ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “vulnerabilities”

24 stories in the last 3d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllAdvisory 97Vulnerability 93Exploit / PoC 74Industry 34AI safety & security 24Research 24Threat actor 20Tools 16Data breach 14Malware 13AI policy 6Policy & legal 5AI industry 5Phishing & fraud 4
SeverityAllcritical 40high 134medium 122low 32info 104

1Password's AI patching benchmark is misleading

Trail of Bits reanalysis says 1Password's 26% AI clean-fix rate is misleading; 86% of eligible patches blocked exploits.

Trail of Bits critiques 1Password's FLAWED AI patching benchmark, arguing its 26% clean-fix headline mixes trials where agents were instructed to apply wrong fixes (22% of data) with trials that prohibited compiling or testing (36%). Restricting to reasonable conditions, 2,634 of 3,067 patches (86%) blocked the supplied exploit. Trail of Bits also reports 12.5% of 2,265 developer first fixes failed in its own 2024-2026 assessments, and released post-patch-validation and review-walkthrough agent skills.

Lobsters · security · 1d agoResearch1

Securing the unpatchable in an age of AI-driven vulnerabilities

Cisco Talos argues AI-driven vulnerability discovery leaves unpatchable OT systems exposed, recommending virtual patching via NGFW/IPS and micro-segmentation.

AI-assisted code analysis is uncovering vulnerabilities faster than organizations can patch, leaving certified or end-of-life OT systems with unmitigated known flaws. Talos recommends virtual patching with next-generation firewalls and IPS, micro-segmentation using VLANs and ACLs, and building visibility-based inventories of legacy systems. The article cites WannaCry's impact on the NHS and 2023 exploitation of end-of-life software in government systems, and warns that air gaps and data diodes are routinely circumvented by operational shortcuts.

Cisco Talos · 23h agoResearch

Forgery of C2PA on a Pixel 10

Researcher forged a Google Pixel 10 C2PA content credential with genuine signatures, showing root-level attackers can fake photo provenance.

A Hacker Factor blog post demonstrates an AI-generated 'unicorn glitter milk' news photo carrying a valid, cryptographically signed C2PA manifest traceable to Google's Pixel camera certificate chain, passing validation in Adobe Inspect and the CAI Verify tool with a verified timestamp. The author, working with UMBC's PASAWG working group, reported to Google and C2PA in November 2025 that root access on a Pixel device could sign arbitrary images as camera captures; after 90 days without resolution, details were published. The finding undermines C2PA Assurance Level 2 claims made for Pixel 10 Content Credentials.

Lobsters · security · 20h agoResearch

Evaluating the NIST Bugs Framework Against CWE as a Successor for Automated Vulnerability Classification

NIST Bugs Framework evaluation shows it is more structured and automation-friendly than CWE for automated vulnerability classification, with gaps in attribute guidance.

The paper evaluates NIST SP 800-231's Bugs Framework (BF) against CWE as a target for automated CVE classification using a systematically screened corpus of CVE-to-CWE research. An inter-rater study with 2 subject-matter experts mapping 13 CVEs showed strong agreement on BF's cause and operation axes but only fair agreement on the attribute axis. Automated classification was tested across two LLM deployments under different budgets, and findings support BF as more structured and automation-friendly than CWE, though gaps include under-specified attribute guidance and missing fix commits for closed-source software.

arXiv cs.CR · 2d agoResearch1

Detecting Logic Vulnerabilities Across the Contract and Device Layers of Blockchain-Enabled IoT With Multi-Agent Heterogeneous Graph Attention

MA-HGAT framework detects logic vulnerabilities across smart contract and IoT device firmware layers using multi-agent heterogeneous graph attention.

Researchers extend MA-HGAT into a cross-layer multi-agent heterogeneous graph attention framework that models smart contracts, firmware artifacts, device fleets, and transaction streams for blockchain-enabled IoT security. A four-role, nine-relation schema supports graph-, link-, and node-level detection tasks, while a gateway-cloud partition enables lightweight edge inference on resource-constrained devices.

arXiv cs.CR · 1d agoResearch

SEMA-GUARD: Semantic and Graph-Based Vulnerability Detection in Assembly Code

SEMA-GUARD uses semantic analysis and graph neural networks to detect vulnerabilities in assembly code, achieving 85.1% accuracy on a Juliet-derived benchmark.

