Search: “realme”

152 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 89 Ransomware 79 Malware 67 Data breach 60 Exploit / PoC 56 Policy & legal 46 Industry 42 Threat actor 32 Phishing & fraud 27 AI tools & infra 7 AI safety & security 7 Research 7 Advisory 6 AI research 4

SeverityAll critical 202 high 152 medium 88 low 73 info 17

Zero Day Initiative — CVE-2026-33824: Remote Code Execution in Windows ...

ZDI details CVE-2026-33824, a double-free in Windows IKEv2 fragment reassembly enabling unauthenticated remote code execution as SYSTEM on Windows.

Zero Day Initiative published technical analysis of CVE-2026-33824, a double-free in the Windows IKE Extension (ikeext.dll) caused by improper ownership handling of a heap blob pointer during IKEv2 fragment reassembly in IkeReinjectReassembledPacket(). A remote unauthenticated attacker can send a crafted IKE_SA_INIT message with a Security Realm Vendor ID followed by fragmented IKE_AUTH payloads to trigger the double free. Successful exploitation could yield arbitrary code execution under the IKEEXT service context (SYSTEM). ZDI also provided IDS detection guidance correlating the two-packet sequence on UDP ports 500 and 4500.

Web discovery (articles for new exploits & KEV entries)Sep 7, 19:06 UTC · 9d agoVulnerability CVE-2026-33824

Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account

Red Hat patched critical Keycloak flaw CVE-2026-18963 (CVSS 9.1) allowing unauthenticated attackers to take over any account, including administrative ones.

Keycloak and Red Hat patched CVE-2026-18963, a CVSS 9.1 flaw (CWE-640) caused by improper state validation in the reset-credentials flow, letting an unauthenticated remote attacker force a password reset without the emailed action token and achieve full account takeover, including admin accounts. Upstream Keycloak 26.7.2 and Red Hat Build of Keycloak 26.4.15/26.6.6 contain fixes; four RHSA errata were issued August 18, 2026. No evidence of exploitation or public exploits exists as of August 24, 2026; mitigation is disabling the Forgot Password feature in all realms.

The Hacker NewsAug 24, 11:56 UTC · 23d agoVulnerability CVE-2026-18963 CVE-2026-15571

New infosec products of the week: July 31, 2026

Help Net SecurityJul 31, 00:00 UTC · Jul 31, 2026Policy & legal in the wild

Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access

Unisoc modem firmware flaw CWE-1189 allows VoLTE video call RCE chain to gain full Android kernel access on T606/T612/T7250 chipsets; no patch yet.

SSD Secure Disclosure published the second stage of an exploit chain, first disclosed in March 2026, that achieves full Android kernel access on Unisoc modem firmware via a VoLTE video call. The privilege-escalation flaw, classified as CWE-1189 (Improper Isolation of Shared Resources on System-on-a-Chip), exploits shared physical memory between modem and application processor with no hardware boundary, letting modem code map the entire 32-bit address space and modify Android kernel pages via ARM Memory Protection Unit registers. Confirmed affected chipsets include Unisoc T606 (Motorola E13), T612 (Realme C33), and T7250 (Xiaomi Redmi A5), sold across more than 140 countries. No CVE has been assigned, the August 2026 Android Security Bulletin does not address it, and Unisoc has not responded to researchers; exploitation requires an attacker-controlled private 4G network and a victim answering the call.

The Hacker NewsAug 17, 10:52 UTC · Aug 17, 2026Vulnerability CVE-2025-31718 CVE-2022-20210

What is OSINT? Open Source Intelligence Explained

Recorded FutureJun 10, 00:00 UTC · Jun 10, 2026Threat actor

SolarWinds Attribution: Getting Ahead of Ourselves?

