← Feed

Posts

• View post

  AdFection: How Targeted Online Ads Became a Zero-Click Spyware Delivery Vector AdFection spyware exposed how targeted online ads delivered zero-click exploits. Explore Discover-Tech, Controlium, Candiru and the attack chain... https://thecybersecguru.com/news/adfection-zero-click-spyware/

• View post

  PS5 Firmware 14.10 Jailbreak Research: Inside Sony’s Kernel Defences, Failed ROP Exploits and the Search for Kernel Access Has the PS5 firmware 14.10 been hacked? New jailbreak research reveals failed ROP exploits, kernel security tests and the search for kernel access... https://thecybersecguru.com/news/ps5-firmware-14-10-jailbreak/

• View post

  OpenCode API Key Breach: Third-Party AI Credentials May Have Been Exposed OpenCode warns that OpenAI and Anthropic API keys may have been exposed after unauthorized access to a legacy system. Learn what happened and how to protect your credentials... https://thecybersecguru.com/news/opencode-api-key-breach/

• View post

  ConnectWise Cloud Backup Breach: OAuth Abuse, Microsoft 365 Exposure, IoCs and Remediation Guide The ConnectWise Cloud Backup breach exposed Microsoft 365 tenants to OAuth abuse. Explore IoCs, affected app IDs, attack details and remediation... https://thecybersecguru.com/news/connectwise-cloud-backup-breach/

• View post

  WPSplinter: a 16-year-old flaw in Broadcom’s Wi-Fi SDK lets anyone in range run code on your router WPSplinter exposes a 16-year-old Broadcom Wi-Fi flaw that lets attackers execute code on vulnerable routers without a Wi-Fi password... https://thecybersecguru.com/exploits/wpsplinter-broadcom-wifi-vulnerability/

• View post

  eMudhra CA Compromise: Eight Intermediate Certificate Keys Expose a Critical Weakness in Internet Trust Eight eMudhra intermediate CA keys were compromised, triggering emergency distrust updates. Learn how the breach affects TLS certificates, browsers and Go... https://thecybersecguru.com/news/emudhra-ca-compromise-copy-slug/

• View post

  PHP2Shell: Inside the Critical PHP RCE Emergency and the Race to Secure the Web PHP2Shell exposes two critical PHP RCE flaws, CVE-2026-109618 and CVE-2026-109619. Learn the risks, affected versions, mitigations and patching steps... https://thecybersecguru.com/advisory/php2shell-cve-2026-109618-109619-php-rce/

• View post

  CVE-2026-110264: a 12-year-old regex integer overflow in GitLab scores CVSS 10.0 GitLab CVE-2026-110264 is a critical regex compiler integer overflow rated CVSS 10.0. Learn about regular expression RCE, affected versions and security patches... https://thecybersecguru.com/news/gitlab-regex-rce-cve-2026-110264/

• View post

  Railway security incident: exposed environment variables and the risk to AI API keys Railway disclosed a security breach that may have exposed environment variables, API keys and database credentials. Read the technical analysis and response steps... https://thecybersecguru.com/news/railway-security-breach-environment-variables/

• View post

  PingCAP Data Breach: What the TiDB Cloud Control Plane Compromise Means for Customers PingCAP confirmed stolen service account credentials led to a TiDB Cloud breach. See what was taken, what FulcrumSec claims, and which keys to rotate now... https://thecybersecguru.com/news/pingcap-data-breach-tidb-cloud/

• View post

  CAPCOM ID Breach: 11.8 Million Records Exposed and 196 Passwords Changed Capcom confirmed a CAPCOM ID breach exposing 11.8M records and 196 unauthorized password changes. What leaked, how it may have happened, and what to do... https://thecybersecguru.com/news/capcom-id-breach-2026/

• View post

  Linux Kernel Vulnerabilities, October 2026: The ZDI Disclosure Sequence Explained Linux kernel security disclosure controversy explained: ZDI reports, public mailing lists, unpatched vulnerability concerns, responsible disclosure and kernel maintainer challenges... https://thecybersecguru.com/news/linux-kernel-public-mailing-list-zdi-disclosure/

• View post

  QPACK Header Accordion Attack: How One HTTP/3 Connection Can Exhaust Server Memory QPACK Header Accordion attacks exploit HTTP/3 header compression to trigger memory exhaustion. Learn the affected libraries, CVEs, and mitigation steps... https://thecybersecguru.com/exploits/qpack-header-accordion-http3-dos/

• View post

  AI Agents in Banking: Why Agentic Finance Broke the Authentication Model U.S. banks face new AI agent security risks as autonomous tools access customer accounts. Explore authentication gaps, prompt injection, OAuth, MCP and defenses... https://thecybersecguru.com/news/ai-agents-banking-security-risks/

• View post

  Quad9 Is Leaving France: What the beIN Sports DNS Ruling Means for the Internet Quad9 is leaving France on November 24, 2026 after a Paris court ruled for beIN Sports. Here is why DNS blocking by country fails and who it hurts... https://thecybersecguru.com/online-privacy/quad9-leaves-france-bein-sports-dns-blocking/

• View post

  Node2Shell CVE-2026-111497: Brotli Out-of-Bounds Write Node2Shell (CVE-2026-111497) is a critical Node.js Brotli decoder vulnerability that risks memory corruption and remote code execution. Learn affected versions and fixes... https://thecybersecguru.com/exploits/node2shell-cve-2026-111497-nodejs-brotli-rce/

• View post

  CVE-2026-91403: How eMudhra’s Weak CA Keys Broke Java TLS Trust Learn how CVE-2026-91403 exposed Java TLS to forged certificates through weak eMudhra CA keys, cross-signing risks, and JSSE trust failures... https://thecybersecguru.com/news/cve-2026-91403-java-tls-vulnerability/

• View post

  Simple Mail Transfer Protocol (SMTP): architecture, packet analysis, server configuration, and security testing Learn how SMTP works, compare ports 25, 465 and 587, inspect SMTP traffic in Wireshark, configure Exim, test with Nmap, and harden mail servers... https://thecybersecguru.com/networking/smtp-protocol-security-testing-guide/

• View post

  CVE-2026-115560 Explained: The PHP Session Bug That Survives the PHP2Shell Patches CVE-2026-115560 is a potential PHP RCE tied to session upload progress. Learn the affected configuration, security risks, and official mitigation... https://thecybersecguru.com/exploits/cve-2026-115560-php-session-rce/

• View post

  Tailworm and Tailscale SSH: How Root-Run Unix Socket Forwarding Breaks Privilege Separation Breakdown of the Tailworm report on Tailscale SSH: root-run Unix socket forwarding, TOCTOU races, Docker socket abuse, and how to fix the privilege model... https://thecybersecguru.com/news/tailworm-tailscale-ssh-unix-socket-forwarding/