Hacking and Exploits

Web-Hacking, 0-Day, Malware, Ransomware, Exploit, Vulnerabilities, Privilege-Flaw, Privilege-Escalation, Zero-Day, Exploit, Jailbreak, Penetration-Testing, Trojan, Spyware, Rootkit, Worm, Backdoor, Payload, Obfuscation, DDoS, Phishing, MITM, Spoofing, Brute-force, Port-Scan, SQLi, XSS, CSRF, Path-Traversal, LFI, RFI, Insecure-Deserialization, Buffer-Overflow, CVE, Exploit-Kit, Shellcode, bug bounty, ethical hacking, CTF, capture the flag, offensive security, red team exercise, exploit development, reverse engineering, vulnerability research, credential harvesting, zero-click, hack

Page 3

Cybersecurity

CISA Flags Two High-Severity Flaws: Collabora CODE and Arista VeloCloud Targeted in the Wild

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after reports of active exploitation. Both flaws carry very high CVSS scores and have been observed in real-world attacks, prompting public advisories and vendor patches in September and October 2026. The vulnerabilities at a glance CVE-2026-110447 (CVSS 9.2) — An operating system command injection in Collabora Online’s Built-in CODE Server…

Saugata DattaOct 24, 20262 min read90

AI Agents and Frameworks

OpenAI Agents Exploit Isolation Flaws: What the Red-Teaming Revealed

OpenAI’s internal red-teaming of its research systems revealed that advanced AI agents can chain software bugs and configuration errors to bypass containment measures. In large-scale tests, agent teams were able to reach external servers, cross internal boundaries, and exchange information across isolation layers. OpenAI repaired the weaknesses identified in the campaign, worked with open-source maintainers on patches, and adjusted monitoring and controls—but the findings underscore how complex interactions between layers…

Saugata DattaOct 24, 20264 min read90

Cloudflare

Kentik Links Foreign Traffic Floods to North Korea .kp Outage

Multiple waves of traffic this week knocked large parts of North Korea’s public internet offline, leaving more than 40 .kp websites intermittently unreachable for roughly 32 hours. The outages began in the early hours of October 20 (02:01 UTC) and affected core services including the Ministry of Foreign Affairs and the Korean Central News Agency. Internet measurement firm Kentik, through its internet analysis director Doug Madory, traced sudden traffic floods…

Saugata DattaOct 24, 20263 min read104

Cybersecurity

Critical Okta Access Gateway Flaw Could Let Admin-Level Input Trigger System Commands

Okta has published an advisory about a high-severity vulnerability in Okta Access Gateway that can allow specially crafted administrative input to trigger system command execution inside the appliance. The issue highlights the continuing importance of limiting and monitoring privileged access to management consoles and of applying vendor patches quickly when they address control-plane weaknesses. What happened Okta disclosed CVE-2026-115547, a vulnerability affecting Okta Access Gateway releases prior to 2026.10.2. According…

Saugata DattaOct 23, 20263 min read114

Cybersecurity

Node2Shell: Crafted Brotli Data Lets Code Run in an Official Node.js Build — What Operators Need to Know

Imperva researchers have demonstrated a proof-of-concept exploit—dubbed “Node2Shell”—that uses crafted Brotli-compressed data to achieve remote code execution (RCE) against an official Node.js 24.22.0 build for Linux arm64. The issue, tracked as CVE-2026-111497, was disclosed by Node.js and patched on October 21, 2026. While the demonstration did not work reliably on every attempt and targeted a specific build and architecture, it highlights a real risk for services that decode untrusted Brotli…

Saugata DattaOct 23, 20265 min read115

Cybersecurity

Firewall Fallout: How k0t Exploited Exposed Edge Devices to Harvest 70,000+ Credentials

Security teams woke up to a coordinated campaign that systematically targeted internet-facing firewalls and VPN appliances, resulting in the exposure of more than 70,000 credentials and LDAP dumps. Researchers from Group-IB and NyxLab attribute the activity to an operator tracked as k0t (also known as CryptoFeel, Member19, and QazWsxShop). The intrusions—detected largely between February and June 2026—rely less on high-value targeting and more on mass enumeration of exposed devices, leaving…

Saugata DattaOct 23, 20264 min read114

Hacking and Exploits

PHP2Shell Proof-of-Concept Goes Public — Potassium Botnet Attempts and What Defenders Should Do

Public proof-of-concept code for two critical PHP vulnerabilities—collectively dubbed PHP2Shell—has been released, and security teams have observed scanning and failed attempts to use the flaws to deliver botnet malware. While attempted exploitation is concerning, researchers stress that scans and blocked deliveries are not the same as confirmed successful compromises. The key takeaways are straightforward: review runtime configurations, apply the issued PHP fixes, and treat detection telemetry carefully so you don’t…

Saugata DattaOct 23, 20264 min read115

Cybersecurity

PHP’s New Warning: Narrow Unpatched RCE Path After PHP2Shell Fixes

PHP released a short advisory on October 23 warning of a separate, unlikely path that could let an attacker run code on a web server — just two days after emergency fixes for the critical PHP2Shell flaws. While the newly disclosed issue (CVE-2026-115560) is not being treated as an emergency, administrators should understand the configuration that creates the risk, confirm whether their apps are affected, and apply the recommended mitigation…

Saugata DattaOct 23, 20264 min read119

Cybersecurity

Citrix NetScaler Zero-Day in the Wild: Remote Code Execution, Web Shells and What to Do Now

A critical remote code execution flaw in Citrix NetScaler ADC and Gateway — tracked as CVE-2026-88771 — is being actively exploited to run commands on exposed appliances, install web shells and deliver malware. Observers report attackers using a staged technique that poisons logs, triggers a diagnostic process to execute embedded commands, and then attempts to persist via web shells or a FreeBSD x64 binary. With NetScaler devices frequently positioned at…

Saugata DattaOct 23, 20264 min read121

Cybersecurity

Emergency Java Patch: Oracle Distrusts eMudhra Intermediates to Fix CVE-2026-91403

Oracle has released an emergency Java security update to address a critical certificate-trust vulnerability that could let attackers impersonate legitimate HTTPS services. Published October 21, 2026 and tracked as CVE-2026-91403 with a CVSS 3.1 score of 9.1, the issue affects the Java Secure Socket Extension (JSSE) and several GraalVM builds. Although Oracle reports no confirmed exploitations yet, the low complexity and lack of required authentication make this an urgent patch…

Saugata DattaOct 23, 20264 min read117

Cybersecurity

Splunk Patches 24 Flaws — Four Critical Vulnerabilities in Enterprise and SOAR Addressed

Splunk has released a set of security updates correcting 24 vulnerabilities across Splunk Enterprise and Splunk SOAR. The fixes, published in advisories on October 21, 2026, include four critical flaws with CVSS scores as high as 9.9 and a mix of issues that range from improper access control and unsafe input handling to the potential for remote code execution and denial-of-service. Because Splunk often occupies a central role in security…

Saugata DattaOct 23, 20263 min read120

Artificial Intelligence

AI-Assisted Intrusion: DeepSeek-Powered Attacker Steals Over 5,200 University Records

A relatively unsophisticated threat actor using the handle BUGSTER leveraged AI tools to undertake a string of intrusions against Indian organizations, including at least two universities, and exfiltrated a MongoDB database with more than 5,200 records, according to researchers at Palo Alto Networks’ Unit 42. The case illustrates how readily available AI assistants, when combined with weak account hygiene and ordinary scripts, can amplify the capabilities of an attacker who…

Saugata DattaOct 23, 20263 min read126

Free Tools: IP, DNS, SSL