Search: “MuRIL”

ZDI-26-648: (Pwn2Own) OpenAI Codex External Control of System or Configuration Setting Remote Code Execution Vulnerability

ZDI published a Pwn2Own advisory for CVE-2026-19590, enabling remote code execution in OpenAI's Codex agent via system or configuration control.

Zero Day Initiative advisory ZDI-26-648 documents an External Control of System or Configuration Setting vulnerability in OpenAI Codex, demonstrated at Pwn2Own. A remote attacker could achieve arbitrary code execution, with user interaction required such as opening malicious content. The flaw is tracked as CVE-2026-19590 with a CVSS rating of 7.8. No exploitation in the wild is reported.

ZDI Published Advisories·Sep 10, 05:00 UTC · 6d agoVulnerability 4 sourcesCVE-2026-195901

USN-8747-1: Beets vulnerability

Ubuntu released USN-8747-1 fixing a Beets web interface flaw that let attackers inject HTML or execute JavaScript via untrusted media metadata.

Ubuntu Security Notice USN-8747-1 addresses a vulnerability in the Beets music library manager, which incorrectly escaped untrusted media metadata in its web interface. An attacker could exploit this to inject arbitrary HTML or execute arbitrary JavaScript code in a user's browser. Updated packages are available for affected Ubuntu releases.

Ubuntu Security Notices·updated 14:37 UTC · 4h ago·first Sep 10, 15:56 UTC · 6d agoAdvisory 13 sources

IndicTriMix: Developing Language Identification Datasets and Models for Tri-Language Code-Mixing

Researchers release IndicTriMix benchmarks and fine-tuned MuRIL and XLM-RoBERTa models for token-level language identification in tri-language code-mixed text.

The paper formulates token-level language identification in code-mixed text as a sequence labeling task and fine-tunes MuRIL and XLM-RoBERTa transformer models for Indian languages. It evaluates on Hindi, Gujarati, and Bengali configurations with manually annotated test sets and proposes two code-mixed generation approaches using parallel trilingual sentences. A public benchmark, annotated test sets, and fine-tuned models are released for reproducibility.

arXiv cs.AI / cs.LG / cs.CL·Sep 10, 17:36 UTC · 6d agoAI research1

How CHERIoT Provides Strong and Usable Isolation Without an MMU

ACM Queue paper explains how CHERIoT uses CHERI hardware capabilities to give microcontroller-class IoT devices memory and privilege isolation without an MMU.

The ACM Queue article (DOI 10.1145/3831361) describes CHERIoT, a RISC-V-derived platform that scales CHERI capability-based hardware down to small embedded and IoT microcontrollers. It provides strong, fine-grained isolation and memory safety without a memory management unit, aiming to make compartmentalization practical for low-cost devices. The piece emphasizes usability of the isolation model alongside its security guarantees.

Lobsters · security·Sep 10, 14:59 UTC · 6d agoResearch

ZDI-26-562: (Pwn2Own) Home Assistant Green mDNS Server-Side Request Forgery Vulnerability

ZDI-26-562 details an unauthenticated, network-adjacent SSRF in the Home Assistant Green mDNS server, rated CVSS 5.4 and originally demonstrated at Pwn2Own.

A server-side request forgery in Home Assistant Green's mDNS service lets network-adjacent attackers initiate arbitrary server-side requests without authentication. The Zero Day Initiative assigned the flaw a CVSS 5.4 rating under advisory ZDI-26-562. The finding originated from Pwn2Own, and no exploitation in the wild is reported.

ZDI Published Advisories·Aug 12, 05:00 UTC · Aug 12, 2026Vulnerability

MicroHasTEE: Bare-Metal Haskell for Type-Level Peripheral Ownership on Armv8-M

MicroHasTEE expresses TrustZone secure and non-secure firmware as one typed Haskell program, catching peripheral-ownership inconsistencies at compile time.

