Security insights & analysis.
Practical cybersecurity and privacy coverage — the latest threats, breaches, and defenses, explained by the GetKhojo team.
Google KernelCTF Missed TLB Shootdown Yields Page‑Table Control
A missed translation‑lookaside‑buffer flush in a Google kernelCTF challenge let an attacker hijack a page table, exposing a subtle Linux kernel weakness that could affect any system reusing mmap pages.
Frappe LMS RCE via Chained XSS & Path Traversal (CVE‑2026‑39405)
Researchers at Rhino Security Labs uncovered a chain of stored XSS and a path‑traversal flaw in Frappe LMS that lets a student‑level user achieve remote code execution when an admin views their profile.
n8n AI Agents Expose Two Authorization Bypass Flaws
Researchers uncovered two separate authorization bypasses in n8n’s AI Agent framework, allowing unauthenticated users to invoke privileged actions and read sensitive data.
Paxton10 Access Control System Vulnerable to Unauthenticated RCE
A chain of flaws lets an unauthenticated, network‑adjacent attacker execute OS commands on Paxton10 servers, exposing building security across the UK and Europe.
Detectify Updates ‘Ultimate Guide to Hacking APIs’ for 2026
Detectify’s refreshed guide shows how AI‑powered services, GraphQL, and serverless functions have reshaped API attack vectors, and why modern defenders must revamp scanning and privacy hygiene.
QA Pro Secures Six‑Figure Role Building E‑Commerce Testing Practice
A seasoned QA leader leveraged security‑focused testing to land a six‑figure job, showing how functional expertise can become a high‑impact cyber‑defense asset.
Accomplish Unveils ‘Beltdown’ Escape From Claude Code macOS Sandbox
Accomplish’s September 2026 disclosure shows that malicious code in a Claude Code project can break out of the macOS sandbox and run as the logged‑in user without any permission prompt.
WeWorm Zero-Click Worm Exploits WeChat Calls on iOS and Android
A proof‑of‑concept worm called WeWorm can hijack WeChat accounts on iPhone and Android in seconds, without the victim answering a call, exposing a new cross‑platform zero‑click attack surface.
Redis Botnet Hijacks 3,562 Servers, Operator Files Expose Toolkit
An open directory on a Hetzner host leaked the complete Redis cryptomining toolkit, confirming the compromise of 3,562 unauthenticated Redis instances and highlighting the scale of rogue replication attacks.
OnePlus 13R Preinstalled App Lets Malicious Apps Hijack Cloud Sessions
A high‑severity flaw in OnePlus’s com.oneplus.account app lets any installed app read the user’s OnePlus Cloud session token, enabling data theft and account takeover.
Fortinet FortiPAM Chrome Extension Flaw Lets Any Site Hijack Proxy and Record Tabs
A critical FortiPAM Chrome bug (CVE‑2026‑84388) lets malicious sites reconfigure your proxy, open tabs, and stream screen recordings, exposing privileged sessions for over a million users.
Bug Bounty Village AI Agent Hacks Net $50K+ in Bounties at DEF CON 34
Researchers at DEF CON 34’s Bug Bounty Village showed how AI‑driven customer service bots can be coerced into leaking secrets and bypassing MFA, earning over $50 000 in rewards without a single network scan.
Temu’s £3 WiFi Extender Ships With Universal Root Password Backdoor
Researchers discovered that every unit of a £3 Wi‑Fi range extender sold on Temu contains the same hard‑coded root password, giving anyone with physical access a built‑in backdoor.
Sangoma Switchvox CVE-2026-9586 Actively Exploited, SMBs Urged to Patch
Critical CVE-2026-9586 is being leveraged in live attacks against Switchvox phones; immediate patching to version 8.4.0.2 is essential for any business using the platform.
Fake Web3 Recruiter Uses Signed ClickOnce to Infect Crypto Worker
A fake Web3 recruiter lured a cryptocurrency employee into installing a signed ClickOnce app that deployed a Rust stealer, a Go RAT, and a persistent loader, highlighting the danger of social engineering in recruitment.
