Search: “webtransport”

CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild

CVE-2026-85706, a CVSS 10.0 unauthenticated path traversal in GitLab CE/EE, is actively exploited and was added to CISA's KEV catalog.

GitLab patched CVE-2026-85706, a critical path traversal (CWE-22) in the repository commits API scoring CVSSv3.1 10.0, allowing unauthenticated arbitrary file reads on affected self-managed servers under certain conditions. CISA added it to the KEV catalog on September 11, 2026, citing active exploitation, with a September 14 remediation deadline and BOD 26-04 forensic triage requirements. Fixed versions are 19.1.8, 19.2.6, and 19.3.2; the release also fixes 17 other vulnerabilities including CVE-2026-87719, a CVSS 9.9 insecure deserialization flaw in GitLab EE.

Rapid7 Blog·updated Sep 15, 00:52 UTC · 2d ago·first Sep 14, 10:02 UTC · 2d agoExploit / PoC in the wild 18 sourcesCVE-2026-85706CVE-2026-877192

Apple iCloud Private Relay Can Expose Real IPs Through WebKit Proxy Bypasses

Researchers found WebKit features bypass proxies and iCloud Private Relay, leaking users' real IP addresses; Apple patched in iOS 26.6.1 and macOS 26.6.2.

Researchers Talal Haj Bakry and Tommy Mysk found that three WebKit features — DNS prefetching, WebAuthn Related Origin Requests, and WebTransport — bypass configured proxies and send traffic directly from the device. This leaks the user's real IP address in Safari and all WebKit-based iOS browsers and undermines iCloud Private Relay's dual-hop privacy design. Any website can trigger the leak via WebAuthn without user interaction or passkey use; a proof-of-concept site, leaks.psylo.app, demonstrates the issue. Apple investigated and patched the leaks in iOS 26.6.1 and macOS 26.6.2.

The Hacker News·Aug 30, 07:12 UTC · 17d agoVulnerability

Who’s Tracking You? Use This New Service to Find Out

KrebsOnSecurity covers DecryptAds, a free service that scrapes and correlates adtech data to reveal which entities track users across sites and apps.

KrebsOnSecurity wrote about DecryptAds, a free service that scrapes and correlates adtech data. The service makes it simple to identify which entities are responsible for ads shown on websites and data harvested by mobile apps, information that is semi-public but traditionally walled away inside large advertising platforms. No security incident is involved; the piece is an introduction to a privacy-research tool.

Krebs on Security·Aug 14, 11:24 UTC · Aug 14, 2026Tools

Heterogeneous Cross-Chain Transaction Tracing for Solana Bridges via Candidate-Set Selective Decision

SolTracer traces cross-chain transactions onto Solana bridges, improving open-world association F1 by 20.16% over the strongest baseline for illicit-fund tracing.

The paper formalizes four Solana-bound cross-chain transaction modes and proposes SolTracer, which maps heterogeneous execution semantics into a unified event space and uses candidate-set selective decision-making with abstention when valid targets are absent. In the challenging open-world setting with a 50% TA ratio, SolTracer improves F1 by 20.16% over the strongest baseline. An empirical study of real-world transfers examines count-value divergence across bridge mechanisms, cross-asset shifts, and decoupling between on-chain settlement and explorer visibility.

arXiv cs.CR·Sep 10, 11:43 UTC · 6d agoResearch

terms.txt: A Consent and Compensation Protocol for Agentic Web Access

terms.txt specifies a robots.txt-style protocol for per-path, per-purpose AI crawler consent and compensation, with enforcement adding 0.20-0.65 ms per request.

The paper documents that automated clients now make up most web requests, that training dominates Cloudflare-classified crawling, and that the largest AI platforms fetch thousands of pages per returned visitor while robots.txt cannot express identity, purpose, terms, or price. It specifies terms.txt plus an origin-enforced exchange using Web Bot Auth signatures, signed intent, delegation tokens, HTTP 402 negotiation, and signed receipts. A dependency-free implementation adds 0.20 to 0.65 ms per request on one vCPU.

arXiv cs.CR·Sep 10, 07:01 UTC · 6d agoResearch

CrossLink: Breaking Location Privacy by Linking Device Identifiers Across Protocols

Researchers present CrossLink, a passive tracing algorithm linking temporary device identifiers across LTE, WiFi, and BLE, reconstructing full traces for 83% of simulated users.

