Search: “reverse engineering”

9 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Threat actor 21 Exploit / PoC 17 AI safety & security 17 Malware 15 Research 9 Vulnerability 8 Model release 6 Industry 6 AI industry 6 Tools 4 Phishing & fraud 4 Advisory 3 Data breach 3 AI tools & infra 1

SeverityAll critical 10 high 29 medium 42 low 2 info 38

Chinese espionage groups swarm to exploit triple-link chain of zero-days

At least four China-aligned espionage groups chained three zero-days in Chromium browsers and Windows ALPC for espionage since late August.

Proofpoint observed at least four state-aligned threat groups, starting with TA412/Violet Typhoon/APT31 on August 28, chaining three zero-days in the 'BlueMoon' exploit chain targeting Chrome, Chromium-based browsers and Microsoft Windows. The chain includes RCE flaws in Chromium's JavaScript engine (CVE-2026-85046, CVE-2026-87491) and a Windows Advanced Local Procedure Call privilege-escalation zero-day (CVE-2026-85880), enabling sandbox code execution, sandbox escape and system privileges. APT31 delivered the chain via phishing links to NGOs, mining and commodity trading firms in the US, installing a browser extension disguised as Google Gemini to surveil activity and steal credentials. Other groups (UNK_LateNight, UNK_DoubleCheck, UNK_QuietRacket) targeted US aerospace, Vietnamese manufacturing, and Indonesian and Singaporean organizations; fewer than 20 victims were directly observed but the true count is likely higher.

CyberScoopSep 9, 21:17 UTC · 7d agoExploit / PoC in the wild 3 sources CVE-2026-85046 CVE-2026-87491 CVE-2026-858802· 1 read

Hackers Chain Chrome and Windows Zero-Days in New BlueMoon Exploit Kit Attacks

Multiple espionage actors, mostly China-nexus, are chaining Chrome V8 and Windows kernel zero-days (CVE-2026-85046, CVE-2026-85880) via the BlueMoon exploit kit against government and defense targets.

Proofpoint identified a new exploit kit dubbed BlueMoon chaining a Chromium V8 type-confusion RCE (CVE-2026-85046), a V8 sandbox escape, and a Windows kernel LPE (CVE-2026-85880). At least four distinct threat clusters, most with suspected China nexus, adopted the kit within days starting with TA412 (Violet Typhoon/APT31) on August 28, 2026. Both Chrome-side flaws were patch-gap zero-days with roughly a four-week exploitation window; the Windows LPE only works on Windows 10 and Server 2019/2022. TA412 used spearphishing posing as university interns to deliver the GemStone browser backdoor disguised as a Google Gemini extension; other clusters delivered ShadowPad via DLL sideloading and a Rust loader against targets in aerospace, government, and finance.

Cyber Security NewsSep 9, 16:59 UTC · 7d agoExploit / PoC in the wildCVE-2026-85046 CVE-2026-858801

New 'BlueMoon' kit exploited Windows and Chrome zero-day flaws

Multiple China-linked espionage groups share the BlueMoon exploit kit chaining Chrome V8 zero-days and a Windows ALPC LPE to deploy backdoors.

Proofpoint and Volexity report that multiple espionage clusters share the BlueMoon exploit kit, chaining Chrome V8 zero-days CVE-2026-85046 and CVE-2026-87491 with the Windows ALPC local privilege escalation CVE-2026-85880. Proofpoint observed spearphishing use since August 28 by JungleBamboo (APT31), while Volexity saw UTA0560 targeting NGOs from September 1; UNK_LateNight hit US aerospace/defense with ShadowPad and UNK_DoubleCheck targeted Vietnamese manufacturers. The kit's maintainers reverse-engineer public Chromium fixes before stable Chrome releases, and Proofpoint suspects the ALPC exploit has existed since 2025.

BleepingComputerupdated Sep 16, 16:06 UTC · 11h agofirst Sep 10, 14:11 UTC · 6d agoExploit / PoC in the wild 14 sources CVE-2026-85046 CVE-2026-87491 CVE-2026-858801

4 groups caught using the same Chrome and Windows exploit kit

Proofpoint says at least four groups, some China-linked, actively share the BlueMoon kit chaining two Chromium and one Windows kernel exploit.

Proofpoint researchers report that at least four hacking groups, some with ties to the Chinese government, are actively using a nearly identical exploit kit named BlueMoon. The kit chains two Chromium browser vulnerabilities and one Windows kernel flaw affecting Windows 10, Windows 11 initial release, and a later Windows version to install malware of the attacker's choice. All three vulnerabilities received patches within the past 24 hours. Proofpoint attributes the kit's rapid, widely shared deployment to a Chromium patch-gap window and AI agents accelerating exploit development against publicly accessible upstream patches.

Ars Technica · SecuritySep 9, 20:55 UTC · 7d agoExploit / PoC in the wild3

"WP2Shell" Critical WordPress RCE Chain (CVE-2026-63030 & CVE-2026-60137)

CISA added the WordPress core pre-auth RCE chain (CVE-2026-63030, CVE-2026-60137) to KEV after confirmed exploitation; WordPress 6.9.5 and 7.0.2 fix the flaws.