GeoNetwork Patch Closes RCE Chain Impacting 121 Government Deployments
A critical chain of four vulnerabilities in the open‑source GeoNetwork platform allowed unauthenticated attackers to execute code on servers used by over a hundred government agencies, but patches released this week eliminate the risk.
GitLab, Mealie Vulnerable to SSRF Bypass via Bad URL Validation
A new audit shows GitLab, Mealie and several other services can be tricked into making unauthorized outbound requests because their URL validators can be bypassed, exposing internal cloud metadata and other sensitive endpoints.
AI Claude Code Turns PaperCut NG Patch Into Working Zero-Day Exploit
Researchers used Claude AI to reverse‑engineer a PaperCut NG emergency patch, creating a full exploit chain in minutes and proving that attackers can shrink the patch‑to‑exploit window to hours.
Proxmox VE 7 Auth Bypass Grants Unauthenticated Root Access
A single unauthenticated HTTP request can now mint a root@pam ticket on any Proxmox VE 7.x host, and attackers are already exploiting it.
IIS AppPool to SYSTEM Escalation via AD CS RPC Hits Windows Servers
Researchers show how a low‑privileged IIS AppPool can hijack AD CS RPC to obtain machine‑account certificates and impersonate SYSTEM, giving attackers full control over Windows servers.
MDSec Shows ServiceNow Hijack Paths in Red Team Simulations
MDSec’s recent red‑team work reveals how attackers can seize control of ServiceNow instances, turning the platform into a stealthy foothold for enterprise-wide compromise.
AI Uncovers 20‑Year‑Old Remote Code Execution in Call of Duty 1
AI‑driven reverse‑engineering revealed a decades‑old RCE in Call of Duty 1’s Linux server binary, proving that legacy game software can become an easy target when modern AI tools are applied.
Unitree G1 Humanoid Robot Falls to Unauthenticated BLE Root RCE
A Bluetooth‑only flaw lets any nearby attacker gain unauthenticated root access to Unitree’s $20k G1 robot, exposing locomotion, cameras and voice controls.
Minimus Shuts Down After $51M Raise, Citing Lack of Commercial Traction
Minimus, the container‑security startup founded by Twistlock’s creators, is closing because it never gained enough market adoption to justify its $51 million seed round, leaving customers a 60‑day window to migrate.
Philippine Nuclear Agency & Contractor Compromised via OwnCloud Flaw
Researchers uncovered that a mis‑configured ownCloud installation let attackers forge WebDAV URLs, exposing data from the Philippine Nuclear Agency, while a separate LiteSpeed Cache flaw breached a naval contractor’s WordPress site.
Wibu-Systems CodeMeter Runtime Grants System-Level Privilege Escalation
Low‑privileged users can hijack the CodeMeter service, which runs as SYSTEM, to execute arbitrary commands on any Windows host that has the driver installed.
Citizen Lab Exposes STA1 Telecom Exploitation Campaigns
Citizen Lab reveals that covert group STA1 is hijacking global telecom signalling to track users, showing how surveillance vendors abuse legitimate network entry points.
Operation CameraSwarm Hijacks 14,000 Dahua Cameras in Ukraine, Russia
A misconfigured server exposed an operator’s full toolkit, letting researchers reconstruct how attackers silently seized control of over 14,000 Dahua surveillance cameras across Ukraine and Russia.
n8n Patch Required: Prototype‑Pollution CVE‑2026‑33696 Enables Remote Code Execution
A prototype‑pollution flaw (CVE‑2026‑33696) lets attackers with workflow‑edit rights run arbitrary commands on n8n servers; updating to the patched releases stops the one‑request RCE chain.
AppFlowy SaaS Patched, Self‑Hosted Still Vulnerable to CVE‑2026‑16007
AppFlowy’s cloud service was patched for CVE‑2026‑16007, but the self‑hosted open‑source edition remains exposed, letting authenticated users run arbitrary SQL and steal data.