SEMA-GUARD is a framework that detects vulnerabilities in compiled programs when source code is unavailable, targeting malware, firmware, and embedded systems analysis. It enriches control flow graphs with low-level execution semantics including stack manipulations, memory accesses, and data flow. Evaluated on a Juliet Test Suite set compiled to assembly and split into function-level chunks, it achieves 85.1% accuracy and an F1 score of 0.801, outperforming purely statistical or structural approaches.

arXiv cs.CR · 1d agoResearch1

Illusion of Depth: Revealing Hidden Stereo Vision Vulnerabilities in Depth Estimation

Simple repeating patterns let attackers shift stereo-camera depth estimates by up to 20 meters, triggering emergency braking in autonomous driving frameworks at 40 km/h.

The paper reveals an intrinsic vulnerability in stereo cameras stemming from pixel sampling and calibration processes, letting attackers finely control estimated depth of real obstacles using simple repeating patterns without adversarial ML techniques. The attack was evaluated against BM and SGBM stereo matching algorithms, deep learning models PSMNet, MoCha-Stereo, and UniMatch, the stereo-LiDAR fusion model SGM-DDC, and commercial cameras ZED2 and Intel RealSense D435; on ZED2, obstacles can be displaced up to 20 meters farther or 12 meters closer. A 0.5-second attack triggered emergency braking in a popular autonomous driving framework, with feasibility confirmed at driving speeds up to 40 km/h using CARLA. State-of-the-art defenses proved ineffective, and the authors propose a similarity-score strategy to dynamically detect and suppress depth discrepancies.

arXiv cs.CR · 2d agoResearch

Automating Attack Graph Construction for Agentic Pentesting. Towards Neuro-Symbolic Vulnerability Hunting

Semi-automated pipeline converts Trivy, Semgrep, Nmap output into MulVAL attack graphs for agentic pentesting, 53.7% mean vulnerability coverage in CyBench.

The paper presents a semi-automated pipeline that parses Trivy, Semgrep, and Nmap findings into MulVAL predicates and uses an LLM-assisted process to build domain-specific Datalog rules linking scanner evidence to attack techniques. MulVAL/XSB then performs symbolic inference to generate structured, auditable attack paths for agentic pentesting. Evaluated on 54 web CTF tasks from CyBench, every task produced at least one goal-reaching graph with 53.7% mean ground-truth vulnerability coverage, 51.9% full coverage, and an 83.9% noise-path rate. Median end-to-end runtime was 24.9 seconds, making the pipeline runtime-practical for agentic workflows.

arXiv cs.CR · 2d agoResearch

From Hypervisor to Container: Cloud Security Vulnerabilities, Defense Mechanisms, and Open Challenges

Survey of 120+ cloud security papers (2008-2025) reviews hypervisor and container isolation attacks, scoring defenses with the ADPO framework and CIA impact scale.

This survey reviews over 120 security publications from 2008 to 2025 on breaches of cloud isolation boundaries via virtual machines and containers. Threats examined include VM escape, VM hopping, CPU cache side-channels, container breakouts, vulnerable container images, and DDoS attacks. The authors introduce ADPO, a 0-3 scoring framework rating defenses on accuracy, deployment ease, performance impact, and operational overhead, plus a 1-5 CIA severity mapping for attack impact.

arXiv cs.CR · 2d agoResearch

Hackers Stole Flock’s Camera Software, Revealing How the Company Tracks Cars and People

Hackers who removed a Flock Safety license plate camera dumped its data, revealing person-detection capabilities and an encryption key stored unencrypted on the device.