On July 17, 2026 WordPress disclosed CVE-2026-63030, a REST API route-confusion flaw, and CVE-2026-60137, a SQL injection in WP_Query, which chain to unauthenticated remote code execution on default installs of WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1. CISA has added both to the Known Exploited Vulnerabilities Catalog and active exploitation is confirmed. Cloudflare deployed WAF rules at 17:03 UTC on July 17, and patches are available in WordPress 6.9.5 and 7.0.2.

Web discovery (articles for new exploits & KEV entries)Sep 8, 16:27 UTC · 8d agoExploit / PoC in the wild 2 sources CVE-2026-63030 CVE-2026-601371· 1 read

KindaRails2Shell threatens Ruby on Rails apps (CVE-2026-66066)

Critical CVE-2026-66066 in Rails' Active Storage/libvips allows unauthenticated arbitrary file read and possible RCE; active exploitation now observed.

CVE-2026-66066 (KindaRails2Shell), discovered by Ethiack researchers and independently by RyotaK of GMO Flatt Security, lets attackers upload crafted files that exploit libvips' handling of specialty formats to read arbitrary files, including process environment secrets, potentially escalating to RCE. Default Rails 7.0+ setups using Active Storage with the vips processor are affected before versions 7.2.3.2, 8.0.5.1, and 8.1.3.1; fixes shipped July 29, 2026, with VIPS_BLOCK_UNTRUSTED as a partial mitigation. Proof-of-concept exploits circulated after disclosure, and VulnCheck updated that it observed active exploitation originating from a single French IP establishing C2 to a host in Israel. Akamai deployed WAF rules, but experts stress patching and credential rotation over filtering alone.

Help Net SecurityAug 31, 12:00 UTC · 16d agoVulnerability in the wildCVE-2026-66066

CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners

CISA added seven actively exploited vulnerabilities to its KEV catalog, including SonicWall SMA 1000 SSRF CVE-2026-83548, amid campaigns deploying reverse shells and crypto miners.

CISA's KEV additions cover flaws in SonicWall SMA 1000 (CVE-2026-83548, CVE-2026-83549), Sangoma Switchvox (CVE-2026-9586), JFrog Artifactory (CVE-2026-82329), Kludex Starlette (CVE-2026-48710), Kestra OSS (CVE-2026-49869) and Berri LiteLLM's MCP endpoint (CVE-2026-59822). SonicWall confirmed active exploitation of the SMA 1000 flaws, while Microsoft and Wiz reported attackers chaining LiteLLM flaws CVE-2026-42271 and CVE-2026-48710 to fingerprint hosts, steal provider API keys and deploy XMRig miners on AI infrastructure. Wiz linked exploitation of the LiteLLM chain to the Qilin ransomware group, and Microsoft detailed a Kestra compromise chain ending in cryptocurrency mining and data harvesting via exposed RAGFlow flaws.

The Hacker NewsSep 3, 05:19 UTC · 13d agoExploit / PoC in the wildCVE-2026-83548 CVE-2026-83549 CVE-2026-9586+10 CVEs1

⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More

Weekly recap: actively exploited Chrome V8 zero-day, MikroTik RouterOS zero-day chain, Magento StyleSmuggler backdoor, and critical N-able N-central flaws.

Google patched an actively exploited Chrome V8 type confusion zero-day, CVE-2026-85046 (CVSS 8.8), the sixth exploited Chrome zero-day of 2026. CERT Polska warned of the MikroTrick exploit chain (CVE-2026-67276 and CVE-2026-86060, CVSS 9.2) giving unauthenticated full control of MikroTik RouterOS devices via SSH, observed since September 2. Sansec disclosed the StyleSmuggler Magento/Adobe Commerce zero-day used since September 4 to inject a Rust backdoor into online stores, while N-able patched three critical N-central flaws (CVE-2026-86206, CVE-2026-86207, and CVE-2026-86218, CVSS 10.0) with Huntress observing likely exploitation. Elastic and Morphisec also detailed RevStealer, an information stealer spread via game cheats and a fake Claude Desktop app.

The Hacker NewsSep 7, 14:36 UTC · 9d agoExploit / PoC in the wildCVE-2026-85046 CVE-2026-86206 CVE-2026-86207+7 CVEs

Chinese Hackers Exploit Critical Tencent Software Flaw for One-Click Code Execution

China-linked UNC3569 actively exploited critical Sogou Input Method flaw CVE-2026-51990 for one-click system-level code execution, deploying the GrayRabbit backdoor.

Gen Threat Labs reports that China-linked threat actor UNC3569, possibly tied to contractor i-SOON, exploited critical CVE-2026-51990 in Tencent's Sogou Input Method, a Windows IME used by hundreds of millions, via crafted sgbiz URLs. The chain combines unvalidated command-line argument injection, unrestricted URL navigation, and an un-sandboxed Chromium 80 engine missing roughly six years of security patches. The exploit gives system-level code execution and was used to deploy the GrayRabbit backdoor, which provides a reverse shell, plugin loading, file upload to C2, and system info collection, and has appeared in UNC3569 intrusions since at least 2021. Tencent patched the issue in version 16.3.0.3498 via automatic update, but the outdated Chromium configuration reportedly remained unchanged as of September 10.

SecurityWeekSep 14, 11:51 UTC · 2d agoExploit / PoC in the wild 2 sources CVE-2026-519901· 1 read