ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “code execution”

81 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 6212Malware 3863Exploit / PoC 3186Ransomware 1949Threat actor 885Data breach 638Policy & legal 338Phishing & fraud 309Advisory 228Industry 219Research 81Tools 42
SeverityAllcritical 8864high 5387medium 3096low 500info 103

Attack Paths Into VMs in the Cloud

Unit 42 maps attack paths into AWS, Azure, and GCP VMs through intended features like startup scripts and SSH key pushes.

Palo Alto Unit 42 reviewed attack vectors against virtual machine services on AWS, Azure, and GCP, finding that 11% of internet-exposed cloud hosts carry Critical or High severity vulnerabilities. The attack paths rely on legitimate features such as EC2 User Data, VM custom data, EC2 Instance Connect, SSM Run Command, and serial consoles rather than vulnerabilities, and exploiting them requires attackers to first obtain control plane permissions. A compromised VM exposes not only its data but the workload identity and cloud permissions assigned to it, making identity compromise potentially more damaging than data theft. The firm places mitigation responsibility on cloud users and administrators.

Palo Alto Unit 42 · Aug 17, 2026Research1

Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another

Forescout used Anthropic's Claude to port a working pre-auth RCE exploit for CVE-2021-31886 between WAGO PLCs, executing ARM shellcode on live hardware.

Forescout Vedere Labs used Claude interactively to port an RCE exploit for CVE-2021-31886, a CVSS 9.8 stack buffer overflow in the Nucleus FTP server's USER command, from a WAGO 750-852 to a WAGO 750-831 PLC, running attacker-supplied ARM shellcode. The final RCE stage cost $535.74 in API usage over 8 hours 32 minutes, and a follow-up attempt to build a C2 implant permanently bricked the device. CERT@VDE lists many Nucleus V1-based WAGO models as vulnerable with no updates available; Siemens plans no Nucleus NET remediation. The work follows a joint NSA/CISA/FBI/DOE/EPA advisory warning of AI-generated exploitation scripts targeting internet-exposed Siemens S7 PLCs.

The Hacker News · 14d agoResearchCVE-2021-318862

Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers

SpecterOps released CDP-Enable-BOF, a Beacon Object File that enables Chrome DevTools Protocol in live Chrome or Edge processes on Windows for session hijacking.

SpecterOps released CDP-Enable-BOF, an x64 Beacon Object File that activates Chrome DevTools Protocol inside running chrome.exe or msedge.exe processes on Windows, exposing cookies, history, saved passwords, and authenticated sessions without administrator rights. It calls Chromium's StartRemoteDebuggingServer on the browser UI thread to stay reliable under CFG, TLS, and CET, and was tested on Chrome 147 and Edge 147. The technique builds on work by DeathFlamingo and Cedric Van Bockhaven; Google had hardened remote debugging in Chrome 136 after attackers used it to steal cookies post-App-Bound Encryption. Defenders can watch Sysmon Event IDs 8 and 10 for injection into browser processes.

The Hacker News · 22d agoResearch2

Researchers Turn USB Auto-Install Into a Full SYSTEM Takeover on Windows 11

DEF CON researchers chained Windows Plug and Play auto-install abuse with third-party driver flaws to reach SYSTEM on fully updated Windows 11.

In 'Plug And Pwn' research prepared for DEF CON 34, Alejandro Hernando and Borja Martinez emulated USB devices so Windows auto-installed signed vendor software, chaining a Sierra Wireless SwiService.exe SetDNS primitive, a Sony FeliCa co-installer path-traversal flaw that writes a DLL into System32, and device reconnection for SYSTEM code execution. A remote variant over Remote Desktop forges a synthetic Intel RealSense device and abuses a CRYPTBASE.dll search-order hijack when PnP or low-level USB redirection is enabled. Microsoft notes RDP does not allow supported PnP and RemoteFX USB redirection by default, and no in-the-wild exploitation has been reported.

The Hacker News · Aug 11, 2026Research

Re: Retrospective by 'gpg.fail' authors

GPG exploitation talk author clarifies a format-string 0day enabling code execution via printf %n writes and a polyglot PEM certificate payload.

