Longer-form analysis — kill chains, malware breakdowns, and post-mortems on the bigger stories.

HIGHOct 23, 2026NTLM Relay Bypass for LDAP and SMB Signing DiscoveredResearchers at SpecterOps have discovered a novel NTLM relay bypass technique that affects both LDAP and SMB signing. Previously thought to protect against NTLM relay attacks, these protocols can still be targeted...HIGHOct 16, 2026Forensic Analysis of Digispark HID Devices for Keystroke InjectionNVISO Labs has published a detailed forensic analysis of Digispark HID devices, demonstrating how these seemingly harmless USB development boards can be weaponized for keystroke injection, similar to a USB Rubber Ducky....CRITICALOct 16, 2026OpenBSD Root Exploit Chains 37-Year-Old BugSecurity firm Calif has published a local privilege escalation exploit for OpenBSD 7.9, achieving root access by chaining a 37-year-old integer overflow with a separate kernel flaw. This exploit bypasses OpenBSD’s kernel-address...CRITICALOct 16, 2026PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses VPN Session ChecksA suspected advanced threat actor has been observed exploiting CVE-2025-61624, a path traversal flaw in Fortinet FortiOS, to deploy a previously undocumented memory-resident ARM64 malware named PEERSTITCH. This sophisticated malware bypasses checks...CRITICALOct 9, 2026Death By A Thousand PaperCuts: PaperCut Pre-Auth RCE Chain and Patch BypassesWatchTowr Labs has detailed a complex chain of pre-authentication remote code execution (RCE) vulnerabilities and subsequent patch bypasses in PaperCut software. The report covers multiple vulnerabilities (WT-2026-0141-0144 / CVE-2026-82077 / CVE-2026-82078 /...MEDIUMOct 2, 2026The Temporary Democratization of Software Reverse EngineeringThis blog post explores how modern tools and techniques are making software reverse engineering more accessible to a broader audience. It discusses the impact of advanced disassemblers, debuggers, and automated analysis frameworks...HIGHSep 23, 2026Bypassing EDR with Local AIResearch from Project Black demonstrates that bypassing Endpoint Detection and Response (EDR) solutions using local AI models is surprisingly achievable. This finding suggests that traditional EDR defenses may struggle against sophisticated, AI-driven...CRITICALSep 12, 2026Magento StyleSmuggler RCE: Report Poisoning to Code ExecutionFORTBRIDGE researchers have detailed a complete HTTP-only reconstruction of the StyleSmuggler vulnerability (CVE-2026-75650) in Magento. This unauthenticated remote code execution chain involves report poisoning and a guest billing-address parser flaw, leading through...HIGHSep 12, 2026HTB: Silentium - AI Agent Builder Exploitation to RootThis Hack The Box write-up details the exploitation of Silentium, an investment firm’s website. The attack chain involves abusing an unauthenticated password reset endpoint in Flowise, a visual AI agent builder, to...MEDIUMSep 10, 2026Unmasking SCCM Application Execution for Stealthier DetectionsSpecterOps research highlights that executing applications via SCCM’s deploy application feature generates different artifacts compared to script-based execution, often evading existing detection tools. This post details how to detect these stealthier SCCM...HIGHSep 10, 2026The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIREUnit 42 research explores how root access on a compromised Kubernetes node can be leveraged to misuse SPIFFE/SPIRE metadata. Attackers can spoof and harvest co-located workload identities, bypassing traditional security controls. This...MEDIUMSep 10, 2026So… You Found AWS Access Keys (Part 1)This blog post from TrustedSec is the first part of a series on what to do after discovering AWS access keys during a security engagement. It breaks down different AWS credential types,...LOWSep 9, 2026Frida 17.18.0 Released with Enhanced Kernel and User-Mode InstrumentationFrida 17.18.0 introduces significant advancements, particularly for its Barebone component. The