Recorded FutureJun 27, 00:00 UTC · Jun 27, 2025Malware

Protecting Tomorrow's World: Shaping the Cyber

The Hacker NewsDec 4, 17:03 UTC · Dec 4, 2024Ransomware

Offensive AI: The Sine Qua Non of Cybersecurity

The Hacker NewsJul 26, 11:00 UTC · Jul 26, 2024Malware

Secrets Sensei: Conquering Secrets Management Challenges

The Hacker NewsMar 8, 09:49 UTC · Mar 8, 2024Data breach

FBI, DOJ defend ‘offensive’ actions against Chinese, Russian operations

The RecordJan 11, 00:00 UTC · Jan 11, 2023Ransomware

Privacy predictions 2023

Kaspersky SecurelistNov 28, 04:13 UTC · Nov 28, 2022Data breach

How to prepare for the future of digital extortion

Help Net SecurityJan 30, 00:00 UTC · Jan 30, 2018Ransomware

From Hacks to Bioweapons, Claude Misuse Is Now Everywhere

Anthropic reports Claude was misused by Midnight Blizzard, ShinyHunters, disinformation campaigns, and bioweapon attempts; roundup also covers Xinbi takedown.

Anthropic's new report documents eight months of Claude misuse: Russian state-sponsored hackers (Microsoft-named Midnight Blizzard) used it for reconnaissance against Ukrainian and European government networks, stealing data and maintaining access, while ShinyHunters used it across hacking and extortion campaigns, and users attempted bioweapon development. Anthropic says it disrupted the activity. The WIRED roundup also covers the US seizure and sanctioning of Xinbi Guarantee, a Telegram black market with $30 billion-plus in sales mostly laundering pig-butchering scam proceeds, plus DOJ raids on 13 scam compounds in Madagascar and a four-year prison sentence for a Conti ransomware member. Meta faces scrutiny over AI child abuse ads and a class action over photo harvesting for AI training.

WIRED · Securityupdated Sep 16, 13:01 UTC · 14h agofirst Sep 12, 10:30 UTC · 4d agoAI safety & security in the wild 18 sources

‘White hat’ hackers take $47 million bounty after $320 million crypto theft

Hackers withdrew $320 million in bitcoin from Liquid Network, negotiated on-chain, returned $266.5 million and kept a $47 million reward.

Purported white-hat hackers withdrew 4,000 BTC (about $320 million) from Liquid Network's own wallet, one of the largest cryptocurrency thefts of 2026. Over roughly 12 hours of public on-chain negotiation with operator Blockstream, the hackers returned $266.5 million in bitcoin and kept 598.5 BTC (about $47 million), claiming it as a reward for uncovering a bug. Blockstream deployed updated software and paused deposits and withdrawals while experts traced the flaw to the Elements sidechain framework. April thefts of $290 million from Kelp and $280 million from Drift, attributed to North Korean hackers, were previously 2026's largest.

The RecordSep 8, 17:00 UTC · 8d agoData breach in the wild

Risky Bulletin: Two TeamPCP members arrested in Australia

Australian Federal Police arrested two alleged TeamPCP members behind supply-chain worm attacks that stole over 500,000 credentials from compromised open-source libraries.

The AFP arrested alleged TeamPCP leader Ruben Thomson, 21, and Louis Gaebler, 23, near Perth; both were charged and remain in custody. The group inserted a self-spreading credential-stealing worm into open-source projects including Trivy, KICS, LiteLLM, and Telnyx, harvesting more than 500,000 credentials used for network access, ransomware, extortion, and sales. About 78,000 tokens and secrets from nearly 2,200 organizations leaked online last month, and the FBI supported the investigation that began in April.

Risky Business NewsAug 28, 04:40 UTC · 19d agoPolicy & legal in the wild1

New Mirai Variant Targeting Network Security Devices

New Mirai botnet variant exploits nine vulnerabilities in SonicWall, D-Link, Netgear, and other devices, with attacks ongoing at publication.

Unit 42 observed attacks exploiting VisualDoor (SonicWall SSL-VPN), CVE-2020-25506 (D-Link DNS-320), CVE-2020-26919 (Netgear ProSAFE Plus), and other flaws, with infrastructure rotating across at least three IP addresses between February 16 and March 13, 2021. Payloads were updated hours after CVE-2021-27561 and CVE-2021-27562 (Yealink Device Management, unauthenticated root RCE) and later added CVE-2021-22502 (Micro Focus Operation Bridge Reporter) and CVE-2019-19356 (Netis WF2419). Successful exploitation invokes wget to fetch shell scripts that download Mirai binaries compiled for multiple architectures and brute-forcers, and attacks were still ongoing when reported.