A hacker collective calling itself stegan0gram physically removed a Flock Safety automatic license plate reader camera from a roadway, copied its storage, and shared the files with 404 Media, WIRED, and Distributed Denial of Secrets. Analysis found an encryption key in an unencrypted 'media' partition that unlocked videos of thousands of vehicle detections, with logs showing more than a million images generated in weeks. The software explicitly detects people, bicycles, and even bumper stickers, and records from one Georgia city were searchable by more than 2,000 agencies nationwide. The findings follow 2025 research by Jon Gaines documenting flaws enabling root-level access to Flock cameras.

404 Mediaupdated · 12m agofirst · 23h agoResearch in the wild 4 sources

What Zero-Day Response Should Be in the Post-Mythos Era

Picus Security outlines a zero-day response playbook where defenders simulate exploit technique chains before public PoCs exist.

The article uses PaperCut NG/MF's August incident — exploitation in the wild before any patch, with the first emergency fix bypassed the same day and a third landing September 1 — as the template for AI-accelerated vulnerability response. It walks through a hypothetical CVE-2026-1001 (explicitly made up) to argue defenders should map CVEs to ATT&CK technique chains and simulate them against NGFW, WAF, EDR, endpoint hardening, and SIEM controls within minutes of disclosure. It notes disclosure-to-exploitation time has fallen from 21.5 days to hours.

BleepingComputer · 1d agoResearch in the wildCVE-2026-1001

What Breaks Local Watermarks? A Robustness Benchmark for Local Invisible Image Watermarking

First systematic robustness benchmark of five local invisible image watermarking methods across 55 transformations finds all are vulnerable, with inpainting and geometric misalignment completely breaking payload…

The paper presents the first systematic robustness benchmark for local invisible image watermarks, covering 55 image transformations across signal distortions, coordinate alignment changes, indirect local edits, and direct watermark edits. It evaluates five methods: MaskWM, WAM, OmniGuard, TrustMark, and PixelSeal, all supporting localization natively or with minimal adaptation. Results show every method is vulnerable to some transformation; MaskWM offers the strongest payload recovery and localization but the lowest clean-image quality, and synchronization further improves its recovery under geometric transformations. Geometric misalignment and generative local edits such as inpainting and outpainting can completely impair payload recovery, while signal distortions are often tolerated.

arXiv cs.CR · 2d agoResearch

From Report to Patch, the OpenBSD Errata Process

A talk walks through the OpenBSD errata process, tracing how vulnerability reports become coordinated, tested, and published security patches.

A Lobsters-linked presentation describes the OpenBSD errata process, covering how a security report travels from initial disclosure to a published patch and errata notice. The linked page itself contains no additional technical detail beyond the title.

Lobsters · security · 22h agoResearch

Apple Reference Image: A New Approach for Verified Photography

Apple introduces Reference Image, hardware-backed verifiable photography on iPhone 18 Pro using sensor signing and Private Cloud Compute to counter AI-generated fakes.

Apple announced Reference Image, an opt-in camera mode debuting on the main sensor of iPhone 18 Pro and iPhone 18 Pro Max that produces securely timestamped, verifiable photographs. The design splits into two phases: a secure digital negative created by cryptographically signing pixel data at the sensor immediately after capture (preventing injection or tampering), then developing that negative into a reference image. Private Cloud Compute handles processing without exposing image contents to anyone, including Apple, and fraudulent reference images can be revoked without revealing the photographer's identity. Apple positions the system as stronger than C2PA-based approaches, which sign metadata after capture, are vulnerable to editing-chain compromise, and can tie images to a device or individual.

Hacker News · security · 1d agoResearchHN 25↑ · 18 comments

InceptionRAG: Stealthy Poisoning Attack Against Retrieval-Augmented Generation

InceptionRAG fragments malicious payloads into dormant passages that trigger LLMs to self-deduce misinformation via multi-hop reasoning, bypassing existing RAG poisoning defenses.

