cybersecurity

cybersecurity

UEFI Secure Boot Bypass: 11 Microsoft-Signed Shims, Some Over a Decade Old, Trusted by Every UEFI Computer — No Exploit Needed, Bootkits Load Before EDR
By

ESET researcher Martin Smolár discovered 11 old Microsoft-signed UEFI shim bootloaders — some over a decade old — that could bypass Secure Boot on virtually every UEFI computer in the world with nothing more than a file copy. No new exploit needed. Affected: all UEFI systems trusting Microsoft Corporation UEFI CA 2011, regardless of OS. Enables deployment of Bootkitty, HybridPetya, BlackLotus — bootkits that run before the OS, before EDR, before AV, and survive OS reinstalls. Microsoft revoked the 11 binaries via June 9 Patch Tuesday dbx update. ESET cannot confirm how many additional unrevoked vulnerable shims remain undiscovered.

Read More UEFI Secure Boot Bypass: 11 Microsoft-Signed Shims, Some Over a Decade Old, Trusted by Every UEFI Computer — No Exploit Needed, Bootkits Load Before EDR
cve | cybersecurity

CitrixBleed 2 (CVE-2025-5777): The Seven-Step Playbook From NetScaler Memory Leak to DragonForce Ransomware in Under an Hour
By

Huntress investigated six intrusions across unrelated organizations in the first half of 2026 and found the same repeatable seven-step attack chain every time: CitrixBleed 2 memory overread steals a live session token, MFA is bypassed entirely, SYSTEM escalation via registry-symlink/AppMgmt trick, rogue admin account created, ScreenConnect and Zoho Assist deployed for persistence, and in the most advanced case, DragonForce ransomware deployed in under an hour from initial access. CVE-2025-5777 CVSS 9.3. An IAB is productizing this as a runbook. Sophos tracks the same cluster as STAC3725. Patch NetScaler and terminate all outstanding sessions now — harvested tokens survive a patch.

Read More CitrixBleed 2 (CVE-2025-5777): The Seven-Step Playbook From NetScaler Memory Leak to DragonForce Ransomware in Under an Hour
cybersecurity

Bad Epoll (CVE-2026-46242): The Linux Kernel Root Exploit That Anthropic’s Mythos Missed — 99% Reliable, Reaches Android, Third Linux LPE in Two Weeks
By

Bad Epoll (CVE-2026-46242) is a race condition use-after-free in the Linux kernel’s epoll subsystem that lets any unprivileged local user escalate to root on Linux desktops, servers, and Android devices running kernel v6.4 or later. A public exploit achieves root 99% of the time despite a race window only six instructions wide. The disclosure has a significant subplot: Anthropic’s Mythos found the sibling bug in the same 2023 commit — and missed Bad Epoll. It is the third Linux kernel LPE with a working public exploit in two weeks. The patch has been in mainline since April 24 but sat unannounced for 70 days.

Read More Bad Epoll (CVE-2026-46242): The Linux Kernel Root Exploit That Anthropic’s Mythos Missed — 99% Reliable, Reaches Android, Third Linux LPE in Two Weeks
cybersecurity

Six Microsoft Defender Zero-Days in 90 Days: BlueHammer, RedSun, UnDefend, GreenPlasma, YellowKey, RoguePlanet — Three Exploited Before Patches, One Still Open Today
By

One researcher. Six Microsoft Defender zero-days in 90 days. Three confirmed exploited in the wild before patches existed. One — RoguePlanet — still unpatched on every Windows 10 and Windows 11 device today. The Chaotic Eclipse / Nightmare Eclipse disclosure campaign began after a disputed Microsoft MSRC interaction, escalated when Microsoft threatened legal action and took down the researcher’s GitHub account, and has produced a cascade of SYSTEM-level exploits that the entire security community has condemned Microsoft for mishandling.

Read More Six Microsoft Defender Zero-Days in 90 Days: BlueHammer, RedSun, UnDefend, GreenPlasma, YellowKey, RoguePlanet — Three Exploited Before Patches, One Still Open Today
cve | cybersecurity

CVE-2026-47729 Was Found by an AI. This Attack Uses AI to Deliver It. Mozilla 0DIN: A Clean GitHub Repo Can Talk Claude Code Into Opening a Reverse Shell — And No Scanner Will Catch It
By

Mozilla’s Zero Day Investigative Network (0DIN) demonstrated that a GitHub repository containing zero lines of malicious code can cause Claude Code to open a reverse shell on a developer’s machine. The payload is stored in a DNS TXT record controlled by the attacker — it doesn’t exist in the repository, appears only at runtime, and is invisible to static analysis, secret scanners, human code review, and the AI agent itself. The attack works by chaining three individually legitimate steps into a single malicious composition. Affects Claude Code, Cursor, Gemini CLI, and any agentic coding tool that follows setup flows.

