Search: “fuzzing”

How hackers used Claude for missiles, drone swarms, and surveillance, while Chinese labs mined it for training data

Anthropic's threat report details eight months of Claude misuse: AI-assisted espionage against 20+ organizations, self-rewriting malware, and Chinese labs distilling Claude via fraudulent accounts.

Anthropic's threat intelligence report covering December 2025 through August 2026 documents Claude misuse across seven categories including cyber operations, surveillance, fraud, and unauthorized model distillation. A Russian-speaking espionage actor tracked as GTG-20006 used AI agents to rewrite and recompile malware evading antivirus detection, targeting more than 20 organizations in Ukraine and Europe and stealing a drone vision system SDK. Alibaba's Qwen lab ran the largest distillation campaign, with over 151 million exchanges between May and July 2026 peaking near 3 million per day to train Qwen 3.5, 3.6, and 3.7. DeepSeek, Moonshot AI, Xiaomi, and Zhipu also relayed customer or replayed traffic to Claude, including PLA-linked users analyzing CCTV footage and users with credentials tied to the Russian Ministry of Defense.

The Decoder·updated Sep 12, 10:30 UTC · 4d ago·first Sep 11, 13:50 UTC · 4d agoAI safety & security in the wild 15 sources2

Re: Retrospective by 'gpg.fail' authors

Unreported 0-day RCE in gpgsm 2.4.9 disclosed via gpg.fail talk, triggered by importing a malicious certificate with --debug options.

A retrospective by the gpg.fail authors revealed a remote code execution vulnerability in gpgsm 2.4.9, triggered when invoked as "gpgsm --debug all --import" with a malicious certificate file. The researchers did not report the issue to GnuPG, leaving it unpatched as an apparent 0-day. Exposure appears limited since it requires importing untrusted certificates with debug options enabled.

oss-security·updated 05:03 UTC · 5h ago·first Sep 14, 19:56 UTC · 1d agoVulnerability 6 sources

Chaotic Eclipse Released GreenSection, A PoC For NVIDIA Memory Corruption Zero-Day

Researcher Chaotic Eclipse released GreenSection, a PoC exploiting an unpatched out-of-bounds write in NVIDIA Windows user-mode shared memory.

Security researcher Chaotic Eclipse disclosed an out-of-bounds write in NVIDIA's Windows user-mode components, which share a global memory section (\BaseNamedObjects\{52813408-3561-4705-820a-2b3b78be92ba}) with full read/write access to all users. The PoC crashes applications running Vulkan or OpenGL; the researcher says the bug could cross user boundaries or compromise dwm.exe but did not fully assess the impact. No CVE has been assigned and no patch is mentioned. The researcher recently released zero-day PoCs against Kaspersky, Avast, and CrowdStrike Falcon.

Security Affairs·Sep 7, 13:42 UTC · 8d agoExploit / PoC 2 sources

Testing race conditions with memory access tracing and stack-based delay injection

Google Project Zero released MAccConc, Linux kernel tooling that traces memory accesses to explore and test race condition interleavings.

A Google Project Zero researcher published MAccConc (Memory Access Concurrency), tooling for exploring possible interleavings of multithreaded test cases in the Linux kernel, available on GitHub. The tools use KCOV with ASAN outline-mode instrumentation to record per-access memory traces, enabling automatic testing of all A-B-A interleavings plus terminal and GUI explorers for manual analysis. The work targets confirming race condition candidates, building reliable regression tests, and enabling concurrency fuzzing, drawing on ideas from SKI and Ned Williamson's sockfuzzer.

Google Project Zero·Sep 8, 07:00 UTC · 8d agoResearch1

Infostealers are hijacking Claude accounts at users’ expense

Malwarebytes reports infostealers are stealing Claude session cookies to hijack Anthropic accounts and consume victims' usage at their expense.

Anthropic warned that infostealer malware operators are harvesting Claude session cookies from infected machines. Attackers replay the stolen cookies to take over users' accounts and consume their usage quotas, affecting the victims' own access. The activity involves observed account hijacking rather than a flaw in Claude itself.

Malwarebytes Labs·Sep 1, 10:08 UTC · 15d agoMalware in the wild

How well do agents use test/verification techniques?