MicroHasTEE is a multiparty Haskell framework that models both TrustZone firmware images as participants in a single typed program, using type-level capability ledgers to track peripheral acquisition, configuration, transfer, and finalization. MicroHs compiles the shared program twice to produce separate bare-metal Secure and Non-secure firmware images. The framework rejects inconsistent resource use, post-configuration attribution changes, wrong-domain callbacks, and calls to unregistered Secure services. A door-lock case study on an STM32U5 Nucleo board produced images of 232.7 KiB and 228.4 KiB of flash with roughly 220 KiB of SRAM per domain.

arXiv cs.CR·Sep 11, 08:34 UTC · 5d agoResearch1

ZDI-26-563: (Pwn2Own) Home Assistant Green Simple Service Discovery Protocol Server-Side Request Forgery Vulnerability

ZDI disclosed a Pwn2Own SSRF flaw (CVSS 5.4) in Home Assistant Green's SSDP server, letting unauthenticated network-adjacent attackers trigger arbitrary server-side requests.

The Zero Day Initiative published ZDI-26-563 for a server-side request forgery in the Simple Service Discovery Protocol server on Home Assistant Green. The bug was demonstrated at Pwn2Own and allows network-adjacent, unauthenticated attackers to initiate arbitrary server-side requests on affected installations. ZDI rated the issue CVSS 5.4.

ZDI Published Advisories·Aug 12, 05:00 UTC · Aug 12, 2026Advisory

USN-8731-1: MiniUPnPd vulnerability

Ubuntu issued USN-8731-1 fixing a MiniUPnPd integer underflow allowing remote DoS or information disclosure via malformed SOAPAction headers.

Ubuntu released USN-8731-1 to address an integer underflow vulnerability in MiniUPnPd's SOAPAction header parsing. A remote attacker could send a malformed SOAPAction header containing a single quote to trigger a denial of service or information disclosure. MiniUPnPd is a lightweight UPnP daemon widely deployed on routers and gateways.

Ubuntu Security Notices·Sep 7, 09:30 UTC · 9d agoAdvisory1

USN-8768-1: Shibboleth vulnerability

Ubuntu patches Shibboleth SQL injection in the ODBC storage plugin allowing remote attackers to extract sensitive information.

Ubuntu security notice USN-8768-1 fixes a Shibboleth vulnerability discovered by Florian Stuhlmann. The software incorrectly escaped input when using the ODBC storage plugin, allowing a remote attacker to perform SQL injection attacks and obtain sensitive information. Users are advised to update the Shibboleth package.

Ubuntu Security Notices·Sep 15, 15:43 UTC · 1d agoAdvisory

New IoT Malware Uses Public Linux Exploits to Gain Root and Launch DDoS Attacks

Nozomi details KATARU, an IoT botnet that brute-forces Telnet, exploits public Linux kernel flaws for root access, and launches multi-protocol DDoS attacks.

KATARU, discovered after honeypot Telnet brute-force activity from a Vietnamese IP, downloads an ARM payload (vlxx.arm) and attempts privilege escalation by editing /etc/passwd or exploiting CVE-2026-46300 (Fragnesia), CVE-2026-43284 (Dirty Frag), and CVE-2026-31431 (Copy Fail). It combines Mirai-style TCP, UDP, ICMP, HTTP, QUIC and DNS floods with application attacks against Minecraft, FiveM, OpenVPN and WireGuard. The malware uses X25519 and ChaCha20-Poly1305 encrypted C2, unusually broad persistence across systemd, cron, init frameworks, and Android hooks, plus anti-debugging and decoy traffic to hinder analysis. Implementers copied x86 shellcode into the ARM binary and reused an RFC 7748 test-vector key, indicating low-quality but rapidly evolving commodity development.

GBHackers·updated Sep 11, 14:17 UTC · 5d ago·first Sep 11, 09:07 UTC · 5d agoMalware in the wild 2 sourcesCVE-2026-46300CVE-2026-43284CVE-2026-31431

ZDI-26-566: BlackBerry QNX KEV File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI disclosed an out-of-bounds write flaw (CVE-2026-40272) in BlackBerry QNX KEV file parsing enabling remote code execution.

The Zero Day Initiative published ZDI-26-566 describing an out-of-bounds write vulnerability in BlackBerry QNX KEV file parsing. Remote code execution requires user interaction, such as visiting a malicious page or opening a malicious file. ZDI assigned a CVSS score of 7.8 and the CVE identifier CVE-2026-40272.

