Security Review #324

SAML, the XML-based authentication protocol that birthed the SSO industry, is fundamentally flawed due to XML complexity, canonicalization issues, enveloped signatures, and design ossification, making it vulnerable to signature wrapping attacks and parser differentials that persist despite decades of awareness.

Uncensored LLMs such as Qwen 3.8 27B can generate a LSASS-dumping executable that evades detection by modern EDR solutions. The tool clones the target process, creates an in-memory minidump, encrypts it, and applies stealth modifications (reduced access masks, random sleeps, renamed output, string scrubbing) to enable credential extraction for lateral movement.

.zwc compiled zsh startup files (e.g., ~/.zshrc.zwc) on macOS are executed by zsh when newer than the plaintext version, enabling attackers to persist malicious payloads while the visible .zshrc appears harmless and creating a DFIR pitfall.

Agent Goal Hijack is a class of vulnerability where AI agents execute attacker-controlled instructions hidden in retrieved content, affecting products such as xAI's Grok/Bankr, Copilot, Cursor and Perplexity Comet. These flaws enable unauthorized actions such as remote code execution, indirect prompt injection or credential theft.

We chained a heap overflow and SSO misconfiguration to compromise multiple OpenAI employees' ChatGPT accounts. With these accounts, we could then access internal OpenAI repositories, and potentially many other connectors.

CVE-2026-13795 is a bypass in Chrome for iOS that leverage shortcuts:// and workflow:// URLs schemes which are opened without the usual app-launch confirmation prompt. This lets a malicious webpage trigger a tel: (or facetime:) URL via the Shortcuts app's x-callback-url mechanism after a single click, bypassing Chrome's user-interaction checks.

macOS creates a fully read/write CDC-ACM serial device node with no TCC gate. Chained with a HID keyboard interface on the same USB composite device, this exfiltrates SSH keys, cloud credentials, and secrets in 24 seconds through a channel that shows no consent prompts.

We detail a sandbox escape in Docker's hypervisor for Mac: a container gets complete read and write access to the host filesystem with three lines of bash.

I found three serious bugs in Godot 4.7 in an audit conducted with an LLM agent. The bugs are due to missing bounds checking in code that reads untrusted files. Using files that are deliberately crafted, Godot can be made to read or write beyond an allowed buffer.

We detail the BragJack attack, that allows ordinary extensions to hijack the internal browser agent of Comet, Chrome, Edge, Opera, and Claude in Chrome

We uncover the Lunex malware platform, revealing a sophisticated attack chain, BYOVD techniques, and previously unreported capabilities.

CVE-2026-94127 is an unauthenticated heap-overflow in F5 BIG-IP APM that allows an attacker to overflow a heap buffer via an oversized Authorization header and achieve remote code execution.

CVE-2026-91766 is a PHP vulnerability that leaks Authorization, Cookie and Proxy-Authorization headers to a redirected host when file_get_contents() or fopen() follows a redirect. This credential leak can expose bearer tokens or cookies to a different origin or over clear-text HTTP, resulting in unauthorized disclosure.

A JSONPath filter taken from a query string lets an attacker pick the regex a Symfony app runs, once per node in the document.

In CodePipeline build jobs where the permissions on the IAM role haven’t been restricted fully and a full-clone is used, an attacker can enumerate, clone and push to all repositories the CodeConnection App has access to on the source code provider. The attacker can also delete all of these repositories and potentially even create new public repositories.

PHP can be told to load a file before the requested script runs, which means before WordPress exists, which means before anything inside WordPress can see it. This guide covers how it works, where to look and how to remove it in an order that actually holds.

We analyse four payloads built to resist analysis: PavokwiLoader, an 80,000-instruction monstrosity hiding its payload in operand bytes; RMMCRAT, a custom C++ "RAT"; a fake RMM agent; and an obfuscated Python loader with a brute-forced decryption key.

Source-code analysis of the Corp MDM Android spyware campaign targeting logistics companies through fake Google Play pages, with SMS theft, call forwarding, persistence, C2, and detection details.

We analyse a multi-stage infection that relied heavily on obfuscation, Registry-based payload storage, covert data delivery, persistence mechanisms, security-control tampering, and in-memory execution. Rather than deploying the final payload directly to disk, the threat actor used layered concealment and reconstructed payloads from Registry data, DNS TXT records, image files, and WAV files to operate Cryptomining .

