A 29-year-old memory leak vulnerability named Squidbleed was discovered in the Squid open-source caching proxy server. The flaw leaks internal memory, including plaintext HTTP requests and sensitive data such as credentials and session tokens, when Squid handles cleartext HTTP traffic and connects to an attacker-controlled FTP server. The vulnerability stems from a 1997 code commit related to FTP directory listing parsing and was fixed in Squid version 7.6 released in June 2026. Disabling FTP support in Squid is recommended to eliminate the attack surface.
This content describes Grant Hopper, an AI-enabled due diligence tool designed to assess foreign influence risks in international research partnerships. It aims to help academic institutions, government agencies, and corporate R&D teams vet visiting scholars, researchers, and grant applicants before signing memoranda of understanding (MOUs). The tool focuses on identifying potential foreign influence that could lead to economic espionage, intellectual property theft, or reputational damage. The emphasis is on enabling informed decisions rather than discouraging international collaboration.
Reports indicate that the OWASP Juice Shop website hosted at https://juice-shop.herokuapp.com/ is currently experiencing accessibility issues, resulting in application errors for users attempting to access the site. There is no detailed technical information or confirmed vulnerability disclosed. No affected software versions or exploit details are provided.
Cloudflare addressed the Copy-Fail vulnerability by developing and deploying patches across all their servers within two days of the CVE disclosure. The rapid mitigation effort highlights Cloudflare's capability to quickly respond to Linux kernel vulnerabilities using custom BPF-LSM patches. No specific affected software versions or exploitation details are provided in the source data.
Between April and June 2026, attackers compromised the build and distribution pipeline of ShapedPlugin, a WordPress plugin vendor, injecting backdoors into Pro plugin updates. The malicious updates deployed malware that steals credentials, including two-factor authentication (2FA) secrets, and grants attackers full site access. The infection involves a loader that installs a disguised fake plugin with a REST API backdoor, webshell, and hardcoded admin login bypass. The attack targeted paying customers via official update channels, while free plugins remained clean. Site owners who installed or updated ShapedPlugin Pro plugins during this period should immediately scan for infections, rotate credentials, and revoke 2FA secrets.
This entry references a news report and a documentary video about a national cyber-attack in Romania that impacted around 100 hospitals, forcing them to revert to pen and paper operations. The content is a link post on Reddit pointing to a YouTube video by BBC News covering the incident. No specific technical details, vulnerabilities, or exploits are described in the provided information.
Healthcare technology company Xsolis, Inc. disclosed a data breach affecting approximately 1.4 million individuals. The breach resulted from a targeted phishing attack detected on January 22, 2026, which allowed unauthorized access to files containing personal and protected health information. Compromised data includes names, dates of birth, addresses, Social Security numbers, health insurance details, and medical treatment information. The company is not aware of any misuse of the stolen information. The incident was publicly disclosed in early June 2026 and added to the US Department of Health and Human Services data breach tracker.
This vulnerability concerns a potential alignment issue in large language models (LLMs), specifically observed in Gemma-3-12B and initially noted in Claude. The issue arises when a long, structured text influences the model's internal hidden states, causing measurable changes in how the model processes subsequent unrelated tasks. This effect can temporarily weaken the model's alignment constraints, making it more willing to provide direct or controversial answers that it would otherwise avoid. The phenomenon is behavioral and supported by hidden-state analysis in open-weight models, but no permanent model modification or universal alignment bypass has been demonstrated.
AryStinger is a malware family that hijacks over 4,300 outdated routers built on Realtek RTL819X chips, primarily D-Link DIR-850L devices, to create a stealthy reconnaissance and intrusion support network. It exploits old vulnerabilities disclosed in 2013 and 2016 to install a lightweight Linux binary that performs distributed scanning and information gathering without typical malicious activities like file encryption or cryptocurrency mining. A second, more capable Go-based build targets NAS devices via a 2025 code injection vulnerability. The malware communicates with its command and control infrastructure using obfuscated protocols and establishes persistence via Dropbear SSH. The infected routers act as Executors that perform parallel scanning tasks, enabling efficient network footprinting. The infection is concentrated mainly in South Korea and China but also affects other countries. The malware's low detection rate and use of legacy hardware with no firmware updates pose ongoing risks to privacy, enterprise security, and national infrastructure.
