SEO Poisoning Campaign Targets DeepSeek Users: Chinese Threat Actor Deploys Kong RAT via Multi-Stage Attacks
https://ift.tt/CuvZlpV
Submitted October 28, 2026 at 08:33PM by CyberMasterV
via reddit https://ift.tt/pOlDMIQ
https://ift.tt/CuvZlpV
Submitted October 28, 2026 at 08:33PM by CyberMasterV
via reddit https://ift.tt/pOlDMIQ
Blogspot
SEO Poisoning Campaign Targets DeepSeek Users: Chinese Threat Actor Deploys Kong RAT via Multi-Stage Attacks
Author: Vlad Pasca Executive Summary SEO poisoning campaign targets DeepSeek AI tool searchers through first-page malicious domains. Multi...
Scanning 7.25 Million Public Repositories on China's Largest Git Platform for Secrets
https://ift.tt/X7HcWqQ
Submitted October 28, 2026 at 09:06PM by Grand_Fan_9804
via reddit https://ift.tt/CrO1mwJ
https://ift.tt/X7HcWqQ
Submitted October 28, 2026 at 09:06PM by Grand_Fan_9804
via reddit https://ift.tt/CrO1mwJ
MongoDB
Scanning 7.25 Million Public Repositories on China's Largest Git Platform for Secrets
Discover the security findings from scanning 7.25 million public repositories on Gitee, which uncovered 26,400 verified-live credentials, cloud keys, and enterprise AI tokens.
EDK2 PXE Flaw (CVE-2026-97631): Find What You Run
https://ift.tt/tERTJGq
Submitted October 28, 2026 at 09:11PM by Traditional-Heat-749
via reddit https://ift.tt/mkXg0tQ
https://ift.tt/tERTJGq
Submitted October 28, 2026 at 09:11PM by Traditional-Heat-749
via reddit https://ift.tt/mkXg0tQ
Cloud Sleuth
EDK2 PXE Flaw (CVE-2026-97631): Find What You Run
CVE-2026-97631 (CVSS 4.0 9.5) hits EDK II's PXE driver through edk2-stable202608. No vendor firmware fix yet. Find which hosts are yours to fix in an hour.
An attacker can crash a Godot game server using DTLS with an unauthenticated UDP datagram
https://ift.tt/GM8tfI3
Submitted October 29, 2026 at 12:39AM by bitbutter
via reddit https://ift.tt/QM0E6mt
https://ift.tt/GM8tfI3
Submitted October 29, 2026 at 12:39AM by bitbutter
via reddit https://ift.tt/QM0E6mt
axeghost.offprint.app
An attacker can crash a Godot game server using DTLS with a single UDP datagram | axeghost | Axe Ghost. On Steam! | Offprint
DTLS is the engine's optional encryption layer for UDP multiplayer. In every version of Godot I inspected the source of — 3.2.2 and 4.7 through 4.7.2 — one unauthenticated datagram can overwrite...
Turning the Valve - Exploiting RCE and LPE in the Steam Platform
https://ift.tt/Wmvy3ul
Submitted October 29, 2026 at 02:54AM by FILLABUSTA
via reddit https://ift.tt/sDmQt9W
https://ift.tt/Wmvy3ul
Submitted October 29, 2026 at 02:54AM by FILLABUSTA
via reddit https://ift.tt/sDmQt9W
Atredis Partners
Turning the Valve - Exploiting RCE and LPE in the Steam Platform
Diving into the Steam platform for local and remote code execution vulnerabilities.
XML Signature Wrapping authentication bypass in Moldova's MPass SAML NuGet library, fixed in 10.0.4 (CVE requested, CAN-2026-2041077)
https://ift.tt/kbqEv0R
Submitted October 29, 2026 at 06:30AM by maxim-masiutin
via reddit https://ift.tt/2DJYb7W
https://ift.tt/kbqEv0R
Submitted October 29, 2026 at 06:30AM by maxim-masiutin
via reddit https://ift.tt/2DJYb7W
Maxim Masiutin
MPass SAML XML Signature Wrapping Authentication Bypass
Egov.Integrations.MPass.Saml before 10.0.4 does not bind the signed XML reference to the trusted SAML response root. Upgrade to 10.0.4 or later.
