Threat Intelligence Database

AI model Cyberkimi claims it turned a 3-day-old V8 patch into a live Chrome exploit in under 24 hours Source: https://x.com/lordx64/status/2096052694326940018?s=20

ThreatFox IOCs for 2026-09-04

Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to internal services.

ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi_json_string_escape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that reach the vulnerable function, causing heap corruption.

PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in param_set_default_file() and param_set_backup_file() functions that allows attackers to crash the autopilot process. Attackers can invoke 'param select' or 'param select-backup' commands with no path argument from any PX4 shell to trigger the crash.

PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start() due to a race condition between task spawning and object deletion. Attackers can trigger the calibration process via shell commands to write to freed heap memory, corrupting unrelated objects or allocator metadata and destabilizing heap operations.

Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4_HDF5_inq_attname() that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing memory corruption and crashes when applications enumerate attribute names.

Frontier labs warn that automated cyber warfare is coming, then gatekeep the intelligence needed to defend against it. Source: https://eddiemissri.substack.com/p/the-asymmetric-disarmament-of-ai

Title: Vectra – Offline CVE & GTFOBins intelligence engine Source: https://github.com/addisabrham36-boop/vectra

Forensics 101: Finding flags in ZIP archives with recursive Python search Source: https://youtube.com/shorts/p2jQ3Oldkz8?feature=share