Cybersecurity

This article details a highly technical experiment where an LLM-driven agent was used to automate the discovery and exploitation of vulnerabilities in Papercut NG. By leveraging patch diffing and automated infrastructure, the AI developed a full proof-of-concept for unauthenticated code execution.

While passkeys offer strong cryptographic protection against phishing, researchers have identified 39 methods to bypass this security by targeting the surrounding ecosystem. These attacks focus on exploiting operating systems, synchronization services, and enrollment workflows rather than breaking the underlying protocol.

Researchers have developed CyberFactory, a unified framework that automates the creation of high-quality cybersecurity training data from real-world vulnerabilities. By using agentic trajectories to train the OpenAegis model, they achieved state-of-the-art performance in vulnerability detection and patching.

A technical deep dive into the 'UniBLEed' exploit chain that grants root access to Unitree G1 humanoid robots. The research details how attackers can leverage unauthenticated BLE characteristics and cloud API flaws to achieve wormable RCE.

Researchers have developed CyberFactory, a unified framework that automates the creation of high-quality cybersecurity training data from real-world vulnerabilities. By using agentic trajectories to train the OpenAegis model, they achieved state-of-the-art performance in vulnerability detection and patching.

CISA has officially identified ransomware gangs exploiting CVE-2025-60710, a high-severity Windows Task Host vulnerability. The flaw allows local attackers to escalate privileges to SYSTEM level on affected Windows systems.

A new side-channel execution flaw allows attackers to leak data from co-located Cloudflare Workers using advanced timing attacks. Cloudflare has responded by deploying hardware-assisted memory protection and enhanced sandboxing to secure their multi-tenant architecture.

U.S. agencies including CISA and the FBI warn of ongoing AI-powered attacks targeting Siemens S7 PLCs in critical infrastructure. Attackers are leveraging automated scripts to exploit vulnerabilities and gain unauthorized access to industrial control systems.

CISA is warning of active exploitation of a critical SSRF vulnerability in the MLflow AI engineering platform. The flaw allows unauthenticated attackers to bypass network boundaries and steal sensitive cloud credentials.

The transition to post-quantum cryptography is a gradual evolution driven by the potential for quantum computers to break current encryption standards. Organizations are encouraged to adopt methodical modernization strategies, following government-led implementation timelines and leveraging new hardware-based cryptographic accelerators.

Anchorage Digital has unveiled a strategic blueprint to defend digital assets against the decryption capabilities of future quantum computers. The strategy combines infrastructure upgrades, such as agile HSM architectures, with novel cryptographic frameworks like the Post-Quantum Turnstile.

Research indicates that thousands of critical industrial controllers used in U.S. water infrastructure remain dangerously exposed to the internet despite federal warnings. These vulnerabilities allow remote actors to potentially manipulate hardware settings and disrupt essential services.

This technical deep-dive explains the mathematical mechanics of elliptic curve twists and their role in cryptographic vulnerabilities. It demonstrates how attackers can exploit unverified input points through quadratic and sextic twist attacks.

Using an advanced multi-agent LLM approach, a researcher discovered a critical zero-day vulnerability in WordPress that allows for pre-authentication RCE. The exploit chain leverages the WordPress batch API to trigger an SQL injection, which is then escalated to full system control.

An attacker compromised AsyncAPI repositories to publish malicious npm packages that deploy the Miasma RAT credential stealer. The attack impacts millions of weekly downloads and utilizes advanced obfuscation and multi-channel C2 infrastructure.

CISA recently released a postmortem regarding a six-month exposure of internal credentials on GitHub caused by a contractor's error. The report details failures in incident notification response and the complexities of rotating secrets within large-scale federal environments.

Microsoft's latest Patch Tuesday includes a record 570 security fixes, highlighting a surge in vulnerabilities found via AI-assisted research. The update addresses several critical flaws and zero-days that are actively being exploited by malicious actors.

A critical security flaw has been identified in NGINX that allows unauthenticated attackers to trigger a heap buffer overflow using crafted HTTP requests. This vulnerability can lead to server crashes or potentially remote code execution under specific system configurations.

