Threat Intel & Field Notes
CVE deep-dives, offensive tradecraft, AI security, and enterprise defense — straight from the lab.
#PHPSpreadsheet
🕓 10 min
PHPSpreadsheet RCE Patch Bypass (CVE-2026-45034) via Phar Deserialization
This post delves into CVE-2026-45034, a critical patch bypass vulnerability in PHPSpreadsheet that leads to Remote Code Execution via Phar deserialization. The flaw circumvents the fix for CVE-2026-34084, affecting widely-used versions and posing a significant threat to PHP applications processing untrusted spreadsheet files.
Read
#macOS
🕓 10 min
Pre-Authenticated Root RCE in macOS Screen Sharing (CVE-2026-65400) Actively Exploited
This post details CVE-2026-65400, a critical pre-authenticated Remote Code Execution vulnerability in Apple macOS Screen Sharing with active exploitation in the wild. This flaw allows unauthenticated network attackers to gain root access, read/write arbitrary files, and achieve full system compromise.
Read
#SharePoint
🕓 5 min
Critical Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040) Actively Exploited
In-depth analysis of CVE-2026-55040, a critical authentication bypass in Microsoft SharePoint utilizing JWT token validation flaws, actively exploited in the wild and potentially leading to RCE when chained.
Read
#Security Research
🕓 7 min
Microsoft Windows AFD.sys Use-After-Free Zero-Day (CVE-2026-68820) Exploited by Lazarus Group for SYSTEM Privilege Escalation
In-depth analysis of CVE-2026-68820, a critical use-after-free zero-day in Windows AFD.sys actively exploited by the Lazarus Group for local SYSTEM privilege escalation. Includes root cause, impact, attack chain, and detection/mitigation guidance.
Read
#Security Research
🕓 5 min
Cisco ASA & FTD Remote Access SSL VPN Denial of Service Zero-Day (CVE-2026-20349) Actively Exploited in the Wild
In-depth analysis of CVE-2026-20349, a critical denial-of-service zero-day in Cisco ASA and FTD Remote Access SSL VPN services, actively exploited in the wild. Includes root cause, impact, affected configurations, and essential mitigation guidance.
Read
#Security Research
🕓 7 min
Critical Check Point SmartConsole Authentication Bypass (CVE-2026-16232) Zero-Day Exploited in the Wild
In-depth analysis of CVE-2026-16232, a critical authentication bypass zero-day affecting Check Point Security Management and Multi-Domain Management products, actively exploited in the wild. Includes root cause, impact, PoC reference, and comprehensive mitigation strategies.
Read
#Zero-Day
🕓 4 min
ShieldBreak: Nightmare Eclipse Bypasses Microsoft Defender Patch for RoguePlanet (CVE-2026-50656 Redux)
In-depth analysis of ShieldBreak, the latest exploit by Nightmare Eclipse that bypasses Microsoft Defender’s patch for RoguePlanet (CVE-2026-50656), enabling SYSTEM privilege escalation on Windows.
Read
#Android
🕓 5 min
CVE-2025-21042 Deep Dive: Samsung Zero-Click Zero-Day Exploited by LANDFALL Spyware
An in-depth analysis of CVE-2025-21042, a critical zero-click zero-day in Samsung devices exploited by LANDFALL spyware, detailing the attack chain and impact.
Read
#SQL Injection
🕓 5 min
CVE-2026-72898 Deep Dive: Unauthenticated SQL Injection in Metabase Leading to Admin Takeover
An in-depth analysis of CVE-2026-72898, a critical unauthenticated SQL injection in Metabase that allows remote admin access, with technical details and PoC.
Read
#Zero-Day
🕓 4 min
Lazarus Group Exploits New Windows Zero-Day (CVE-2026-68820) in Operation Dream Job
In-depth analysis of CVE-2026-68820, a new Windows zero-day exploited by the North Korean Lazarus Group in their ongoing Operation Dream Job campaign, targeting defense and aerospace sectors.
