Search: “solar-eclipse”

24 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll

SeverityAll critical 0 high 0 medium 0 low 0 info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

AI slops from Eve

oss-security moderator Solar Designer approved three AI-generated vulnerability reports from automated security researcher Eve, sparking debate over AI slop on the list.

oss-security moderator Solar Designer approved three posts submitted by Eve, described as an 'automated security researcher', noting they lacked Date headers and arrived on the list server on September 9. He expressed uncertainty about their value but suggested they may have historical significance as early examples of AI-generated security reports at the dawn of AI security research. The post is meta-commentary on AI-generated content reaching a vulnerability disclosure mailing list rather than a specific vulnerability disclosure itself.

oss-securityupdated Sep 13, 15:08 UTC · 2d agofirst Sep 10, 01:37 UTC · 6d agoIndustry 12 sources

Chaotic Eclipse Released A PoC For NVIDIA GreenSection Memory Corruption Zero-Day

Researcher Chaotic Eclipse released GreenSection, a PoC exploit for an NVIDIA Windows user-mode shared-memory flaw enabling out-of-bounds writes and potential dwm.exe compromise.

Researcher Chaotic Eclipse (aka Nightmare Eclipse) released a PoC named GreenSection for a zero-day in NVIDIA's Windows user-mode components. Multiple NVIDIA components share a global memory section in BaseNamedObjects with full read/write access to all users; although checks prevent misuse, runtime reuse of section data can cause an out-of-bounds write. The unstable PoC crashes applications using Vulkan or OpenGL and could potentially cross user boundaries or compromise the Windows Desktop Window Manager (dwm.exe), though impact was not fully investigated. The researcher recently published similar zero-day PoCs against Kaspersky Endpoint Security, Avast Antivirus, and CrowdStrike Falcon.

Security AffairsSep 7, 13:42 UTC · 9d agoExploit / PoC 2 sources

ZDI-26-636: Oracle Outside In Technology PostScript File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI disclosed a heap-based buffer overflow in Oracle Outside In Technology's PostScript parsing (CVE-2026-60412) enabling user-triggered remote code execution.

Zero Day Initiative published ZDI-26-636, a CVSS 7.8 heap-based buffer overflow in PostScript file parsing within Oracle Outside In Technology. Remote attackers can execute arbitrary code when the target opens a malicious file or visits a malicious page, making user interaction a requirement. The vulnerability is tracked as CVE-2026-60412. The advisory reports no exploitation.

ZDI Published AdvisoriesSep 9, 05:00 UTC · 7d agoVulnerability 4 sources CVE-2026-604121

Nightmare-Eclipse Strikes Again with 'ShieldCrash' Windows Exploit

A researcher known as Nightmare-Eclipse published another zero-day exploit, dubbed ShieldCrash, targeting Windows Defender.

Dark Reading reports that the disgruntled researcher tracked as Nightmare-Eclipse continued a vendetta against Microsoft by publishing a new zero-day exploit named ShieldCrash for Windows Defender. The brief report does not detail affected versions, exploitation prerequisites, or whether exploitation has been observed.

Dark ReadingSep 10, 15:29 UTC · 5d agoExploit / PoC1

European parliament members call for slowdown of Serbia’s EU entry over spyware use

29 MEPs urge delaying Serbia's EU accession after researchers found Pegasus and NoviSpy spyware on student activists' phones.

Twenty-nine Members of the European Parliament sent a letter Friday demanding Serbia's EU accession be slowed until an investigation into its spyware use is completed. The letter follows a SHARE Foundation report, with Amnesty International and the Citizen Lab, documenting Pegasus and NoviSpy infections on Serbian student activists' phones; NoviSpy evidence pointed to Serbian government authorities, though Pegasus attribution was not assigned. The MEPs also urged European Commission President Ursula von der Leyen to cancel a planned visit to Serbia and called the surveillance 'a direct state attack on democracy' ahead of upcoming elections. The Serbian government did not respond to requests for comment.

