Cybersecurity, AI, etc.
Red teaming (offensive research, new TTPs, exploitation techniques, PoC releases, adversary simulation findings)
Summary Zenity Labs has disclosed “AgentForger,” a critical cross-site request forgery vulnerability in OpenAI’s ChatGPT Workspace Agents that allowed a single manipulated link to silently create and deploy a fully…
Summary In one of the most striking demonstrations of AI-assisted vulnerability research to date, agents built on Moonshot AI’s Kimi K3 model reportedly discovered 19 zero-day vulnerabilities in Redis —…
A high-severity authentication bypass vulnerability in Palo Alto Networks PAN-OS — CVE-2026-0257 — has been confirmed as an active initial access vector for Qilin ransomware affiliates. The flaw affects the…
Summary A large-scale malware supply-chain campaign dubbed FakeGit has seeded approximately 7,600 malicious GitHub repositories impersonating popular tools — Gmail, WhatsApp, Databricks, Jenkins, Docker — to spread the SmartLoader dropper,…
Summary Qualys Threat Research Unit disclosed RefluXFS (CVE-2026-64600), a local privilege escalation vulnerability in the Linux kernel present since version 4.11 (2017) — a nine-year-old race condition in the XFS…
Summary Two zero-day vulnerabilities in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances — CVE-2026-15409 (SSRF, CVSS 10.0) and CVE-2026-15410 (code injection, CVSS 7.2) — were actively exploited in…
Summary A critical pre-authentication remote code execution chain in WordPress Core, dubbed “wp2shell”, is under active exploitation. Discovered by researchers at Searchlight Cyber, the chain combines two CVEs: CVE-2026-63030 (a…
Summary Hugging Face disclosed a security incident in July 2026 that marks a historic milestone in cybersecurity: the first known intrusion into production infrastructure driven entirely by an autonomous AI…
ANY.RUN threat researchers have exposed PhantomEnigma, an active campaign that has compromised over 20 legitimate Brazilian government websites (.gov.br domains) and the email accounts associated with them, using that trusted…
A new class of supply-chain attack is emerging that doesn’t target software bugs — it targets AI hallucinations. Researchers have documented several related techniques under the umbrella of “AI squatting,”…