Researchers introduce InceptionRAG, a stealthy corpus poisoning attack against retrieval-augmented generation that splits a malicious payload into a chain of individually harmless dormant passages. When retrieved together, the passages induce LLMs to self-deduce target misinformation through multi-hop reasoning, achieving over 80% attack success rate across three datasets and three LLMs under rigorous adversarial constraints. A zeroth-order suffix optimization (ZOSO) method automates authoritative suffix generation in black-box settings. The authors also propose HODOR, a document isolation defense that decouples adversarial logical dependencies.

arXiv cs.CR · 2d agoResearch

New hardware device can RAM into encrypted memory, expose your data

Researchers built a $200 DDR5 interposer that silently drops memory writes to break TDX, SGX, and SEV-SNP confidential VM integrity, requiring physical access.

Researchers from KU Leuven, ETH Zurich, Durham University, and Google demonstrated DDRop, a hardware interposer costing under $200 that corrupts DDR5 bus commands to silently drop writes to encrypted memory, enabling replay attacks on confidential VMs. Because scalable memory encryption lacks freshness checks, protected VMs keep computing on stale attacker-selected data; on an Intel TDX server the attack forces debug mode for plaintext memory reads or forges attestation reports, succeeding in under two minutes without crashing. Intel and AMD both called the attack out of scope for their cloud threat models, with no mitigation planned, and proposed cache line versioning appears still vulnerable. The full interposer design is being released as open-source hardware.

The Register · Security · 2d agoResearch

AIJon: Automated Generation of Annotations for Fuzzing

AIJON uses LLMs to auto-generate IJON-style fuzzing annotations, matching human-expert quality on the Magma benchmark.

Researchers replicate IJON experiments and propose AIJON, a system that uses LLMs to automatically generate expert-style annotations for coverage-guided fuzzing at scale. On the Magma benchmark, LLM-generated annotations performed comparably to human-generated ones, though annotation-based fuzzing was not strictly better than AFL++. The paper analyzes how annotations affect fuzzer energy distribution across campaigns.

arXiv cs.CR · 23h agoResearch

A GAN-Based Framework for Robust DDoS Attack Detection

WGAN-GP-generated adversarial DDoS traffic augments training data, improving detection resilience against evasion attempts.

Researchers built a DDoS detection framework combining Random Forests, deep neural ensembles, and Transformer-based models trained on CICDDoS2019 with synthetic adversarial flows generated by a Wasserstein GAN with gradient penalty. Hybrid datasets of benign, malicious, and generated traffic taught models more generalizable decision boundaries. Experiments showed improved accuracy and resilience against unseen adversarial traffic, validated on real-world generated flows.

arXiv cs.CR · 1d agoResearch

The modern attack chain: Rethinking Google Workspace security in the age of AI

Analysis of Vercel and Composio breaches shows stolen OAuth tokens, not phishing email, now open Google Workspace attacks — a path authorized AI agents follow.

The author analyzes the Vercel and Composio breaches as the same OAuth-first attack chain run twice: a stolen OAuth token, obtained via a compromised supplier, becomes the entry point rather than email. These tokens survive password resets, are hard to observe, and let attackers read Gmail and Drive data, take over accounts, and pivot laterally using stored credentials and password-reset magic links. The piece warns that authorized AI agents with overbroad OAuth grants can unintentionally traverse the same path — accessing inboxes, reading sensitive content, and exfiltrating data downstream — without any malicious actor or compromised credential.

Help Net Security · 1d agoResearch in the wild

RobResilience: Implementing and Evaluating a Resilience Framework for Cyber-Physical Embodied Systems

RobResilience implements a runtime resilience framework for robots in Webots/ROS2, evaluating tolerable disruption, degradation, and mitigation feasibility across eight attack scenarios.

The paper implements a formal resilience framework for embodied cyber-physical systems using a PR2 robot and ROS2 in a Webots simulation. At runtime it evaluates three predicates — tolerable disruption (δ), tolerable degradation (γ), and mitigation feasibility (μ) — over a compromised device set derived from IDS confidence scores, triggering mitigation strategies when resilience is lost. Eight attack scenarios systematically covering the full predicate state space confirm runtime behavior matches theoretical definitions. The work addresses 'graceful failure paralysis,' where autonomous systems cannot distinguish safe degraded states from catastrophic hazards during attacks.

arXiv cs.CR · 1d agoResearch

DDRop Attack Forces Intel TDX Confidential VMs Into Debug Mode and Exposes Memory

KU Leuven and ETH Zurich researchers released DDRop PoC hardware that forces Intel TDX confidential VMs into debug mode and exposes plaintext memory.