Axis Camera Station Deep-Dive: Unauth RCE to Decrypting Every Camera Credential (CVE-2025-30026/30023 + CVE-2026-63286)
https://ricardojoserf.github.io/axisrce
Submitted October 29, 2026 at 02:15PM by Rare_Bicycle_5705
via reddit https://ift.tt/pSNhJ4f
https://ricardojoserf.github.io/axisrce
Submitted October 29, 2026 at 02:15PM by Rare_Bicycle_5705
via reddit https://ift.tt/pSNhJ4f
ricardojoserf.github.io
From RCE to camera credentials in Axis Camera Station
During a penetration test, I exploited CVE-2025-30023 (insecure deserialization) chained with CVE-2025-30026 (authentication bypass) to get SYSTEM-level RCE on two Windows machines running Axis Camera Station on a factory. After that, I discovered CVE-2026…
Linux Kernel TIPC DoS: named_distribute() NULL Dereference, Race Analysis, and Remote Triggering
https://ift.tt/OrRZvcd
Submitted October 29, 2026 at 02:22PM by louis703
via reddit https://ift.tt/oy78BAJ
https://ift.tt/OrRZvcd
Submitted October 29, 2026 at 02:22PM by louis703
via reddit https://ift.tt/oy78BAJ
The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only!
https://ift.tt/EFC8QTg
Submitted October 29, 2026 at 02:45PM by albinowax
via reddit https://ift.tt/9yFd2UW
https://ift.tt/EFC8QTg
Submitted October 29, 2026 at 02:45PM by albinowax
via reddit https://ift.tt/9yFd2UW
Orange Tsai
The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only!
This is what I built for Pwn2Own Berlin 2026 — a completely handmade, logic-only Microsoft Edge Full Chain, with no memory corruption, and no AI at all! 🔥
PHP2Shell Activity Across Previdian Network
https://ift.tt/ABzP9R8
Submitted October 29, 2026 at 04:33PM by ethicalhack3r
via reddit https://ift.tt/oLQYFZp
https://ift.tt/ABzP9R8
Submitted October 29, 2026 at 04:33PM by ethicalhack3r
via reddit https://ift.tt/oLQYFZp
Previdian
PHP2Shell Activity Across Previdian Network
Previdian Research — 28 October 2026
On 28 October, Previdian observed successful remote code execution on four PHP/Apache honeypots configured to provide highly favourable conditions for exploitation. Apache launched an attacker-supplied shell command and…
On 28 October, Previdian observed successful remote code execution on four PHP/Apache honeypots configured to provide highly favourable conditions for exploitation. Apache launched an attacker-supplied shell command and…
TeamViewer RCE Vulnerability (CVE-2026-11585)
https://ift.tt/6LuZ2PK
Submitted October 29, 2026 at 07:37PM by NewResearch1337
via reddit https://ift.tt/eWhvMUZ
https://ift.tt/6LuZ2PK
Submitted October 29, 2026 at 07:37PM by NewResearch1337
via reddit https://ift.tt/eWhvMUZ
Remedio
TeamViewer RCE Vulnerability (CVE-2026-11585) | Remedio
Remedio disclosed a critical TeamViewer remote code execution vulnerability (CVE-2026-11585). Explore the exploit chain and affected versions
TightVNC Viewer Pre-auth RCE
https://ift.tt/caydnMS
Submitted October 29, 2026 at 07:39PM by SSDisclosure
via reddit https://ift.tt/LCgq0p7
https://ift.tt/caydnMS
Submitted October 29, 2026 at 07:39PM by SSDisclosure
via reddit https://ift.tt/LCgq0p7
SSD Secure Disclosure
TightVNC Viewer Pre-auth RCE - SSD Secure Disclosure
Summary In VNC the server announces the screen size and the viewer allocates a pixel buffer for it. TightVNC computes that buffer’s byte size in a 32-bit int. A server announcing 32768 x 32769 at 32bpp makes the size wrap from 4 GB to 128 KB, while the viewer…
