A pre-authentication XML External Entity (XXE) vulnerability leading to HTTP Server-Side Request Forgery (SSRF) was reported on ArubaOS 8.13.2, specifically on port 32000's default XML API which requires no authentication. The report includes evidence such as TCP packet captures, SSH localhost logs, and internal port scans via SSRF. Despite this evidence, the issue was closed by the vendor as theoretical with no valid proof of concept. The vulnerability details and proof of concept are publicly documented on GitHub for community review.
SecureX is an open-source specification protocol defining 13 rules for zero-knowledge, privacy-preserving application design. It mandates client-side encryption, multi-tenant isolation, elimination of third-party tracking, no administrative backdoors, atomic data deletion, and other privacy and security best practices. The protocol aims to establish a compliance standard for software developers to ensure absolute data isolation and privacy. There is no indication of a specific vulnerability or exploit associated with SecureX itself.
This content is a community-shared set of detection queries for identifying suspicious PowerShell and living-off-the-land binary (LOLBin) activities in production environments. It includes specific queries to detect unusual parent processes for LOLBins, PowerShell spawned from office or browsers, encoded PowerShell commands with payload decoding, reflective loading indicators, and behavioral baseline layering to reduce false positives. The post is a knowledge-sharing resource rather than a direct security vulnerability or exploit.
This entry is a request on Reddit for current phishing email samples targeting IONOS customers, intended for a technical blog analysis focusing on email headers and artifacts. It does not describe a specific vulnerability or active exploit but rather seeks raw phishing email data for research purposes.
CVE-2026-45447 is a use-after-free vulnerability in OpenSSL's PKCS#7 signature verification that occurs when processing specially crafted PKCS#7 or S/MIME signed messages containing an empty ASN.1 SET in the SignedData digestAlgorithms field. This flaw causes OpenSSL to incorrectly free a caller-owned BIO during PKCS7_verify(), potentially leading to crashes, heap corruption, or remote code execution. Applications using OpenSSL PKCS#7 APIs are affected, while those using CMS APIs or FIPS modules are not impacted. The vulnerability has been addressed by OpenSSL in official commits.
This report discusses testing offensive AI agents within a cloud lab environment using deception technology. The source is a Reddit post linking to an external site describing repeated experiments of the Tularosa study against multiple offensive AI agents to evaluate the effectiveness and perception of deception techniques. There is no indication of a specific vulnerability or exploit. The content is informational about security research rather than a direct security threat.
France's government messaging app Tchap was breached after a single user account was compromised via social engineering. The attacker accessed public channels, scraping approximately 650,000 messages, data on over 73,000 accounts including email addresses and device metadata, and 13.5GB of documents and media. Private conversations remained protected by end-to-end encryption and were not accessed. The compromised account was quickly identified and blocked by French authorities. The breach highlights risks from mandatory adoption of the platform without proportional security review. The investigation is ongoing.
A security flaw in ServiceNow was exploited by unknown threat actors to gain unauthorized access to customer instances. The issue allowed unauthenticated users, under certain conditions, to access ServiceNow instances beyond intended permissions. ServiceNow applied a security update on June 5, 2026, to restrict this access to authenticated users only. The flaw affects customers on the Australia platform release or those with specific configuration changes on earlier releases. ServiceNow detected anomalous activity and notified impacted customers. The vulnerability does not yet have a CVE identifier and was initially reported internally to ServiceNow in April 2026. This is a developing situation with limited technical details publicly available.
GhostTrace is a Windows forensic scanner tool designed to detect remnants left behind after software uninstallation. It operates offline and read-only, scanning 22 forensic modules including registry keys, prefetch entries, scheduled tasks, WMI subscriptions, and more. The tool aims to provide forensic evidence of persistence, execution, user activity, and installed software traces without modifying the system or generating network traffic. It is intended for investigative use rather than automatic threat verdicts.
Six vulnerabilities collectively called Proto6 have been identified in protobuf.js, a JavaScript/TypeScript implementation of Protocol Buffers used in Node.js applications. These flaws can lead to remote code execution (RCE) and denial-of-service (DoS) attacks by exploiting the library's default trust of schema and metadata inputs. The vulnerabilities affect protobuf.js versions <=7.5.5 and >=8.0.0 <=8.
