Software Engineering

A researcher identified a $90,000 vulnerability in Google's developer platforms where an exposed OAuth client secret allowed for the forgery of Flask session cookies. This forgery enabled the injection of malicious pickle payloads, leading to unauthenticated remote code execution.

CVE-2026-74580 is a high-severity vulnerability in the Linux vhost subsystem caused by stale IOTLB metadata caching. It enables both local privilege escalation to root and VM escape via QEMU heap corruption.

The CoDA framework enables a closed-loop system where robot simulation environments and action policies co-evolve based on shared learning progress. By using failure diagnoses to automate both scene generation and dense reward shaping, the method achieves substantial gains in out-of-distribution task success.

This update covers major version releases for essential Ethereum development tools including Solidity, Vyper, and Foundry. It highlights critical infrastructure improvements such as the Glamsterdam upgrade preparations and significant milestones in contract verification via Sourcify.

Cloudflare patched a security flaw in its container platform that allowed users to access residual data from other tenants via the storage allocator. The vulnerability was caused by a performance optimization that skipped zeroing out blocks during thin provisioning.

Researchers have developed a new class of quantum algorithms that reduce the query complexity of simulating sparse Hamiltonians from linear to square-root sparsity scaling. The method eliminates significant subpolynomial overheads and provides nearly tight lower bounds for Hamiltonian simulation, ODEs, and linear systems.

Microsoft researchers have identified a destructive attack by the Storm-3168 threat actor using compromised Azure machine identities. The operation involved widespread deletion of cloud resources and credential collection, signaling potential ransomware preparation.

Researchers have introduced a new suite of algorithms designed to optimize the synthesis of Clifford and CNOT circuits by reducing two-qubit gate counts. These methods, ranging from optimal to greedy approaches, outperform existing tools like Qiskit and tket in circuit efficiency.

AMD engineers have submitted Linux kernel patches to enable Enhanced SMT Protection (ESMTP) for EPYC processors. This hardware-based mechanism mitigates side-channel attacks by ensuring sibling threads are either idle or running trusted guest vCPUs.

The new HTTP 'QUERY' method introduces a hybrid between GET and POST that poses significant security risks to unupdated web infrastructure. Inconsistent support across proxies and frameworks could allow attackers to bypass WAF signatures and exploit caching mechanisms.

This article details the dynamic analysis of the RedTail Linux malware, focusing on its ability to masquerade as legitimate system processes. The researcher demonstrates how the malware attempts to evade detection by killing monitoring tools and using DNS-over-TLS for network activity.

The article explores how SSRF vulnerabilities arise when the security verdict of a URL validator is not preserved through the entire request lifecycle. It identifies specific 'handoff' points where discrepancies between parsers and clients can lead to unauthorized access to internal resources.

The article details a large-scale statistical study of compiler signatures found in over 690,000 malicious PE files. By parsing the undocumented MSVC Rich Header and other toolchain signatures, the author provides insights into the development environments used by malware authors.

Ibteda Digital Library details the evolution of their large-scale book digitization project from a manual, labor-intensive process to an automated approach. By leveraging ten years of manual cropping decisions as training data, they aim to overcome the limitations of traditional computer vision in handling diverse historical artifacts.