EMBRACE: How We Hacked the Browsers Embedded in Top Five Desktop AI Assistants · Forever Secur
https://ift.tt/ubJqCny
Submitted October 29, 2026 at 08:01PM by Content-Winter5328
via reddit https://ift.tt/ip71hIa
https://ift.tt/ubJqCny
Submitted October 29, 2026 at 08:01PM by Content-Winter5328
via reddit https://ift.tt/ip71hIa
Forever
EMBRACE: How We Hacked the Browsers Embedded in Top Five Desktop AI Assistants · Forever Security
Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop each built a browser into their AI assistant, then enriched it beyond what a normal browser allows. Those enrichments broke the browser threat model, letting a web page or a local file reach the machine…
Stopping Remote Code Execution with Sandboxes, CVE-2026-115995: Rust Zip
https://ift.tt/ItS0vVU
Submitted October 29, 2026 at 09:48PM by HectaMan
via reddit https://ift.tt/WCEPkt0
https://ift.tt/ItS0vVU
Submitted October 29, 2026 at 09:48PM by HectaMan
via reddit https://ift.tt/WCEPkt0
Cosmonic Blog
Stop Remote Code Execution with a Sandbox (Real CVE Demo) | Cosmonic
A real RCE vulnerability, left unpatched, does nothing inside a sandbox. See how deny-by-default WebAssembly components block every move a malicious zip makes.
Every false positive we have shipped had the same cause
https://ift.tt/RSU3tX9
Submitted October 30, 2026 at 04:06AM by magixer
via reddit https://ift.tt/YcS9d4l
https://ift.tt/RSU3tX9
Submitted October 30, 2026 at 04:06AM by magixer
via reddit https://ift.tt/YcS9d4l
crossfyre.io
Every false positive we have shipped had the same cause
Four false positives in four vulnerability classes had one root cause: the scanner accepted something it had caused as proof. A template matched a marker it had put in the request. An SSRF probe counted a callback our own client made. Here are the four, and…
php2bitcoin x brotli2coin: live hacking stream
https://ift.tt/SLCwrjV
Submitted October 30, 2026 at 08:36AM by eth0izzle
via reddit https://ift.tt/okKbhjO
https://ift.tt/SLCwrjV
Submitted October 30, 2026 at 08:36AM by eth0izzle
via reddit https://ift.tt/okKbhjO
Claude vs Code Extension compromised
https://ift.tt/RutNims
Submitted October 30, 2026 at 06:11PM by Alfrede81
via reddit https://ift.tt/HfRth3d
https://ift.tt/RutNims
Submitted October 30, 2026 at 06:11PM by Alfrede81
via reddit https://ift.tt/HfRth3d
Phorion | macOS Endpoint Detection and Response (EDR)
Official Claude Code Extension Compromise: Security Advisory | Phorion
Phorion has detected a backdoor in the official Claude Code for VS Code extension bundle on the Cursor Marketplace that drops a persistent SSH backdoor across macOS, Linux, and Windows. This write-up …
Cloud Exposure Index 2026: 484,142 open buckets mapped
https://ift.tt/S5HmqXr
Submitted October 31, 2026 at 07:50PM by lexcor
via reddit https://ift.tt/v1cpEG7
https://ift.tt/S5HmqXr
Submitted October 31, 2026 at 07:50PM by lexcor
via reddit https://ift.tt/v1cpEG7
Ransomnews
Cloud Exposure Index 2026: 484,142 open buckets mapped
484,142 publicly listable cloud buckets hold 18 billion files. Azure over-indexes on backups, and two-thirds of exposed .env secrets files were written in 2026.