Dan Luu's eval finds coding-agent testing instructions (TDD, formal methods, PBT, skills) mostly fail to beat defaults on Zstd implementation correctness.

The author ran 26 prompt conditions plus 4 skills on a Zstd-in-Rust implementation eval using codex with GPT-5.6, testing TDD, fuzzing, property-based testing, formal methods (Lean 4, TLA+, Verus, Kani, SMT solvers) and community skills. Nothing dramatically outperformed the default no-instruction condition, which did above average; at xhigh effort, fuzzing and PBT conditions did slightly better than formal methods. Pre-registered predictions included TDD underperforming and popular test skills (ECC, Hegel, Trail of Bits) not outperforming. Results are averages of 80 runs per condition plotted against cost.

Hacker News · security·Sep 8, 02:58 UTC · 8d agoAI researchHN 131↑ · 50 comments

Researcher shows how Claude Code can be tricked simply by asking it to summarize a website

Researcher wunderwuzzi showed Claude Code can be hijacked via prompt injection simply by asking it to summarize a website.

Security researcher Johann Rehberger (wunderwuzzi) demonstrated that Claude Code can be manipulated through prompt injection by simply asking it to summarize a website. Instructions embedded in fetched web content are executed by the agent, hijacking its behavior. The Register frames the finding as another demonstration of prompt injection risks in agentic coding tools that ingest untrusted web content.

The Register · Security·Aug 28, 20:50 UTC · 18d agoAI safety & security1

When LLM Decompilers Recompile More and Preserve Less

Researchers show LLM decompiler outputs can recompile yet diverge behaviorally, proposing the Decompile-Diverge fuzzing oracle to catch hidden changes.

The paper demonstrates that LLM-based decompilers can produce code that recompiles and passes all shipped tests yet diverges on other legitimate inputs—4.9% overall and up to 13% for one system—and can make disclosed vulnerabilities vanish without a visible crash. Across 300 real GitHub functions and 287 CVE-grounded functions, a refinement LLM lifted Ghidra's build rate from 75% to 90% while Matched rate fell from 74% to 62%, with up to one tenth of vulnerabilities showing Crash Absence. Decompile-Diverge detects these gaps by synthesizing drivers, growing fuzzing corpora from the reference, and rerunning decompiled code on identical inputs.

arXiv cs.CR·Sep 4, 17:16 UTC · 11d agoResearch

Hackers are stealing Claude tokens from subscribers

Infostealer malware is stealing Claude login sessions, letting attackers mint OAuth tokens and burn subscribers' paid usage largely undetected.

Anthropic confirmed a bad actor used common infostealer malware to steal Claude login sessions from users' computers and consume their paid usage. A UK consultant saw idle token usage climb, and Anthropic suspended his account, invalidated sessions and Claude Code tokens, and issued a £44.49 partial refund on his $200-per-month plan. Multiple other users on Reddit and GitHub reported similar theft; Anthropic signed out affected users and issued refunds, but still lacks itemized usage reporting to help users detect misuse.

TechCrunch · AI·Sep 8, 21:10 UTC · 7d agoAI safety & security in the wild1

Harnessing LLMs for Automating BOLA Detection

Unit 42's BOLABuster methodology uses LLMs to automate detection of broken object-level authorization vulnerabilities, uncovering flaws in Grafana, Harbor, and Easy!Appointments.

Palo Alto Unit 42 details BOLABuster, a methodology combining large language models with heuristics to automate detection of broken object-level authorization (BOLA) flaws, which traditional fuzzing and static analysis struggle to find. The approach uses LLM reasoning to understand application logic, map endpoint dependency relationships, and generate and interpret test cases. It found CVE-2024-1313 in Grafana, CVE-2024-22278 in Harbor, and 15 CVEs in Easy!Appointments. The team is continuing to hunt for BOLAs in open-source and internal projects.

Palo Alto Unit 42·Aug 17, 12:34 UTC · 29d agoResearchCVE-2024-1313CVE-2024-22278CVE-2023-3285+14 CVEs

We have a year to fix security everywhere

Blog post warns that cheap open-weight GLM 5.3-flash, once abliterated, could enable mass AI-driven vulnerability exploitation, urging industry-wide patching now.

