Search: “zero-cost-proxies”

26 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll

SeverityAll critical 0 high 0 medium 0 low 0 info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

ZDI-26-673: Adobe Acrobat Pro DC Doc Object Use-After-Free Remote Code Execution Vulnerability

ZDI disclosed CVE-2026-81988, a use-after-free in Adobe Acrobat Pro DC document object handling that enables remote code execution.

Zero Day Initiative advisory ZDI-26-673 describes a use-after-free vulnerability in the document object handling of Adobe Acrobat Pro DC. Arbitrary code execution is possible when a target opens a malicious file or visits a malicious page. The flaw received a CVSS rating of 7.8. No in-the-wild exploitation is reported.

ZDI Published AdvisoriesSep 10, 05:00 UTC · 6d agoVulnerability 19 sources CVE-2026-81988

Apple iCloud Private Relay Can Expose Real IPs Through WebKit Proxy Bypasses

Researchers found WebKit features bypass proxies and iCloud Private Relay, leaking users' real IP addresses; Apple patched in iOS 26.6.1 and macOS 26.6.2.

Researchers Talal Haj Bakry and Tommy Mysk found that three WebKit features — DNS prefetching, WebAuthn Related Origin Requests, and WebTransport — bypass configured proxies and send traffic directly from the device. This leaks the user's real IP address in Safari and all WebKit-based iOS browsers and undermines iCloud Private Relay's dual-hop privacy design. Any website can trigger the leak via WebAuthn without user interaction or passkey use; a proof-of-concept site, leaks.psylo.app, demonstrates the issue. Apple investigated and patched the leaks in iOS 26.6.1 and macOS 26.6.2.

The Hacker NewsAug 30, 07:12 UTC · 17d agoVulnerability

Evaluating Practical Enumeration and Blocking Attacks on the Snowflake Circumvention System

Ethical measurements enumerated 21,000+ Snowflake proxy IPs across ~1,000 ASes; blocking top 1% of ASes disrupts 30% of Snowflakes.

Researchers tested Snowflake's assumptions that proxy IPs cannot be easily enumerated and that blocking them causes unacceptable collateral damage. Over 48 days of real-world measurements (May-June 2025), malicious-client-style enumeration collected over 21,000 unique proxy IPs across almost 1,000 autonomous systems. Blocking the top 1% of ASes blocks more than 30% of observed Snowflakes while affecting about 2.5% of Tranco Top 1M domains, and the broker's load-aware matching leaks stable high-capacity proxies to attackers. Some proposed mitigations have already been integrated into Snowflake.

arXiv cs.CRSep 10, 22:01 UTC · 6d agoResearch1

Zero trust AI agents demand a different kind of security

Teleport's Chris Webber argues zero trust must extend to AI agents through trusted runtimes with zero initial privileges and continuous per-action enforcement.

In an interview, Teleport VP of Product Marketing Chris Webber says point-in-time authentication and static least privilege fail for agents that act fast, unpredictably, and continuously, sometimes spawning dozens of clones with the credentials of the human who invoked them. Teleport Trusted Runtimes give each agent a unique attestable identity, zero starting privileges, and expiration after task completion to eliminate standing privilege and stored data. Teleport Identity Security monitors agent actions against declared objectives in real time, intervening up to termination and runtime destruction, replacing anomaly-based ITDR detection with continuous enforcement.

Help Net SecuritySep 7, 00:00 UTC · 10d agoAI safety & security

Almost Half of Malware Samples Communicate Direct to IP

Unit 42 analysis of 4 million malware reports finds 45% of C2-active samples connect directly to hard-coded IPs, bypassing DNS defenses.

Palo Alto Unit 42 analyzed over 4 million Advanced WildFire dynamic analysis reports and found that 45.32% of malware samples with C2 activity made at least one direct-to-IP connection, accounting for 23.17% of all C2 connection attempts. The firm proposes zero trust IP (ZT-IP), an enforcement approach that verifies whether outbound destinations were ever sanctioned by a DNS response. ZT-IP analysis surfaced Phorpiex ransomware droppers fetching payloads directly from C2 IPs, a persistent data exfiltration campaign using an obfuscated \GET protocol, and Mozi P2P botnet payloads delivered to IoT devices without DNS. Only 1% of benign samples connected directly to untrusted IP addresses.

Palo Alto Unit 42Aug 17, 12:45 UTC · Aug 17, 2026Research

Show HN: Check if your IP has appeared in a residential proxy network

Spur Intelligence launches Have I Been Proxied, a free tool that checks if your public IP appeared in residential proxy networks.

