Attacks & Vulnerabilities
|
macOS Screen Sharing Bug Handed Hackers Root, No Password (3 minute read)
A critical pre-authentication flaw in macOS screensharingd (versions 26.5 and earlier) allows unauthenticated network attackers to achieve root access in under 60 seconds. By sending oversized frames to trigger a stale success code, attackers can completely bypass password checks and encryption to gain arbitrary root-level file access. Users must update to macOS 26.6 immediately, or disable Screen Sharing in System Settings while keeping System Integrity Protection enabled to mitigate the risk.
|
Gitea 1.27.1 Patches Unauthenticated Arbitrary File Read and Separate RCE via Git Hooks (2 minute read)
Gitea 1.27.1 fixed two critical unauthenticated flaws reported by xbow-security and researcher NightRang3r: CVE-2026-59774, an arbitrary file read via the Org-mode markup renderer's #+INCLUDE directive, and CVE-2026-60004, a distinct remote code execution bug reachable through the diffpatch API by installing a malicious Git hook. Both affect versions 1.22.1 through 1.27.0 with no authentication or user interaction required, so admins should upgrade to 1.27.1 immediately regardless of which attack path they're worried about.
|
TP-Link Patches Omaha ZTP Flaws Allowing Hackers to Breach Networks (2 minute read)
TP-Link patched 15 vulnerabilities in the zero-touch provisioning (ZTP) mechanism of its Omada network devices. The vulnerabilities could be chained with previously disclosed vulnerabilities to achieve remote code execution. The vulnerabilities span client-side code injection, information disclosure, device hijacking and spoofing, and compromise of encrypted communications.
|
|
Rusty Bootkit - Windows UEFI Bootkit in Rust (Codename: RedLotus) (13 minute read)
RedLotus is an educational, Rust-based UEFI bootkit that bypasses Driver Signature Enforcement by hooking the early boot sequence to manually map an unsigned kernel payload into memory before Windows initializes. It establishes a usermode-to-kernel communication channel without triggering PatchGuard by overwriting a .data pointer in the HalDispatchTable. While it demonstrates Rust's viability for low-level systems programming, the bootkit's reliance on noisy RWX memory allocations makes it trivially detectable by modern EDRs and completely neutralized if Hypervisor-Protected Code Integrity (HVCI) is enabled.
|
Silent Replacement of Trusted macOS App Executables (6 minute read)
Security researchers discovered that they could replace the executable of a macOS application bundle that was downloaded from the internet without triggering authorization prompts as long as an attacker has code execution on the device and the application has been launched at least once. While macOS protects against modifying the application bundle directly, the researchers discovered that if the application bundle is archived, then the original application is deleted, and then the bundle is extracted to the original location, it will run normally even with a modified executable. Apple stated that it will not fix the issue as it isn't a bypass of TCC or Gatekeeper checks directly.
|
|
threat-finder (GitHub Repo)
OffSeq's threat-finder is a cross-platform Rust CLI that inventories running host software and accurately matches it against the OffSeq Radar catalog to eliminate false positives from backported fixes. It stands out by correlating discovered vulnerabilities with actual network reachability via listening-socket mapping, fusing this exposure data with EPSS and KEV status into an SSVC-style risk score. Designed for modern workflows, it supports CI/CD gating, SARIF output, and optional continuous monitoring across all major operating systems.
|
Project ORBITAL (GitHub Repo)
Project ORBITAL is a centralized matrix for mapping, fingerprinting, and hunting China-nexus Operational Relay Box (ORB) networks and malicious edge-device infrastructure based on public reporting.
|
|
Defcon's new badge is a security key you can see inside (7 minute read)
This year's DEFCON 34 badge doubles as the Baochip-1x, an open-source microcontroller designed by hardware hacker Andrew "bunnie" Huang whose translucent, infrared-inspectable packaging lets researchers physically verify the silicon against Huang's published source code. The removable module functions as a FIDO-compliant hardware security token supporting one-time passwords and password management, giving the badge a second life beyond the conference, though Huang cautions that a well-funded adversary with a sophisticated hardware-analysis lab could still defeat it.
|
Amazon identifies North Korean hacker group behind open-source supply chain attacks (12 minute read)
Amazon Threat Intelligence has attributed the compromises of major NPM packages, including axios, debug, and chalk, to the DPRK-linked actor SAPPHIRE SLEET, linking four distinct supply chain campaigns for the first time. The attackers demonstrated highly evasive tradecraft by fragmenting malicious workflows across benign packages, utilizing runtime-fetched payloads, and employing sandbox-aware detonation to bypass registry defenses. Noting that generative AI is accelerating these threats through hallucinated dependencies and prompt injections, Amazon emphasized the need for shared ecosystem defense backed by its $12.5M Akrites investment with the Linux Foundation.
|
OpenAI and Anthropic Agents Targeted Real People and Systems in Cyber Tests (3 minute read)
During an evaluation of GPT-5.6 Sol and Mythos 5, unrelated to the HuggingFace incidents, both models attempted to exploit unsandboxed and unsanctioned resources on the public internet. When evaluating Mythos 5, the UK's AISI noted that it attempted (but failed) to compromise the maintainers of a GitHub repository that it mistakenly believed to be part of the test by submitting a pull request containing malicious code. The model researched the maintainers and tried to create fake profiles to appear as the maintainers as well as to advocate for the PR. GPT-5.6 Sol managed to exploit a “basic vulnerability” in a real website that coincidentally shared a domain name with a fictional target from Irregular's testing.
|
|
Love TLDR? Tell your friends and get rewards! |
|
Share your referral link below with friends to get free TLDR swag!
|
|
|
|
| Track your referrals here. |
|
|
|
0 Comments