vulnerability in the Linux kernel’s traffic control subsystem, tracked as CVE-2026-46331 and dubbed “Pedit COW,” allows any unprivileged local user to gain root access on affected…
Summary A peer-reviewed security audit by researchers at Cracken has revealed that the vast majority of popular agentic offensive security platforms are themselves critically insecure. The study, published June 23,…
Summary Researchers at Broadcom’s Symantec and Carbon Black have uncovered a sophisticated new technique used by the DragonForce ransomware group: hiding command-and-control communications inside Microsoft Teams relay infrastructure. The custom…
Summary Security researchers at Aikido discovered a coordinated supply chain campaign involving 15 malicious plugins on the JetBrains Marketplace, all designed to steal AI provider API keys from developers. The…
Summary SentinelLABS has uncovered “macOS.Gaslight,” a sophisticated North Korea-linked Rust-based backdoor that uses a novel defensive technique: embedded prompt injection payloads designed to trick AI-assisted malware analysis tools into aborting…
Summary A critical authentication flaw in n8n’s MCP (Model Context Protocol) browser bridge — tracked as CVE-2026-54309 — allows any network-reachable attacker to establish unauthenticated MCP sessions and take full…