Have I Been Proxied is a free one-click web tool that checks whether a user's public IP has been observed routing traffic in residential proxy networks. Devices can be silently enrolled via apps, browser extensions, VPNs, or smart TVs, and the tool offers guidance on which apps and devices to investigate. It is powered by Spur Intelligence's network intelligence data, which serves fraud and trust teams detecting residential proxies, VPNs, and anonymization infrastructure.

Hacker News · securitySep 15, 14:24 UTC · 1d agoTools HN 20↑ · 10 comments

Guppy: Efficient Light Clients via Recursive Zero-Knowledge Proofs

Guppy lets blockchain light clients verify full state via recursive zero-knowledge proofs without validators maintaining state commitments, processing thousands of updates per second.

Guppy is a light-client protocol in which validators commit only to state updates while an off-chain, untrusted service secured by recursive zero-knowledge proofs maintains a verifiable Merkle tree over the full state. A hash-chain commitment moves validator signature verification out of the proving circuit, and a parallel recursive proving pipeline keeps latency growth logarithmic with throughput. A Plonky2-based implementation maintains a tree of size 2^30 while processing thousands of updates per second, adding only 2-4 seconds of latency without increasing block-construction complexity.

arXiv cs.CRSep 7, 20:41 UTC · 9d agoResearch

ZK-Trace: Certified Collusion Tracing with Zero-Knowledge Credentials for Federated GNSS Interference Monitoring

ZK-Trace combines Tardos fingerprints and zero-knowledge credentials to trace leaked classifier copies in federated GNSS monitoring without leaker cooperation.

ZK-Trace addresses leakage of a proprietary classifier distributed to partly trusted stations in federated GNSS interference monitoring, combining public identity marks, recipient-specific Tardos fingerprints, and zero-knowledge credential verification to support offline tracing. The paper provides false-accusation and tracing-score bounds with an interval-arithmetic checker allocating a common budget across accusation and tamper decisions. In a simulated GNSS federation it isolates all 160 single-owner copies and traces 712 of 720 two-owner mixtures with a 0.001 false-naming budget, while feature marks survive feature matching in 20/20 runs at 4.8 percentage-point accuracy cost but are erased by function-only distillation.

arXiv cs.CRSep 8, 14:00 UTC · 8d agoResearch

SpecGuard: Inference-Time Backdoor Detection For Free

SpecGuard detects backdoored LLM behavior at inference time using speculative decoding acceptance rates, adding no extra model computation.

Researchers propose SpecGuard, an inference-time backdoor detector that repurposes draft-token acceptance rates from speculative decoding as a detection signal at zero added model-computation cost. When a trigger shifts the target model toward attacker-controlled behavior, the clean draft model's acceptance rate changes, exposing the backdoor; the paper formalizes when this signal appears and shows suppressing it weakens the backdoor. Experiments across diverse backdoor types and model families show reliable detection, including stealthy cases invisible to input-level filters. Speculative decoding is positioned as a free, always-on monitor for frequently updated deployed models.

arXiv cs.CRSep 10, 16:51 UTC · 6d agoAI safety & security 2 sources2

Subject: CVE-2026-2035703: Tozed ZLT X300 5G CPE — Unauthenticated Remote Root Code Execution via TR-069 Command Injection (CVSS 9.8)

Tozed ZLT X300 5G CPE firmware 6.01.3 has an unauthenticated TR-069 command injection (CVE-2026-2035703, CVSS 9.8) enabling root code execution.

Tozed ZLT X300 5G CPE router firmware 6.01.3 contains an OS command injection (CWE-78) in the TR-069/CWMP client daemon netcwmpd, tracked as CVE-2026-2035703 with CVSS 9.8. The IPPingDiagnostics Host parameter is passed unsanitized into sprintf, and the resulting shell command executes via system_by_root() as root. An attacker operating a rogue LTE base station built from roughly $300 of SDR hardware can impersonate the carrier's Auto Configuration Server and inject arbitrary commands. The disclosure does not report any observed exploitation.

Full DisclosureSep 8, 17:30 UTC · 8d agoVulnerability CVE-2026-2035703

Free streaming boxes may be routing criminal traffic through your home

Researchers found SuperBox streaming boxes and the CyberFlix TV app enroll home connections into the Popanet residential proxy network, routing criminal traffic.