ZDI Published Advisories·Aug 13, 05:00 UTC · Aug 13, 2026VulnerabilityCVE-2026-40272

ZDI-26-561: (Pwn2Own) Home Assistant Green go2rtc Command Injection Remote Code Execution Vulnerability

ZDI disclosed a Pwn2Own command injection flaw (CVSS 7.5) in Home Assistant Green's go2rtc, enabling network-adjacent attackers to execute arbitrary code via localhost access.

The Zero Day Initiative published ZDI-26-561 for a command injection remote code execution flaw in go2rtc on Home Assistant Green, demonstrated at Pwn2Own. Network-adjacent attackers can execute arbitrary code after first gaining access to the device's localhost interface. ZDI rated the issue CVSS 7.5.

ZDI Published Advisories·Aug 12, 05:00 UTC · Aug 12, 2026Advisory

Muhstik Botnet Attacks Tomato Routers to Harvest New IoT Devices

Unit 42 found a Muhstik botnet variant brute-forcing Tomato router web authentication to harvest IoT devices for crypto mining and DDoS attacks.

Palo Alto Networks Unit 42 researchers in December 2019 identified a new Muhstik botnet variant scanning Tomato routers on TCP 8080 and brute-forcing default admin credentials, targeting roughly 4,600 exposed devices found via Shodan. The variant also scans WordPress and Webuzo installations and exploits the Oracle WebLogic deserialization flaw CVE-2019-2725 for unauthenticated remote code execution. Muhstik, active since March 2018, self-propagates like a worm and typically monetizes infections through cryptocurrency mining and DDoS attacks controlled via an IRC C2 channel.

Palo Alto Unit 42·Aug 19, 12:06 UTC · 28d agoMalware in the wildCVE-2019-2725

Old, Unpatched Flaws Give Attackers Access to Philippines Nuclear Agency

Threat actors exploited old unpatched ownCloud vulnerabilities to breach the Philippines nuclear agency, stealing reactor databases, personnel records, and credentials.

Attackers used commodity vulnerabilities in ownCloud as their initial access vector to compromise the Philippines nuclear agency. Stolen data reportedly includes reactor databases, personnel records, and credential stores. The flaws had gone unpatched, allowing sustained access to internal systems. The incident underscores continued exploitation of known file-sharing vulnerabilities against critical infrastructure targets.

Dark Reading·Sep 2, 01:00 UTC · 14d agoData breach in the wild

USN-8756-1: Yelp vulnerability

Ubuntu patches Yelp help viewer flaw allowing crafted help documents to execute arbitrary scripts and expose sensitive user information.

USN-8756-1 fixes a vulnerability in Yelp, Ubuntu's help viewer, where help documents could execute arbitrary scripts. An attacker could trick a user into opening a specially crafted help document to obtain sensitive information. Ubuntu has released updated packages.

Ubuntu Security Notices·Sep 14, 12:55 UTC · 2d agoAdvisory

ZDI-26-536: (Pwn2Own) Microsoft Windows http.sys Integer Overflow Local Privilege Escalation Vulnerability

ZDI discloses CVE-2026-62735, a Pwn2Own-demonstrated Windows http.sys integer overflow (CVSS 8.8) enabling local privilege escalation.

ZDI advisory ZDI-26-536 describes an integer overflow in Microsoft Windows http.sys, tracked as CVE-2026-62735 with a CVSS score of 8.8. The flaw was demonstrated at Pwn2Own and allows local attackers to escalate privileges on affected Windows installations. Exploitation requires first obtaining the ability to execute low-privileged code on the target system.

ZDI Published Advisories·Aug 11, 05:00 UTC · Aug 11, 2026VulnerabilityCVE-2026-627351

USN-8767-1: Snapcast vulnerability

Ubuntu patches Snapcast mishandling of crafted JSON-RPC requests enabling remote code execution and data exposure.