Read More CVE-2026-47729 Was Found by an AI. This Attack Uses AI to Deliver It. Mozilla 0DIN: A Clean GitHub Repo Can Talk Claude Code Into Opening a Reverse Shell — And No Scanner Will Catch It
cybersecurity

Device Code Phishing: 37x Spike, 18 Kits, Every Major PhaaS Platform Shipping It — The MFA Bypass That Survives Password Resets Is Now a Criminal Commodity
By

At the start of 2026, device code phishing was a niche Russian espionage technique. Six months later: 18 kits in circulation, 37.5x detection spike, every major AiTM PhaaS platform shipping it as a standard feature. It bypasses every legacy MFA method — TOTP, push, SMS — and delivers OAuth tokens that survive password resets. EvilTokens, AI-built and Telegram-distributed, is the dominant kit. The FBI issued an advisory on Kali365. Your Conditional Access policy doesn’t block it by default.

Read More Device Code Phishing: 37x Spike, 18 Kits, Every Major PhaaS Platform Shipping It — The MFA Bypass That Survives Password Resets Is Now a Criminal Commodity
cve | cybersecurity

Cordyceps: A Free GitHub Account Is All It Takes to Hijack CI/CD Pipelines at Microsoft, Google, Apache, and Cloudflare — 300+ Repos Confirmed Exploitable
By

Cordyceps is a systemic class of CI/CD workflow vulnerabilities discovered by Novee Security that allows any unauthenticated user with a free GitHub account to hijack build pipelines at Microsoft, Google, Apache, Cloudflare, and the Python Software Foundation. 300+ repositories confirmed fully exploitable across a scan of 30,000. No CVE — this is a misconfiguration class, not a single bug. AI coding agents are reproducing the insecure patterns at exponential scale. No confirmed exploitation in the wild. All named organizations have applied fixes.

Read More Cordyceps: A Free GitHub Account Is All It Takes to Hijack CI/CD Pipelines at Microsoft, Google, Apache, and Cloudflare — 300+ Repos Confirmed Exploitable
cve | cybersecurity

Squidbleed (CVE-2026-47729): Claude Mythos Found a 29-Year-Old Heartbleed-Style Memory Leak in Every Version of Squid Proxy — And the Patch Isn’t in 7.6
By

Squidbleed (CVE-2026-47729) is a Heartbleed-style heap buffer overread in Squid Proxy’s FTP directory listing parser that has lived in every version of Squid since 1997 — 29 years — in its default configuration. It leaks adjacent heap memory, potentially including other users’ HTTP Authorization headers, cookies, and session tokens. Discovered by Calif.io using Claude Mythos Preview. Critical correction: the patch is in Squid 7.7, NOT 7.6. Immediate mitigation: disable FTP in Squid. PoC is public.

Read More Squidbleed (CVE-2026-47729): Claude Mythos Found a 29-Year-Old Heartbleed-Style Memory Leak in Every Version of Squid Proxy — And the Patch Isn’t in 7.6
cybersecurity | Uncategorized

FortiBleed Update: CISA Issues Formal Advisory — Scope Jumps to 86,644 Devices in 48 Hours, Free Lookup Tool Now Available
By

CISA issued a formal advisory on FortiBleed on June 18, 2026 — and the confirmed compromised device count jumped from 30,791 to 86,644 in 48 hours. CISA mandates five immediate actions: terminate all sessions, reset all credentials, verify PBKDF2 hashing, enable phishing-resistant MFA, and restrict management access. Hudson Rock released a free FortiBleed Lookup Tool. FortiSandbox critical vulnerabilities now also exploited. No specific CVE — this campaign exploits organizational process failure at global scale.

Read More FortiBleed Update: CISA Issues Formal Advisory — Scope Jumps to 86,644 Devices in 48 Hours, Free Lookup Tool Now Available
cve | cybersecurity

FortiBleed: 30,791 Verified Fortinet Credentials Compromised Across 194 Countries — The Self-Feeding Attack Nobody Can Find the Source Of
By

SOCRadar discovered an exposed attacker server revealing FortiBleed — a self-sustaining credential-harvesting campaign that has compiled 30,791+ verified working Fortinet administrator and SSL VPN credentials across 194 countries, with Hudson Rock and Kevin Beaumont estimating up to 75,000 affected devices. Telecoms, governments, hospitals, and a Turkish NATO defense contractor confirmed compromised. The initial access vector remains unconfirmed. Most credentials trace to years-old unrotated passwords from prior Fortinet breaches.

Read More FortiBleed: 30,791 Verified Fortinet Credentials Compromised Across 194 Countries — The Self-Feeding Attack Nobody Can Find the Source Of