A new archive-manipulation technique called “Zombie ZIP” lets attackers conceal payloads inside ZIP files in a way that can evade many antivirus and endpoint detection solutions. The method was described by security researcher Chris Aziz of Bombadil Systems and has drawn warnings from CERT/CC and the wider security community. This post explains how Zombie ZIP works, what research and evidence
Category: Security
Zero-Day, APT, Exfiltration, Lateral-Movement, Privilege-Escalation, Botnet, Rootkit, Backdoor, Keylogger, Smishing, Vishing, Spear-Phishing, Social-Engineering, MITM, SQL-Injection, Cross-Site-Scripting, XSS, CSRF, Path-Traversal, Buffer-Overflow, Honeypot, CVE, CVSS, Red-Team, Blue-Team, Threat-Hunting, Malware-Analysis, MITRE-ATT&CK, Insider-Threat, Privilege-Flaw, Jailbreak, Shellcode, Exploit-Kit, LFI, RFI, Obfuscation, Payload.
Microsoft .NET Out-of-Bounds Read (CVE-2026-26127) Causes Remote Denial-of-Service Risk
Microsoft has issued an emergency security update to address a newly disclosed vulnerability in the .NET ecosystem that can be triggered remotely and results in denial-of-service (DoS) conditions. The flaw, tracked as CVE-2026-26127, affects multiple .NET runtime and package versions across Windows, macOS, and Linux. Administrators and developers should prioritize applying the available patches to prevent service disruption. What the
Microsoft Copilot Cowork: Automating Multi-Step Workflows Inside Microsoft 365
Microsoft announced Copilot Cowork as a new Copilot capability for Microsoft 365 that moves beyond single-response assistance to plan-and-execute workflows across Microsoft 365 apps and files. Cowork converts a user’s intent into a structured plan, runs the plan across supported apps and data sources, and surfaces checkpoints that require user confirmation before applying changes. The feature is positioned to operate
Zero-Day on the Market: $220K Exploit Targets Windows Remote Desktop Services (CVE-2026-21533)
Remote Desktop Services (RDS) has come under renewed scrutiny after reports that a working exploit for CVE-2026-21533 — an elevation-of-privilege vulnerability in Windows Remote Desktop Services — was listed for sale on a dark web forum for $220,000. The listing and surrounding reporting are factual and straightforward: a recently created account advertised a claimed zero-day exploit, observers recorded the posting,
Cognizant’s TriZetto Subsidiary Reports Data Breach Affecting 3.4 Million Patients
TriZetto Provider Solutions, a healthcare-technology subsidiary of Cognizant, has disclosed a large data breach that exposed the protected health information of 3,433,965 patients. The company classified the incident as an external system hacking event after threat actors gained unauthorized access to TriZetto’s external infrastructure. Timeline and discovery Initial unauthorized access occurred on November 19, 2024. TriZetto did not detect the
Clipboard Trap: ClickFix Now Abuses Windows Terminal to Deliver Lumma Stealer
A newly observed wave of ClickFix social-engineering attacks has shifted tactics, hijacking Windows Terminal as its execution environment to deliver credential-stealing malware. Security researchers from Microsoft and other vendors tracked this campaign in early 2026 and reported a reliable pattern: victims are manipulated into pasting an obfuscated command from their clipboard into a legitimate-looking terminal window, which then decodes and