Hacking and Exploits

Web-Hacking, 0-Day, Malware, Ransomware, Exploit, Vulnerabilities, Privilege-Flaw, Privilege-Escalation, Zero-Day, Exploit, Jailbreak, Penetration-Testing, Trojan, Spyware, Rootkit, Worm, Backdoor, Payload, Obfuscation, DDoS, Phishing, MITM, Spoofing, Brute-force, Port-Scan, SQLi, XSS, CSRF, Path-Traversal, LFI, RFI, Insecure-Deserialization, Buffer-Overflow, CVE, Exploit-Kit, Shellcode, bug bounty, ethical hacking, CTF, capture the flag, offensive security, red team exercise, exploit development, reverse engineering, vulnerability research, credential harvesting, zero-click, hack

Page 7

Cloud Computing

Copy Fail (CVE-2026-31431): A 4‑Byte Kernel Bug That Lets Attackers Gain Root on Major Linux Distros

Microsoft Defender Security Research recently disclosed CVE-2026-31431—nicknamed “Copy Fail”—a high‑severity local privilege escalation in the Linux kernel’s crypto subsystem that enables an unprivileged user to escalate to root. The vulnerability affects kernels released since 2017 and has broad implications for cloud and container environments because the exploit can corrupt in-memory representations of readable files (including setuid binaries) without changing the on-disk file. Although public proof-of-concept code exists and detected exploitation…

Saugata DattaMay 2, 20265 min read350

Artificial Intelligence

How the Google Gemini CLI Flaw Turned CI/CD Pipelines into Remote Code Execution Risk

A critical remote code execution (RCE) vulnerability in the Google Gemini CLI and its associated GitHub Action exposed a startling weakness in how AI tooling can interact with developer infrastructure. Rated with the maximum CVSS score of 10.0, the bug allowed unprivileged external actors to execute commands on the machines running CI/CD workflows. This wasn’t a prompt-injection trick against a model; it was an infrastructure-level failure that allowed malicious configuration…

Saugata DattaApr 30, 20264 min read338

Cybersecurity

Email threat landscape: Q1 2026 trends and insights

During the first quarter of 2026, email-based threats remained pervasive and dynamic. Microsoft Threat Intelligence recorded roughly 8.3 billion phishing messages across January–March, with monthly volumes edging down from about 2.9 billion in January to 2.6 billion in March. While total volume showed only slight decline, the quarter revealed important shifts in delivery mechanisms and attacker behavior: link-based attacks dominated, QR code phishing accelerated rapidly, CAPTCHA-gated campaigns resurged with new…

Saugata DattaApr 30, 20266 min read309

Cybersecurity

CISA orders federal agencies to patch CVE-2026-32202 after zero-click NTLM hash leak is reported

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to secure Windows systems against a vulnerability tracked as CVE-2026-32202 after cybersecurity firm Akamai reported it as a zero-click NTLM hash leak left behind when Microsoft incompletely patched a February remote code execution flaw (CVE-2026-21510). CISA added CVE-2026-32202 to its Known Exploited Vulnerabilities (KEV) Catalog and mandated that Federal Civilian Executive Branch agencies patch affected endpoints and servers…

Saugata DattaApr 30, 20262 min read369

Hacking and Exploits

PhantomRPC: New Windows RPC Vulnerability Lets Attackers Escalate Privileges Across All Windows Versions

PhantomRPC is an architectural weakness in the Windows Remote Procedure Call (RPC) runtime that allows low-privileged processes to escalate to SYSTEM or Administrator by impersonating privileged clients. Disclosed by Kaspersky’s Haidar Kabibo at Black Hat Asia 2026, the flaw stems from how rpcrt4.dll handles connections to unavailable RPC servers: when a privileged process attempts an RPC call to a server that is offline or disabled, the RPC runtime can be…