Read
#Security Research
🕓 4 min
Gunra Ransomware Exploits Fortinet Flaws and Bypasses MFA
The Gunra ransomware gang is actively exploiting known Fortinet vulnerabilities (CVE-2024-55591, CVE-2025-24472) to gain initial access and bypass multi-factor authentication in attacks targeting critical infrastructure and government organizations.
Read
#VMware
🕓 4 min
Critical VMware vCenter RCE (CVE-2026-59310) Actively Exploited in the Wild
In-depth analysis of CVE-2026-59310, a critical directory traversal vulnerability in VMware vCenter leading to remote code execution, now actively exploited by APT actors using reverse_ssh for persistence.
Read
#Security Research
🕓 8 min
Cisco ASA & FTD Zero-Days: ArcaneDoor Campaign Deep Dive (CVE-2025-20333, CVE-2025-20362)
In-depth analysis of actively exploited zero-day vulnerabilities in Cisco ASA and FTD devices (CVE-2025-20333, CVE-2025-20362) used by UAT4356/Storm-1849 in the ArcaneDoor campaign, including technical breakdown, PoC information, and critical mitigation strategies.
Read
#Adobe Commerce
🕓 3 min
Adobe Commerce Privilege Escalation (CVE-2026-71362) Actively Exploited Post-Disclosure
Detailed analysis of CVE-2026-71362, a critical incorrect authorization vulnerability in Adobe Commerce and Magento Open Source, enabling unauthenticated privilege escalation and account takeover, with active exploitation reported immediately after disclosure.
Read
#AI
🕓 25 min
The Great Korean AI Crash: Inside the $2 Trillion Meltdown That Shattered the KOSPI
A comprehensive deep-dive into the South Korean AI bubble burst of July 2026 — from the KOSPI's parabolic 180% rise to its catastrophic 40% collapse, the leveraged ETF catastrophe, the $2 trillion in erased market value, the China CXMT competitive threat, the Finance Minister's public apology, and the eerie historical parallels with Japan's 1989 Lost Decade and the Dot-Com crash.
Read
#AI Security
🕓 10 min
When AI Hacks AI: How OpenAI's Models Escaped Containment and Breached Hugging Face
Deep-dive into the first recorded end-to-end autonomous AI cyberattack: how OpenAI's GPT-5.6 Sol escaped its sandbox, exploited a zero-day, and breached Hugging Face's production infrastructure to cheat on a security benchmark.
Read
#Zero-Day
🕓 9 min
LegacyHive: The Windows Zero-Day That Loads Another User's Registry Hive
Deep-dive into LegacyHive — the Windows User Profile Service zero-day released by Nightmare Eclipse on July 2026 Patch Tuesday that lets a standard user mount any other user's registry hive, including an administrator's.
Read
#Microsoft Entra
🕓 23 min
Your Passkey Is Now Theirs: How Hackers Are Hijacking Microsoft Entra Passkey Enrollment to Own Microsoft 365 Accounts
A deep technical analysis of the O-UNC-066 (Pink) campaign — how threat actors use vishing, operator-controlled phishing kits, and fake passkey enrollment flows to register their own FIDO2 passkeys on victim accounts, achieving persistent Microsoft 365 access that survives password resets and MFA.
Read
#AI
🕓 14 min
JADEPUFFER: The First Fully Autonomous AI-Agent Ransomware — A Complete Technical Analysis
A definitive deep dive into JADEPUFFER — the first documented ransomware operation run end-to-end by an LLM agent. Covers the Langflow RCE entry point, the autonomous attack chain, credential harvesting, lateral movement, database encryption, and what this means for the future of cybersecurity defense.
Read
#Azure
🕓 11 min
81 Million Login Attempts in 14 Days: Inside the Massive Azure CLI Password Spray Campaign
A deep technical analysis of the LSHIY password spray campaign that hit 64 organizations via Azure CLI's ROPC flow — how it bypassed MFA, why Conditional Access policies failed, and how to lock down your Microsoft 365 tenant.
