Skip to content
skopnix
Every edition · newest first

The archive.

1,115 dispatchespage 17 / 19№ 155 – 96

  1. Wed 29 Jul 2026

    2 dispatches
    Researchers Show a Single Malicious Webpage Visit Can Compromise Tor BrowserVULN
  2. GHSA-rcr6-4jqh-j84m: Gitea: Remote Code Execution via diffpatch Git Hook InstallationKEV

  3. Tue 28 Jul 2026

    47 dispatches
    CubePilot drone software dev hit by DNS hijacking to intercept trafficSUPL
  4. Thousands of Data Center Controllers Open to TakeoverVULN
  5. IPMI bug in BMCs found after 22 years, exposes 24,000-plus serversVULN
  6. RT by @cyb3rops: Update: the Chinese threat actor behind the #Hermes + #CyberStrikeAI + #SliverC2 exploitation node has shifted operations to a new server ( migrated ~19 Jun 2026). Threat actor also hit http://derouter.ai, an AI-API reseller selling Claude/GPT access. Found an endpoint wide open and pulled 775 upstream API-key IDs + their ban/rate-limit status + full traffic data(patched). New infra IOCs: 203.88.119[.]53 — new primary host post-migration 137.220.144[.]253:12305 — Sliver Redirector (also ran its own independent exploit campaign vs 32 targets) 143.92.51.76[:]23175 — WireGuard/SOCKS5 exit node for scan traffic 207.180.56[.]150 — Operator's IP address Domains: 1daynews[.]app/435736b425a677a8 — public-facing CVE-intel dashboard (14,643 CVEs tracked, 20 sources, live-updating) aitoday[.]me — second service Attribution: SSH key artifact leaks username knaithe (knaithe@DESKTOP-IQA5FIU), retained across the migration. Telegram control bot (AAtttttttaccccckBot). Full China-nexus stack — FOFA / DeepSeek / GLM / dnslog[.]cn, internal agent notes all in Chinese. Shodan username via api key: crc2 @malwrhunterteam @500mk500 @MichalKoczwaraKEV
  7. OpenAI models used Artifactory zero-days to escape to the internetEXPL
  8. Claude Mythos degrades HAWK and developed new exploit for round-reduced AESRSCH
  9. Pinned: BREAKING — Claude AI found a working HAWK-256 key-recovery attack. HAWK is a NIST post-quantum cryptography candidate. It also made an impractical 7-round AES-128 attack up to 800x faster. Read this here: https://thehackernews.com/2026/07/claude-ai-just-cracked-post-quantum.htmlRSCH
  10. Claude AI Just Cracked a Post-Quantum Test Scheme and Found a Faster 7-Round AES AttackRSCH
  11. vBulletin fixes critical pre-auth RCE flaw with public exploitVULN
  12. Flying Eagle Android RAT: TLS Certificate Pivots, Panel Fingerprints, and 170 Servers Across Hong Kong ASNsMALW
  13. FBI sees Anthropic’s Mythos as a law enforcement challengePOLI
  14. 'Certighost' Flaw Haunts Microsoft Active Directory CertificatesVULN
  15. Wordfence PRISM Detected Backdoored WordPress Plugin within Two Hours of it Being IntroducedVULN
  16. Hugging Face breach reignites open-weights debate, raises liability questionsBRCH
  17. RT by @cyb3rops: Cato: China-nexus SilverFox hits Japanese industrial manufacturing with ValleyRAT (Winos 4.0), extending beyond its historical Chinese-language targeting. The group evolves its BYOVD driver abuse and hijacking of signed software to evade defenses. https://www.catonetworks.com/blog/cato-ctrl-silverfox-evolves/APT
  18. Bugs in Hugging Face Diffusers Bypass Custom Code SafeguardVULN
  19. Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its ProcessMALW
  20. AI-Assisted Bug Hunt Uncovers Linux Kernel 0-Day in net/schedVULN
  21. 24,650 internet-exposed BMCs are leaking IPMI authentication hashes before login, giving attackers what they need to crack passwords offline. More than 30% matched recoverable passwords, including factory-issued credentials. Read what exposed servers need to lock down: https://thehackernews.com/2026/07/24650-internet-exposed-bmcs-disclose.htmlVULN
  22. 24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before LoginVULN
  23. Apple Patches 87 Vulnerabilities in iOS, 155 in macOS TahoeVULN
  24. Simple Job Board ≤ 2.11.0 - Unauthenticated RCE (CVE-2024-1813)VULN