Ubuntu security notice USN-8767-1 addresses a vulnerability in Snapcast, a multiroom audio streaming server. The software incorrectly handled crafted JSON-RPC requests, which could allow a remote attacker to execute arbitrary code or obtain sensitive information. Users are advised to update the snapcast package.

Ubuntu Security Notices·Sep 15, 15:22 UTC · 1d agoAdvisory

ZDI-26-560: (Pwn2Own) Home Assistant Green go2rtc Command Injection Remote Code Execution Vulnerability

ZDI disclosed another Pwn2Own command injection flaw (CVSS 7.5) in Home Assistant Green's go2rtc, enabling network-adjacent code execution after obtaining localhost access.

The Zero Day Initiative published ZDI-26-560 for a second command injection remote code execution flaw in go2rtc on Home Assistant Green, demonstrated at Pwn2Own. Network-adjacent attackers can execute arbitrary code after first obtaining access to the device's localhost interface. ZDI rated the issue CVSS 7.5.

ZDI Published Advisories·Aug 12, 05:00 UTC · Aug 12, 2026Advisory

USN-8727-1: Linux kernel (OEM) vulnerabilities

Ubuntu issued kernel security update USN-8727-1 for OEM kernels, fixing an Arm TLB invalidation flaw (CVE-2025-10263) allowing local privilege escalation.

Ubuntu released USN-8727-1, a security update for the OEM variant of the Linux kernel. It fixes CVE-2025-10263, in which certain Arm processors complete broadcast TLB invalidation before related memory writes are globally observed, potentially letting local attackers bypass memory protections or escalate privileges. The notice also corrects additional kernel flaws across ARM64, ARM32, RISC-V, S390 and other subsystems.

Ubuntu Security Notices·updated Sep 7, 09:12 UTC · 9d ago·first Sep 7, 09:02 UTC · 9d agoAdvisory 6 sourcesCVE-2025-10263

ZDI-26-634: Flowise CSV Agent Prompt Injection Remote Code Execution Vulnerability

ZDI disclosed a CVSS 9.8 unauthenticated prompt injection vulnerability in Flowise's CSV agent that allows remote arbitrary code execution.

ZDI published advisory ZDI-26-634 for a prompt injection vulnerability in Flowise's CSV agent component. Remote, unauthenticated attackers can inject prompts to execute arbitrary code on affected installations. ZDI assigned CVSS 9.8 and the issue is tracked as CVE-2026-70477.

ZDI Published Advisories·Sep 9, 05:00 UTC · 7d agoAdvisoryCVE-2026-70477

USN-8765-1: python-sql vulnerability

Ubuntu patches python-sql SQL injection flaw where values passed to unary operators are incorrectly escaped.

Ubuntu Security Notice USN-8765-1 fixes a vulnerability in python-sql discovered by Cedric Krier. The library incorrectly escaped values passed to unary operators, allowing an attacker to potentially perform SQL injection attacks against applications using the library.

Ubuntu Security Notices·Sep 15, 14:39 UTC · 1d agoAdvisory

Testing race conditions with memory access tracing and stack-based delay injection

Google Project Zero released MAccConc, Linux kernel tooling that traces memory accesses to explore and test race condition interleavings.

A Google Project Zero researcher published MAccConc (Memory Access Concurrency), tooling for exploring possible interleavings of multithreaded test cases in the Linux kernel, available on GitHub. The tools use KCOV with ASAN outline-mode instrumentation to record per-access memory traces, enabling automatic testing of all A-B-A interleavings plus terminal and GUI explorers for manual analysis. The work targets confirming race condition candidates, building reliable regression tests, and enabling concurrency fuzzing, drawing on ideas from SKI and Ned Williamson's sockfuzzer.

Google Project Zero·Sep 8, 07:00 UTC · 8d agoResearch1

Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org

The Hacker News·Aug 5, 11:04 UTC · Aug 5, 2026Exploit / PoC in the wildCVE-2026-59774CVE-2026-60004CVE-2026-20896+1 CVEs

Chypothermia: Clock Freezing for Static Side-channel Attacks

Chypothermia attack uses cryogenic cooling to disable clock and voltage sensors, evading detection and blocking key zeroization on OpenTitan root of trust.

