Cybersecurity

We Were About to Launch. First, We Decided to Hack Ourselves.

It was an ordinary Tuesday. The API was running, tests were passing, Docker came up on the first try…

GHSA-9GGV-8W38-R7PM: GHSA-9GGV-8W38-R7PM: SQL Injection in TypeORM UpdateQueryBuilder and SoftDeleteQueryBuilder

GHSA-9GGV-8W38-R7PM: SQL Injection in TypeORM UpdateQueryBuilder and SoftDeleteQueryBuilder Vulne…

Use-after-free in the QPACK encoder of nginx HTTP/3 - CVE-2026-42530

submitted by /u/everping [link] [comments]…

GHSA-C3WQ-J5VH-68RC: GHSA-C3WQ-J5VH-68RC: Hugo Symlink Confinement Bypass in os.ReadFile

GHSA-C3WQ-J5VH-68RC: Hugo Symlink Confinement Bypass in os.ReadFile Vulnerability ID: GHSA-C3WQ-J…

AutoJack: One Web Page Turns a Local AI Agent Into Host Code Execution

TL;DR what: AutoJack chains three weaknesses in AutoGen Studio's MCP WebSocket so an attacker we…

10,000 GitHub Repositories Hosting Malware

Key takeaways 10,000 repositories were found hosting Trojan malware. The attack targets the softwa…

Reads Rhythm, Not Content.

I built a macOS Focus App That Reads Your Rhythm, Not Your Content. I have been building a small m…

Unpatchable 'usbliter8' Exploit Breaks Apple A12 and A13 SecureROM Boot Chain

Security researchers at Paradigm Shift have published a working exploit, dubbed usbliter8, that achi…

The Gentlemen RaaS Uses GentleKiller EDR Framework Targeting 400 Security Processes

The Gentlemen ransomware-as-a-service (RaaS) operation is actively developing and maintaining a suit…

No user verification leading to subscription bypass and pre-register

For security reasons, we consider "Target app", as the target we practiced on, and the real name won…

GHSA-MQQ5-J7W8-2HGH: GHSA-MQQ5-J7W8-2HGH: Missing Authorization in Alchemy CMS API Pages Controller

GHSA-MQQ5-J7W8-2HGH: Missing Authorization in Alchemy CMS API Pages Controller Vulnerability ID: …

Malicious Devices Enroll Users in Proxy Networks

🔗 Live Dashboard: autonomous-portfolio-2026.live 📢 Telegram Channel: t.me/AII2026futher T…