Smartphones emit temporary identifiers simultaneously over LTE, WiFi, and BLE, and per-protocol randomization defenses implicitly assume their protections compose across protocols. CrossLink is an uncertainty-aware tracing algorithm that stitches device identifiers across time, space, and protocols even when the adversary is fully passive and rotations are unsynchronized. In large-scale mobility simulation it reconstructs full traces for 83% of users versus 22% for the best single-protocol baseline. It remains effective under partial sniffer coverage, including strategically placed sniffers near LTE handover regions, mobile sniffers, and limited high-coverage subregions.

arXiv cs.CR·Sep 9, 09:51 UTC · 7d agoResearch

Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another

Forescout used Anthropic's Claude to port a working pre-auth RCE exploit for CVE-2021-31886 between WAGO PLCs, executing ARM shellcode on live hardware.

Forescout Vedere Labs used Claude interactively to port an RCE exploit for CVE-2021-31886, a CVSS 9.8 stack buffer overflow in the Nucleus FTP server's USER command, from a WAGO 750-852 to a WAGO 750-831 PLC, running attacker-supplied ARM shellcode. The final RCE stage cost $535.74 in API usage over 8 hours 32 minutes, and a follow-up attempt to build a C2 implant permanently bricked the device. CERT@VDE lists many Nucleus V1-based WAGO models as vulnerable with no updates available; Siemens plans no Nucleus NET remediation. The work follows a joint NSA/CISA/FBI/DOE/EPA advisory warning of AI-generated exploitation scripts targeting internet-exposed Siemens S7 PLCs.

The Hacker News·Sep 2, 07:47 UTC · 14d agoResearchCVE-2021-318862

AutoTrans: AI-Assisted Automatic Translation of Security Assertions for RISC-V Processors

AutoTrans uses LLMs with regex extraction and formal verification to automatically translate security assertions across RISC-V processors, achieving 78% unattended acceptance.

AutoTrans is an automated framework for translating verified security assertions between RISC-V processor targets, where manual translation takes hours per assertion. It combines a regex-based SystemVerilog signal extractor to prevent LLM signal hallucination, a pinned prompt template yielding byte-identical prompts resilient to model updates, and JasperGold FPV formal verification of generated assertions. Applied with DeepSeek V4 to translate assertions between RISC-V targets such as IBEX and NS31A, it achieves a 78% automatic translation acceptance rate without human intervention and 100% after human refinement.

arXiv cs.CR·Sep 9, 11:31 UTC · 7d agoResearch

Trends in Web Threats: Old Web Skimmer Still Active Today

Unit 42 detected 577,000 landing URL incidents in Q1 2022, with an old web skimmer family still actively stealing payment card data.

Palo Alto Unit 42 detected 577,275 landing URL incidents (116,643 unique) and 2,043,862 malicious host URL incidents (180,370 unique) between January and March 2022. Web threat volumes declined after the November 2021 holiday peak, but an old web skimmer family remained active. Business and economy sites overtook personal sites as the most common apparently benign entry points. Most malicious domains geolocated to the United States, Germany, and Russia, though proxy servers and VPNs obscure true locations.

Palo Alto Unit 42·Aug 17, 13:05 UTC · Aug 17, 2026Research

Siemens Teamcenter

Reflected XSS in Siemens Teamcenter /auth/ redirect flow lets unauthenticated attackers inject JavaScript into authenticated sessions (CVE-2026-58113).

CISA republished Siemens advisory SSA-157465 for CVE-2026-58113, a reflected cross-site scripting flaw (CVSS 6.1) in the /auth/ authentication redirect flow of Siemens Teamcenter V2412, V2506, V2512, and V2606. An unauthenticated attacker can craft a URL that injects arbitrary JavaScript into an authenticated user's browser, enabling data theft or actions within the victim's Teamcenter session. Fixed versions are available for all affected releases; Enzo Alvarez of Bishop Fox reported the vulnerability.

CISA Advisories·Sep 15, 12:00 UTC · 1d agoAdvisoryCVE-2026-58113

[webapps] C-MOR 6.0104 - Directory Traversal

A directory traversal proof-of-concept for video surveillance software C-MOR version 6.0104 has been published on Exploit-DB.

Exploit-DB entry 52666 discloses a directory traversal vulnerability in C-MOR version 6.0104, a video surveillance platform. The issue is listed under web application vulnerabilities. No CVE identifier or exploitation evidence is included in the listing.

Exploit-DB·Aug 31, 00:00 UTC · 17d agoExploit / PoC

Trends in Web Threats in CY Q2 2022: Malicious JavaScript Downloaders Are Evolving

Unit 42 detected 751,000 landing URL incidents in Q2 2022 and documented malicious JavaScript downloaders evolving to evade detection.