  25. JFrog confirms OpenAI models exploited a zero-day in self-hosted "Artifactory," escalated privileges, and moved laterally until they reached the open internet. From there, the models targeted #HuggingFace and obtained ExploitGym solutions from its production database via a separate attack path. Here's how it happened: https://thehackernews.com/2026/07/jfrog-confirms-openai-models-exploited.htmlEXPL
  26. JFrog Confirms OpenAI Models Exploited Artifactory Zero-Day Before Hugging Face BreachEXPL
  27. How We Hacked Thousands of Data Centers in Minutes Using a 20-Year-Old VulnerabilityVULN
  28. Phishing Dominates as Initial Entry Method for Cyber-Attacks, as Hackers Hone Evasion TechniquesRSCH
  29. ALERT - OpenWrt users, this one needs attention. A critical pre-auth DHCPv6 flaw could let an attacker who can reach the service send a crafted request and run code as root on the router. A separate audit also found 7 more flaws, including three pre-auth paths to device compromise. What users need to update now: https://thehackernews.com/2026/07/critical-openwrt-dhcpv6-flaw-could-let.htmlVULN
  30. Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as RootVULN
  31. Microsoft Launches Flurry of AI Security Initiatives to Combat AI-Enabled ThreatsMISC
  32. Over 24,000 exposed server BMCs leak password hash via decades-old flawVULN
  33. Iranian state-backed Nimbus Manticore is turning compromised systems into covert network relays. NightLedger executes commands, uploads files, and captures screenshots, while BridgeHead and ArcBridge tunnel traffic through victim networks. Read more: https://thehackernews.com/2026/07/nimbus-manticore-deploys-nightledger.htmlAPT
  34. Exposed BMCs hand out password hashes before loginVULN
  35. Nimbus Manticore Deploys NightLedger and Turns Victim Systems Into Covert RelaysAPT
  36. Update your iPhone, iPad and Mac to fix Apple security holesVULN
  37. IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chainsRSCH
  38. New Crypter-as-a-Service Cruciferra Fuels Stealthy Malware Attacks WorldwideMALW
  39. AWS to retire Shield Advanced L7 automatic mitigation on January 1, 2027POLI
  40. Data breach at medical billing firm MCBS affects 1.26 million peopleBRCH
  41. Coca-Cola confirms hackers stole data in Fairlife ransomware attackBRCH
  42. Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)KEV
  43. Researcher Says AI Helped Develop Linux Traffic-Control Race Into Root ExploitVULN
  44. AutoIT Payload Injector , (Tue, Jul 28th)MALW
  45. Unpatched Fastjson Vulnerability Exploited in AttacksVULN
  46. Shadow AI incident response begins with logs that may already be goneRSCH
  47. Origin Energy Data Breach Affects 900,000 AustraliansBRCH
  48. Attackers are exploiting a CVSS 10.0 command injection flaw in on-prem Arista VeloCloud Orchestrator. A successful exploit could compromise the orchestrator and give attackers access to managed Edge devices. CISA has ordered federal agencies to patch by July 30. Details: https://thehackernews.com/2026/07/attackers-exploit-arista-velocloud.htmlVULN
  49. AI Agent Drives Espionage Attack on Thai Ministry of FinanceAPT

  50. Mon 27 Jul 2026

    11 dispatches
    Hackers target US firms in FastJson RCE zero-day attacksEXPL
  51. Reuters: OpenAI Agent Hacked Hugging Face for Days Before Being DetectedBRCH
  52. RefluXFS: A Linux Kernel Local Privilege Escalation to Root in XFS (CVE-2026-64600)VULN
  53. New Dysphoria DDoS botnet spreads to 200k devices worldwideMALW
  54. New Certighost PoC exploit lets attackers hijack Windows domainsVULN
  55. 'Confused Deputy' Flaws Persist in Google Cloud, Microsoft AzureVULN
  56. GitHub, PyPI add time-based defenses against supply chain attacksSUPL
  57. [KEV] CVE-2026-16812: Arista VeloCloud Orchestrator On-Prem OS Command Injection VulnerabilityKEV
  58. New AI attack can reconstruct typed text from keyboard sounds with 90-99% accuracyRSCH
  59. Aftercall ads are driving Android users crazyMALW
  60. Really Muddy Waters — Refuting the Seedworm Attribution of Commodity MaaSRSCH