Two critical vulnerabilities have been discovered in libssh2, a widely used SSH library embedded in many systems globally. These flaws allow remote attackers to exploit vulnerable instances without requiring privileges or user interaction. The vulnerabilities are described as critical and enable remote code execution. No specific affected versions or patch information is provided in the available data.
A security issue was identified in the ClawHub AI plugin registry where 23 plugins were found squatting official npm-style scopes such as @openclaw/ and @clawhub/. These scopes, which are intended to indicate official ownership, were not properly reserved, allowing unrelated accounts to publish plugins under these trusted namespaces. This creates a supply chain risk because users may trust plugins based on their official-looking scope even if the code is not malicious. The registry has made changes following disclosure to address this issue. This reflects broader security gaps emerging alongside new AI tools and registries.
The Volume Booster Chrome extension, with approximately 2 million weekly users, silently activated a commerce-tracking SDK (Give Freely) between versions 1.0.2 and 1.0.4 without triggering Chrome's permission re-consent prompt. The extension had previously been granted broad host permissions that were dormant until the SDK was activated. This SDK collects device identifiers, geolocation data, and telemetry continuously, regardless of user interaction with the extension's visible UI. The Chrome Web Store listing's privacy declaration does not disclose these data flows, creating a discrepancy between declared and actual behavior.
This content is a detailed personal exploration and tutorial about the internal workings of Wazuh, an open-source security monitoring platform. It explains the event processing pipeline from log generation to alert visualization, including components like File Integrity Monitoring and Vulnerability Detection. The post does not describe any security vulnerability or threat but rather provides educational insights into Wazuh's architecture and detection mechanisms.
A new malware masquerading as ClearMic, a legitimate microphone noise suppression application, has been identified. This malicious software is a Remote Access Trojan (RAT) that logs keystrokes, captures screens, hijacks clipboard data, records microphone audio, and exfiltrates this information to a remote server. It also deletes Windows Shadow Copies to hinder file recovery, a behavior typical of ransomware. The malware detects sandbox environments to evade analysis. Users who have installed this malware are advised to disconnect from the internet, run anti-malware tools, and change passwords from a clean device.
A Broken Access Control vulnerability was discovered and responsibly disclosed in a government student welfare portal used by over 300,000 students in India. The flaw allowed unauthorized authenticated users to access privileged functionality and sensitive beneficiary information, including addresses and government benefit details. The vulnerability stemmed from authorization being enforced only on the frontend, without proper backend validation. The issue was reported to CERT-In and relevant authorities, and has since been confirmed fixed.
A pre-authentication out-of-bounds write vulnerability exists in the bootloader Odin/LOKE decompressor of certain Snapdragon SM8250 Samsung Galaxy devices, including the Note20 (SM-N986U) US variant. This flaw allows an attacker to cause a recoverable denial of service (DoS) by corrupting UEFI memory, leading to device reboot out of Download Mode. The issue affects end-of-life US Snapdragon models and has been patched in supported devices such as the S20 FE and all S21 through S25 models. Exynos variants are not affected due to different bootloaders.
This entry references a white paper analyzing the performance of deepfake detectors when videos/images are re-encoded by social media platforms. The research benchmarks popular open source detectors against synthetic face datasets generated by SDXL and InstantID models. The study aims to evaluate the robustness of detection tools under conditions that mimic real-world social media content transformations. No direct vulnerability or exploit is described.
MESH is an open-source remote mobile forensics tool designed to enable encrypted, peer-to-peer wireless debugging and forensic data acquisition on mobile devices, particularly Android. It creates a censorship-resistant mesh network that overcomes NAT and firewall restrictions without exposing devices to the public internet. The tool supports integration with common forensic utilities and includes network monitoring capabilities. MESH is currently in public alpha, actively developed, and has undergone penetration testing with major vulnerabilities patched. It is intended for use in high-risk or censored environments and emphasizes transient, analyst-controlled forensic sessions rather than permanent infrastructure.
This entry discusses zero knowledge proofs in the context of a Rust-based decentralized internet infrastructure project called The Sovereign Network. The project aims to build a community-owned mesh network with privacy and post-quantum cryptography features. The information is a link post on Reddit with minimal technical discussion and no specific vulnerability or exploit details provided.
This content is a free educational resource providing courses and PDFs on WiFi hacking techniques, including foundational wireless attacks against common Wi-Fi protocols such as WEP, WPS, and WPA2. It covers penetration testing disciplines and tools used in wireless security assessments. The material is intended for learning both offensive and defensive cybersecurity concepts and is not itself a vulnerability or exploit.