Squeezing four more LPEs out of Linux with agentic vuln hunting: DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), and DiagSpill (CVE-2026-74469).

This short blog post is about abusing a privilege escalation bug that Microsoft recently fixed in Windows, CVE-2026-66804. The root cause of the bug was a dangling COM object registration in the system wide classes key, meaning it was accessible to all users on the system. Therefore you can create an arbitrary DLL file at that location and the COM object can be instantiated potentially leading to privilege escalation.

Technical writeup on ZTE SmartLife security findings covering app-auth recovery, account enumeration, password reset behavior, signup abuse, and Homecare SDK reach.

Differential photon-emission microscopy localized debug enable register activity and narrowed the laser search before SWD-guided injection set the two bits required to restore Secure debug on the Raspberry Pi microcontroller (RP2350 A4).

Why static linters miss multi-stage lateral movement, how autonomous LLMs navigate graph-based escalation, and defensive strategies for AI infrastructure.

We details a pre-auth format string vulnerability in tac_plus, a popular daemon implementing TACACS+ for network device management, and the shared secret oracle that makes it a practical RCE chain.

Chaining an AtlasService binder command injection and an olc2 HAL binder method into uid 0 with all Linux capabilities from a plain installable app on OxygenOS 16.

The Windows Error Reporting Dump Encoding Library (WerEnc.dll) is a Microsoft signed DLL that can be abused by threat actors to encrypt their implant using a trusted Microsoft cryptographic implementation. Threat actors can develop smaller stagers without using crypto code, enabling them to have improved evasion capabilities against endpoint detection and response systems.

GitLab gives you a private email address to create issues. If leaked, anyone who has it can push code, execute CI/CD jobs, and bypass IP restrictions across all of your public and private projects.

We are patch-diffing VMware vCenter to reveal two pre-auth bugs: an authentication bypass (CVE-2026-59309) and a syslog path traversal to RCE (CVE-2026-59310).

CodeConnections in AWS SageMaker Unified Studio, SageMaker AI, and App Runner grant IAM roles enabling an attacker with notebook or pipeline access to exfiltrate repository code, delete or create repositories, tamper with downstream build pipelines, and thereby achieve privilege escalation, information disclosure, DOS/ransomware, reputation damage, and lateral movement.

A vulnerable chat overlay, an unsandboxed Chromium renderer, and a V8 bug already exploited in the wild were enough to turn viewer-controlled text into native code execution, with OBS itself left at its default settings.

We discivered a vulnerability in OpenCode's upgrade endpoint that, under certain conditions, allowed malicious webpages to execute code on developers' machines.

BambooToken Linux implant is a stripped, statically linked x86-64 ELF that decodes a 59-byte XOR-obfuscated blob to obtain the MQTT broker host and a fixed group topic, then connects on TCP 2883 using encoded topics. It provides host inventory collection, a shell command worker, and a file manager supporting directory enumeration, chunked download/upload and deletion.

In versions 4.2.4 and before It is possible to get RCE in Adminer, a PHP database management tool, using the SQLite functionality by creating a database file with the .php extension and inserting PHP code.

Exposed Ollama servers (e.g., reachable via http://IP:11434/api) let attackers freely use the host's CPU/GPU to generate code, rewrite malware, develop exploits, and potentially steal API keys from outdated instances, resulting in unauthorized workload execution and possible credential compromise.

We introduce MAccConc, a kernel-userspace toolset that lets developers reliably reproduce and discover race-condition bugs such as use-after-free, deadlocks, and other concurrency errors that are difficult to trigger with conventional testing.

In this guide, we explore key Impacket tools, including PSExec, WMIExec, SMBExec, and SecretsDump, for remote code execution and credential harvesting.

We identified a significant vulnerability that enabled bypassing GitHub's SAML authentication when encrypted assertions were in use. This blog post will provide an in-depth look at GitHub Enterprise's SAML implementation and analyze the specific code issue that permitted this bypass.

We analyze CVE-2026-7162, an integer overflow in the WinFsp kernel driver leading to an unprivileged NonPagedPool overflow and local privilege escalation to SYSTEM