Search: “timelines”

7 stories in the last 24h

A 2026 buyer's guide compares 12 cloud detection and response platforms on coverage, response speed, pricing transparency, and free-tier leverage.

GBHackers published an editorial scorecard of 12 CDR solutions including Sysdig, CrowdStrike, Wiz, Palo Alto Networks, Microsoft Defender, Permiso, Stream.Security, and Skyhawk. Open-source Falco is scored as the free runtime-detection floor, with weighted scores led by Sysdig (4.45) and Microsoft Defender (4.35). The guide contrasts per-workload, credit, and quote-based pricing and highlights specialists focused on cloud identity and real-time response.

GBHackers08:06 UTC · 5h agoTools 10 sources

A heap overflow and SSO misconfiguration to compromise OpenAI internal repos

Hacktron researchers chained a libheif heap overflow in Discourse with an OpenAI SSO flaw to take over employee ChatGPT/Codex accounts and access internal repositories.

On July 25, 2026, Hacktron researchers chained a heap buffer overflow in libheif 1.19.7/1.19.8 (missing Debian security backports, upstream fix never assigned a CVE), reached through Discourse image uploads processed by ImageMagick, to gain remote code execution on community.openai.com. Combined with an SSO identity misconfiguration in the 'Sign in with OpenAI' flow, they took over employees' ChatGPT/Codex accounts with connected GitHub, Slack, and email access, and proved it by opening PR #1186742 in OpenAI's internal openai/openai monorepo. They reported the issues for coordinated patching, received a $6,500 bounty from OpenAI, and Debian shipped fixed libheif packages on August 8, 2026. The team used Claude Opus 4.8 and Claude Opus 5 to locate the missing backport and autonomously develop working x86-64/ARM64 exploits.

Hacker News · securityupdated 13:30 UTC · 36m agofirst 02:47 UTC · 11h agoResearch in the wild 9 sources HN 334↑ · 128 comments1

Over 100,000 WordPress Sites Exposed to RCE Through Tutor LMS Vulnerability

Wordfence disclosed CVE-2026-78175, an authenticated PHP object injection chain enabling RCE in Tutor LMS affecting 100,000+ WordPress sites; fixed in 4.0.8.

Wordfence Argus discovered on August 23, 2026, that Tutor LMS 4.0.7 and earlier mishandle esc_sql() on withdrawal-account data stored via update_user_meta(), creating a serialized-length mismatch exploitable for PHP object injection through the tutor_save_withdraw_account AJAX handler. Any subscriber can reach the endpoint because it checks a nonce but no capability, and a property-oriented programming chain using Guzzle's FileCookieJar allows writing a PHP payload to the uploads directory for remote code execution. Themeum shipped version 4.0.8 on September 10 with a role check, input validation, and a field whitelist; Wordfence rated the issue CVSS 8.8.

GBHackersupdated 11:52 UTC · 2h agofirst 10:04 UTC · 4h agoVulnerability 9 sources CVE-2026-78175

WordPress 7.1.1 Maintenance and Security Release

WordPress 7.1.1 patches an unauthenticated stored XSS (CVE-2026-93485) in wpautop(), exploitable via published comments, with CVSS 3.1 score 7.1.

WordPress 7.1.1, released 17 September 2026, contains 11 security fixes and 17 core bug fixes. The headline flaw is CVE-2026-93485, an unauthenticated stored XSS in wpautop() affecting WordPress core up to and including 7.1, rated CVSS 3.1 7.1. A payload submitted through the ordinary comment form survives wp_kses() because a newline placeholder in quoted attribute values becomes a '>' that breaks wpautop()'s regex parsing, enabling script execution in the site origin for any visitor. Comment moderation slows but does not prevent exploitation; the fix makes the regex aware of quoting, and backports shipped to older branches.

Patchstackupdated 07:53 UTC · 6h agofirst 06:56 UTC · 7h agoVulnerability 4 sources CVE-2026-93485

How Pentest Companies Adapt In The Era of AI

Opinion piece urges pentest firms to adopt self-hosted AI like Qwen3-Coder via Ollama, warning client findings pasted into cloud models breach confidentiality.

The article argues penetration testers are already using AI tools, and pasting client findings, scope documents, or credentials into cloud models like ChatGPT or Claude risks NDA breaches and GDPR/HIPAA compliance violations. It recommends self-hosted models on firm-controlled infrastructure instead of banning AI. The piece promotes PentestPad, a pentest reporting platform offering managed, self-hosted, and air-gapped deployment, an MCP server exposing fourteen typed tools, and a writing assistant that can target a local LLM. PentestPad's own team reportedly runs Qwen3-Coder through Ollama with OpenCode or Claude Code as the agent harness.

GBHackers04:12 UTC · 9h agoIndustry

CyberCom 2.0 and the Revolution in AI-Enabled Offensive Cyber Operations

Horizon3.ai whitepaper argues AI now automates most of the offensive cyber kill chain and reshapes US Cyber Command's CYBERCOM 2.0 talent model.

Horizon3.ai's CyberCom 2.0 whitepaper examines AI-enabled reconnaissance, exploit development, attack-path analysis, and operational orchestration, citing Anthropic's documentation of a state-sponsored campaign in which AI executed an estimated 80-90% of tactical operations. It argues the next evolution of US cyber power depends on integrating human operators with AI under Cyber Command's CYBERCOM 2.0 force-generation model. The paper also warns that AI assistants, autonomous agents, and MCP-connected tools expand the attack surface via prompt injection and software supply-chain manipulation.

Horizon3.aiSep 17, 17:22 UTC · 20h agoResearch

SilkParasite Infrastructure Links SpiceRAT to Central Asian Targets

Hunt.io linked SpiceRAT, NodeEdgeRAT, and NomadRAT C2 servers to the SilkParasite campaign targeting Central Asian governments since mid-2022.

Hunt.io and researcher Guy Yasur mapped C2 infrastructure tying three of seven RAT families from Bitdefender's SilkParasite report through shared TLS certificates, parent domains, and a cloned RTX Corporation homepage. One certificate spoofing Uzbekistan's state railway was issued by TLC, a CA funded by China's CAICT, and domains impersonate state entities in Turkmenistan, Uzbekistan, Tajikistan, and Kyrgyzstan. Passive DNS pushes the campaign back to mid-2022, and the infrastructure overlaps China-nexus activity including FamousSparrow and IndigoZebra.

Security AffairsSep 17, 14:16 UTC · 23h agoThreat actor in the wild 3 sources