An essay argues that Z.ai's open-weight GLM 5.3-flash—runnable locally on roughly $6k consumer hardware at 20-45 tokens/second—combined with 'abliterated' variants from groups like DeAlignAI that score 0% on HarmBench-320 puts dangerous hacking capability in nearly anyone's hands. GLM 5.3 scores 84.5% on CyberGym and 54.4% on ExploitBench, versus GPT-6 Astra's 100% and GPT-5.6 Sol's 78.5%, and the author cites evidence of frontier models exploiting real-world infrastructure. The author calls for using LLMs (Project Glasswing, Daybreak) to find and fix vulnerabilities industry-wide before adversaries weaponize cheap open models.

Hacker News · security·Sep 8, 04:48 UTC · 8d agoAI safety & securityHN 278↑ · 292 comments

Claude is a Contrarian

Opinion piece argues Claude habitually contradicts explicit user instructions, injecting contrarian content despite CLAUDE.md rules and user objections.

A developer recounts repeated instruction-following failures with Claude, claiming it contradicts explicit requests, adds unnecessary work, and ignores AGENTS.md and CLAUDE.md directives. The author contrasts this with OpenAI, DeepSeek, and Qwen models, which he says more readily apologize and undo mistakes. He theorizes Claude's training makes it assume the human is wrong and needs correcting. The post is personal commentary with no benchmarks or systematic evaluation.

Hacker News · AI·Sep 14, 16:14 UTC · 1d agoAI industryHN 54↑ · 48 comments

1Password's AI patching benchmark is misleading

Trail of Bits reanalysis says 1Password's 26% AI clean-fix rate is misleading; 86% of eligible patches blocked exploits.

Trail of Bits critiques 1Password's FLAWED AI patching benchmark, arguing its 26% clean-fix headline mixes trials where agents were instructed to apply wrong fixes (22% of data) with trials that prohibited compiling or testing (36%). Restricting to reasonable conditions, 2,634 of 3,067 patches (86%) blocked the supplied exploit. Trail of Bits also reports 12.5% of 2,265 developer first fixes failed in its own 2024-2026 assessments, and released post-patch-validation and review-walkthrough agent skills.

Lobsters · security·Sep 15, 20:03 UTC · 14h agoResearch

Code review used to be the only way to catch these bugs

Palo Alto Networks' Unit 42 says its NOVA system found 14,090 vulnerabilities in 3,915 open-source projects, mostly non-crashing bugs like access control flaws.

Unit 42's NOVA system analyzed 3,915 open-source projects over two months and reported 14,090 validated vulnerabilities, only 85 of which matched previously documented findings. 92% of findings fell outside fuzzing-friendly categories, clustering instead in access control, path traversal, injection, prototype pollution, and SSRF; language ecosystems showed distinct weakness profiles. Of 5,421 supply-chain findings, 1,280 were flaws in dependencies while 4,141 were downstream exposures, 2,776 validated with working proof-of-concepts. Unit 42 warned that faster discovery combined with an average 55-day patch deployment window has collapsed the patch-to-exploit gap.

Help Net Security·Aug 25, 18:03 UTC · 21d agoResearch

Researchers open-source a Wi-Fi cyber range for security training

NTNU and Aegean researchers open-source a software-emulated Wi-Fi cyber range using mac80211_hwsim with LLM-assisted scenario building.

Researchers from the Norwegian University of Science and Technology and the University of the Aegean published a design and prototype for a cyber range dedicated to IEEE 802.11 security training, emulating access points and clients with mac80211_hwsim, Linux namespaces, hostapd, wpa_supplicant, dnsmasq, and FreeRADIUS. The platform bundles Aircrack-ng, Wireshark, and custom tools WPAxFuzz and Bl0ck, and can convert plain-language scenario descriptions into deployable definitions via a locally hosted Llama model. A working prototype covering scenario creation and deployment is on GitHub; monitoring, access control, and orchestration zones remain future work.