Researchers found that SuperBox devices and the CyberFlix TV app, distributed through SuperBox's custom app store, contain Popanet proxy functionality that registers the device with servers controlled by the proxy operator, enrolling household connections into residential proxy networks. The reported configuration weakens Android safeguards with exposed ADB access, root-level privileges without authentication, and removal of app-install protections. Plume's research warns these proxy networks can also function as malware-delivery platforms, and the FBI notes foreign entities use residential proxies to conceal activity such as credential stuffing and account abuse. Malwarebytes advises disconnecting and replacing affected SuperBox/CyberFlix devices rather than factory-resetting them.

Malwarebytes LabsSep 4, 09:20 UTC · 12d agoMalware in the wild

You Get What You Sample: Evaluating Sampling Strategies for Web Security Measurements

Evaluation of 500k Tranco and 24.8M Common Crawl hosts shows Top-N domain sampling biases web security measurements; probability sampling yields unbiased estimates.

The study is the first comprehensive investigation of how sampling strategies affect web security measurement conclusions, comparing datasets and strategies across 500k Tranco domains and 24.8M Common Crawl hosts. It shows Top-N selection does not reflect the overall web distribution and may bias observed vulnerability rates, while probability-based strategies yield stable, unbiased prevalence and impact estimates. Hybrid sampling offers no advantage because its deterministic prefix consistently hurts accuracy, and the authors propose an adaptive probability-based strategy effective even when target prevalence is unknown.

arXiv cs.CRSep 10, 08:21 UTC · 6d agoResearch1

ZDI-26-583: Clam AntiVirus 7z Archive Parsing Integer Overflow Remote Code Execution Vulnerability

Zero Day Initiative discloses CVE-2026-20215, an integer overflow in ClamAV's 7z archive parsing enabling remote code execution, rated CVSS 8.4.

The Zero Day Initiative published ZDI-26-583 for an integer overflow in Clam AntiVirus's 7z archive parsing. A remote attacker can execute arbitrary code when the antivirus processes a crafted archive, with attack vectors varying by implementation. The flaw is tracked as CVE-2026-20215 and rated CVSS 8.4. The advisory does not mention active exploitation.

ZDI Published AdvisoriesAug 13, 05:00 UTC · Aug 13, 2026Vulnerability CVE-2026-202151

New AI Attack Hides Malicious Instructions in Normal-Looking Text to Evade Safety Filters

Check Point researchers show crafted prose hides policy-violating instructions that bypass all tested LLM gatekeepers, including GPT-4o mini and Llama Guard 3.

A new prompt-crafting technique embeds malicious payloads inside grammatical, natural-looking text without Base64, invisible Unicode, or obvious encodings, defeating lightweight pre-screening gatekeepers. In testing, all four evaluated gatekeeper models—gpt-4o-mini-2024-07-18, gpt-oss-safeguard:20b, claude-3-haiku-20240307, and llama-guard3:8b—classified the crafted wrappers as safe at a 100% bypass rate across 23 obfuscated prompts. GPT-5 Thinking in high-reasoning mode recovered and acted on the hidden instruction in 17 of 18 tests (~94.4%), often spending over a minute and multiple Python executions. Researchers recommend paraphrasing untrusted input, hardening gatekeeper policies, and applying defense-in-depth controls for agentic deployments.

GBHackersSep 11, 05:53 UTC · 5d agoAI safety & security 2 sources

Don't Trust the Super-App: A Case Study of Russia's Max

Researchers show super-apps like Russia's Max can silently capture mini-app UI, storage, network traffic, and authentication, enabling untraceable user impersonation.

The paper challenges the assumption that super-apps are trusted intermediaries, citing WeChat's passive cross-mini-app tracking, Russia's Max's entanglement with state prosecution of online speech, and Iran's Bale operating during a prolonged internet shutdown. Using Max as a case study, the authors demonstrate that a super-app can capture mini-app UI, read and write mini-app local storage, inject arbitrary JavaScript into mini-app runtimes, mediate network traffic, and control authentication context, enabling silent user impersonation without trace. They argue these capabilities are inherent to the super-app architecture and call for mobile OS and app store interventions to close the blind spot.

arXiv cs.CRSep 10, 17:08 UTC · 6d agoResearch1

Zero-Day Flaw in TP-Link Cameras Enables Eavesdropping

OPSWAT disclosed two zero-days in TP-Link Tapo C200 cameras: CVE-2026-15315 authentication replay bypass enabling surveillance and CVE-2026-15316 denial-of-service, both patched in firmware.