CyberScoopSep 4, 21:02 UTC · 11d agoPolicy & legal in the wild

Chaotic Eclipse Releases GenDigital Avast Antivirus ZeroDay PrettyPrague

Researcher Chaotic Eclipse released PrettyPrague, a PoC zero-day privilege escalation exploit against fully patched GenDigital Avast Antivirus.

Security researcher Chaotic Eclipse (also known as INFINITE NIGHTMARE or MSNightmare) published a PoC named PrettyPrague exploiting a zero-day privilege escalation flaw in Avast Antivirus. The PoC abuses a flaw in the Avast Sandbox to dump the Windows SAM database and spawn a SYSTEM-level shell, reportedly working on fully patched Avast and patched Windows 11 25H2. The researcher believes the flaw may also affect other GenDigital products such as AVG and Norton. It follows his recent HardBreacher PoC for a Kaspersky Endpoint Security privilege escalation flaw.

Security AffairsSep 1, 14:33 UTC · 15d agoExploit / PoC

Nightmare Eclipse Drops CrowdStrike, Nvidia, Avast Zero-Day Exploits

Researcher Nightmare Eclipse released working zero-day PoCs for Avast, CrowdStrike Falcon, and Nvidia, prompting a Gen patch, CrowdStrike mitigation, and Nvidia investigation.

Security researcher Nightmare Eclipse released three zero-day exploits within a short window: PrettyPrague targeting the Avast sandbox for full system privileges (possibly affecting other GenDigital products including AVG and Norton), FalconFlank exploiting CrowdStrike Falcon Sensor's Office malicious macros remediation feature for privilege escalation, and GreenSection targeting an out-of-bounds memory write in a shared global memory section used by Nvidia user-mode components. GenDigital said it has fixed the Avast issue; CrowdStrike advised disabling the Microsoft Office File Suspicious Macro Removal policy setting; Nvidia said it is actively investigating the PoC. Kevin Beaumont reported that the Avast, CrowdStrike, and Kaspersky exploits work. The researcher previously released the HardBreacher privilege escalation zero-day in Kaspersky endpoint security, patched August 31.

SecurityWeekSep 7, 12:15 UTC · 9d agoExploit / PoC

ShieldBreak: New Windows Zero-Day Bypasses Microsoft’s RoguePlanet Patch

Researcher Chaotic Eclipse published a PoC bypassing Microsoft's CVE-2026-50656 Defender patch, enabling SYSTEM-level code execution on fully patched Windows systems.

Security researcher Chaotic Eclipse released a proof-of-concept for ShieldBreak, a Microsoft Defender zero-day that fully bypasses the patch for CVE-2026-50656 (RoguePlanet), a race condition in the Malware Protection Engine (mpengine.dll) allowing SYSTEM-level code execution. The PoC was tested on Windows 11 25H2 and Windows Server 2025 with a 100% success rate, and Windows 10 is also vulnerable though not supported by the PoC; the flaw may also leak 8 bytes of memory. Microsoft's MSRC had criticized the researcher's repeated uncoordinated disclosures, including YellowKey (BitLocker bypass), GreenPlasma, and LegacyHive (User Profile Service LPE).

Security AffairsAug 12, 08:08 UTC · Aug 12, 2026Exploit / PoC CVE-2026-50656

Chaotic Eclipse Releases Crowdstrike Falcon ZeroDay FalconFlank

Researcher Chaotic Eclipse released FalconFlank, a PoC zero-day privilege escalation exploit against CrowdStrike Falcon's Microsoft Office macro removal feature.

Security researcher Chaotic Eclipse (also known as Nightmare Eclipse) published FalconFlank, a proof-of-concept zero-day exploit for a privilege escalation flaw in CrowdStrike Falcon Sensor. It abuses the Microsoft Office file malicious macro removal remediation feature, which runs with high privileges, and works on fully updated Windows 11 25H2 and Windows Server 2025 with Falcon Phase 3 Optimal Protection. CrowdStrike says it is investigating and advises customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy. The same researcher recently released zero-day PoCs against Kaspersky Endpoint Security (HardBreacher) and Avast Antivirus (PrettyPrague), the latter dumping the SAM database for a SYSTEM shell.

