Hacking and Exploits

Web-Hacking, 0-Day, Malware, Ransomware, Exploit, Vulnerabilities, Privilege-Flaw, Privilege-Escalation, Zero-Day, Exploit, Jailbreak, Penetration-Testing, Trojan, Spyware, Rootkit, Worm, Backdoor, Payload, Obfuscation, DDoS, Phishing, MITM, Spoofing, Brute-force, Port-Scan, SQLi, XSS, CSRF, Path-Traversal, LFI, RFI, Insecure-Deserialization, Buffer-Overflow, CVE, Exploit-Kit, Shellcode, bug bounty, ethical hacking, CTF, capture the flag, offensive security, red team exercise, exploit development, reverse engineering, vulnerability research, credential harvesting, zero-click, hack

133 stories

North Korea’s TraderTraitor Pulls Off Crypto’s Biggest Heist: Inside the $6.36B Binance Breach

On the evening of October 29, 2026, wallets tied to Binance began sending large volumes of crypto across ten blockchains in a tightly timed operation. TRM Labs traced roughly USD 6.36 billion in outflows and attributes the attack to North Korea’s TraderTraitor unit. Stablecoin issuers and network councils froze about USD 2.7 billion, but the attacker still controls roughly USD 2.4 billion in assets that remain beyond issuers’ reach. This…

Saugata DattaOct 30, 20266 min read17

Artificial Intelligence

How a Tampered Claude Code Extension Can Give Attackers Persistent SSH Access

A recent analysis by OpenSourceMalware found a tampered Claude Code extension on Open VSX that can give attackers persistent remote access to developer systems. The altered package, identified as anthropic.claude-code version 2.1.313, injects a short JavaScript loader that runs during normal extension activity and implements an SSH backdoor, reverse tunneling, and cross-platform persistence mechanisms. The sample analyzed targeted macOS on Apple Silicon, though the injected code contains branches for Linux…

Saugata DattaOct 30, 20264 min read9

Hacking and Exploits

Binance Breach and the Race to Trace Billions in Crypto

Binance, the world’s largest cryptocurrency exchange, abruptly suspended deposits and withdrawals as it investigated a massive suspected security incident that initial reports placed in the billions of dollars. Early figures and shifting estimates have left users and industry observers scrambling for verified facts: some transfers across multiple blockchains looked suspicious, but determining what portion — if any — represents confirmed theft requires careful tracing and coordination with token issuers and…

Saugata DattaOct 30, 20263 min read19

AI Agents and Frameworks

Linux TCP use-after-free (CVE-2026-98432): Anthropic’s exploit, vendor status, and what admins should do

A serious race-condition bug in the Linux kernel’s IPv4 TCP path, tracked as CVE-2026-98432, has drawn attention because the kernel team rated it 9.8/10 on the CVSS scale and because Anthropic says its AI model wrote an exploit that achieved root command execution against servers running a multipath TCP (MPTCP) listener. Vendors and distributions have diverging severity scores and staggered patch timelines, leaving many administrators deciding whether to wait for…

Saugata DattaOct 30, 20265 min read23

Hacking and Exploits

Invisible Texts, Visible Damage: Inside Android’s “SMS of Death” Zero-Click Flaw

A recently disclosed zero-click vulnerability—dubbed the "SMS of Death"—can render Android phones partially or wholly unusable with a single, malformed WAP Push message. The exploit leaves no trace in the user’s inbox, can drop active calls, and in some tests caused persistent loss of telephony that survived reboots and even factory resets until carriers’ retry behavior was addressed. How the flaw works The bug resides in WapPushOverSms.decodeWapPdu(), the Android routine…

Saugata DattaOct 30, 20263 min read30

AI Agents and Frameworks

Claude-written exploit exposes critical Linux kernel race, patches and uncertain attack path

Anthropic’s Frontier Red Team disclosed a striking research result: an unreleased Claude model produced a working exploit for a critical Linux kernel vulnerability tracked as CVE-2026-98432. According to Anthropic, the proof-of-concept lets a remote attacker run commands as root without a login or user interaction. The company treated the work as a lab test and said the underlying bug has been fixed upstream and backported to maintained kernel branches—but distribution…

Saugata DattaOct 29, 20263 min read27

Cybersecurity

Seven Critical Firebox Flaws in WatchGuard Fireware Could Allow Remote Code Execution

WatchGuard disclosed a set of serious vulnerabilities in Fireware OS on October 27, 2026, revealing seven critical defects that, in some cases, allow remote code execution or root-level actions without prior authentication. The advisory is part of a broader release covering 18 security issues across Fireware OS and the Windows Mobile VPN with SSL client, with the seven critical entries carrying CVSS scores between 9.1 and 9.5. Where noted, attackers…

Saugata DattaOct 29, 20263 min read38

Cybersecurity

Warp Panda Abused VMware ESX Logging Flaw to Reduce Audit Trail Visibility

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently added CVE-2026-41709 to its Known Exploited Vulnerabilities (KEV) catalog after researchers linked the flaw to active exploitation by a China-nexus threat actor known as Warp Panda. CrowdStrike’s reporting indicates the adversary used the vulnerability as a zero-day in early 2026 to limit audit logging, enabling covert and persistent access in targeted environments—most notably in the U.S. legal sector. The vulnerability: CVE-2026-41709…

Saugata DattaOct 29, 20263 min read30

Cybersecurity

Cisco Patches CVE-2026-76418 as SSL VPN Flaw Crashes ASA and FTD Devices

Cisco has released security updates for a high‑severity zero‑day, CVE-2026-76418, after its Product Security Incident Response Team observed active exploitation in October 2026. The flaw allows unauthenticated remote attackers to trigger unexpected device restarts in Secure Firewall ASA and FTD software, causing denial-of-service and disruption of remote access. Cisco assigned the vulnerability a CVSS score of 8.6 and published its advisory on October 28, 2026. The issue was discovered by…

Saugata DattaOct 29, 20263 min read45

Cloud Computing

Telegram Stickers, Zero-Click Risks, and the Race to Patch rlottie

Security researcher Saifeldeen Aziz has revealed a worrying set of findings about Telegram’s animated sticker handling: zero-click bugs in the sticker engine that he says can be chained to achieve code execution on iOS. His work — scheduled for presentation at OffensiveCon in Tokyo — follows a long-running exchange between researchers and Telegram about whether server-side checks are an adequate mitigation for client-side flaws. How the flaw was characterized ZDI…

Saugata DattaOct 29, 20263 min read36

Cloud Computing

Chrome 156 Patch Closes 52 Flaws, Including Four Critical Bugs

Google has pushed a new Chrome update that patches 52 security vulnerabilities across the browser, addressing issues that touch file handling, page rendering, JavaScript, graphics, and media processing. The Stable channel moves to version 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 for Linux. According to Google’s release, the fixes include four critical vulnerabilities, 46 high-severity issues, and two medium-severity bugs. The company has not published exploit details or confirmed active…

Saugata DattaOct 28, 20263 min read44

Cybersecurity

Critical GoAhead TLS flaws put millions of embedded devices at risk

Three newly disclosed vulnerabilities in the GoAhead embedded web server weaken how some devices validate certificates and protect encrypted sessions. Researchers at FoxIO, led by Sébastien Féry, found flaws in GoAhead’s TLS backends that can allow revoked certificates to succeed, enable passive decryption of certain sessions, or let overly long certificate chains be accepted. The issues affect devices that embed GoAhead—found in routers, printers, gateways and industrial controllers from vendors…

Saugata DattaOct 28, 20264 min read31

Free Tools: IP, DNS, SSL