Hardening

VeloCloud CVE-2026-93952: An Exploited Flaw in the SD-WAN Control Plane

An actively exploited VeloCloud Orchestrator flaw needs no admin login. Check certificate-based exposure, fixed releases, and evidence of compromise.

BragJack: When a Browser Extension Reaches the AI Agent

Researchers demonstrated five ways a malicious extension could cross into browser AI features. The impact varies by product, but extension governance is the shared control.

Nightmare Eclipse Revealed: What a Former Employee Can Still Do to Your Security

The Nightmare Eclipse identity reveal is a useful test of how organizations handle departing experts, residual access, institutional knowledge, and vulnerability disclosure.

Rapuncel Infostealer: A Microsoft-Signed Driver Turns Against EDR

Rapuncel pairs fake GitHub downloads with a signed driver used to kill security processes. What defenders should monitor and why driver controls matter.

Canary Tokens: Deployment, Alert Triage and Detection Limits

Deploy canary tokens in repositories, documents and cloud workflows. Understand what triggers an alert, what can be missed, and how to investigate benign activity.

Password Managers After LastPass: Are They Still Safe to Use?

The 2022 LastPass breach led to real crypto thefts years later. Here's what actually went wrong, why zero-knowledge encryption still matters, and how to pick a safe password manager in 2026.

Prompt Injection in 2026: From Research Toy to Real CVEs, Agent Hijacking, and Zero-Click Exfiltration

CVE-2025-32711 (EchoLeak) exfiltrated M365 data with zero user interaction. The Anthropic MCP server had three exploitable injection CVEs. OpenAI says AI browsers may never be fully fixed. Here's the full attack chain — and how to detect it.

Minimum Package Age: The Supply Chain Control That Buys Defenders Time

Fast takedowns do not protect systems that auto-install malicious packages or extensions in the first minutes after release. Minimum package age turns time into a practical supply chain defense.

IPV6_FRAG_ESCAPE: The Linux Container Escape Your CVE Scanner May Miss

IPV6_FRAG_ESCAPE is a Linux kernel 6.12 privilege escalation with public PoC code, no CVE at disclosure time, and a practical path from container user to host root.

One HTTP Header, Full Admin Access: Gitea's June 2026 Security Release Explained

Gitea 1.26.3 and 1.26.4 addressed a dense security release window, including a 9.8 CRITICAL auth bypass exploitable with a single HTTP header. Here's what broke and how to fix it.

Your Favicon Is Leaking Your Entire Infrastructure

A single 16x16 icon file can expose hundreds of servers, bypass WAF protections, and map your entire attack surface — here's how attackers use favicon hashing with Shodan, and how defenders can stop it.

pedit COW & DirtyClone: Two New Linux Root Exploits That Bypass On-Disk Integrity Checks

CVE-2026-46331 and CVE-2026-43503 both corrupt the Linux page cache via network subsystems to grant root — bypassing file integrity tools like AIDE and Tripwire without touching files on disk.

FortiBleed: Treat Exposed FortiGate Credentials as an Incident, Not a Patch Ticket

A reported FortiGate credential-harvesting campaign is a reminder that patched edge appliances can still be compromised. Here is how to verify exposure, contain access, and hunt for follow-on activity.

47-Day Certificates Will Make Every Website Look Like a Phishing Site

The CA/Browser Forum is cutting TLS certificate lifespans from 398 to 47 days by 2029 to reduce the value of stolen certificates. The fix creates a bigger target: the automation that now issues every certificate on the internet.

Insider Threat in 2026: The Risk Is Not Who You Trust, But What They Can Reach

Insider threat is not only about malicious employees. It is about trusted access, forgotten accounts, stolen sessions, and the controls that decide how far one identity can go.

Your AI Assistant Has Tools. Audit Them Before They Audit You.

A practical home-user checklist for auditing MCP servers, AI assistant tools, local permissions, and supply-chain risk before a trusted setup turns into an exposed one.

GitHub Finally Puts a Human in the Loop: npm Staged Publishing Explained

npm packages no longer publish instantly. GitHub's staged publishing forces a 2FA-gated human approval before any version hits the registry — here's what it means and how to enable it.