Saugata DattaApr 26, 20264 min read330

Cybersecurity

CISA: Zimbra XSS (CVE-2025-48700) Now Exploited — 10,500+ Servers Vulnerable

Over 10,000 instances of the Zimbra Collaboration Suite are exposed online and remain vulnerable to an actively exploited cross-site scripting flaw, raising fresh alarms about email server security for governments and businesses alike. The vulnerability, tracked as CVE-2025-48700, is serious because it can be triggered without user interaction and has been confirmed as abused in the wild, prompting action from both vendors and national cybersecurity authorities. What happened Shadowserver, an…

Saugata DattaApr 24, 20264 min read438

Cybersecurity

Hackers Leverage Microsoft Teams to Breach Organizations: Inside UNC6692’s SNOW Campaign

In late 2025 and into early 2026, a sophisticated intrusion campaign used the everyday familiarity of Microsoft Teams to turn routine collaboration into a direct route for enterprise compromise. By posing as IT helpdesk staff and exploiting users’ trust in external Teams invitations, the threat group tracked as UNC6692 moved from a simple chat message to full domain-level access—without exploiting a software vulnerability. The result was a carefully staged, cloud-hosted…

Saugata DattaApr 24, 20265 min read410

Cybersecurity

109 Fake GitHub Repositories Used to Deliver SmartLoader and StealC Malware

A large-scale campaign recently uncovered shows how attackers abused the trust developers place in open-source hosting to distribute two dangerous malware families, SmartLoader and StealC. By cloning legitimate projects and burying malicious ZIP archives deep inside repository structures, the threat actor made harmful downloads look like routine releases. For many victims the repository looked authentic at a glance: real source files remained intact, but documentation and release links silently pointed…

Saugata DattaApr 23, 20264 min read485

Cloud Computing

Google Cloud and Wiz Turn Defense Into an Agentic Response to AI-Powered Attacks

Attackers and defenders are now playing with the same toys: powerful AI models that can find and exploit zero-day vulnerabilities in hours. At Google Cloud Next ’26, Google and Wiz unveiled a set of AI-driven defenses designed to shrink the time between discovery and remediation — and to automate much of the manual work that has left security teams lagging behind. Together, the announcements signal a shift toward agentic, cross-cloud…

Saugata DattaApr 22, 20265 min read426

Compliance and Privacy

Lovable AI App Builder Reportedly Exposes Thousands of Projects’ Source Code and Customer Data

A critical Broken Object Level Authorization (BOLA) vulnerability in Lovable, an AI-powered app builder, has reportedly left thousands of legacy projects accessible to unauthorized users. According to security researchers, an API endpoint returned full project data — including source code, database credentials, AI chat histories, and customer information — for projects created before November 2025. While Lovable appears to have patched newly created projects, the persistent exposure of older projects…

Saugata DattaApr 20, 20264 min read457

Cybersecurity

New RDP Alert After April 2026 Security Update Warns of Unknown Connections

Microsoft’s April 2026 Patch Tuesday introduced a small-looking but important change to how Windows handles Remote Desktop (.rdp) files. What used to be a silent, one-click experience can now surface clear warnings about unknown connections and requested local resource access, closing an easy door attackers have been exploiting for phishing and session hijacking. For organizations and individual users alike, the update shifts the default toward safer, more explicit consent when…

Saugata DattaApr 20, 20264 min read374

Cybersecurity

Recently Leaked Windows Zero-Days Now Being Actively Exploited: What You Need to Know

Threat actors have begun abusing three recently disclosed Windows vulnerabilities to escalate privileges and interfere with Microsoft Defender, shifting a theoretical disclosure debate into a real-world security crisis. A security researcher known as “Chaotic Eclipse” (also called “Nightmare-Eclipse”) released proof-of-concept exploit code for all three flaws earlier this month, and multiple security teams have since observed the techniques used in live intrusions. For defenders and administrators, the situation underscores how…

Saugata DattaApr 17, 20264 min read381

Free Tools: IP, DNS, SSL