A zero-day vulnerability named RoguePlanet in Microsoft Defender allows attackers to gain SYSTEM-level access on fully updated Windows 10 and 11 machines. The exploit is a race condition that can result in arbitrary code execution with the highest privileges. It has been publicly disclosed with a proof-of-concept by a security researcher known as Chaotic Eclipse. The vulnerability affects desktop Windows systems with June 2026 Patch Tuesday updates installed but does not currently work on Windows Server due to mounting restrictions. The researcher has criticized Microsoft's handling of vulnerability disclosures and has released multiple related exploits. Microsoft has condemned the public disclosures but has not yet provided an official patch.
This entry describes a Reddit post linking to a video about a skill created to scan codebases. It does not describe a specific security vulnerability or threat. There is no technical detail indicating an exploit, vulnerability, or attack vector.
Miasma-style supply chain attacks represent a new category of supply chain threats that leverage the widespread use of third-party packages, CI/CD automation, and coding agent configuration files. These attacks are challenging to defend against, even for organizations with strong security postures. The threat is currently discussed in a recent blog post linked from a Reddit cybersecurity community, highlighting emerging risks in software supply chains.
FCaptcha versions 1.11 and 1.12 introduce mechanisms to detect AI agents that control real browsers. The detection techniques include Chrome DevTools Protocol (CDP) input forensics, analysis of think-time cadence, and matching declared user agents. This is a security-related development aimed at identifying automated AI-driven browser interactions.
A Wi-Fi deauthentication flooding tool named KTO can disconnect clients protected by Protected Management Frames (PMF) on some Android phones by overwhelming them with invalid deauth frames. Despite PMF rejecting unprotected frames cryptographically, aggressive flooding causes disconnections within seconds. The tool continuously scans and deauthenticates clients automatically without manual targeting. This behavior was tested on three Android devices with the latest security patches. The effectiveness against other platforms like iOS, Windows, or IoT devices is unknown.
This content describes a practical detection approach for identifying encoded PowerShell commands using Kusto Query Language (KQL) in Microsoft Sentinel. The detection method incorporates a weighted scoring model that reduces noise by considering multiple indicators beyond the simple presence of encoded commands, such as the parent process, download-related keywords, execution flags, and execution paths. The approach aims to improve alert accuracy and reduce false positives in enterprise environments. It is not a vulnerability or exploit but a detection technique shared on a public forum.
Operation Riptide is an ongoing coordinated law enforcement campaign announced by the FBI targeting criminal actors and the key services they rely on, including their infrastructure, tools, communications platforms, and financial channels. The campaign aims to disrupt illicit activities by focusing on multiple facets of criminal operations. No specific technical vulnerabilities or exploits are detailed in the available information. There is no indication of affected software versions or direct exploitation methods. The campaign represents a law enforcement initiative rather than a software vulnerability or malware threat.
ServiceNow confirmed a security incident involving unauthorized access to some customer instances through a vulnerable API endpoint. The flaw allowed unauthenticated users to query customer instance data, which may include sensitive enterprise information such as IT tickets, employee records, and internal documentation. ServiceNow applied a security update on June 5, 2026, to restrict the vulnerable API endpoint to authenticated users only. Impacted customers have been notified via support cases. The issue primarily affected customers on the Australia platform release or those with certain configuration changes on older releases. No detailed public disclosure of the exploited data or technical specifics has been made yet.
This report discusses concerns about the safety of using GoPhish, a phishing framework, due to a Cisco Talos blog noting that threat actors abuse GoPhish to deliver malware such as PowerRAT and DCRAT. The information is sourced from a Reddit cybersecurity post linking to the Talos blog. There is no direct vulnerability in GoPhish itself described here, but rather its abuse as a delivery mechanism by attackers. No affected versions or patches are specified.
RoguePlanet is a newly disclosed Windows Defender vulnerability involving a race condition exploit that can spawn a SYSTEM shell if successful. The proof-of-concept (PoC) has been tested on Windows 10 and Windows 11 with June 2026 patches applied, showing variable success rates depending on the machine. Windows Server versions are believed to be vulnerable as well, though the current PoC does not work on them due to user restrictions on mounting ISO images. The exploit targets a race condition in Windows Defender, allowing privilege escalation to SYSTEM level.