Unit 42 detected 751,331 landing URL incidents (253,644 unique) and 1,744,629 malicious host URL incidents (256,844 unique) from April through June 2022. Total landing URL incidents rose compared with Q1 2022, and unique host URL incidents grew 42%, indicating attackers deploying more variants. The report includes a case study of a JavaScript downloader campaign demonstrating new evasion techniques. Personal sites, blogs, and business sites were the top apparently benign entry points.

Palo Alto Unit 42·Aug 17, 13:05 UTC · Aug 17, 2026Research

Google’s new search redirects make links harder to check before you click

Google routes some search result links through encoded google.com/goto?url= redirects, breaking hover-to-verify link checks and raising scraping costs.

Google has started routing some search result links through opaque google.com/goto?url=... redirects using a custom Google-specific encoding, with the destination visible only via the redirect response's Location header. Google confirmed the rollout as an anti-abuse measure, most likely to make bulk extraction of destination URLs from search results more difficult and costly. Malwarebytes warns the change undermines the standard hover-before-clicking safety advice, while legitimate rank-tracking, SEO auditing, archival, and accessibility tools now face the same rate limits and costs as abusive scrapers.

Malwarebytes Labs·Sep 14, 14:17 UTC · 2d agoIndustry

You Get What You Sample: Evaluating Sampling Strategies for Web Security Measurements

Evaluation of 500k Tranco and 24.8M Common Crawl hosts shows Top-N domain sampling biases web security measurements; probability sampling yields unbiased estimates.

The study is the first comprehensive investigation of how sampling strategies affect web security measurement conclusions, comparing datasets and strategies across 500k Tranco domains and 24.8M Common Crawl hosts. It shows Top-N selection does not reflect the overall web distribution and may bias observed vulnerability rates, while probability-based strategies yield stable, unbiased prevalence and impact estimates. Hybrid sampling offers no advantage because its deterministic prefix consistently hurts accuracy, and the authors propose an adaptive probability-based strategy effective even when target prevalence is unknown.

arXiv cs.CR·Sep 10, 08:21 UTC · 6d agoResearch1

[webapps] CubeCart 6.7.4 - Stored XSS

A proof-of-concept stored cross-site scripting exploit targeting CubeCart 6.7.4 was published on Exploit-DB.

Exploit-DB lists a proof-of-concept exploit for a stored cross-site scripting (XSS) vulnerability in CubeCart 6.7.4, a PHP-based e-commerce web application. The listing demonstrates injection of attacker-controlled script that persists in the application, but no exploitation in the wild or CVE assignment is reported in the provided text.

Exploit-DB·Aug 31, 00:00 UTC · 17d agoExploit / PoC1

Google’s New Search Redirects Make It Harder to Check Where Links Lead Before Clicking

Malwarebytes reports Google's new encoded google.com/goto?url= redirects break hover-preview link checking, weakening a common phishing defense.

Google now routes some search results through opaque google.com/goto?url= redirects using custom encoding, so browser link previews no longer reveal the true destination, only the claimed label above the result. Malwarebytes found the final destination is visible only in the redirect response's Location header, complicating hover-based safety checks as well as scraping, archiving, and audit tools. The change arrives amid malvertising, search-result poisoning, and fake installer campaigns like the recent Node.js infostealer lure. Google says it deploys measures against evolving abuse but did not explain the change.

Cyber Security News·Sep 15, 12:21 UTC · 1d agoResearch

TRACE: Trajectory-robust Admission with Evidence Ordering for Efficient GUI Agents

TRACE, a training-free visual token pruning framework, cuts GUI agent inference latency and memory while keeping trajectory-wide visual evidence reusable.

TRACE is a training-free framework for trajectory-robust admission and coverage-aware evidence ordering that prunes high-resolution screenshot tokens accumulated in GUI agent trajectories. It ranks visual evidence using a query-independent layout-derived interaction prior combined with instruction relevance and feature novelty, and reserves part of the budget for native tokens distributed across the screen to repair spatial coverage. A monotone KV contraction incrementally compresses retired frames into compact session state, avoiding repeated visual encoding or pruning. Experiments across six GUI benchmarks and diverse models verify effectiveness under tight budgets, with source code to be released.

Hugging Face daily papers·Sep 8, 20:00 UTC · 8d agoAI research

[webapps] webpack_devserver 5.2.5 - CSRF

Exploit-DB published a cross-site request forgery proof of concept for webpack_devserver 5.2.5.

