Cybersecurity

Research from Citizen Lab has uncovered a sophisticated campaign where targeted ads were used to deploy zero-click mercenary malware. The operation leveraged the trust of verified ad vendors to reach sensitive targets in government and national security sectors.

A long-standing bug in PHP-FPM's FastCGI client authorization logic allowed a massive range of IPv6 addresses to bypass access controls. The issue stemmed from a hardcoded 12-byte comparison that failed to validate the full 128-bit IPv6 address.

SEALSQ has unveiled the VaultIC409 secure element to provide a hardware-based path for IoT and industrial manufacturers to adopt post-quantum cryptography. The solution integrates cryptographic agility and hardware acceleration to manage the increased computational demands of quantum-resistant algorithms.

Microsoft and international partners have successfully disrupted a large-scale cybercrime ecosystem that supplied phishing kits and fraudulent accounts. The operation targeted the YAM Store marketplace, effectively neutralizing tools like CoGUI and Iron Man that powered massive global phishing campaigns.

The discussion explores the shift from software-only security to hardware-anchored memory safety. It highlights how technologies like CHERI can protect legacy C/C++ codebases without requiring massive rewrites.

Researchers have identified a critical argument injection vulnerability in the Open Build Service that allows for remote code execution via Mercurial. By manipulating the 'revision' parameter in an '_service' file, an attacker can execute arbitrary commands on the build server.

The NCSC is directing large-scale organizations to prepare for a transition to post-quantum cryptography by 2035. The agency emphasizes that this migration involves complex architectural changes and requires proactive planning to secure critical national infrastructure.

A critical Denial of Service vulnerability, identified as CVE-2026-23870, allows attackers to freeze React-based servers using specially crafted multipart/form-data requests. The flaw exploits inefficient field scanning logic in React Server Actions, potentially causing service outages for Next.js applications.

An autonomous AI agent successfully breached the DIVD network by exploiting a chain of zero-day vulnerabilities in the Zammad helpdesk platform. The attack enabled rapid session hijacking and root privilege escalation, though the breach was contained via network segmentation.

A new implementation of a subexponential-time attack against RSA has been identified, allowing for digital signature forgery. While the attack is significant, it only affects unpadded signatures and does not recover private keys.

This technical analysis explores how the TerminalFix campaign employs PNG steganography to conceal malicious Windows executables and DLLs. By manipulating pixel data within IDAT chunks, attackers successfully hide payloads that are later extracted and used for sideloading.

A new partnership between SEALSQ, WISeKey, and the Canton of Jura aims to launch a multi-million franc semiconductor center in Switzerland. The facility will specialize in post-quantum cryptographic hardware and secure semiconductor provisioning.

FedRAMP is implementing significant changes to its Vulnerability Detection and Response (VDR) and Verification and Evaluation (VER) rules by late 2026. These updates require cloud service providers to move away from monthly scans toward automated, continuous validation of security controls.

A critical path traversal vulnerability in GitLab's repository commits API is being actively exploited by attackers to steal sensitive data. CISA has officially added CVE-2026-85706 to its KEV catalog, urging immediate patching for both federal and private sector organizations.

Cybersecurity researchers have identified a sophisticated campaign where Sandworm-linked actors exploit Cisco FMC vulnerabilities to deploy Cyclops Blink malware. This updated malware variant features enhanced reconnaissance capabilities and targets 64-bit Linux-based network appliances.

The rise of quantum computing threatens to break the fundamental public-key encryption that secures the modern internet. To mitigate risks like 'harvest-now-decrypt-later' attacks, organizations must begin migrating to post-quantum cryptographic standards and improving crypto-agility.

Multiple vulnerabilities in AVEVA Pipeline Integrity Monitor pose significant risks to critical manufacturing infrastructure. These flaws could allow attackers to decrypt sensitive data, escalate privileges via password brute-forcing, or perform unauthorized read operations.

GitLab is urging immediate updates to address a maximum-severity path traversal vulnerability and a critical insecure deserialization flaw. These vulnerabilities could allow attackers to read arbitrary files or steal sensitive credentials from self-managed instances.

A new Windows exploit named ShieldCrash has been released by researcher Nightmare-Eclipse, specifically designed to bypass a recent Microsoft security patch. The vulnerability allows for unauthorized file access with high-level system privileges.

This article details a highly technical experiment where an LLM-driven agent was used to automate the discovery and exploitation of vulnerabilities in Papercut NG. By leveraging patch diffing and automated infrastructure, the AI developed a full proof-of-concept for unauthenticated code execution.

While passkeys offer strong cryptographic protection against phishing, researchers have identified 39 methods to bypass this security by targeting the surrounding ecosystem. These attacks focus on exploiting operating systems, synchronization services, and enrollment workflows rather than breaking the underlying protocol.

Researchers have developed CyberFactory, a unified framework that automates the creation of high-quality cybersecurity training data from real-world vulnerabilities. By using agentic trajectories to train the OpenAegis model, they achieved state-of-the-art performance in vulnerability detection and patching.

A technical deep dive into the 'UniBLEed' exploit chain that grants root access to Unitree G1 humanoid robots. The research details how attackers can leverage unauthenticated BLE characteristics and cloud API flaws to achieve wormable RCE.

Researchers have developed CyberFactory, a unified framework that automates the creation of high-quality cybersecurity training data from real-world vulnerabilities. By using agentic trajectories to train the OpenAegis model, they achieved state-of-the-art performance in vulnerability detection and patching.