Lexi Groves, author of the gpg.fail talk, clarified on oss-security that the first finding was an actual zero-day: a classic printf injection using %n for memory writes, with multiple X.509 certificates in one PEM file to re-enter and defeat ASLR before calling execv@plt. The payload executed the certificate itself, a polyglot file made by inserting a shebang and bash command into the PEM. A second finding was hash-collided by another party before the author could exploit it.

oss-securityupdated · 1h agofirst · 16h agoResearch 7 sources

When the Whole Company Adopts AI: What It Does to Your SOC

Analysis of 16.9 million SOC alerts finds AI-related alerts at 0.43%, growing 685% since February, with 94.1% noise and 0.02% real attacks.

A review of roughly 16.9 million SOC alerts found about 73,000 (0.43%) were AI-related, a share that grew 685% between February and June 2026. Of AI-related alerts, 94.1% were noise, 5.8% genuine risks, and 0.02% real attacks; 79.8% received benign verdicts, 81.7% were automatically suppressed, and only 5.4% reached a human analyst. The only confirmed attacks were phishing campaigns that weaponized AI brand names as lures, while developer coding agents spawning shells and reading credential stores routinely tripped detections written before AI agents existed.

The Hacker News · 4d agoResearch1

"They don't care about this": A Systematic Study of TEE Build Reproducibility in the Wild

91% of 115 surveyed TEE deployments across Intel SGX, TDX, and AMD SEV fail to provide reproducible builds needed for verifiable remote attestation.

A systematic study of 115 TEE deployments found 91% were not reproducible and 80% lacked both source code and a reference build, undermining remote attestation guarantees. Interviews with 12 developers of 50 Intel SGX projects confirmed that only one participant treats reproducibility as a development priority. The authors identify technical barriers such as embedded timestamps plus ecosystem-level issues like lack of build-environment control in multi-stakeholder projects, and call for holistic, committed reproducibility practices.

arXiv cs.CR · 6d agoResearch

$20 per zero-day is already the WordPress plugin reality

TrendAI and CHT Security used an AI pipeline to find over 300 verified WordPress plugin zero-days at roughly $20 per vulnerability.

A pipeline built in three days by TrendAI and CHT Security, presented at Ekoparty Miami, paired AI-driven static analysis with automated Docker provisioning and Chrome DevTools MCP dynamic verification to surface more than 300 critical zero-days in WordPress plugins within 72 hours. The run consumed about 222 million tokens across 95 tasks, averaging roughly $20 per verified vulnerability, with findings including pre-auth RCE, SQL injection, privilege escalation, SSRF, and an AI-assembled downgrade attack chain. Dynamic verification eliminated over 80% of false positives, but manual review at 30-60 minutes per finding remains the bottleneck, straining ZDI and NIST triage backlogs.

Help Net Security · 23d agoResearch1

No Bit Left Behind: Using Brute-Force Lifting to Achieve Fully Static Binary Recompilation

Prototype binary lifter brute-force lifts every byte offset of x86-64 binaries to LLVM IR, enabling fully static cross-ISA recompilation without runtime support.

The paper presents a fully static, whole-program binary lifting system that treats every byte offset as a potential branch target, constructing a superset control flow graph that conservatively contains all feasible control flows. Statically unresolvable computed branches are reduced to lookups in a dispatch table pointing to translated control flow paths, eliminating runtime translation machinery on the target machine. A prototype recompiles x86-64 binaries to LLVM IR with no code/data heuristics and achieves fully static cross-compilation to AArch64 using unmodified LLVM backends.

arXiv cs.CR · 1d agoResearch

LG smart TVs caught logging audio with screen off and snooping on local devices

Gamers Nexus found LG smart TVs record microphone audio in standby, scan home networks, and feed LG Ad Solutions ad targeting.

A 135-minute Gamers Nexus investigation with Level1Techs and independent researchers found retail LG OLED TVs running webOS sweep local networks, gather device names and Wi-Fi metadata, and run Automated Content Recognition. Tests showed the TVs capture clean microphone audio while appearing powered down and store it offline, uploading once reconnected. The team also found RCE vulnerabilities in webOS now moving through responsible disclosure; LG claims 216 million smart TV sales, and its ad unit claims access to 363 million addressable devices in the US.

