Articles
Long-form writing on tech, culture, and the edges of the internet.
Telegram Desktop File Theft Bug
Telegram Desktop 7.2.9 fixed a link-triggered file theft bug that could expose local session files without a passcode.
Dell's 1 October patch closes a root-level DSU flaw
Dell patched CVE-2026-86360, a path traversal flaw in the System Update CLI that gives unauthenticated remote attackers root. Upgrade to DSU 2.3.0.0.
GitLab AI Gateway sandbox escape
GitLab's critical CVE-2026-90970 lets an authenticated Duo user escape the AI Gateway prompt sandbox and run arbitrary commands. Self-hosted operators must patch now.
Kiteworks patches max-severity EPG flaw in 30 September advisory
Kiteworks patched CVE-2026-54154, a max-severity unauthenticated RCE in its Email Protection Gateway. Upgrade to 9.4.1 and check exposed appliances.
macOS screen sharing flaw is being exploited for Monero mining
CVE-2026-65400, an actively exploited macOS screen sharing flaw, dropped Monero miners via port 5900, and an AI agent on one host caught the compromise.
Math.random() session key lets attackers run code on HFS
A weak Math.random() session key in Rejetto HFS 3.0.0-3.2.0 lets attackers forge admin cookies and run code; CVE-2026-61500 is under active exploitation.
Pwn2Own Ireland 2026 paid $1,262,000 for 98 zero-days
Pwn2Own Ireland 2026: 29 teams demonstrated 98 zero-days for $1,262,000, with Ikotas Labs taking Master of Pwn and a $300,000 Pixel 10 hack.
Attackers drained $387.5M through Bitget's own security appliances
Bitget confirms a third-party zero-day let attackers reach its wallet job server and drain $387.5M; SlowMist and Mandiant trace the two-stage path.
Cisco SD WAN Flaw Under Exploit
CISA added CVE-2026-76504, an actively exploited Cisco Catalyst SD-WAN Manager auth bypass, to its KEV catalog.
Citrix patches second NetScaler SAML bug in days
Citrix patched NetScaler zero-day CVE-2026-88779, a SAML memory overflow under active attack that causes denial-of-service and may allow code execution.
iOS CoreGraphics PoC published two days after the patch
Apple patched CVE-2026-86950, an out-of-bounds write in CoreGraphics triggered by a malicious PDF font and used in targeted attacks on iOS before 27.
Two Zammad zero-days let an AI agent reach root
DIVD says two Zammad zero-days let an AI agent hijack a session, reach root, and exfiltrate data in seconds; network segmentation limited the breach.