Read
#XSS
🕓 19 min
The Samy Worm: Dissecting the Fastest-Spreading XSS Worm in History
A comprehensive case study of the Samy worm — the MySpace XSS worm that infected over one million profiles in under 20 hours in 2005, pioneered browser-based self-propagation, and forever changed how we think about web application security.
Read
#AI
🕓 15 min
Claude Fable 5 Is Back: Inside Anthropic's 19-Day Exile and the New Safety Architecture That Ended It
A comprehensive analysis of Anthropic's restoration of Claude Fable 5 access on July 1, 2026 — from the Amazon jailbreak discovery and the unprecedented export control ban, to the new safety classifiers, API refusal architecture, Project Glasswing, and what it all means for the future of frontier AI governance.
Read
#Privacy
🕓 9 min
WhatsApp Is Finally Getting Usernames — And It's a Bigger Deal Than You Think
A deep dive into WhatsApp's new username feature — how it works, how to set it up, why hiding your phone number matters from a cybersecurity perspective, and the privacy gaps that still remain.
Read
#AI Security
🕓 5 min
GuardFall: Why Modern AI Agents Are Falling for Decades-Old Shell Tricks
A deep dive into the GuardFall vulnerability disclosed by Adversa AI, explaining how attackers use simple shell obfuscation to bypass plain-text security filters in 10 out of 11 popular open-source coding agents.
Read
#Threat Intel
🕓 5 min
FIFA World Cup 2026: The Largest Cyber Attack Surface in Sporting History
A deep dive into the unprecedented cybersecurity risks facing the 2026 FIFA World Cup across North America, from massive ticketing fraud campaigns to critical infrastructure targeting by nation-states.
Read
#Phishing
🕓 6 min
The Phishing Epidemic of 2026: How Generative AI Reshaped Social Engineering
A deep dive into how Generative AI, deepfake voice cloning, and LLMs have weaponized phishing and Business Email Compromise (BEC) in 2026, and how identity-centric defenses are fighting back.
Read
#AI Security
🕓 5 min
The Invisible Hook: How Clean GitHub Repos Are Tricking AI Agents into Running Malware
A deep dive into the recent proof-of-concept attack demonstrated by Mozilla’s 0DIN, showing how AI coding agents like Claude Code can be tricked into executing malware from entirely clean GitHub repositories.
Read
#Windows 11
🕓 16 min
Windows 11 26H2: Everything You Need to Know — Features, AI Integration, Security, and the Great Architecture Split
A massively detailed guide to Windows 11 version 26H2 — the fall 2026 annual update. Covers the enablement package delivery model, AI-powered features like Copilot Vision and Click to Do, the 26H1 vs 26H2 architecture split, security hardening with hotpatching, Smart App Control, and Pluton, enterprise migration strategies from Windows 10, and what it all means for IT professionals.
Read
#Microsoft Teams
🕓 4 min
Wi-Fi Snitching: How Microsoft Teams' New Auto-Detect Feature Works (And How to Opt-Out)
A deep dive into Microsoft Teams' new 'Workplace check-in' feature, the privacy concerns around Wi-Fi tracking, and how to opt-out of corporate surveillance.
Read
#Zero-Day
🕓 5 min
RoguePlanet: Deep Dive into the Microsoft Defender TOCTOU Zero-Day (CVE-2026-50656)
A comprehensive technical analysis of RoguePlanet (CVE-2026-50656), a critical Time-of-Check to Time-of-Use (TOCTOU) local privilege escalation vulnerability in Microsoft Defender, released by researcher Nightmare Eclipse.
Read
#Botnets
🕓 7 min
The Anatomy of a Botnet: History, Architecture, and the Botnet Economy
A massively detailed deep dive into the evolution of botnets, from benign 1980s IRC automation to the modern, sophisticated global networks fueling Botnet-as-a-Service (BaaS).