Hacker News · security · 9d agoResearchHN 1151↑ · 3 comments

Risky Bulletin: Expired cards can be used for new transactions

Researchers show expired Visa contactless cards can be revived via NFC man-in-the-middle relay to run fraudulent transactions; roundup also covers major breaches.

University of Massachusetts Amherst researchers built an NFC man-in-the-middle rig that updates a card's expiration date in transit and relays the modified payment to POS terminals, reviving expired contactless cards; Visa terminals and the backends of all five banks studied failed to catch the manipulation. The same roundup reports Iranian hackers shut down a small UK power plant for four days, Lazarus breached South Korea's Presidential Office as part of a campaign exceeding 100 victims, and French telecom SFR suffered a breach affecting over 2.1 million customers.

Risky Business News · 23d agoResearch1

Risks in IoT Supply Chain

Unit 42 analyzes multilayer IoT supply chain risks across hardware, firmware, and software, citing counterfeit Cisco switches and OpenWrt attacks.

Unit 42 examines weaknesses in the IoT supply chain ecosystem across hardware, firmware, operation, and vulnerability layers, noting that 89% of IT decision-makers reported IoT device growth and IDC forecast 41.6 billion connected IoT devices by 2025. Examples include counterfeit Cisco Catalyst 2960-X switches with possible backdoor access (F-Secure, July 2020), a March 2020 OpenWrt flaw enabling malicious update impersonation, and threat actor interest in TeamViewer remote support software. The report stresses that untracked third-party components and missing device inventories make it hard to assess vulnerability impact across vendors.

Palo Alto Unit 42 · 28d agoResearch

The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution

Unit 42's August 2026 report tracks the rise of AI-enabled malware, from brand abuse to agentic execution, and how behavioral detection stops AI-authored code.

Palo Alto Networks Unit 42 released its August 2026 assessment of AI-enabled malware, covering attacker use cases from brand abuse to agentic execution. The report details how existing behavioral detection and endpoint analytics can stop AI-authored code before execution.

Palo Alto Unit 42 · 22d agoResearch

Hunting Vulnerabilities Using Frontier Models

Okta used frontier AI models GPT-5.5 Cyber and Mythos via OpenAI and Anthropic programs to scan millions of code lines for vulnerabilities.

Okta describes using frontier AI models, including GPT-5.5 Cyber Preview (TAC) and Mythos Preview, through OpenAI's Daybreak Cyber Partner Program and Anthropic's Project Glasswing to hunt vulnerabilities across its product codebase. The team built a custom Python orchestrator with strong isolation, vendor-agnostic model support, and four distinct scanning pipelines executed as isolated Codex or Claude Code sessions with progressive context loading to reduce context bloat. Human experts and AI agents worked both autonomously and in paired hunts, and Okta reports the best results when humans and agents taught each other.

Okta Security · 8d agoResearch

The AI Malware Maturity Gap

Recorded Future introduces AIM3, a five-level maturity model for AI malware, showing current attacker AI use is mostly AI-assisted rather than autonomous.

Recorded Future proposes AIM3, a five-level model defining AI malware from LLM-translated to LLM-embedded, spanning experimentation to fully autonomous agentic campaigns. Public examples remain early-stage: PROMPTFLUX uses Google Gemini to rewrite its VBScript dropper (Level 1), while Lamehug/PROMPTSTEAL, attributed to APT28, invokes the HuggingFace API to generate reconnaissance commands (Level 3). The authors argue most current AI malware augments existing tradecraft rather than enabling one-click autonomous attacks.

Recorded Future · 21d agoResearch

Understanding Angler Exploit Kit

Unit 42 explains exploit kit fundamentals, describing how landing pages profile victims, deliver exploits, and install malware payloads on Windows hosts.

Unit 42 published a primer on exploit kit fundamentals, defining vulnerabilities, exploits, malware payloads, actors, and campaigns in EK-based attacks. It explains the infection chain: a landing page profiles the victim's Windows system for vulnerable applications such as Flash Player, Java, Silverlight, and Internet Explorer, then a matching exploit executes a downloader or final payload, often delivered encrypted with XOR or RC4. The post also describes the EK-as-a-Service business model, in which leading EKs are rented for a few thousand dollars per month while buyers supply campaign infrastructure.