OPSWAT found two zero-days in the TP-Link Tapo C200 camera, widely used for baby/pet monitoring and SOHO security: CVE-2026-15315, an authentication bypass via replay granting administrative access without the password, and CVE-2026-15316, an unauthenticated denial-of-service that crashes the camera's HTTPS service via oversized encrypted credentials. Both were fixed in firmware version V5_1.4.6 released August 18. A third, still-unpatched zero-day rated critical could allow full camera compromise for use as a network foothold; details await an available fix.

Infosecurity Magazineupdated Sep 16, 13:27 UTC · 14h agofirst Sep 16, 10:00 UTC · 17h agoVulnerability 3 sources CVE-2026-15315 CVE-2026-15316

Access Control as Verified Parse Constraints

Researchers verify a class of EverParse validators that correctly enforce access-control policies, deploying a machine-checked enforcement gate on seL4.

The paper targets enforcement-code bugs in commercial security gateways by proving that forward-only, backtrack-free EverParse validators are verified recognizers for a bounded finite-state class that includes access-control decision functions with fixed-offset fields and bounded disjunction. Encoding a bounded policy language into a fixed-size byte buffer allows an SMT solver to verify the enforcement code once, covering all byte values, policies, requests, and sessions. Editing rule content over a fixed endpoint set requires no new proof, while adding endpoints reruns the toolchain. A deployment on the seL4 microkernel ensures every request passes through the gate and unverified components cannot corrupt the enforcement chain.

arXiv cs.CRSep 11, 06:33 UTC · 5d agoResearch1

You've Got a BUD in Me: Authenticated Reads from Per-Block Write Logs

Researchers propose BUD, per-block write-log digests enabling blockchain validators to serve historical membership and exclusion proofs far cheaper than state-wide tries.

The paper introduces Block Update Digests (BUD), which authenticate each block's write log with predecessor pointers, plus a SuperBUD and exponential hierarchy to turn long unchanged intervals into short proofs. Soundness against adversarial provers and up to f Byzantine validators is proven under archive, attestation, and committee evidence assumptions. Benchmarks show a 50x state-size increase raises the base-BUD path only 1.24x versus 3.1x for in-memory and 69.5x for disk-backed Merkle Patricia tries, with read payloads below 800 bytes and p99 warm verification at 146 microseconds.

arXiv cs.CRSep 10, 08:46 UTC · 6d agoResearch

Understanding the Privacy-Preserving Potential of HTTP/2 Against Webpage Fingerprinting

Researchers show HTTP/2 features can emulate website fingerprinting defenses like FRONT and Tamaraw with tunable privacy-overhead trade-offs.

An arXiv paper demonstrates that application-layer defenses such as HTTPOS, LLaMA, FRONT, ALPaCA, and Tamaraw can be emulated through HTTP/2 features at both the client and server side, including proactive resource suggestion, multiplexing, and flow control. The authors propose a unified evaluation blueprint that calibrates defense parameters per dataset, combines practical attacks with information-theoretic leakage estimators, and measures overheads to map each defense's privacy-overhead trade-offs.

arXiv cs.CRSep 4, 13:16 UTC · 12d agoResearch

Researchers Build WeChat Zero-Click Worm Hijacking Phones via Calls

Calif researchers built WeWorm, a zero-click worm exploiting a WeChat VoIP memory-corruption RCE that Tencent has now patched.

Calif researchers found a memory corruption flaw in WeChat's VoIP stack in July using LLM-assisted analysis and built working exploits within two days, then integrated them into WeWorm, which they call the first zero-click worm spreading through WeChat calls on iOS and Android. A crafted incoming call yields remote code execution with no user interaction, giving full control of the victim's WeChat account; the attacker only needs to be on the victim's friend list, easily achieved by compromising a contact first. Tencent confirmed the bug and shipped patches in WeChat Android 8.0.77 and iOS 8.0.76, and chaining with other OS bugs could yield full device control.

Infosecurity MagazineSep 9, 15:00 UTC · 7d agoExploit / PoC

Zero Day Initiative — CVE-2026-33824: Remote Code Execution in Windows ...

ZDI details CVE-2026-33824, a double-free in Windows IKEv2 fragment reassembly enabling unauthenticated remote code execution as SYSTEM on Windows.

Zero Day Initiative published technical analysis of CVE-2026-33824, a double-free in the Windows IKE Extension (ikeext.dll) caused by improper ownership handling of a heap blob pointer during IKEv2 fragment reassembly in IkeReinjectReassembledPacket(). A remote unauthenticated attacker can send a crafted IKE_SA_INIT message with a Security Realm Vendor ID followed by fragmented IKE_AUTH payloads to trigger the double free. Successful exploitation could yield arbitrary code execution under the IKEEXT service context (SYSTEM). ZDI also provided IDS detection guidance correlating the two-packet sequence on UDP ports 500 and 4500.

