/r/netsec
@r-netsec-bot.bsky.social
Follow for new posts submitted to the netsec subreddit. Unofficial. Automated by @kiding.bsky.social.
We found 4,972 "hello" messages hiding thousands of malicious commands targeting Flowise
You Had Me at "Hello": Inside The Greeter, A Chinese-Language Framework Targeting AI Infrastructure
Era Research uncovered Greeter, a Chinese-language exploitation framework that hid malicious commands inside "hello" messages to attack exposed Flowise AI deployments.
era.security
Pass-ta-key Golden Attack: Stealing Google Password Manager Synced Passkeys for Offline Account Takeover
Pass-ta-key Golden Attack: Extracting the Security Domain Secret from Chrome process memory
Part 1 of a technical deep-dive into the Pass-ta-key Golden Attack, covering a new method for extracting the Security Domain Secret (SDS) of Google Password Manager from Chrome process memory.
0rcruxe.github.io
Jailbreaking my car's navigation system just so I can change the time
Jailbreaking my car's navigation system just so I can change the time | nns.ee
I shouldn't have to be doing any of this, but at least it's fun.
blog.nns.ee
Fake Nuclear Alert Sent Through Russian Emergencies Ministry App After Hack
Fake Nuclear Alert Sent Through Russian Emergencies Ministry App After Hack - Nationwide Private Investigator & Skip Tracing | Knoxville TN Background Checks & OSINT | Kyle's Investigation
MOSCOW, November 2, 2026— Russia’s Emergencies Ministry said Monday that its mobile app was hit by a cyberattack that let outsiders push false warnings to users, according to the state news agency TASS. The incident came hours after Ukraine reported that its own air raid alert app had been hacked. What users saw The bogus […]
kylesinvestigation.com
Remote code execution on Linux systems with multipath TCP
Remote code execution on Linux systems with multipath TCP
On October 27, LLM provider Anthropic reported on a remotely exploitable use-after-free bug a [...]
lwn.net
Mirage2FA stole 4,561 M365 session cookies despite MFA via AiTM proxy (CVE-2026-69836 CVSS 10.0) : detection rules and WHfB/Cloud Kerberos Trust hardening guide
AiTM / Cookie Hijacking M365 — Détection, mitigation et protection structurelle DoIt4Everyone
Guide technique complet sur les attaques AiTM contre Microsoft 365. CAE, WHfB, FIDO2, Cloud Kerberos Trust, CA Authentication Strength. Validé terrain sur infra hybride — août 2026.
doit4everyone.github.io
Every false positive we have shipped had the same cause
Every false positive we have shipped had the same cause
Four false positives in four vulnerability classes had one root cause: the scanner accepted something it had caused as proof. A template matched a marker it had put in the request. An SSRF probe counted a callback our own client made. Here are the four, and the five rules that now stop them, each enforced in code rather than by review.
crossfyre.io
Stopping Remote Code Execution with Sandboxes, CVE-2026-115995: Rust Zip
Stop Remote Code Execution with a Sandbox (Real CVE Demo) | Cosmonic
A real RCE vulnerability, left unpatched, does nothing inside a sandbox. See how deny-by-default WebAssembly components block every move a malicious zip makes.
cosmonic.com
EMBRACE: How We Hacked the Browsers Embedded in Top Five Desktop AI Assistants · Forever Secur
EMBRACE: How We Hacked the Browsers Embedded in Top Five Desktop AI Assistants · Forever Security
Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop each built a browser into their AI assistant, then enriched it beyond what a normal browser allows. Those enrichments broke the browser threat model, letting a web page or a local file reach the machine behind it. Two issues remain unpatched.
forever.security
The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only!
The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only!
This is what I built for Pwn2Own Berlin 2026 — a completely handmade, logic-only Microsoft Edge Full Chain, with no memory corruption, and no AI at all! 🔥
blog.orange.tw
Linux Kernel TIPC DoS: named_distribute() NULL Dereference, Race Analysis, and Remote Triggering
404 Page not found
blog.jamessawyer.co.uk
Axis Camera Station Deep-Dive: Unauth RCE to Decrypting Every Camera Credential (CVE-2025-30026/30023 + CVE-2026-63286)
From RCE to camera credentials in Axis Camera Station
During a penetration test, I exploited CVE-2025-30023 (insecure deserialization) chained with CVE-2025-30026 (authentication bypass) to get SYSTEM-level RCE on two Windows machines running Axis Camera Station on a factory. After that, I discovered CVE-2026-63286, a weak credential encryption scheme, which allowed me to decrypt all the camera credentials stored in the application’s database and connect to the cameras.
ricardojoserf.github.io
XML Signature Wrapping authentication bypass in Moldova's MPass SAML NuGet library, fixed in 10.0.4 (CVE requested, CAN-2026-2041077)
MPass SAML XML Signature Wrapping Authentication Bypass
Egov.Integrations.MPass.Saml before 10.0.4 does not bind the signed XML reference to the trusted SAML response root. Upgrade to 10.0.4 or later.
masiutin.net
Turning the Valve - Exploiting RCE and LPE in the Steam Platform
Turning the Valve - Exploiting RCE and LPE in the Steam Platform
Diving into the Steam platform for local and remote code execution vulnerabilities.
atredis.com
An attacker can crash a Godot game server using DTLS with an unauthenticated UDP datagram
An attacker can crash a Godot game server using DTLS with a single UDP datagram | axeghost | Axe Ghost. On Steam! | Offprint
DTLS is the engine's optional encryption layer for UDP multiplayer. In every version of Godot I inspected the source of — 3.2.2 and 4.7 through 4.7.2 — one unauthenticated datagram can overwrite...
axeghost.offprint.app
Scanning 7.25 Million Public Repositories on China's Largest Git Platform for Secrets
Scanning 7.25 Million Public Repositories on China's Largest Git Platform for Secrets
Discover the security findings from scanning 7.25 million public repositories on Gitee, which uncovered 26,400 verified-live credentials, cloud keys, and enterprise AI tokens.
mongodb.com
SEO Poisoning Campaign Targets DeepSeek Users: Chinese Threat Actor Deploys Kong RAT via Multi-Stage Attacks
SEO Poisoning Campaign Targets DeepSeek Users: Chinese Threat Actor Deploys Kong RAT via Multi-Stage Attacks
Author: Vlad Pasca Executive Summary SEO poisoning campaign targets DeepSeek AI tool searchers through first-page malicious domains. Multi...
hybrid-analysis.blogspot.com
Cache Me If You Can: XSS in Cloudflare's /cdn-cgi/image/
Cache Me If You Can: XSS in Cloudflare's /cdn-cgi/image/
We achieved XSS through Cloudflare's /cdn-cgi/image/ endpoint by chaining an SVG sanitizer bypass with a Chromium Cache-Control trick that strips CSP. The same trick also works on Netlify and S3.
slcyber.io
