A local privilege escalation (LPE) vulnerability exists in the Gigabyte kernel driver gdrv3.sys, used by Gigabyte App Center and EasyTune. The driver exposes a device with no security descriptor, allowing any local user to interact without administrative rights. One vulnerable IOCTL allows arbitrary write-what-where by writing kernel data to user-supplied addresses, enabling token stealing to escalate privileges. Another IOCTL allows arbitrary Model-Specific Register (MSR) read/write, breaking kernel address space layout randomization (KASLR) and enabling syscall hijacking. The vulnerability was reported to Gigabyte in June 2026 and has been fixed by adding security descriptors and whitelisting MSR writes. The fixed driver is no longer exploitable via these methods.
Sudocrypt v16.0 is an international Capture The Flag (CTF) and cryptic challenge event organized by Exun Clan, a student-run tech club. The event is scheduled for October 27–28, 2026, and is open globally. It features cryptography, code-breaking, and cybersecurity challenges with a prize pool of approximately $900 USD and additional rewards. The competition is online and team-based, encouraging participants to solve puzzles and demonstrate cybersecurity skills.
The provided information references 'pwn.college' as a resource for learning exploit development and hacking techniques. It is presented as a recommendation for beginners and those exploring cybersecurity, without any indication of a specific vulnerability, exploit, or active threat. No technical details, affected software versions, or exploit data are provided.
GLM 5.3 is an advanced open-weight AI model released for free use by the cybersecurity community. It is designed specifically to assist defenders with tasks such as code review, vulnerability triage, penetration testing, reverse engineering, malware analysis, and threat modeling. The model has demonstrated significant capabilities in building exploits and identifying vulnerabilities, comparable to other leading models in the field. It is accessible via an API with a free token allowance upon registration with a work email. The release aims to empower security professionals with a powerful tool for authorized security testing and research.
The GhostAction campaign is a supply chain attack targeting GitHub developer accounts and repositories. It compromises user accounts to inject malicious GitHub Actions workflows that steal CI/CD secrets, cloud credentials, and API keys. The campaign has affected about 1,900 GitHub accounts and over 30,000 repositories as of October 2026. GitHub has intervened to prevent the malicious workflows from running in recent waves of the attack.
This content is an announcement of a live Ask Me Anything (AMA) session hosted by the Firefox security team on Reddit. The team invites the community to ask questions about securing the open-source Firefox browser, covering topics such as anti-fingerprinting, security hardening, product security, fuzzing, web security standards, and privacy protections.
Multiple U.S. military commissaries experienced refrigeration outages affecting frozen and refrigerated goods, leading to spoilage and loss. The Defense Commissary Agency has acknowledged a possible refrigeration disruption but has not confirmed the cause. The refrigeration units themselves are not network-connected, but remote monitoring systems are part of contracts for refrigeration needs. Recent research has highlighted potential security vulnerabilities in refrigeration systems that could be exploited. Commissaries remain open, with efforts to mitigate product loss by transferring goods to alternate locations. No official confirmation of a cyberattack has been provided.
This content discusses the Burp Suite Web Academy's learning paths and topics, which are educational resources for learning web security vulnerabilities. It compares the structured 'paths' with the broader 'topics' and seeks guidance on which approach to follow for learning. There is no indication of a security vulnerability or threat in this content.
An advanced spear-phishing campaign targets Taiwan research organizations using AI-assisted content generation to craft personalized, credible event invitations. The campaign employs real-time adversary-in-the-middle (AitM) phishing kits that impersonate Google authentication pages, relaying credentials and multi-factor authentication (MFA) tokens live to the attacker. The threat actor also uses QR code phishing (quishing) by modifying legitimate event posters with malicious QR codes to expand attack vectors. The phishing infrastructure uses hybrid HTTP and WebSocket architectures to synchronize authentication workflows and capture session cookies and device fingerprints. The campaign demonstrates sophisticated social engineering, leveraging legitimate event details and institutional impersonation to reduce suspicion. The phishing kits are localized primarily in Simplified Chinese and adapted for Traditional Chinese and English. Defenses such as passkeys, device-bound sessions, impossible-travel detection, and rapid takedown of lookalike domains are noted as potentially effective mitigations.
This report compares browser environment signals from two AI agents, Muse AI and Grok Bot, tested against an instrumented website login flow. Both agents exhibited similar browser and infrastructure characteristics, such as operating system, browser version, and GPU rendering method, with some differences in processor count and screen resolution. Grok Bot traffic did not consistently originate from the same IP range, making IP-based identification less reliable. The analysis highlights the challenge of distinguishing AI agents from legitimate users based solely on infrastructure signals and notes that as AI agents run more locally, such signals may become less effective. The observations are specific to the tested sessions and do not represent universal traits of these agents.