Researchers at Google recently discovered a way to break 256-bit ECC encryption with much lower qubit counts than expected, but withheld their exact method using zero-knowledge proofs. The startup Eigen Labs successfully bypassed this secrecy by using AI agents and crowdsourcing to develop an even more efficient attack circuit.

The Whisper_Bully tool demonstrates a sophisticated three-stage attack against Bluetooth Fast Pair devices. It leverages a specific vulnerability to bypass privacy randomization, followed by L2CAP flooding and connection hijacking.

This technical report details multiple methods for abusing Windows Services to achieve persistence and elevated privileges. It covers everything from traditional binary path modification to advanced techniques involving SDDL manipulation and service recovery hijacking.

CISA released an after-action report regarding a credential leak caused by a contractor's use of a personal GitHub repository. The agency successfully mitigated the exposure without loss of mission data and is implementing stricter development environment guardrails.

The article advocates for a proactive 'sniff test' methodology to validate the integrity of SBOMs in containerized environments. It highlights how identifying omissions like unpinned packages or missing dependencies is crucial for preventing supply chain attacks.

Security researchers at watchTowr have identified a critical memory overread vulnerability, CVE-2026-8451, affecting Citrix NetScaler appliances. The flaw allows for unauthorized memory disclosure when the device is configured as a SAML Identity Provider.

This technical report details a series of critical vulnerabilities in Adobe ColdFusion, highlighted by an exploit in the RDS module. The analysis demonstrates how unvalidated input in the RDS protocol allowed for arbitrary file system access.

Aikido Security has completed a $70 million acquisition of Root to introduce automated backporting of security patches. The move aims to remediate critical vulnerabilities in existing open source dependencies without forcing developers to undergo complex version upgrades.

CISA is mandating rapid patching for critical vulnerabilities in Ubiquiti and Lantronix hardware that are currently being exploited by attackers. These flaws range from access control bypasses to remote command injection, posing a significant risk of full system compromise.

Fraunhofer IPMS has unveiled Q-Dice, a high-speed quantum random number generator designed to secure networks against classical and quantum threats. The platform offers both hardware appliances for data centers and an API-driven cloud service for on-demand entropy.

360 Security Technology introduced two new AI models, Tulongfeng and Yitianzhen, to automate cyber offensive and defensive operations. The company aims to bridge the technological gap with US-based AI by focusing on scalable, automated defense systems.

Researchers have identified a critical vulnerability chain called SearchLeak that allows attackers to exfiltrate enterprise data via Microsoft 365 Copilot. By combining prompt injection with an HTML race condition and Bing-based SSRF, attackers can bypass security controls with a single click.

This paper challenges the assumption that Differential Privacy enhances Federated Learning security against backdoor attacks. The authors present 'Ring', an attack mechanism that leverages DP noise to conceal malicious updates from detection systems.

France is implementing a mandatory transition to quantum-resistant encryption for all certified security products by 2027. This regulatory shift responds to the growing threat of future quantum computers capable of breaking current cryptographic standards.

Security researchers have identified a new unpatchable bootROM exploit named usbliter8 that affects several older Apple devices. The vulnerability stems from how USB controllers manage data packets, allowing for persistent hardware-level exploits.

A supply chain attack targeting Klue's market intelligence platform allowed threat actors to steal Salesforce customer data through OAuth token abuse. The Icarus extortion group is identified as the primary actor behind this recent wave of CRM-focused breaches.

Accenture has announced a massive $4.1 billion initiative to dominate the OT cybersecurity market by acquiring stakes in Dragos, runZero, and NetRise. This strategic expansion focuses on providing comprehensive protection for critical infrastructure and industrial environments.

Former Signal engineers have unveiled Encrypted Spaces, a framework for building end-to-end encrypted collaborative platforms. The system uses zero-knowledge proofs to allow servers to manage and verify data changes without ever accessing the underlying unencrypted information.