Help Net Security·Aug 24, 04:21 UTC · 23d agoTools1

StyleSmuggler: Unpatched Magento and Adobe Commerce Zero-Day Exploited

Attackers are actively exploiting an unpatched zero-day dubbed StyleSmuggler in Magento Open Source and Adobe Commerce for unauthenticated remote code execution.

A zero-day vulnerability tracked as StyleSmuggler affects Magento Open Source and Adobe Commerce and permits unauthenticated remote code execution. The flaw is unpatched and exploitation is ongoing in the wild. E-commerce stores running these platforms are at direct risk of compromise until a fix is released.

SOCRadar·Sep 7, 11:31 UTC · 8d agoExploit / PoC in the wild

How to secure edge AI in customer-owned environments

Microsoft outlines security architecture guidance for edge AI, urging runtime attestation, artifact provenance, and deterministic mediation of model actions.

Microsoft details how edge AI shifts trust responsibilities to customers operating their own infrastructure, where prompt injection, model tampering, and malicious firmware updates can occur alongside model weights, credentials, and physical-system access. The guidance recommends verifying runtimes with attestation, verifying AI artifacts with provenance, and constraining model actions through a deterministic mediator outside the model. It also covers new exposure surfaces from MCP, multi-agent systems, and computer-use agents running in disconnected or hostile edge environments.

Microsoft Security Blog·Sep 4, 19:10 UTC · 11d agoAI safety & security

graphql-go/graphql <= 0.8.1: quadratic CPU-exhaustion DoS via OverlappingFieldsCanBeMergedRule

Unauthenticated quadratic CPU-exhaustion DoS disclosed in graphql-go/graphql up to v0.8.1 via OverlappingFieldsCanBeMergedRule; no fixed version exists.

Evgenios Gkritsis publicly disclosed an algorithmic-complexity denial-of-service flaw in github.com/graphql-go/graphql affecting all released versions up to and including v0.8.1. The defect is triggered via the OverlappingFieldsCanBeMergedRule validation, is unauthenticated and network-reachable, and causes quadratic CPU exhaustion. No fixed version exists; the disclosure was public because the project has no private security-reporting channel or SECURITY.md.

oss-security·Sep 14, 17:58 UTC · 1d agoVulnerability

IntentFuzz: A Protocol-Aware Fuzzer for Automated Invariant Violation Detection in Intent-Based Cross-Chain Bridges

IntentFuzz protocol-aware fuzzer recovers bridge structure from unannotated Solidity and confirmed 22 invariant violations across 24 real-world deployments.

IntentFuzz formalizes a taxonomy separating invariant violations from settlement exposures in intent-based cross-chain bridges, then recovers a bridge's intent structure and deposit/fill function roles from unannotated Solidity source. It classified deposit and fill functions with 100% recall and 82% combined precision, and achieved 100% recall and precision on 23 planted-bug mutants. Across 24 real-world deployments it confirmed 17 genuine invariant violations with heuristic-only input generation, rising to 22 with its LLM-assisted tier, spanning eight vulnerable GitHub repositories with findings reproducible against public deployed bytecode.

arXiv cs.CR·Sep 11, 16:03 UTC · 4d agoResearch1

Wireshark 4.6.8 patches 28 security bugs, nine in file parsers

Wireshark 4.6.8 fixes 28 security bugs, including nine crash-prone capture file parsers, misdecoded 5G fields, and memory-safety issues.

Wireshark 4.6.8 fixes 28 security bugs spanning advisories wnpa-sec-2026-64 through wnpa-sec-2026-91, including nine crash bugs in file parsers such as pcapng, Endace ERF and Tektronix K12xx that trigger when opening capture files. Fixes cover dissectors for RDP, SSH, Kerberos, H.245, CMS, C12.22 and several Bluetooth protocols, plus unnumbered memory-safety issues like a stack buffer overflow in the K12/RF5 writer. The release also corrects eight misdecoded 5G NAS/5GSM fields and moves the Unix extcap path to /usr/libexec/wireshark/extcap.

Help Net Security·Aug 13, 00:00 UTC · Aug 13, 2026Advisory

Cybersecurity jobs available right now: June 16, 2026

Help Net Security rounds up cybersecurity job openings at Boeing, Lockheed Martin, Siemens Energy, and other firms across the US, Europe, India, and Israel.