Security AffairsSep 9, 13:58 UTC · 7d agoExploit / PoC1· 1 read

Pegasus and NoviSpy Used Against Serbian Protesters

Citizen Lab confirmed zero-click Pegasus infected a Serbian student activist's iPhone, part of the largest documented Serbian spyware wave targeting at least 14 people.

The Citizen Lab, with the SHARE Foundation, confirmed a Serbian student protest movement member's iPhone was infected with NSO Group's Pegasus via an iMessage zero-click exploit between December 2025 and January 2026; Apple patched the exploit in iOS 18.4.1. SHARE Foundation has documented at least 14 targeted individuals since early 2026, including student activists, civil society figures, an opposition MP and a local councilor, coinciding with the March 2026 local elections. SHARE and Amnesty Tech also found a new NoviSpy variant on a student activist's Android phone after Serbian authorities seized it during police questioning.

Security AffairsSep 3, 20:17 UTC · 12d agoThreat actor in the wild

Pegasus Zero-Click Exploit Infects Serbian Student Activist's iPhone

Citizen Lab and SHARE Foundation confirm a Serbian student activist's iPhone was infected with NSO Group Pegasus via a zero-click iMessage exploit.

Forensic analysis found high-confidence infection indicators on the activist's iPhone during December 2025 and January 2026, using an iMessage zero-click exploit the Citizen Lab believes was patched as of iOS 18.4.1, released April 2025. The target was among at least 14 Apple Threat Notification recipients in Serbia's student movement, civil society, and opposition politics documented by the SHARE Foundation. Targeting occurred ahead of key 2026 election cycles; Amnesty Tech also confirmed a new NoviSpy version on another student movement member's device.

Infosecurity MagazineSep 3, 15:25 UTC · 12d agoThreat actor in the wild

Chaotic Eclipse Released ShieldCrash, A PoC For Microsoft Defender Zero-Day

Researcher Chaotic Eclipse released ShieldCrash, a PoC showing Microsoft Defender's CVE-2026-69414 patch is incomplete, enabling arbitrary file reads as SYSTEM.

Security researcher Chaotic Eclipse published ShieldCrash, a proof-of-concept exploit for the Microsoft Malware Protection Engine privilege escalation vulnerability CVE-2026-69414 (ShieldBreak). The PoC performs arbitrary file reads with SYSTEM privileges on all supported Windows versions, including systems running the September 2026 security updates and Malware Protection Engine version 1.1.26080.3. The researcher claims Microsoft's patch fixed several exploit paths but missed a specific condition that still enables the attack. His recent releases also include zero-day PoCs targeting Nvidia, Kaspersky, Avast, and CrowdStrike Falcon.

Security AffairsSep 9, 07:53 UTC · 7d agoExploit / PoC CVE-2026-69414

Pegasus, NoviSpy variant spyware found on devices of Serbian activists

Researchers confirmed the first 2026 Pegasus infection and a new NoviSpy variant on 14 Serbian activists, likely surveillance by Serbian authorities ahead of elections.

Citizen Lab confirmed with high probability the first forensically confirmed Pegasus infection of 2026, on a Serbian student activist hacked via a zero-click exploit between December of last year and January. Amnesty International confirmed two devices infected with a new NoviSpy variant, and the SHARE Foundation documented 14 targets including a member of parliament and a local government official, the largest documented spyware wave in Serbia to date. Evidence points to Serbian police or intelligence services, with NoviSpy infections occurring around police detention ahead of key local and parliamentary elections. Apple threat notifications preceded the findings, and updated iOS versions break the exploit chain.

CyberScoopSep 2, 15:03 UTC · 13d agoThreat actor in the wild

ZDI-26-591: NVIDIA TensorRT ONNX File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI disclosed a heap-based buffer overflow RCE (CVE-2026-24272, CVSS 7.8) in NVIDIA TensorRT ONNX parsing, requiring user interaction to exploit.