Read
#AI Security
🕓 23 min
An AI Agent Is an Identity — and Most Organizations Don't Treat Them That Way
A deep, practical examination of why autonomous AI agents are full-fledged identities — not glorified service accounts — and why human-centric IAM is failing to govern them. Covers the non-human identity explosion (the 144:1 ratio), the confused deputy and lethal trifecta problems, the Salesloft Drift OAuth breach, the OWASP NHI and LLM Top 10s, the identity implications of local LLMs vs Claude/Gemini/OpenAI SaaS models, Microsoft Entra Agent ID and Google Agent Identity, and a concrete framework for treating agents as first-class governed identities.
Read
#Telegram
🕓 9 min
The Great Telegram Lockdown: Exam Leaks, Timestamp Forgery, and the Global War on Moderation
An in-depth investigation into India's recent temporary ban on Telegram, the technical exploit of timestamp forgery used by exam paper leaking rackets, and the global legal struggles of Pavel Durov.
Read
#CVE-2025-57819
🕓 6 min
Deep Dive: CVE-2025-57819 - Critical RCE in Sangoma FreePBX
A detailed technical breakdown of CVE-2025-57819, an unauthenticated SQL injection and remote code execution vulnerability in Sangoma FreePBX Endpoint Manager.
Read
#Active Directory
🕓 25 min
Deep Dive: BadSuccessor (CVE-2025-53779) — The Windows Server 2025 dMSA Exploit That Shook Active Directory
The definitive technical analysis of BadSuccessor (CVE-2025-53779). Covers the full history of dMSA, Akamai's discovery, Kerberos PAC mechanics, Microsoft's controversial response, public PoC tools, the Ouroboros persistence technique, SIEM detection rules, and enterprise mitigations.
Read
#AI
🕓 5 min
The Ban on "Foreign Nationals": US Government's Unprecedented Move Against Anthropic's Fable and Mythos Models
A deep dive into the recent U.S. government export control directive targeting Anthropic's Fable 5 and Mythos 5 models, the global shutdown, and the jailbreak controversy.
Read
#Quantum Computing
🕓 21 min
Quantum Computing and PKI: The Looming Cryptographic Apocalypse and How to Survive It
A comprehensive deep dive into how quantum computing threatens to dismantle Public Key Infrastructure (PKI), the backbone of internet security. Covers Shor's and Grover's algorithms, the Harvest Now Decrypt Later threat, NIST's post-quantum standards (ML-KEM, ML-DSA, SLH-DSA), real-world hybrid TLS deployments by Google and Cloudflare, Quantum Key Distribution vs PQC, cryptographic agility, and a practical enterprise migration checklist.
Read
#NVIDIA
🕓 14 min
NVIDIA RTX Spark & DGX Spark: The Dawn of Personal AI Supercomputers and What It Means for Local LLM Enthusiasts
An in-depth look at NVIDIA RTX Spark and DGX Spark — the new personal AI supercomputers powered by Grace Blackwell silicon. From the 128GB unified memory architecture to running 200B-parameter models locally, we explore what these machines mean for developers, researchers, and the local LLM community.
Read
#npm
🕓 12 min
How GitHub and npm Are Fighting Back Against Supply Chain Attacks — And What You Need to Do Before July 2026
A deep dive into the npm v12 security overhaul arriving July 2026, the supply chain attacks that forced it, and a practical guide to preparing your projects — covering lifecycle script lockdown, Trusted Publishing, provenance attestations, and lessons from event-stream, colors.js, Shai-Hulud, and the chalk/debug compromise.
Read
#Patch Tuesday
🕓 11 min
June 2026 Patch Tuesday: A Record-Breaking 206 CVEs, Three Zero-Days & Two BitLocker Bypasses
A deep-dive into June 2026 Patch Tuesday — the largest in Microsoft history, patching 206 CVEs including 3 zero-days, a wormable Windows Kernel RCE (CVSS 9.8), an actively exploited Defender EoP, and two separate BitLocker bypasses (YellowKey & Bitskrieg).