Help Net Security's June 16, 2026 roundup lists cybersecurity job openings including Android vulnerability researcher, application security engineer, vulnerability management specialist, DevSecOps engineer, and OT/ICS consultant. Employers include Byteria, Millennium, Nava, Siemens Energy, Lockheed Martin, Enterprise Products, Audubon Companies, Boeing, and General Dynamics across the US, Ireland, Germany, India, Israel, and the UK.

Help Net Security·Aug 17, 09:05 UTC · Aug 17, 2026Industry

⚡ Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More

The Hacker News·Aug 4, 12:16 UTC · Aug 4, 2026RansomwareCVE-2026-50746CVE-2026-50747CVE-2026-50748+45 CVEs

Meme Coin Factories: Uncovering Large-Scale Manipulations on pump.fun

Large-scale pump.fun study of 15 million meme coins identifies five manipulation classes including wash trading and a Market-Manipulation-as-a-Service ecosystem.

Researchers analyzed all 15 million coins launched on pump.fun over the last two years plus large random samples of transaction data, identifying five manipulation classes: wash trading, creator address obfuscation, coordinated sells, copycat coins, and social media manipulation. Strategic actors bypass the platform interface and implement strategies in a highly automated, low-latency way by interacting directly with the blockchain. The study also uncovers Market-Manipulation-as-a-Service (MMaaS) third-party tools that let non-technical users run these manipulations, and proposes mitigations for traders, pump.fun, and regulators.

arXiv cs.CR·Sep 9, 14:35 UTC · 6d agoResearch

Google Chrome 153 Released With Fixes for 42 Security Vulnerabilities

Google shipped Chrome 153 to the Stable channel fixing 42 vulnerabilities, including three critical flaws in WebGL, Internals, and Workers; no exploitation reported.

Google released Chrome 153 (153.0.8010.47/48) for Windows, macOS, and Linux, patching 42 security vulnerabilities including three rated critical: CVE-2026-91726 (out-of-bounds read in WebGL), CVE-2026-91721 (use-after-free in Internals), and CVE-2026-91749 (use-after-free in Workers). Twenty-eight fixes are rated high severity, covering use-after-free, type confusion, race condition, integer overflow, and authorization flaws across components like V8, Skia, DOM, ServiceWorker, PDF, and Extensions. Google's bulletin indicates no vulnerabilities are currently being exploited in the wild, and external researchers earned rewards up to $1,500 for reported issues. Enterprises are advised to verify fleet-wide deployment via browser-management consoles and enable automatic updates.

GBHackers·05:00 UTC · 5h agoVulnerabilityCVE-2026-91726CVE-2026-91721CVE-2026-91749+27 CVEs

Infostealers Are Hijacking Claude Sessions and Draining Subscriptions

Infostealers hijacked active Claude sessions to bypass 2FA, drain paid usage and run unauthorized charges; Anthropic is revoking sessions and refunding.

Anthropic confirmed that infostealer malware on user machines stole active Claude login sessions, letting attackers bypass passwords, MFA, and SSO and drain paid usage and run unauthorized charges. Affected families identified on Windows include Vidar, LummaC2, StealC, RedLine, and Acreed, plus Atomic Stealer on a small number of Macs; the malware typically arrived via unofficial downloads or malicious apps. Anthropic signed users out, removed saved payment cards, revoked affected sessions, and is refunding unauthorized charges, noting phones and tablets were not involved.

Security Affairs·Aug 31, 09:17 UTC · 16d agoMalware in the wild

From Specs to Apps: Verifying and Monitoring Models of Signal and WhatsApp

Researchers use the SpecMon runtime monitor to verify WhatsApp Web and Signal Desktop against formal Signal protocol models, finding undocumented libsignal fork differences.