Exploit-DB lists a webapps CSRF proof-of-concept against webpack_devserver version 5.2.5. The flaw affects the local webpack development server, where cross-site requests could be issued against it. No CVE id is cited in the entry and no active exploitation is reported.

Exploit-DB·Aug 17, 00:00 UTC · Aug 17, 2026Exploit / PoC

$536 and 8 Hours: AI Learns to Attack a Different PLC

Forescout used Claude to port a WAGO PLC exploit for $536 in 8 hours, and an AI-generated payload later permanently bricked the test device.

Forescout researchers used Claude Code with Ghidra, terminal access, and physical hardware to port CVE-2021-31886, a pre-authentication buffer overflow in the Nucleus FTP server, from a WAGO 750-852 PLC to the WAGO 750-831 without source code or debugger access. The final RCE development stage cost $535.74 in API fees over an 8-hour, 32-minute session (2.6k input and 1.3M output tokens) and required heavy researcher guidance. Claude produced working ICMP and UDP beacon exploits in 12 minutes after identifying that normal FTP command completion was overwriting its shellcode, fixed by omitting the CRLF terminator. A follow-up session extending the payloads toward a C2 implant wrote to flash-mapped memory and permanently bricked the PLC, underscoring the risks of autonomous agents operating against physical infrastructure.

Security Affairs·Sep 2, 13:50 UTC · 14d agoResearchCVE-2021-318861

Telegram Desktop Flaw Lets Hidden JavaScript Exfiltrate Messages From HTML Exports

Telegram Desktop HTML export XSS (CVSS 8.2) let bot messages exfiltrate exported chats; fixed in 7.0.1 but old exports stay vulnerable.

ExPatch researchers found that Telegram Desktop versions 4.15.1 (March 2024) through 6.9.3 wrote bot inline-keyboard button text into HTML chat exports without escaping, allowing a bot to plant invisible JavaScript. When a user opened the export in a browser, the script could exfiltrate every message in that 1,000-message file, rewrite the displayed content, or fake a verification form. The flaw (rated CVSS 3.1 8.2) was fixed by commit 8457d13a in 6.9.4 beta (July 3, 2026) and 7.0.1 stable (July 14, 2026), but pre-fix exports remain dangerous since updating the app does not fix old files. No CVE identifier or Telegram security advisory exists, and no exploitation in the wild is claimed.

The Hacker News·updated Sep 15, 09:47 UTC · 1d ago·first Sep 14, 17:58 UTC · 2d agoVulnerability 2 sources1

[webapps] CubeCart 6.7.4 - Cross-Site Scripting

A cross-site scripting exploit targeting CubeCart 6.7.4 web applications was published on Exploit-DB as entry 52661.

Exploit-DB listing 52661 discloses a cross-site scripting vulnerability in CubeCart version 6.7.4, classified under webapps. The listing makes a public exploit available, but no CVE id, exploitation evidence, or vendor patch status is provided in the item text.

Exploit-DB·Aug 31, 00:00 UTC · 17d agoExploit / PoC

Webinar Today: Keep Pace With AI – A New Operating Model for Endpoint Remediation

SecurityWeek and Automox host a webinar on accelerating endpoint vulnerability remediation through automation and governance policies.

The 20-minute webinar promotes 'Frontier Pace Governance,' an approach to balancing automation, policy, and business risk in endpoint patching. It is vendor marketing content co-hosted with Automox, covering visibility, remediation automation, and patching SLAs.

SecurityWeek·Sep 10, 13:30 UTC · 6d agoIndustry

Cybersecurity IR Workshop: The workshop you shouldn’t miss

Microsoft's DART team promotes a 2-3 day Cybersecurity Incident Response Readiness Workshop that stress-tests IR plans against simulated attacks.

Microsoft's Detection and Response Team (DART), which delivers Defender Experts incident response and has supported organizations across 54 countries, is offering its Cybersecurity Incident Response Readiness Workshop. The scenario-driven engagement exercises detection, investigation, containment, and decision-making across identity, endpoint, cloud, and communications, ending with prioritized recommendations. It is available to Unified Enterprise agreement customers via their Customer Success Account Manager.

Microsoft Security Blog·Sep 1, 18:55 UTC · 15d agoIndustry

Google Search Makes It Harder to See Where a Link Really Goes Before You Click

Google now routes some Search results through opaque google.com/goto redirects, weakening hover-to-verify anti-phishing checks.