IronCircle, a cybersecurity boot camp provider affiliated with several universities, abruptly shut down in June 2026, leaving many students with unpaid tuition debts and no job placement support. The program, which charged up to $18,900, was criticized for poor course functionality, misleading job prospects, and inadequate student support. Despite partnerships with over 20 universities, IronCircle operated with minimal oversight, was not accredited, and did not comply with many federal regulations protecting students. The sudden closure left students unable to access courses and struggling with private loan repayments. The Department of Education has issued guidance on third-party university partners, but enforcement appears limited.
This is a promotional post seeking testers for an open-source tool designed to ingest multiple vulnerability feeds and prioritize CVEs based on exploitation risk and other factors. The tool aims to help users rank vulnerabilities for remediation efforts more effectively. It is currently implemented as a Cloudflare worker with plans for a Docker version.
This content is a request for participation in an academic survey related to a cybersecurity project. It does not describe a security threat or vulnerability.
In October 2026, a large-scale cyberattack targeted French supermarket refrigeration systems, remotely raising temperatures to 50°C and causing food spoilage, fires, and sprinkler floods. The attack exploited legacy Danfoss refrigeration controllers (AK-SM800 and AK-SC355) that no longer receive security updates. These controllers were accessible via the internet, allowing attackers to force defrost cycles and disrupt food preservation across hundreds of stores. The incident caused significant financial losses and operational disruption. The exact attack vector remains undisclosed, but known vulnerabilities in unsupported firmware versions were previously documented. Recovery efforts are ongoing, with long-term impacts expected.
Several major French supermarket chains were targeted in a cyber-attack that manipulated refrigeration control systems, causing significant food spoilage and financial losses. The attackers exploited outdated and unpatched versions of Danfoss refrigeration control software with remote-control capabilities lacking secure communication channels. The attack forced defrost cycles and raised temperatures to damaging levels, impacting hundreds of stores across France and some in Belgium and the Netherlands. Danfoss confirmed the affected models were obsolete or not updated, and prior research had identified critical vulnerabilities in these controllers. The incident prompted investigations by French authorities and highlighted the risks of industrial control systems exposed to the internet without adequate protections.
A study measured the coverage of Google Safe Browsing against live branded credential-phishing pages, finding that only 55% were detected at first sighting and 71% after a week. The data was collected from 550 phishing pages reported by OpenPhish and tracked over seven days. The findings highlight a significant gap in real-time protection for users relying on browser warnings, as nearly a third of phishing pages remain undetected even after a week. The gap is due to the nature of blocklists like Google Safe Browsing, which rely on prior reporting and confirmation, causing delays in listing new phishing URLs. This gap poses a risk to users who may visit phishing sites before they are flagged by Safe Browsing.
This content is a discussion post about the revamped SANS course SEC573, which focuses on AI-powered security automation using Python, large language models, and MCP. It is a user inquiry seeking opinions and recommendations about the course's value and preparation tips.
A critical security vulnerability was discovered in a SmartOffice biometric and HRMS system instance used by Hyderabad-based companies. The vulnerability stemmed from a weak password policy that allowed an attacker to gain full administrative access, exposing sensitive employee data, login records, biometric device controls, and HR functions. The issue was responsibly disclosed to the vendor and affected organizations. This highlights the importance of strong password policies and proper network security configurations.
Abu Dhabi is implementing AI-agent security controls across more than 50 government entities to mitigate risks where attackers might manipulate AI agents into performing unauthorized actions that appear legitimate. The main concern is not AI errors but malicious instructions causing agents to access sensitive data or execute unauthorized transactions. The security strategy involves defense in depth with monitoring, auditing, guardrails, and kill switches to shut down misbehaving AI agents. Experts emphasize the need for real-time monitoring and clear identities for AI agents to prevent them from becoming malware-like threats. The approach aims to build trust in AI-native government operations while addressing emerging attack techniques such as 'living off local agents' and malicious AI skills.
Exoproc is a TypeScript-based engine designed for Windows x64 that enables thread redirection and memory manipulation in external processes without using traditional DLL injection or creating remote threads. It supports native Windows processes and JVM instances, allowing interaction with Java classes and methods externally. The tool is intended for educational, security research, and malware analysis purposes, providing advanced instrumentation capabilities while explicitly disclaiming use for unauthorized exploitation.