The paper applies SpecMon, a runtime monitoring tool, to check whether executions of WhatsApp Web and Signal Desktop conform to formal models of the Signal protocol. The authors instrument both applications and build Tamarin-compatible multiset-rewrite models, including the first model of WhatsApp Web's implementation and the most detailed model to date of Signal's original protocol. They verify authentication and secrecy properties for core Signal protocol components, show monitoring detects deliberately injected faults with low overhead, and identify previously undocumented behavioral differences between the original libsignal library and WhatsApp's fork.

arXiv cs.CR·Sep 10, 17:48 UTC · 5d agoResearch

Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages

Check Point links Gambling Goblin, a Chinese-speaking cluster, to malicious Apache modules hijacking Brazilian government servers to promote betting sites.

Check Point Research tracks Gambling Goblin, a Chinese-speaking cluster, installing malicious Apache reverse-proxy modules on compromised Brazilian government and education web servers since mid-2025. The modules divert visitors to gambling and fake app-store pages while stripping the site's security headers, likely for large-scale SEO manipulation. The group's Linux arsenal includes DownPro, AlphaAgent, oRAT, a 3snake-based credential stealer, and SSH brute-forcing tools, and it is tied to Trend Micro's Earth Berberoka. Related SEO-fraud campaigns on .gov.br domains were documented by ESET (GhostRedirector), Palo Alto Networks Unit 42, and Hunt.io.

The Hacker News·Sep 2, 13:44 UTC · 13d agoThreat actor in the wild

Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code

Malicious .git core.fsmonitor configs let attacker code run in AI coding agents like Claude Code and Codex; four of eight flaws remain unpatched.

Manifold Security disclosed eight flaws across seven command-line AI coding agents where a repository's Git core.fsmonitor configuration causes agent-spawned commands to execute attacker code outside the sandbox and without approval prompts. Fixes shipped for goose (CVE-2026-72718, CVSS 4.0 score 7.0), Claude Code on one path, and Cursor, while Hermes Agent, Qwen Code, Grok Build, and a second Claude Code path were still unpatched as of September 1. OpenAI issued three CVEs for the same class in Codex, including CVE-2026-19592, and prior related bugs include CVE-2021-43891 in Visual Studio Code and CVE-2022-24346 in JetBrains IDEs. Exploitation requires the repository to arrive with its .git directory intact, such as via archives, shared drives, or USB sticks rather than an ordinary clone.

The Hacker News·Sep 2, 14:06 UTC · 13d agoVulnerabilityCVE-2026-19592CVE-2026-72718CVE-2026-71963+3 CVEs1

Iran-Linked Hackers Use Fake LinkedIn Job Offers to Deploy NodeRabbit and PollCat RATs

Iran-linked Mirage Kitten targets software engineers with fake LinkedIn recruiter coding tests deploying new NodeRabbit and PollCat RATs.

Kaspersky researchers link the campaign to Mirage Kitten (also tracked as UNC1549, Smoke Sandstorm, Nimbus Manticore), with victims in aviation, aerospace and fintech in Egypt, Ethiopia and Afghanistan. Trojanized npm dependencies (colorized_terminal, pretty-log) bundled in coding-challenge archives launch the Node.js implants across Windows, Linux and macOS. NodeRabbit uses AES-256-GCM-encrypted C2 via Azure, and its third variant persists through a fake GitHub Copilot Helper VS Code extension plus Git post-merge/post-checkout hooks. PollCat is an obfuscated JavaScript RAT that registers with C2 before OTP authentication and inventories tools from 24 security vendors.

GBHackers·updated Sep 9, 14:07 UTC · 6d ago·first Sep 9, 12:52 UTC · 6d agoThreat actor in the wild 2 sources1

ZDI-26-593: NVIDIA TensorRT ONNX File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI disclosed a second TensorRT heap-based buffer overflow RCE (CVE-2026-24268, CVSS 7.8) in ONNX file parsing, requiring user interaction.

The Zero Day Initiative published advisory ZDI-26-593 covering another heap-based buffer overflow in NVIDIA TensorRT's ONNX file parsing. A remote attacker can execute arbitrary code if the target opens a malicious file or visits a crafted page. ZDI rated the vulnerability CVSS 7.8 and assigned CVE-2026-24268.

ZDI Published Advisories·Aug 24, 05:00 UTC · 23d agoAdvisoryCVE-2026-24268

Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon

Check Point identifies Chinese-speaking group Gambling Goblin hijacking Brazilian government domains via malicious Apache modules for SEO-manipulated gambling phishing.