Palo Alto Unit 42 · Aug 17, 2026Research1

Hackers Steal Active Directory Password Hashes Without Attacking Domain Controllers Directly

Attackers use the DCSync technique to impersonate domain controllers and harvest AD password hashes and Kerberos keys without directly compromising domain controllers, Trellix warns.

Per Trellix, threat actors increasingly abuse Active Directory replication via DCSync, using privileged credentials to invoke DRSGetNCChanges and retrieve NTLM password hashes and Kerberos key material without running code on domain controllers. Capturing the krbtgt account hash enables forging Golden Tickets for persistent, highly privileged domain access. Because malicious replication traffic mimics legitimate DRS/RPC activity, defenders should monitor Windows Security Event ID 4662, restrict replication permissions, and investigate replication requests from non-domain-controller systems.

GBHackers · 6d agoResearch in the wild 2 sources2

Almost Half of Malware Samples Communicate Direct to IP

Unit 42 analysis of 4 million malware reports finds 45% of C2-active samples connect directly to hard-coded IPs, bypassing DNS defenses.

Palo Alto Unit 42 analyzed over 4 million Advanced WildFire dynamic analysis reports and found that 45.32% of malware samples with C2 activity made at least one direct-to-IP connection, accounting for 23.17% of all C2 connection attempts. The firm proposes zero trust IP (ZT-IP), an enforcement approach that verifies whether outbound destinations were ever sanctioned by a DNS response. ZT-IP analysis surfaced Phorpiex ransomware droppers fetching payloads directly from C2 IPs, a persistent data exfiltration campaign using an obfuscated \GET protocol, and Mozi P2P botnet payloads delivered to IoT devices without DNS. Only 1% of benign samples connected directly to untrusted IP addresses.

Palo Alto Unit 42 · Aug 17, 2026Research

Towards Scalable and Cost-Efficient Vulnerability Detection: A Study on Automatic Query Generation

A study finds LLM-synthesized CodeQL queries improve average F1-score by 82% over baseline queries, offering scalable vulnerability detection versus direct LLM scanning.

Researchers conducted an empirical study evaluating whether LLMs can synthesize executable CodeQL queries from National Vulnerability Database vulnerability data. LLM-generated queries significantly enhanced baseline CodeQL suites, yielding an 82% improvement in average F1-score across a diverse set of real-world vulnerabilities. A cost-benefit analysis shows direct LLM-based scanning of entire repositories is often computationally and financially prohibitive, while LLM query synthesis offers a scalable and cost-effective alternative for large-scale vulnerability detection.

arXiv cs.CR · 7d agoResearch1

SEMA-GUARD: Semantic and Graph-Based Vulnerability Detection in Assembly Code

SEMA-GUARD uses semantic analysis and graph neural networks to detect vulnerabilities in assembly code, achieving 85.1% accuracy on a Juliet-derived benchmark.

SEMA-GUARD is a framework that detects vulnerabilities in compiled programs when source code is unavailable, targeting malware, firmware, and embedded systems analysis. It enriches control flow graphs with low-level execution semantics including stack manipulations, memory accesses, and data flow. Evaluated on a Juliet Test Suite set compiled to assembly and split into function-level chunks, it achieves 85.1% accuracy and an F1 score of 0.801, outperforming purely statistical or structural approaches.

arXiv cs.CR · 1d agoResearch1

The History Is the Detector: Executing CVE Patch History, End-to-End

BUGSTONE-E2E converts CVE patch history into executable LLM-guided detection rules, yielding 1,033 rules and 644 runtime-verified findings across 14 programs.

The BUGSTONE-E2E framework mines reusable detection rules from verified fixing commits, organized by CWE and language, and applies them through a funnel pipeline that escalates from Tree-sitter anchors and lightweight heuristics to LLM-based agent inspection, runtime verification, and scope-checked patch generation. Built from 19,325 high-severity CVEs published 2022-2026, it produced 1,033 detection rules spanning 56 CWE families, packaged into 172 skills. Applied across 14 programs, it generated runtime evidence for 644 findings, demonstrating that vulnerability history can drive reproducible detection and repair.

arXiv cs.CR · 12d agoResearch

Trends in Web Threats: Attackers Were More Active During Holiday Season

Unit 42 tracked 533,000 malicious landing URL incidents from October-December 2021, showing web threats peaked during the holiday shopping season.

