Longer-form analysis — kill chains, malware breakdowns, and post-mortems on the bigger stories.

HIGHAug 20, 2026UAT-10147 Deploys SPECTRE: Cross-Platform Implant with Linux Rootkit and BYOVDCisco Talos has identified a new, sophisticated implant named SPECTRE, deployed by the UAT-10147 threat actor. This cross-platform malware features C2 operations, process injection, credential theft, anti-analysis protections, and kernel-level EDR bypass...HIGHAug 13, 2026Return of the Cookie Monster: Chromium DevTools Protocol for Session TheftSpecterOps research explores using the Chrome DevTools Protocol (CDP) to perform post-exploitation activities, including browser enumeration, cookie theft, and browser takeover. While traditional cookie protections have made session theft harder, CDP offers...HIGHAug 13, 2026Browser Extensions Used for Chromium C2 Persistence and Cookie TheftSpecterOps research reveals how browser extensions can be leveraged to turn Chromium into a persistent command and control (C2) platform. This method allows for silent installation of extensions, enabling continuous cookie theft...MEDIUMAug 12, 2026Blacklight: Open-Source Toolkit for AI Agent Artifact AnalysisSpecterOps released Blacklight, an open-source security research toolkit designed to discover and analyze AI agent artifacts on endpoints. This tool helps security teams assess exposure, guide decisions, and develop detection and hardening...HIGHAug 6, 2026ChainDrop: A Self-Propagating npm Worm Using Ethereum for C2Analysis of ‘ChainDrop’ reveals a self-propagating npm supply chain worm that extracts GitHub Actions runner secrets. Uniquely, it leverages Ethereum smart contracts for Command and Control (C2) routing, demonstrating an innovative method...CRITICALJul 17, 2026Three Chained Zero-Days in Siemens ROX II OT Switches Allow Persistent Root AccessPalo Alto Networks’ Unit 42 has detailed a trilogy of chained zero-day vulnerabilities in Siemens ROX II OT switches. These flaws allow for privilege escalation and persistent root access to the industrial...HIGHJul 10, 2026Laser Attack Resets Tangem Wallet Passwords on Unpatchable CardsLedger’s Donjon security team demonstrated a laser fault injection attack that can reset Tangem crypto wallet card passwords. A precisely timed laser pulse aimed at the chip allows an attacker to set...HIGHJul 10, 2026Dell BIOS Passwords Recoverable Due to Weak XOR Encryption (CVE-2026-40639)A joint discovery by MDSec and AmberWolf revealed a critical vulnerability (CVE-2026-40639) in Dell BIOS password storage. Dell stores BIOS administrator passwords using weak XOR encryption, allowing recovery from the SPI flash....MEDIUMJun 21, 2026OWASP Top 10 for LLM Applications: A Testing GuideFORTBRIDGE has released a comprehensive guide for testing the OWASP Top 10 vulnerabilities specifically for LLM applications. This guide details how to test for each of the ten critical risks, including Prompt...MEDIUMJun 17, 2026Black Box Probing: Security Analysis of Xiaomi's MJA1 Secure ChipQuarkslab conducted a black-box security analysis of Xiaomi’s proprietary MJA1 secure chip, used in their cameras to protect sensitive data. Lacking public documentation, researchers reverse-engineered the chip through hardware identification, I2C sniffing,...MEDIUMJun 17, 2026FreeBSoD: Leveraging Language Models to Find and Exploit Kernel BugsPraetorian’s research, ‘FreeBSoD’, demonstrates how language models like Claude Code (Opus 4.6) can be leveraged to discover and exploit kernel bugs in FreeBSD. This work is part of building Constantine, an automated...HIGHJun 15, 2026Zombie COTables: Resurrecting Freed Memory to Escape VirtualBox Severity: HIGH HIGHJun 14, 2026Four Methods for Azure Storage Ransomware Identified by Datadog Security Labs Severity: HIGH HIGHJun 12, 2026China-Linked Hackers Backdoored Linux Login Software for Decade-Long Persistence Severity: HIGH HIGHJun 12, 2026Factoring 'Short-Sleeve' RSA Keys with Polynomials Severity: HIGH