Check Point Research tracks a sustained campaign since mid-2025 against Brazilian government and educational organizations by Gambling Goblin, a Chinese-speaking cybercrime cluster linked to Earth Berberoka. Attackers compile and install malicious Apache modules that silently reverse-proxy visitors to phishing pages impersonating Google Play, Microsoft Store, and Amazon, chaining compromised high-reputation domains to inflate search rankings. The group deploys a heavily obfuscated Linux toolkit including DownPro, AlphaAgent, oRAT, a 3snake-based credential stealer, and SSH brute-forcers, with parallel phishing networks localized for Vietnamese, Spanish, and English victims.

Check Point Research·Sep 2, 10:16 UTC · 14d agoThreat actor

Hackers Can Hide Malicious AI Commands Inside Normal English to Bypass Security Filters

Check Point's PuzzleMask technique hides malicious prompts in ordinary English that fast gatekeeper models miss but high-reasoning downstream models execute.

Check Point researchers disclosed PuzzleMask, a technique concealing policy-breaking instructions in natural-language prose without encodings or invisible characters. Fast screening models classified all 23 crafted wrappers as safe, while a high-reasoning model recovered and acted on the hidden instruction in 17 of 18 tests (94.4%). The gap stems from capability imbalance between gatekeeper and target models, with defenses including paraphrasing untrusted input, stricter self-referential wording rules, and output/tool-call monitoring.

Cyber Security News·Sep 11, 07:36 UTC · 5d agoAI safety & security1

ZDI-26-591: NVIDIA TensorRT ONNX File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI disclosed a heap-based buffer overflow RCE (CVE-2026-24272, CVSS 7.8) in NVIDIA TensorRT ONNX parsing, requiring user interaction to exploit.

The Zero Day Initiative published advisory ZDI-26-591 covering a heap-based buffer overflow in NVIDIA TensorRT's ONNX file parsing. Successful exploitation allows remote code execution when a user opens a malicious ONNX file or visits a crafted page. ZDI rated the vulnerability CVSS 7.8 and assigned CVE-2026-24272.

ZDI Published Advisories·Aug 24, 05:00 UTC · 23d agoAdvisoryCVE-2026-24272

VLC Media Player Flaws Let Attackers Corrupt Memory and Leak Sensitive Data

VLC 3.0.0-3.0.23 has two flaws: a heap out-of-bounds write via malicious PNGs (CVE-2026-56711) and an out-of-bounds read via hostile RealRTSP servers.

CVE-2026-56711 is a heap out-of-bounds write (CVSS v4 8.6) caused by an integer overflow in VLC's AllocatePicture routine when processing PNG images with exceptionally large IHDR width and height values, allowing writes past the allocated buffer; it maps to CWE-190 and CWE-787 and was credited to Fabian Wahle of Hap Security. CVE-2026-73324 is a medium-severity out-of-bounds read (CVSS v4 6.9) in VLC's RealRTSP handling, where RtspReadLine copies response lines longer than 4,096 bytes into a fixed buffer without null termination, potentially leaking heap data back to a hostile RTSP server via the Session header. Both bugs affect VLC 3.0.0 through 3.0.23, and updated builds had not yet been released at the time of disclosure.

GBHackers·updated Sep 12, 14:31 UTC · 3d ago·first Sep 11, 12:03 UTC · 4d agoVulnerability 2 sourcesCVE-2026-56711CVE-2026-73324

Nightmare-Eclipse Strikes Again with 'ShieldCrash' Windows Exploit

A researcher known as Nightmare-Eclipse published another zero-day exploit, dubbed ShieldCrash, targeting Windows Defender.

Dark Reading reports that the disgruntled researcher tracked as Nightmare-Eclipse continued a vendetta against Microsoft by publishing a new zero-day exploit named ShieldCrash for Windows Defender. The brief report does not detail affected versions, exploitation prerequisites, or whether exploitation has been observed.

Dark Reading·Sep 10, 15:29 UTC · 5d agoExploit / PoC1

ZDI-26-679: Adobe Photoshop DCM JPEG Image Parsing Integer Overflow Remote Code Execution Vulnerability

ZDI disclosed a CVSS 7.8 integer overflow remote code execution flaw (CVE-2026-75862) in Adobe Photoshop DCM JPEG image parsing.