The Zero Day Initiative published advisory ZDI-26-591 covering a heap-based buffer overflow in NVIDIA TensorRT's ONNX file parsing. Successful exploitation allows remote code execution when a user opens a malicious ONNX file or visits a crafted page. ZDI rated the vulnerability CVSS 7.8 and assigned CVE-2026-24272.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoAdvisory CVE-2026-24272

Chaotic Eclipse Releases Kaspersky Zero

Researcher Chaotic Eclipse released HardBreacher, a PoC privilege-escalation exploit for Kaspersky Endpoint Security on fully patched Windows 11 25H2.

Security researcher Chaotic Eclipse, also known as INFINITE NIGHTMARE and Nightmare-Eclipse, released a PoC zero-day exploit named HardBreacher targeting Kaspersky Endpoint Security v14.0.0.504. The exploit achieves privilege escalation on fully patched Windows 11 25H2, creating a DLL in System32 with full user permissions and potentially disrupting Kaspersky's UI process and file-access controls. The PoC is unstable and may require repeated attempts; Kaspersky claims it has already addressed the vulnerability.

Security AffairsSep 1, 09:34 UTC · 15d agoExploit / PoC1

Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed

Researcher Chaotic Eclipse released a PoC showing CVE-2026-69414's patch is bypassable, allowing arbitrary file reads as SYSTEM on current Windows.

The researcher known as Chaotic Eclipse published a proof-of-concept for a zero-day in Microsoft Defender, dubbed ShieldCrash, assessed as a patch bypass for ShieldBreak (CVE-2026-69414, CVSS 7.8). The PoC demonstrates an arbitrary file read as SYSTEM with the latest Windows installed, and all supported desktop versions are said to be impacted. Microsoft patched the original issue in Microsoft Malware Protection Engine 1.1.26080.3, which updates automatically. The same researcher recently released PoCs for flaws in CrowdStrike Falcon Sensor, Kaspersky, Avast Antivirus and NVIDIA.

The Hacker NewsSep 9, 06:47 UTC · 7d agoExploit / PoC CVE-2026-694141

Pegasus Zero-Click Spyware Exploit Infects Serbian Student Movement Member's iPhone

Citizen Lab confirms Pegasus zero-click iMessage spyware infected a Serbian student activist's iPhone amid at least 14 spyware targets in Serbia during 2026.

The Citizen Lab, with the SHARE Foundation, confirmed an iMessage zero-click exploit infected a Serbian student protest movement member's iPhone with NSO Group's Pegasus spyware, with high-confidence indicators from December 2025 to January 2026. The exploit was addressed by Apple in iOS 18.4.1, released April 2025. At least 14 people in Serbia, including students, activists, an MP, and a councilor, were targeted with advanced spyware since the start of 2026, coinciding with March 29, 2026 local elections; a new Android spyware similar to NoviSpy was also found on a confiscated device.

The Hacker NewsSep 3, 08:43 UTC · 13d agoThreat actor in the wild

ZDI-26-593: NVIDIA TensorRT ONNX File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI disclosed a second TensorRT heap-based buffer overflow RCE (CVE-2026-24268, CVSS 7.8) in ONNX file parsing, requiring user interaction.

The Zero Day Initiative published advisory ZDI-26-593 covering another heap-based buffer overflow in NVIDIA TensorRT's ONNX file parsing. A remote attacker can execute arbitrary code if the target opens a malicious file or visits a crafted page. ZDI rated the vulnerability CVSS 7.8 and assigned CVE-2026-24268.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoAdvisory CVE-2026-24268

ZDI-26-587: Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI advisory ZDI-26-587 details a heap-based buffer overflow RCE (CVE-2026-19781, CVSS 7.8) in Ashlar-Vellum Cobalt VS file parsing, requiring user interaction.