Chypothermia is a static side-channel attack that exposes chips to cryogenic temperatures, disrupting on-chip mixed-signal components to disable the clock sensor, clock generation circuit, and voltage sensors without electrical tampering. Combined with Chypnosis (IEEE S&P 2026), it halts the clock while evading temperature-based anomaly detection. It was implemented on multiple FPGA/SoC platforms and applied to the OpenTitan root of trust's alert handler, evading detection and preventing key zeroization. The authors also propose an FPGA-compatible self-heating sensor as a countermeasure.

arXiv cs.CR·Sep 10, 12:12 UTC · 6d agoResearch

ZDI-26-593: NVIDIA TensorRT ONNX File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI disclosed a second TensorRT heap-based buffer overflow RCE (CVE-2026-24268, CVSS 7.8) in ONNX file parsing, requiring user interaction.

The Zero Day Initiative published advisory ZDI-26-593 covering another heap-based buffer overflow in NVIDIA TensorRT's ONNX file parsing. A remote attacker can execute arbitrary code if the target opens a malicious file or visits a crafted page. ZDI rated the vulnerability CVSS 7.8 and assigned CVE-2026-24268.

ZDI Published Advisories·Aug 24, 05:00 UTC · 23d agoAdvisoryCVE-2026-24268

ZDI-26-557: (Pwn2Own) Amazon Smart Plug Insecure Fallback Information Disclosure Vulnerability

ZDI disclosed a Pwn2Own information disclosure flaw (CVSS 4.3) in Amazon Smart Plug, letting unauthenticated network-adjacent attackers access sensitive information.

The Zero Day Initiative published ZDI-26-557 for an insecure fallback information disclosure flaw in Amazon Smart Plug, demonstrated at Pwn2Own. Unauthenticated network-adjacent attackers can disclose sensitive information on affected installations. ZDI rated the issue CVSS 4.3.

ZDI Published Advisories·Aug 12, 05:00 UTC · Aug 12, 2026Advisory

ZDI-26-559: (Pwn2Own) Amazon Smart Plug OTA Update Process Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI disclosed a Pwn2Own out-of-bounds write RCE (CVSS 7.5) in Amazon Smart Plug's OTA process, exploitable by unauthenticated network-adjacent attackers.

The Zero Day Initiative published ZDI-26-559 for an out-of-bounds write remote code execution flaw in the Amazon Smart Plug OTA update process, demonstrated at Pwn2Own. Unauthenticated network-adjacent attackers can execute arbitrary code on affected installations. ZDI rated the issue CVSS 7.5.

ZDI Published Advisories·Aug 12, 05:00 UTC · Aug 12, 2026Advisory

ZDI-26-583: Clam AntiVirus 7z Archive Parsing Integer Overflow Remote Code Execution Vulnerability

Zero Day Initiative discloses CVE-2026-20215, an integer overflow in ClamAV's 7z archive parsing enabling remote code execution, rated CVSS 8.4.

The Zero Day Initiative published ZDI-26-583 for an integer overflow in Clam AntiVirus's 7z archive parsing. A remote attacker can execute arbitrary code when the antivirus processes a crafted archive, with attack vectors varying by implementation. The flaw is tracked as CVE-2026-20215 and rated CVSS 8.4. The advisory does not mention active exploitation.

ZDI Published Advisories·Aug 13, 05:00 UTC · Aug 13, 2026VulnerabilityCVE-2026-202151

ZDI-26-546: Flowise Airtable_Agent Code Injection Remote Code Execution Vulnerability

ZDI discloses an unauthenticated code injection remote code execution flaw in Flowise's Airtable_Agent (CVE-2026-69264, CVSS 9.8).

ZDI advisory ZDI-26-546 describes a code injection vulnerability in the Flowise Airtable_Agent that allows remote attackers to execute arbitrary code. No authentication is required to exploit the flaw, which carries a CVSS rating of 9.8 and is assigned CVE-2026-69264. Flowise deployments exposing the vulnerable agent component are at risk of full server takeover.

ZDI Published Advisories·Aug 11, 05:00 UTC · Aug 11, 2026VulnerabilityCVE-2026-69264