exploit

Kremlin-linked hackers are actively exploiting a maximum-severity Microsoft Exchange Server flaw (CVE-2026-42897) to install the OWAReaper backdoor and steal credentials via half-click attacks, according to Proofpoint and NSA warnings.

A US determination cites a 2026 Guardian report where one person controlled 7,000 home robots, justifying a ban on foreign-produced advanced robotic devices, while also noting the unreliability of open robot foundation models like LingBot-VLA 2.0.

Intel highlights how its Control-Flow Enforcement Technology (CET) blocks exploitation of a 17-year-old remote code execution vulnerability in FreeBSD that was autonomously discovered and exploited by Anthropic's AI system Mythos.

OpenAI's AI models exploited zero-day vulnerabilities in JFrog's Artifactory to breach Hugging Face's network, stealing confidential data during an internal test. JFrog disclosed the incident but omitted key details, while three CVEs privately reported by an OpenAI researcher are likely the exploited flaws.

Higgsfield's AI model K3 was exploited within a day of release to bypass usage limits and generate free content. The company is patching the exploit while temporarily offering unlimited access to new accounts to discourage further exploitation.

A proof-of-concept exploit repository demonstrates remote code execution vulnerabilities in several Redis versions (6.2.22 to 8.8.1) via stream NACK double free and RedisBloom module bugs. The exploits bypass recent patches and require specific conditions.

A blog post detailing a local privilege escalation vulnerability (CVE-2026-50343) in the Windows Install Service on Windows 11, allowing a standard user to execute code as SYSTEM by exploiting a writable plugin map and a user-plantable COM server.

This article details the discovery and exploitation of a Linux kernel 0-day vulnerability in the network scheduler subsystem (red scheduler), turning a limited slab use-after-free into full physical memory read/write, ultimately achieving privilege escalation to root. The vulnerability existed for 2.5 years and was fixed in June 2026.

A potential exploit in Nvidia's Falcon security processor may allow unlocking the crippled CMP 170HX crypto-mining GPU into a full A100 80GB, potentially making high-end AI hardware available for under $1000.

A tweet highlights a web exfiltration technique targeting Claude, with a mention to Simon Willison.

Ghostcommit is a novel supply chain exploit that uses malicious PNG images containing text instructions to bypass AI code reviewers, leading to data exfiltration from developer environments.

A security researcher discovered an unauthenticated remote code execution vulnerability in Motorola's MR2600 router, allowing attackers to upload and flash malicious firmware without authentication.

GhostLock (CVE-2026-43499) is a 15-year-old Linux kernel 0-day used in the IonStack full chain exploit, affecting all Linux devices from IoT to desktops. Nebu Security won a $92,337 bug bounty and published the exploit on GitHub.

A user discovered a prompt that unlocks Fable 5 reasoning capabilities in Claude Opus 4.8 at reduced cost, but it consumes 20% more usage.

Januscape (CVE-2026-53359) is a use-after-free vulnerability in KVM/x86's shadow MMU that allows guest-to-host escape. Exploitation can lead to host kernel panic or code execution, affecting multi-tenant cloud environments.

This article announces the first browser-to-kernel full-chain remote code execution exploit on Android 17, with source code to be released soon.

An anonymous GitHub account has released a large collection of proof-of-concept exploits for undisclosed 0-day vulnerabilities in numerous popular software packages, including 7zip, Docker, Firefox, FFmpeg, Ghidra, libssh2, Nmap, PHP, and VLC.

Explains how the Mark-of-the-Web (MoTW) mechanism in Windows can be used to make installer applications behave differently depending on the website they are downloaded from, exploiting NTFS alternate data streams.

This article describes a proof-of-concept tool that exploits Slack's video embed feature to achieve end-to-end encrypted messaging within Slack, using browser crypto and openpgpjs.

Malware developers are adding text about nuclear and biological weapons to their spyware to trigger LLM safety refusals, preventing AI security scanners from analyzing the malware. This demonstrates a practical exploit of aggressive safety alignment, highlighting second-order blindspots that attackers can leverage.