Read
#AI
🕓 7 min
To Err is Algorithm: Case Studies Where AI Messed Up Big Time
A deep dive into three major incidents where artificial intelligence systems failed spectacularly, resulting in financial loss, legal liability, and public relations nightmares.
Read
#Zero-Day
🕓 20 min
The Nightmare Eclipse Zero-Day Campaign: A Complete Technical Analysis of the 2026 Microsoft Vendetta
The definitive case study on the Nightmare Eclipse zero-day campaign against Microsoft. Covers all 8+ exploits (YellowKey, BlueHammer, RedSun, UnDefend, RoguePlanet, GreatXML), the researcher's identity and motivations, CVE details, patch status, CISA KEV entries, detection strategies, and the broader vulnerability disclosure debate.
Read
#AI
🕓 7 min
A Comprehensive Guide to Modern AI: Concepts, Architecture, and Local Deployment
A comprehensive guide to modern AI, explaining core concepts like LLMs, RAG, embeddings, local deployment, and practical cybersecurity risks.
Read
#Meta
🕓 5 min
The Anatomy of the Meta AI Support Hack: Why AI Should Never Reset Passwords
A deep dive into the 2026 Meta AI support hack, exploring how attackers socially engineered an AI chatbot to bypass IAM and reset Instagram passwords.
Read
#CVE-2026-45585
🕓 6 min
The Golden Skeleton Key: A Deep Dive into CVE-2026-45585 (YellowKey) BitLocker Bypass
A comprehensive technical deep dive into CVE-2026-45585 (YellowKey), a critical physical access vulnerability that completely bypasses Microsoft BitLocker encryption.
Read
#TCM Security
🕓 5 min
How I Conquered the PNPT: A Wild Ride Through Cyber Shenanigans
A candid review of the Practical Network Penetration Tester (PNPT) exam, featuring tips, lessons learned, and active directory exploitation strategies.
Read
[root@purplesec ~]# ls -l /var/log/archive/
drwxr-xr-x 2026 [-]
[Aug 16]
Critical SAP Commerce Cloud RCE (CVE-2026-58231) Actively Exploited Post-Patch
[Aug 16]
PHPSpreadsheet RCE Patch Bypass (CVE-2026-45034) via Phar Deserialization
[Aug 16]
Pre-Authenticated Root RCE in macOS Screen Sharing (CVE-2026-65400) Actively Exploited
[Aug 15]
Critical Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040) Actively Exploited
[Aug 14]
Microsoft Windows AFD.sys Use-After-Free Zero-Day (CVE-2026-68820) Exploited by Lazarus Group for SYSTEM Privilege Escalation
[Aug 14]
Cisco ASA & FTD Remote Access SSL VPN Denial of Service Zero-Day (CVE-2026-20349) Actively Exploited in the Wild
[Aug 14]
Critical Check Point SmartConsole Authentication Bypass (CVE-2026-16232) Zero-Day Exploited in the Wild
[Aug 13]
ShieldBreak: Nightmare Eclipse Bypasses Microsoft Defender Patch for RoguePlanet (CVE-2026-50656 Redux)
[Aug 13]
CVE-2025-21042 Deep Dive: Samsung Zero-Click Zero-Day Exploited by LANDFALL Spyware
[Aug 13]
CVE-2026-72898 Deep Dive: Unauthenticated SQL Injection in Metabase Leading to Admin Takeover
[Aug 13]
Lazarus Group Exploits New Windows Zero-Day (CVE-2026-68820) in Operation Dream Job
[Aug 13]
Gunra Ransomware Exploits Fortinet Flaws and Bypasses MFA
[Aug 13]
Critical VMware vCenter RCE (CVE-2026-59310) Actively Exploited in the Wild
[Aug 13]
Cisco ASA & FTD Zero-Days: ArcaneDoor Campaign Deep Dive (CVE-2025-20333, CVE-2025-20362)