Google has begun serving some organic search results as opaque google.com/goto?url= redirects whose destinations can only be resolved server-side by Google, likely to raise scraping costs for rank trackers and archival services. The change removes the pre-click hover preview of the true destination URL, undermining a long-standing anti-phishing habit for spotting lookalike, typosquatted, or search-optimized phishing domains. Security teams are advised to rely on layered defenses such as domain reputation, DNS and web filtering, browser isolation, and user training rather than hover text.

GBHackers·Sep 15, 13:42 UTC · 1d agoIndustry

VU#614868: OpenCart ecommerce platform contains directory traversal vulnerability

OpenCart 4.2.0.0 extension installer fails to validate zip extraction paths, allowing directory traversal (CVE-2026-18412) to write files outside intended directories.

CERT/CC VU#614868 discloses CVE-2026-18412, a directory traversal vulnerability in OpenCart v4.2.0.0's extension installer. The installer extracts uploaded .ocmod.zip files using zip entry filenames as filesystem paths without verifying the resolved path stays inside the intended directory. A malicious extension zip could result in arbitrary file writes outside the target directory.

CERT/CC Vulnerability Notes·Aug 10, 14:47 UTC · Aug 10, 2026VulnerabilityCVE-2026-184121

HarnessVLN: Unifying Training-Free Embodied Navigation through an Agent Harness

Researchers introduce HarnessVLN, a zero-shot training-free agent harness that sets new training-free SOTA on vision-language navigation benchmarks including R2R and HM3D.

HarnessVLN is a zero-shot, training-free framework for embodied vision-language navigation that coordinates perception, retrieval, grounding, navigation, recovery, and termination through a unified tool interface. It validates planner proposals against spatial evidence, geometric feasibility, and subgoal consistency, using hierarchical event memory and a persistent Spatiotemporal Graph that stores reusable spatial evidence and failure annotations. It reports success rates of 60.8% on R2R, 53.9% on RxR, 76.0% on HM3D-v2, and 59.3% on HM3D-OVON, surpassing prior training-free state of the art, with real-world humanoid deployment demonstrated.

Hugging Face daily papers·Sep 13, 20:00 UTC · 3d agoAI research

⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More

Weekly recap: actively exploited Chrome V8 zero-day, MikroTik RouterOS zero-day chain, Magento StyleSmuggler backdoor, and critical N-able N-central flaws.

Google patched an actively exploited Chrome V8 type confusion zero-day, CVE-2026-85046 (CVSS 8.8), the sixth exploited Chrome zero-day of 2026. CERT Polska warned of the MikroTrick exploit chain (CVE-2026-67276 and CVE-2026-86060, CVSS 9.2) giving unauthenticated full control of MikroTik RouterOS devices via SSH, observed since September 2. Sansec disclosed the StyleSmuggler Magento/Adobe Commerce zero-day used since September 4 to inject a Rust backdoor into online stores, while N-able patched three critical N-central flaws (CVE-2026-86206, CVE-2026-86207, and CVE-2026-86218, CVSS 10.0) with Huntress observing likely exploitation. Elastic and Morphisec also detailed RevStealer, an information stealer spread via game cheats and a fake Claude Desktop app.

The Hacker News·Sep 7, 14:36 UTC · 9d agoExploit / PoC in the wildCVE-2026-85046CVE-2026-86206CVE-2026-86207+7 CVEs

[Webinar] Tales from the Frontlines: An exclusive briefing on Q2 incidents

Cisco Talos·Aug 3, 16:00 UTC · Aug 3, 2026Ransomware

Exploits in the Wild for Citrix ADC and Citrix Gateway Directory Traversal Vulnerability CVE-2019

Unit 42 confirmed in-the-wild exploitation of CVE-2019-19781, a critical Citrix ADC/Gateway directory traversal flaw enabling unauthenticated file access and RCE.

CVE-2019-19781, a CVSS 9.8 directory traversal vulnerability, affects all supported versions of Citrix ADC and Citrix Gateway. Unit 42 captured multiple exploitation attempts in the wild and identified scanning activity from roughly 700 Shodan-exposed hosts. The flaw stems from improper pathname handling in Apache, allowing unauthenticated attackers to read sensitive files like smb.conf or achieve remote code execution via crafted XML. Palo Alto Networks released Threat Prevention signatures 57497 and 57570 on January 7, 2020, while Citrix published advisories CTX267027 and CTX267679 with responder policy mitigations pending a late-January patch.

Palo Alto Unit 42·Aug 17, 13:07 UTC · Aug 17, 2026Exploit / PoC in the wildCVE-2019-19781