SSH-keysign-pwn: The Nine-Year Linux Kernel Flaw

CVE-2026-46333 (ssh-keysign-pwn) is a nine-year-old Linux kernel race condition that lets an unprivileged local user steal SSH host keys and dump /etc/shadow. Root command execution is also possible on specific configurations.

SQL Injection 2026: Blind, Time-Based, ORM Bypass, and WAF Evasion

Still powering major breaches in 2026 — blind injection, time-based attacks, ORM bypasses, WAF evasion. Real payloads and detection queries.

Dirty Frag & Copy Fail: Two New Linux Kernel Vulnerabilities Grant Root Privileges

Two new Linux kernel vulnerabilities — Dirty Frag (CVE-2026-43284/43500) and Copy Fail (CVE-2026-31431) — enable local privilege escalation to root on nearly all major distros. What users and admins need to know.

AitM Phishing: How Attackers Bypass MFA and How to Stop Them

Adversary-in-the-Middle phishing silently proxies real login pages and steals session tokens — making MFA useless. Here's how it works and how to detect it.

BYOVD: How Attackers Use Legitimate Drivers to Kill Your Security Tools

BYOVD (Bring Your Own Vulnerable Driver) lets attackers reach the Windows kernel using signed, legitimate drivers — and then silently kill your EDR before ransomware drops.

CrackArmor: Nine AppArmor Flaws That Let Attackers Own the Kernel

Qualys TRU disclosed nine confused deputy vulnerabilities in Linux AppArmor — exposing 12.6 million servers to root escalation, KASLR bypass, and container isolation collapse. Technical deep dive and detection guide.

The Linux Server Attack Surface You Didn't Install: Default Services That Open Your System

Every major Linux distro ships services you never asked for. From snapd to CUPS to rpcbind — a practical audit guide covering Ubuntu, Debian, RHEL, Rocky, Fedora, and openSUSE.

Linux Privilege Escalation: Attack Techniques and How to Detect Them

A complete guide to Linux privilege escalation — SUID abuse, sudo misconfig, cron hijacking, capabilities, and kernel exploits. Includes auditd rules, Sigma, Wazuh, and Sentinel KQL detections.

macOS Offensive Security: How Attackers Exploit Apple's Unique Attack Surface

TCC bypass, Keychain theft, Launch Agent persistence, dylib hijacking — how attackers target macOS and how defenders detect them. Attack→Detect with real commands.

NTFS Alternate Data Streams: How Attackers Hide in Plain Sight

NTFS Alternate Data Streams let attackers hide executables inside innocent-looking files. Learn how ADS works, how malware uses it, and how to detect it with PowerShell, Sysinternals, and Sysmon.

Project Glasswing: Anthropic's AI That Finds Zero-Days Better Than Humans

Anthropic just unveiled Claude Mythos Preview — an AI model too dangerous to release publicly, but powerful enough to find vulnerabilities that evaded detection for decades. Here's what it means and how to get involved.

Why Enterprise VPN and Gateway Products Are Perpetually Broken

Ivanti, Fortinet, Palo Alto — the names change but the pattern doesn't. Here's the structural reason why enterprise edge devices are permanently on fire and what you can do about it.

When Your Defender Becomes the Attacker: How Trusted Windows Processes Get Weaponized

Windows Defender and other high-privilege system processes are increasingly targeted by attackers. Learn how security tools become attack surfaces — and what you can do about it.

XSS Explained: How Attackers Inject Code Into Your Browser

Cross-Site Scripting (XSS) lets attackers inject malicious JavaScript into web pages viewed by other users — stealing sessions, redirecting victims, and taking over accounts.

Your Data on the Dark Web: How to Find It Without Ever Opening Tor

Your email and password are probably already on the dark web. Here's how to check using real tools — no Tor browser, no .onion sites, no technical expertise needed.

Kubernetes and Container Security: Attacks, Misconfigurations, and Defenses

How attackers break out of containers, escalate privileges in Kubernetes clusters, and move into cloud infrastructure — and how defenders detect and stop them.

Passkeys and FIDO2: The End of Passwords — and What Attackers Do Next

How passkeys and FIDO2 work, why they defeat phishing and credential stuffing, and how attackers are already adapting with downgrade attacks and fallback abuse.