Bishop Fox recovers Claude sandbox tokens and bypasses a local block
Anthropic said the observations stay inside the untrusted sandbox and do not qualify as security issues.
58
Organization
Bishop Fox
- Mentions · 7d2
- Mentions · 30d9
- All mentions13
- First seenSep 10, 2026
- Last mentioned23h ago
Timeline
13 articles · newest firstBishop Fox extracts Claude's sandbox binary and a Google Cloud token
Google's token-info API accepted the rebuilt service-account token; Anthropic said its threat model was not broken.
58
PoC Exploit Code Released for Fortinet FortiClient EMS Authentication Bypass Flaw
Public exploit code is out for FortiClient EMS flaw CVE-2026-35616, exploited since spring 2026.
88
Citrix NetScaler security snafus get even worse amid more 0-day reports
Attackers are exploiting unpatched Citrix NetScaler CVE-2026-88779, a SAML memory overflow that causes denial of service.
86
US, Australia warn of latest Citrix vulnerability after NetScaler advisory
CISA orders agencies to patch actively exploited Citrix NetScaler flaw CVE-2026-88779, a confirmed denial-of-service bug.
84
CISA flags new exploited NetScaler flaw as attackers crash appliances (CVE-2026-88779)
CISA added actively exploited Citrix NetScaler CVE-2026-88779 to KEV after attacks crash ADC and Gateway appliances.
88
New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline
Citrix patched exploited NetScaler CVE-2026-88779, a SAML memory overflow that can deny service.
82
Citrix NetScaler SAML Vulnerability Enables Unauthenticated Remote DoS Attacks
Citrix patched CVE-2026-88779, a CVSS 8.7 unauthenticated NetScaler SAML memory overflow enabling persistent remote DoS, reportedly exploited in targeted attacks.
78
Citrix NetScaler SAML 0-Day Vulnerability Actively Exploited in Attacks
Citrix patched actively exploited NetScaler SAML zero-day CVE-2026-88779, which can deny service on ADC and Gateway appliances.
82
SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild
CISA listed actively exploited SharePoint RCE and MikroTik RouterOS flaws in the KEV catalog.
88
MikroTrick Attack Lets Hackers Gain Full Admin Control of MikroTik Routers Without Login
Bishop Fox's MikroTrick chains CVE-2026-67279 and CVE-2026-86060 to gain unauthenticated admin control of internet-exposed MikroTik RouterOS devices, with compromise evidence.
78
Hackers Exploit MikroTik Vulnerabilities to Take Over MikroTik Routers Without Authentication
Attackers chained SSH authentication bypass CVE-2026-67276 and privilege flaw CVE-2026-86060 to fully hijack internet-exposed MikroTik routers before patches existed.
85
Hacker Conversations: Vinnie Liu, Performer Turned Ringmaster
SecurityWeek interviews Bishop Fox CEO Vinnie Liu, recruited by the NSA at 17 in 1999, on hacker ethics, intent, and his career.
15
Related CVEs
by mentions- CVE-2026-8877911%8.7Unauthenticated denial of service in NetScaler ADC and Gateway
- CVE-2026-8877182%9.5Unauthenticated RCE in Citrix NetScaler ADC and Gateway
- CVE-2026-8877278%9.5Unauthenticated RCE/DoS in Citrix NetScaler ADC and Gateway
- CVE-2026-860606%9.2Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation
- CVE-2026-672792%6.9Unauthenticated SSH Session Bypass Enables File Writes in MikroTik RouterOS
- CVE-2026-3561694%9.8Unauthenticated Code Execution in Fortinet FortiClient EMS 7.4.5–7.4.6
- CVE-2026-656608%8.8Authenticated Code Injection RCE in Microsoft SharePoint Server
- CVE-2026-672769%9.2SSH RSA Authorized-Key Bypass in MikroTik RouterOS 7.x
Appears with
- watchTowrorganization · 6
- CISAorganization · 6
- Citrixvendor · 5
- NetScaler ADCproduct · 5
- NetScaler Gatewayproduct · 5
- MikroTikvendor · 3
- RouterOSproduct · 3
- Cloud Software Grouporganization · 3
- Claudeai model · 2
- Googlevendor · 2
- CERT Polskaorganization · 2
- Anthropicvendor · 2
- Microsoftvendor · 1
- @stakeorganization · 1
- FortiClient EMSproduct · 1
- SecurityWeekorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.