Cybersecurity, AI, etc.
Red teaming (offensive research, new TTPs, exploitation techniques, PoC releases, adversary simulation findings)
CISA and international partners issued a joint advisory on China-linked activity enabled by Integrity Technology Group. The agencies say the actors combined automated scanning, botnets, VPN infrastructure and hands-on intrusion…
Splunk has released security updates for CVE-2026-76268, a critical Splunk Enterprise vulnerability reported to allow unauthenticated remote operating-system command execution. The vulnerability carries a CVSS v3.1 score of 9.8. Because…
Researchers have identified 16 malicious Mozilla Firefox extensions that impersonate Rabby and OKX wallet tools and can steal cryptocurrency-wallet recovery phrases and private keys. Browser extensions can inherit broad access…
A Tensorlake npm package was reportedly compromised to distribute the Shai-Hulud credential-stealing worm. Researchers cited by the report said the first rogue commit appeared on October 7, 2026. Supply-chain incidents…
SonicWall has released fixes for four SMA1000 vulnerabilities, including a pre-authentication server-side request forgery issue rated CVSS 10.0. The company said the flaws were not known to be exploited at…
Researchers have described a human-operated phishing platform that impersonates advertising products associated with AI services including ChatGPT, Gemini, Claude, Perplexity, and Meta. The operation is designed to capture credentials and…
Attackers reportedly compromised country-code registry infrastructure for .gh, .sl, and .as and obtained certificates for Google domains. Let’s Encrypt staff said certificates for Google and YouTube were issued and later…
JFrog disclosed CVE-2026-105192, a critical vulnerability in LMCache that can allow unauthenticated remote code execution. The issue affects LMCache versions 0.3.9 through 0.5.5, according to the disclosure, and was rated…
Anthropic has expanded its Cyber Verification Program, offering qualifying cybersecurity professionals access to advanced cyber capabilities and reduced-blocking classifiers. The company says the program builds on Project Glasswing, whose participants…
Researchers have reported a phishing operation using fake advertising portals branded around prominent AI products, including ChatGPT, Claude, and Gemini. The lures promise advertising or campaign-management features, then direct targets…