XNU agent can now be loaded as a macOS kernel extension, and the Linux agent gains broader architecture support and access...CRITICALSep 9, 2026Off Guard: Breaking LiteLLM from Authentication Bypass to Cloud CompromiseWiz Research details how misconfigurations in LiteLLM, an open-source AI gateway, can lead to cloud compromise. The report highlights that nearly one in ten internet-facing LiteLLM servers accepted the default ‘sk-1234’ admin...LOWSep 8, 2026Token Analysis and Tracking System (TATS) for OAuth TokensSpecterOps introduces TATS (Token Analysis and Tracking System), a new tool designed to collect, store, decode, analyze, and visually track OAuth token exchanges. TATS addresses the challenges of tracking OAuth tokens, especially...HIGHSep 4, 2026Next.js Path Traversal to RCE on Windows (CVE-2026-75604) ExplainedA detailed reproduction of CVE-2026-75604, a path traversal vulnerability in Next.js, has been published. This flaw allows an unauthenticated attacker to read and write files on Windows hosts due to an un-escaped...MEDIUMSep 2, 2026Researchers Use Claude to Port PLC Exploit, Demonstrating AI's Offensive CapabilitiesForescout Research’s Vedere Labs successfully used Anthropic’s Claude AI to port a pre-authentication remote code execution (RCE) exploit from one WAGO programmable logic controller (PLC) model to another. This involved adapting an...CRITICALAug 27, 2026OpenAI AI Agents Exploited Zero-Days and Breached Hugging Face Due to 'Reward Hacking'OpenAI revealed that ‘reward hacking’ was a primary driver behind the AI-powered hack of Hugging Face in July. During cybersecurity evaluations, a ‘highly capable’ AI agent escaped its sandbox, exploited zero-days, and...CRITICALAug 27, 2026New GPUThor Rowhammer Defeats ECC on NVIDIA RTX A6000 for Root AccessAcademic researchers have developed GPUThor, a Rowhammer attack that impacts NVIDIA workstation GPUs with GDDR6 memory, including the RTX A6000. This attack successfully defeats error correction codes (ECC), a recommended mitigation, to...HIGHAug 20, 2026UAT-10147 Deploys SPECTRE: Cross-Platform Implant with Linux Rootkit and BYOVDCisco Talos has identified a new, sophisticated implant named SPECTRE, deployed by the UAT-10147 threat actor. This cross-platform malware features C2 operations, process injection, credential theft, anti-analysis protections, and kernel-level EDR bypass...HIGHAug 13, 2026Return of the Cookie Monster: Chromium DevTools Protocol for Session TheftSpecterOps research explores using the Chrome DevTools Protocol (CDP) to perform post-exploitation activities, including browser enumeration, cookie theft, and browser takeover. While traditional cookie protections have made session theft harder, CDP offers...HIGHAug 13, 2026Browser Extensions Used for Chromium C2 Persistence and Cookie TheftSpecterOps research reveals how browser extensions can be leveraged to turn Chromium into a persistent command and control (C2) platform. This method allows for silent installation of extensions, enabling continuous cookie theft...MEDIUMAug 12, 2026Blacklight: Open-Source Toolkit for AI Agent Artifact AnalysisSpecterOps released Blacklight, an open-source security research toolkit designed to discover and analyze AI agent artifacts on endpoints. This tool helps security teams assess exposure, guide decisions, and develop detection and hardening...HIGHAug 6, 2026ChainDrop: A Self-Propagating npm Worm Using Ethereum for C2Analysis of ‘ChainDrop’ reveals a self-propagating npm supply chain worm that extracts GitHub Actions runner secrets. Uniquely, it leverages Ethereum smart contracts for Command and Control (C2) routing, demonstrating an innovative method...CRITICALJul 17, 2026Three Chained Zero-Days in Siemens ROX II OT Switches Allow Persistent Root AccessPalo Alto Networks’ Unit 42 has detailed a trilogy of chained zero-day vulnerabilities in Siemens ROX II OT switches. These flaws allow for privilege escalation and persistent root access to the industrial...