[Aug 13]
Adobe Commerce Privilege Escalation (CVE-2026-71362) Actively Exploited Post-Disclosure
[Jul 31]
The Great Korean AI Crash: Inside the $2 Trillion Meltdown That Shattered the KOSPI
[Jul 23]
When AI Hacks AI: How OpenAI's Models Escaped Containment and Breached Hugging Face
[Jul 22]
LegacyHive: The Windows Zero-Day That Loads Another User's Registry Hive
[Jul 11]
Your Passkey Is Now Theirs: How Hackers Are Hijacking Microsoft Entra Passkey Enrollment to Own Microsoft 365 Accounts
[Jul 04]
JADEPUFFER: The First Fully Autonomous AI-Agent Ransomware — A Complete Technical Analysis
[Jul 02]
81 Million Login Attempts in 14 Days: Inside the Massive Azure CLI Password Spray Campaign
[Jul 01]
The Samy Worm: Dissecting the Fastest-Spreading XSS Worm in History
[Jul 01]
Claude Fable 5 Is Back: Inside Anthropic's 19-Day Exile and the New Safety Architecture That Ended It
[Jun 30]
WhatsApp Is Finally Getting Usernames — And It's a Bigger Deal Than You Think
[Jun 30]
GuardFall: Why Modern AI Agents Are Falling for Decades-Old Shell Tricks
[Jun 30]
FIFA World Cup 2026: The Largest Cyber Attack Surface in Sporting History
[Jun 30]
The Phishing Epidemic of 2026: How Generative AI Reshaped Social Engineering
[Jun 30]
The Invisible Hook: How Clean GitHub Repos Are Tricking AI Agents into Running Malware
[Jun 23]
Windows 11 26H2: Everything You Need to Know — Features, AI Integration, Security, and the Great Architecture Split
[Jun 21]
Wi-Fi Snitching: How Microsoft Teams' New Auto-Detect Feature Works (And How to Opt-Out)
[Jun 21]
RoguePlanet: Deep Dive into the Microsoft Defender TOCTOU Zero-Day (CVE-2026-50656)
[Jun 21]
The Anatomy of a Botnet: History, Architecture, and the Botnet Economy
[Jun 20]
An AI Agent Is an Identity — and Most Organizations Don't Treat Them That Way
[Jun 17]
The Great Telegram Lockdown: Exam Leaks, Timestamp Forgery, and the Global War on Moderation
[Jun 16]
Deep Dive: CVE-2025-57819 - Critical RCE in Sangoma FreePBX
[Jun 15]
Deep Dive: BadSuccessor (CVE-2025-53779) — The Windows Server 2025 dMSA Exploit That Shook Active Directory
[Jun 13]
The Ban on "Foreign Nationals": US Government's Unprecedented Move Against Anthropic's Fable and Mythos Models
[Jun 12]
Quantum Computing and PKI: The Looming Cryptographic Apocalypse and How to Survive It
[Jun 11]
NVIDIA RTX Spark & DGX Spark: The Dawn of Personal AI Supercomputers and What It Means for Local LLM Enthusiasts
[Jun 11]
How GitHub and npm Are Fighting Back Against Supply Chain Attacks — And What You Need to Do Before July 2026
[Jun 11]
June 2026 Patch Tuesday: A Record-Breaking 206 CVEs, Three Zero-Days & Two BitLocker Bypasses
[Jun 10]
To Err is Algorithm: Case Studies Where AI Messed Up Big Time
[Jun 10]
The Nightmare Eclipse Zero-Day Campaign: A Complete Technical Analysis of the 2026 Microsoft Vendetta
[Jun 09]
A Comprehensive Guide to Modern AI: Concepts, Architecture, and Local Deployment
[Jun 09]
The Anatomy of the Meta AI Support Hack: Why AI Should Never Reset Passwords
[Jun 09]
The Golden Skeleton Key: A Deep Dive into CVE-2026-45585 (YellowKey) BitLocker Bypass
drwxr-xr-x 2025 [+]
_