Mirage2FA stole 4,561 M365 session cookies despite MFA via AiTM proxy (CVE-2026-69836 CVSS 10.0) : detection rules and WHfB/Cloud Kerberos Trust hardening guide
https://ift.tt/qv6tDAr
Submitted November 1, 2026 at 03:45PM by doit4everyone
via reddit https://ift.tt/yXuaSVW
https://ift.tt/qv6tDAr
Submitted November 1, 2026 at 03:45PM by doit4everyone
via reddit https://ift.tt/yXuaSVW
MVC nLPD — Microsoft 365 Business Premium
AiTM / Cookie Hijacking M365 — Détection, mitigation et protection structurelle DoIt4Everyone
Guide technique complet sur les attaques AiTM contre Microsoft 365. CAE, WHfB, FIDO2, Cloud Kerberos Trust, CA Authentication Strength. Validé terrain sur infra hybride — août 2026.
r/netsec monthly discussion & tool thread
Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.Rules & GuidelinesAlways maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.Avoid use of memes. If you have something to say, say it with real words.All discussions and questions should directly relate to netsec.No tech support is to be requested or provided on r/netsec.As always, the content & discussion guidelines should also be observed on r/netsec.FeedbackFeedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.
Submitted November 1, 2026 at 07:59PM by albinowax
via reddit https://ift.tt/CTe2k53
Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.Rules & GuidelinesAlways maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.Avoid use of memes. If you have something to say, say it with real words.All discussions and questions should directly relate to netsec.No tech support is to be requested or provided on r/netsec.As always, the content & discussion guidelines should also be observed on r/netsec.FeedbackFeedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.
Submitted November 1, 2026 at 07:59PM by albinowax
via reddit https://ift.tt/CTe2k53
Reddit
From the netsec community on Reddit
Explore this post and more from the netsec community
/r/netsec's Q4 2026 Information Security Hiring Thread
OverviewIf you have open positions at your company for information security professionals and would like to hire from the /r/netsec user base, please leave a comment detailing any open job listings at your company.We would also like to encourage you to post internship positions as well. Many of our readers are currently in school or are just finishing their education.Please reserve top level comments for those posting open positions.Rules & GuidelinesInclude the company name in the post. If you want to be topsykret, go recruit elsewhere. Include the geographic location of the position along with the availability of relocation assistance or remote work.If you are a third party recruiter, you must disclose this in your posting.Please be thorough and upfront with the position details.Use of non-hr'd (realistic) requirements is encouraged.While it's fine to link to the position on your companies website, provide the important details in the comment.Mention if applicants should apply officially through HR, or directly through you.Please clearly list citizenship, visa, and security clearance requirements.You can see an example of acceptable posts by perusing past hiring threads.FeedbackFeedback and suggestions are welcome, but please don't hijack this thread (use moderator mail instead.)
Submitted November 1, 2026 at 10:49PM by netsec_burn
via reddit https://ift.tt/Q2TJG9S
OverviewIf you have open positions at your company for information security professionals and would like to hire from the /r/netsec user base, please leave a comment detailing any open job listings at your company.We would also like to encourage you to post internship positions as well. Many of our readers are currently in school or are just finishing their education.Please reserve top level comments for those posting open positions.Rules & GuidelinesInclude the company name in the post. If you want to be topsykret, go recruit elsewhere. Include the geographic location of the position along with the availability of relocation assistance or remote work.If you are a third party recruiter, you must disclose this in your posting.Please be thorough and upfront with the position details.Use of non-hr'd (realistic) requirements is encouraged.While it's fine to link to the position on your companies website, provide the important details in the comment.Mention if applicants should apply officially through HR, or directly through you.Please clearly list citizenship, visa, and security clearance requirements.You can see an example of acceptable posts by perusing past hiring threads.FeedbackFeedback and suggestions are welcome, but please don't hijack this thread (use moderator mail instead.)
Submitted November 1, 2026 at 10:49PM by netsec_burn
via reddit https://ift.tt/Q2TJG9S