CISA has implemented a new directive forcing federal civilian agencies to remediate high-risk vulnerabilities in as little as three days. This rapid response requirement is a direct reaction to the increased ability of threat actors to use AI for automated bug hunting and exploitation.

A critical pre-authentication remote code execution vulnerability has been discovered in IBM i Management Central. The flaw allows unauthorized attackers to execute commands with full system privileges by exploiting a custom binary protocol.

Quantum eMotion and JMEM TEK have partnered to develop a highly secure, quantum-resilient System-on-Chip (SoC). This platform will integrate advanced cryptographic hardware and quantum entropy sources to meet the rigorous security demands of critical infrastructure.

GhostTree is a sophisticated attack technique utilizing NTFS junctions to create recursive, branching file path loops. By generating an effectively infinite number of valid paths, it can cause directory scanning tools and EDR products to hang, thereby allowing malicious files to remain unexamined.

Pathfinding Labs is a new resource offering over 100 intentionally vulnerable AWS environments for security professionals. It enables red and blue teams to practice exploiting complex, real-world misconfigurations and validate the effectiveness of their detection and CSPM tools.

Discord has implemented mandatory end-to-end encryption (E2EE) for all voice and video communication across its platform. This major update extends the DAVE protocol to secure DMs, group chats, and live streams, significantly boosting user privacy.

PacketLight and Quantum XChange have launched a strategic solution to enhance the security of optical transport networks. This joint platform integrates both post-quantum cryptography and physics-based QKD, offering carriers and defense networks protection against future decryption threats.

Cybercriminals are increasingly operating as professional, profit-driven enterprises, utilizing automation and AI to execute rapid attacks against SMEs. To mitigate this risk, businesses must pivot from simple technical compliance to building deep, operational cyber resilience across their entire supply chain.

An attacker successfully compromised 42 TanStack npm packages by chaining GitHub Actions cache poisoning with OIDC token extraction. The breach allowed for the unauthorized publication of malicious versions that could exfiltrate sensitive cloud and infrastructure credentials.

Researchers have identified a critical unauthenticated remote code execution vulnerability in the Exim mail server, tracked as CVE-2026-45185. The bug stems from a use-after-free condition during TLS shutdown when GnuTLS is employed.

The TeamPCP hacker group has compromised the Checkmarx Jenkins AST plugin by leveraging credentials stolen from a previous Trivy scanner breach. This supply-chain attack allows for the delivery of credential-stealing malware to developer environments.

The rapid adoption of Generative AI is expanding the human risk surface through shadow AI and advanced, AI-augmented external attacks. To mitigate these evolving threats, cybersecurity leaders must move beyond traditional awareness training toward behavior-driven security culture programs.

Threat actors compromised DigiCert support endpoints by sending malicious attachments through a customer chat channel. This breach enabled the unauthorized retrieval of certificate initialization codes, resulting in the misissuance of 60 code signing certificates.

Attackers compromised legitimate DAEMON Tools installers to distribute trojanized, digitally signed binaries that execute malicious code upon system startup. The campaign utilizes an initial information collector to profile victims before deploying advanced payloads like the QUIC RAT for targeted exploitation.

A critical buffer overflow vulnerability in Palo Alto Networks' PAN-OS is under active exploitation, allowing for unauthenticated root access. Organizations are advised to restrict access to the User-ID Authentication Portal to trusted networks until an emergency patch is released.

A heap buffer overflow in MariaDB's JSON schema validation allows authenticated attackers to escalate privileges and execute arbitrary code. Users should upgrade to the patched versions 11.4.10 or 11.8.6 immediately.

This article explains how a downgrade attack can bypass BitLocker encryption by leveraging unrevoked legacy certificates in the Secure Boot process. By loading a vulnerable boot manager, an attacker with physical access can gain access to a decrypted OS volume.

AISLE has identified a critical, long-standing remote command execution vulnerability in FreeBSD's dhclient. This flaw enables attackers on the same local network to gain root privileges by exploiting improper sanitization of DHCP protocol data.