Researchers from KU Leuven, ETH Zurich, Google, and Durham University published proof-of-concept code, hardware designs, and firmware for DDRop, a DDR5 interposer that injects parity errors to drop selected cache-line writebacks. Because Intel TDX, Intel Scalable SGX, and AMD SEV-SNP lack per-line cryptographic freshness, processors decrypt and accept stale DRAM contents as current state. The PoC flips a victim's ATTRIBUTES.DEBUG flag to enable TDX debug mode, then copies victim memory in plaintext and can forge attestation reports. Affected environments include Intel 5th- and 6th-generation Xeon Scalable with TDX; Intel says the attack falls outside its cloud-computing threat model.

GBHackers · 1d agoResearch

Hackers Turn Windows Shadow Copies Into a Tool for Credential Theft and Ransomware

Attackers abuse Windows VSS shadow copies to delete recovery points before ransomware and to extract NTDS.dit/SAM credentials, demanding context-aware detection.

Threat actors are weaponizing the Volume Shadow Copy Service (VSS) for two purposes: destroying local recovery points via vssadmin.exe, wmic.exe, diskshadow.exe, wbadmin.exe, and bcdedit.exe before encryption, and accessing static copies of locked files such as NTDS.dit and SAM for credential theft. Ransomware families tied to shadow-copy removal include Akira, Black Basta, BlackCat, Conti, LockBit, Qilin, RansomHub, REvil, Ryuk, and WannaCry. Huntress's analysis of the Nightmare-Eclipse tool showed the BlueHammer technique chaining a Windows Defender timing issue with a VSS snapshot to dump the SAM database and decrypt NT hashes. Defenders should correlate VSS operations with parent process, hive access, and subsequent encryption activity, and maintain immutable off-host backups.

GBHackers · 2d agoResearch in the wild1

GPUThor: Amplifying Rowhammer Attacks via Non-Uniform Patterns to Exploit ECC-Protected GPUs

GPUThor uses non-uniform hammering to amplify Rowhammer on NVIDIA GPUs, achieving 500X-23,500X more bit flips and first exploits of ECC-protected GPUs.

GPUThor is a Rowhammer attack on NVIDIA GPUs that reverse-engineers memory-access coalescing behavior to enable non-uniform hammering patterns activating aggressor rows more intensely than decoy rows. By identifying refresh instances where in-DRAM mitigations apply, it constructs longer patterns that escape mitigation across refresh intervals. It yields 500X to 23,500X more bit flips than prior GPU Rowhammer attacks across NVIDIA A4000, A4500, A5000, and A6000 GPUs, and enables the first Rowhammer exploits on ECC-protected GPUs via uncorrectable double and triple bit flips, making denial-of-service and privilege-escalation attacks practical.

arXiv cs.CR · 2d agoResearch

The Model Proposes, the Code Disposes: A Pre-Registered Ablation of a Verifier-and-Acceptance Stage in an LLM-Orchestrated Offensive-Security Agent

Pre-registered ablation finds a model verifier stage in an LLM offensive-security agent suppresses findings; removing it eliminated suppression with precision tradeoff.

The paper evaluates a verifier-and-acceptance stage in an LLM-orchestrated offensive-security agent via a pre-registered 20-run confirmatory ablation and a 2x2 factorial study with 40 runs on vulnerable lab targets. Removing the stage eliminated pre-report suppression (median 2 vs 0 findings, p = 0.00003) but reduced model-blinded shipped precision (0.471 vs 0.353, p = 0.0087). Suppression was attributed to the model verifier rather than deterministic acceptance rules, and an instrumented canary recorded zero external contacts in all 60 runs. The full design retained 93.8% of model-adjudicated true candidates but failed its pre-registered non-inferiority floor of 0.90.

arXiv cs.CR · 2d agoResearch