Unit 42 detected 533,452 malicious landing URL incidents (120,753 unique) and 2,906,875 malicious host URL incidents (165,255 unique) from October through December 2021. Threat activity peaked in November, likely tied to Black Friday in the United States, United Kingdom, and Germany. Most malicious domains appeared to originate in the United States, followed by Russia and Germany. Personal sites, blogs, business sites, and shopping sites were the most common apparently benign entry points for attacks.

Palo Alto Unit 42 · Aug 17, 2026Research

Enterprise Defenses Recovered at the Edge and Collapsed Inside

Picus Labs' Blue Report 2026 finds perimeter prevention at 69% but post-compromise prevention just 37%, with reconnaissance blocked only 10% of the time.

Picus Labs' Blue Report 2026, based on 434,000+ simulated attacks across client production environments in H1 2026, found perimeter prevention effectiveness rose from 62% to 69% while the Post-Compromise Prevention Rate was only 37%. Quiet techniques fared worst: reconnaissance was blocked 10% of the time, registry-based credential access less than 1%, and the alert score stayed at 14% despite logging at a four-year high of 58%. IOC-based prevention fell to 50% from 71% in 2024, and Mimikatz's LSASS path was blocked about 94% while alternative credential-read paths went nearly undetected.

The Hacker News · Aug 12, 2026Research

Linux Detection Engineering - Local Privilege Escalation

Elastic details a layered detection framework for Linux local privilege escalation, covering 2026's copy-on-write bug wave and LLM-assisted discovery.

Elastic Security Labs describes how most Linux local privilege escalations share a common host flow — an unprivileged process launched from a writable path becoming root — and proposes layered detections combining general outcome-based rules with per-technique rules in Elastic Defend and Auditd. It tracks 13 recent LPE disclosures, seven of which share a copy-on-write/zero-copy bug class, including Copy Fail, DirtyFrag, Fragnesia, DirtyDecrypt, DirtyClone, pedit COW, and RefluXFS. Qualys attributes RefluXFS to an LLM-assisted research effort with Anthropic using Claude Mythos Preview, and another bug is credited to an LLM-assisted workflow. Detection and endpoint rules are published in Elastic's detection-rules and protections-artifacts repositories.

Elastic Security Labs · 5d agoResearch

Scalable Composition of Byzantine Agreements under Reorder Attacks

Researchers present the first adversary model combining party corruption with channel reordering attacks, establishing tight security thresholds for composed Byzantine agreement protocols.

The paper presents the first adversary model combining party corruption with adversarial channel attacks that reorder messages across multiple Byzantine agreement executions. It proves impossibility results for authenticated BA under parallel composition when n ≤ 3t or n ≤ 2c + 2t + 1, with matching possibility results when n > max{3t, 2c + 2t + 1}. The authors provide general black-box compilers plus erasure-correcting-code variants that achieve constant multiplicative communication overhead for long messages.

arXiv cs.CR · 7d agoResearch

When LLM Decompilers Recompile More and Preserve Less

Researchers show LLM decompiler outputs can recompile yet diverge behaviorally, proposing the Decompile-Diverge fuzzing oracle to catch hidden changes.

The paper demonstrates that LLM-based decompilers can produce code that recompiles and passes all shipped tests yet diverges on other legitimate inputs—4.9% overall and up to 13% for one system—and can make disclosed vulnerabilities vanish without a visible crash. Across 300 real GitHub functions and 287 CVE-grounded functions, a refinement LLM lifted Ghidra's build rate from 75% to 90% while Matched rate fell from 74% to 62%, with up to one tenth of vulnerabilities showing Crash Absence. Decompile-Diverge detects these gaps by synthesizing drivers, growing fuzzing corpora from the reference, and rerunning decompiled code on identical inputs.

arXiv cs.CR · 11d agoResearch