The Zero Day Initiative published advisory ZDI-26-679 describing an integer overflow remote code execution vulnerability in Adobe Photoshop, tracked as CVE-2026-75862 with a CVSS 7.8 score. The flaw occurs while parsing JPEG data in DCM images. Exploitation requires user interaction: the target must visit a malicious page or open a malicious file. No in-the-wild exploitation is reported.

ZDI Published Advisories·Sep 10, 05:00 UTC · 6d agoVulnerability 3 sourcesCVE-2026-75862

Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia

Suspected Russian clusters abuse OAuth and authentication flows to phish academia, defense, government, and think tank targets across Europe and the US.

Google Threat Intelligence Group (GTIG) is tracking three distinct suspected Russian cyber espionage clusters abusing legitimate authentication flows. Newly detailed clusters UNC7005 and UNC5976 conduct phishing, abuse OAuth flows, and/or deploy malware, alongside previously reported UNC6293 phishing operations. Targets include individuals in academia, aerospace and defense, governments, and think tanks across Europe, as well as academia and think tanks in the United States.

Google Threat Intelligence·Aug 20, 14:00 UTC · 26d agoThreat actor in the wild

Fake bank websites play dead to evade security scanners

Fortra uncovered Chameleon SEO Poisoning: cloaked typosquat bank sites rank on Google and Bing to steal credentials while evading scanners, with cases up 40% in Q2 2026.

Fortra's threat intelligence unit FIRE spent three months tracking Chameleon SEO Poisoning, a phishing method that ranks recently registered typosquat domains on second-level domains like .ph.com and .gr.com above legitimate bank sites on Google and Bing. The technique uses presentation control (cloaking by referrer): direct visits get a dead, offline-looking page, while search-referred clicks receive a convincing fake bank login page, letting poisoned results persist for days or weeks. Fortra recorded a 40% jump in cases during the second quarter of 2026 and recommends referrer-spoofed URL testing, faster SLD takedowns, and bookmarking bank logins.

Help Net Security·Aug 24, 00:00 UTC · 23d agoPhishing & fraud in the wild

InceptionRAG: Stealthy Poisoning Attack Against Retrieval-Augmented Generation

InceptionRAG fragments malicious payloads into dormant passages that trigger LLMs to self-deduce misinformation via multi-hop reasoning, bypassing existing RAG poisoning defenses.

Researchers introduce InceptionRAG, a stealthy corpus poisoning attack against retrieval-augmented generation that splits a malicious payload into a chain of individually harmless dormant passages. When retrieved together, the passages induce LLMs to self-deduce target misinformation through multi-hop reasoning, achieving over 80% attack success rate across three datasets and three LLMs under rigorous adversarial constraints. A zeroth-order suffix optimization (ZOSO) method automates authoritative suffix generation in black-box settings. The authors also propose HODOR, a document isolation defense that decouples adversarial logical dependencies.

arXiv cs.CR·Sep 15, 08:22 UTC · 1d agoResearch

Apple Xcode Integer Underflow Flaw Lets Crafted Archives Leak Memory and Crash Builds

Researchers disclosed an integer underflow in Apple's Mach-O archive parser that lets crafted static libraries crash Xcode builds or leak process memory.

SecureLayer7 disclosed an integer underflow in the mach_o::Archive::Entry::name() function in Apple's open-source dyld project, reported to Apple Product Security on May 23, 2026, with no public patch after more than 90 days. Crafted static archives (.a files) cause the parser's unsigned index to wrap to SIZE_MAX, producing SIGSEGV crashes in the ld-prime linker, out-of-bounds reads that may print adjacent memory to stderr, or SIGABRT in libtool and ranlib. The modern parser is used by ld-prime, the default linker for arm64, arm64e, and x86_64 since Xcode 15, while legacy ld-classic is unaffected. Crafted archives need only be processed, creating supply-chain risk via vendored SDKs, binary dependencies, and CI pipelines.

GBHackers·Sep 10, 11:41 UTC · 5d agoVulnerability1