The Zero Day Initiative released advisory ZDI-26-587 covering a heap-based buffer overflow in Ashlar-Vellum Cobalt's VS file parsing. A remote attacker can execute arbitrary code when the target opens a malicious file or visits a crafted page. ZDI rated the vulnerability CVSS 7.8 and assigned CVE-2026-19781.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoAdvisory CVE-2026-19781

Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems

Google/Mandiant profile Breeze Comet, a Brazil-based e-crime group executing fraudulent Pix and STR payment transactions at banks, retailers, and fintechs.

Google Threat Intelligence Group and Mandiant describe Breeze Comet (formerly UNC5669), a financially motivated threat actor active since September 2023 targeting Brazilian financial services, retail, and e-commerce. The group gains access via password spraying, vishing impersonating IT support to install RMM tools like AnyDesk, WhatsApp social engineering, and exploitation of vulnerable JBoss AS servers for web shell deployment. It uses compromised government websites as C2, deploys the Rust-based COBALTSPIN tunneler and multiple custom backdoors (LIGHTPAINT, MILDFROST, KICKPLATE, BOATBEAM), then clears logs after executing hundreds of fraudulent transactions through Pix, STR, and Boleto payment systems. At least one heist yielded tens of thousands of dollars, with infrastructure suggesting expansion toward Latin America and Africa.

The Hacker NewsSep 8, 11:22 UTC · 8d agoThreat actor in the wild

'Breeze Comet' Tears Into Brazilian & Global Financial Systems

Threat group 'Breeze Comet' is attacking Brazil's financial systems and reportedly stealing funds directly, per Dark Reading threat intelligence.

Dark Reading reports that 'Breeze Comet', described as Brazil's most sophisticated threat group, is compromising the country's financial systems. The activity is financially motivated, with funds reportedly moved directly to the attackers. The campaign reportedly extends to global financial systems, though technical details, victims and attribution evidence were not disclosed in the excerpt.

Dark ReadingSep 3, 12:00 UTC · 13d agoThreat actor in the wild

27.5KB language-agnostic WebGPU syntax highlighter

A developer released gpu-lexer, a 27.5KB language-agnostic syntax highlighter that uses a tiny WebGPU model to label code tokens in the browser.

gpu-lexer splits source into words, whitespace, and symbols, then a small WebGPU model uses local and whole-file context to assign nine token classes, working on languages never seen in training. On held-out files, 12.57% of token labels differ from Shiki, though this measures agreement with Shiki rather than objective correctness. In benchmarks against Shiki 4.4.3, Prism.js, Highlight.js, Sugar High, and Starry Night, it highlighted 10 concatenated copies of three.min.js (5.56M characters) about 10x faster on an Apple M4 Pro in Chrome 152. The author frames it as an experiment, not a grammar-equivalent highlighter.

Hacker News · securitySep 9, 01:14 UTC · 7d agoAI tools & infra HN 21↑ · 5 comments1

ZDI-26-696: Linux Kernel NTFS3 Journal Heap-based Buffer Overflow Code Execution Vulnerability

ZDI-26-696: Linux Kernel NTFS3 journal heap-based buffer overflow (CVE-2026-72196, CVSS 8.8) enables local arbitrary code execution.

ZDI advisory ZDI-26-696 describes a heap-based buffer overflow in the Linux Kernel NTFS3 journal handling, tracked as CVE-2026-72196 with a CVSS score of 8.8. Exploitation requires the attacker to first execute low-privileged code on the target system. Successful exploitation allows local attackers to execute arbitrary code. No in-the-wild exploitation is mentioned.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability CVE-2026-721961

E-Commerce Access, Vedicline Data, Langflow RCE, ASUS Claim, and Energy Shell Access

SOCRadar reports underground posts claiming a Bangladeshi e-commerce database, Vedicline data leak, Langflow RCE, ASUS breach, and energy-sector shell access.

SOCRadar's Dark Web Team identified several new underground posts, including an alleged Bangladeshi e-commerce customer database offered for sale. The roundup also covers a claimed Vedicline data leak, Langflow remote code execution, an ASUS breach claim, and energy-sector shell access sales. Details on record counts and victims were not provided in the excerpt.

SOCRadarSep 7, 09:20 UTC · 9d agoData breach