Web discovery (articles for new exploits & KEV entries)Sep 7, 19:06 UTC · 9d agoVulnerability CVE-2026-33824

Lightweight Zero Trust via Automotive SDN

Researchers map automotive SDN with MACsec/MKA and CORECONF/YANG to NIST SP 800-207, satisfying five of seven Zero Trust tenets without added infrastructure.

Zonal in-vehicle networks ship Ethernet, MACsec, and TSN but treat the network itself as trusted, with no standardized runtime way to revoke access, rotate keys, or contain a compromised ECU. The paper first analyzes what Open Alliance TC17 v1.0 MACsec/MKA with pre-shared CAKs already provides against the seven NIST SP 800-207 Zero Trust tenets. It then adds CORECONF/YANG management per Open Alliance TC19, mapping the SDN Controller and Agents one-to-one onto NIST's PE, PA, and PEP, and instantiates a YANG-based network-access-control flow and key-management scheme. The result fully covers five of the seven tenets and partially covers two, without any ZTA-specific infrastructure.

arXiv cs.CRSep 9, 07:20 UTC · 7d agoResearch

Testing race conditions with memory access tracing and stack-based delay injection

Google Project Zero released MAccConc, Linux kernel tooling that traces memory accesses to explore and test race condition interleavings.

A Google Project Zero researcher published MAccConc (Memory Access Concurrency), tooling for exploring possible interleavings of multithreaded test cases in the Linux kernel, available on GitHub. The tools use KCOV with ASAN outline-mode instrumentation to record per-access memory traces, enabling automatic testing of all A-B-A interleavings plus terminal and GUI explorers for manual analysis. The work targets confirming race condition candidates, building reliable regression tests, and enabling concurrency fuzzing, drawing on ideas from SKI and Ned Williamson's sockfuzzer.

Google Project ZeroSep 8, 07:00 UTC · 8d agoResearch1

GAUGE: A Formal Framework for Measuring Cryptographic Security under Heterogeneous Adversary Cost Models

GAUGE frames cryptographic security as profiles over adversary cost models, certifying a ranking reversal between ML-KEM-512 and AES-128 from a 4–5% memory pricing shift.

GAUGE represents cryptographic security as a function over admissible adversary cost models (a security profile), proves profiles are piecewise-linear and concave, and establishes a rating trilemma when two profiles cross. A polynomial-time linear-programming procedure certifies whether the ranking of two schemes is robust, reverses under admissible models, or is genuinely incomparable. Applied to NIST post-quantum standards, the framework certifies a ML-KEM-512 versus AES-128 ranking reversal from a 4–5% shift in memory pricing and measures lattice-sieving cost drift of 9.79 bits per year over eight years. A hybrid X25519 + ML-KEM-768 handshake reduces combined-break probability twenty-fold at a 2.3 kilobyte cost.

arXiv cs.CRSep 15, 14:55 UTC · 1d agoResearch

Zero-Click Grok Chat History Theft: Adversa AI Demonstrates Cryptographic Context Injection

Adversa AI's Cryptographic Context Injection bypasses AI guardrails using AES-encrypted payloads, enabling zero-click theft of Grok users' full chat histories.

Adversa AI researcher Rony Utevsky disclosed Cryptographic Context Injection, which hides instructions in AES-256-GCM ciphertext and tricks models into decrypting them inside their own code execution runtime, where the output is treated as trusted. Demonstrated against xAI's Grok, it stole user names, locations, subscription tiers, and full chat histories with zero clicks, and against Google's Gemini to bypass safety rules, generate incendiary-device instructions, and expose system instructions. Reported to xAI on June 3, 2026, the Grok attack remained reproducible as of August 19, 2026; the Gemini issue was not formally reported because Google's bug bounty excludes jailbreaks.

Security AffairsAug 23, 07:20 UTC · 24d agoAI safety & security

CVE-2026-79993: Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode

Critical ZooKeeper flaw lets any authenticated client delete arbitrary empty persistent or container znodes by bypassing ACL checks.

CVE-2026-79993 (critical severity) affects Apache ZooKeeper 3.9.0-3.9.5 and 3.8.0-3.8.6. The deleteContainer opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific empty znodes in the data tree regardless of ACL restrictions on the znode or its parent. This can corrupt coordination state for dependent distributed systems like Kafka, HBase, or Solr clusters relying on ZooKeeper.

oss-securitySep 15, 18:24 UTC · 1d agoVulnerability CVE-2026-79993