Exploit Blog- 2026 2025 2024 2023 2021 2020 2019 2018
AI blog APT blog Attack blog BigBrother blog BotNet blog CyberCrime blog Cyber blog Cryptocurrency blog Exploit blog Hacking blog ICS blog Incident blog IoT blog Malware blog OS Blog Phishing blog Ransom blog Safety blog Security blog Social blog Spam blog Vulnerebility blog
DATE |
NAME |
Info | CATEG. | WEB |
| 7.11.26 | Rust in Peace | At Calif, we spend a lot of time performing offensive security research on software and hardware. If you’ve followed our recent posts, you’ve seen that work in action. What we’ve talked less about is how our exploitation work helps us deepen our understanding of how attacks succeed and which defenses are effective at stopping them. From there, we develop strategies to help our customers prevent and mitigate security bugs, limiting the impact of exploitation. | Exploit blog | Calif |
| 7.11.26 | Inside Coruna and DarkSword Chains: From Web Lures to iOS Exploitation | Seven months after Google Threat Intelligence Group (GTIG) published its initial analysis of the Coruna iOS exploit framework, the campaign has continued to evolve: the recovered infrastructure now deploys two distinct exploit chains conditioned on the target device's operating system version. | Exploit blog | ZIMPERIUM |
| 7.11.26 | CITRIX 0-DAY EXPLOITS: CVE-2026–88771 & CVE-2026–88772 IN THE WILD – | NOTE: This is an analysis of the artifacts and samples found during the hunt of SLAPSHOT, WHIPSHOT which is a Python tunneler used to proxy traffic into internal networks. The analysis is done using various AI Models and if you find any irrelevancy, please do report directly. This article is intended for Network Defenders, Threat Analysts, SOC and IT Administrators. | Exploit blog | THE RAVEN FILE |
| 7.11.26 | Exploitation Targeting Node-RED, a Tool Embedded in ICS Products | On October 30, 2026, one of our canaries caught an attacker exploiting CVE-2026-58115, an unauthenticated Node-RED admin API flaw, to deploy a flow that downloads and runs a Linux bot. The request came from an IP in Microsoft's ASN (AS8075). We have since seen 16 events from the same IP against this CVE, covering several different payloads (see the Update section below). | Exploit blog | VulnCheck |
| 7.11.26 | StyleSmuggler Exploitation Deploys PSK Agent RAT Against Magento Stores | TL;DR: Between September 9 and September 13, 2026, we detected a coordinated campaign exploiting Magento and Adobe Commerce stores across Western Europe, North America, and the Asia-Pacific region. | Exploit blog | Imperva |
| 7.11.26 | What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks | The vulnerability landscape continues to expand. From 1999 through September 2026, approximately 383,000 software vulnerabilities had been disclosed across platforms and technologies, yet only about 2,000 CVEs (roughly 0.5%) have been linked to real-world exploitation. | Exploit blog | Microsoft Security Blog |
| 4.11.26 | Inside Coruna and DarkSword Chains: From Web Lures to iOS Exploitation | Seven months after Google Threat Intelligence Group (GTIG) published its initial analysis of the Coruna iOS exploit framework, the campaign has continued to evolve: the recovered infrastructure now deploys two distinct exploit chains conditioned on the target device's operating system version. | Exploit blog | ZIMPERIUM |
| 4.11.26 | Dead Domains, Live Exploits: How Infected Ads and Expired Analytics Tags Deliver Coruna and DarkSword to iPhones | Combined research between iVerify and Report URI uncovers multiple vectors within the advertising ecosystem several cybercriminal groups are using to automatically deliver two of the most capable iOS exploit kits we've seen, Coruna and DarkSword, as iPhone users browse the web and doomscroll. | Exploit blog | IVERIFY |
|
31.10.26 |
php2shell: The exploitability gap between frontier and open models | TLDR: I gave five open and frontier models the same working php2shell exploit and asked them to port it to an isolated, production MediaWiki deployment behind Caddy. Claude Mythos 5.1 got the flag in 3h 28m, GPT-5.6 Sol solved it in 6h 10m. Open models, GLM 5.3 got local code execution but couldn’t exploit the remote target after 20+ hours. Kimi K3.1 Pro and DeepSeek V4.1 Flash never reached the leak which is the first step of the exploit. | Exploit blog | Hacktron AI |
|
31.10.26 |
PHP2Shell Is Hitting Windows Servers in the Wild. We Stopped It. | Every public exploit targets Linux. The attacks we blocked were on Windows IIS. For 110 million servers running end-of-life PHP, no patch exists. Here is what we saw, and how AMTD shut it down. | Exploit blog | Morphisec Blog |
|
31.10.26 |
Inside Coruna and DarkSword Chains: From Web Lures to iOS Exploitation | Seven months after Google Threat Intelligence Group (GTIG) published its initial analysis of the Coruna iOS exploit framework, the campaign has continued to evolve: the recovered infrastructure now deploys two distinct exploit chains conditioned on the target device's operating system version. Targets running iOS 17.2.1 or earlier receive the legacy Coruna framework (exhibiting byte-identical JavaScript payloads across multiple recovered configurations). | Exploit blog | ZIMPERIUM |
|
31.10.26 |
How PHP2Shell exploit leads directly to RCE and how to mitigate the threat | On October 21, 2026, the PHP foundation released a security advisory and emergency patches addressing two core runtime vulnerabilities responsible for permitting unauthenticated remote code execution (RCE). PHP identified the following modules as critically exploitable, requiring immediate attention: mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. | Exploit blog | THREATLOCKER |
|
31.10.26 |
Cache Me If You Can: Unpacking a Go Implant and Its Toolkit | In early October 2026, one of our canaries caught an attacker exploiting Gotenberg's CVE-2026-42589 to deploy a custom Go reverse shell called cache_base. The activity came from a residential Japanese IP and lasted a couple of days. There were only 38 recorded canary events, but the attacker gave us the full exploit chain, including command execution, output retrieval, and three attempts to download an implant from independent mirrors. | Exploit blog | VulnCheck |
|
31.10.26 |
VulnCheck Opens Initial Access Community Edition to the Public | This weekend, our Initial Access Intelligence offering surpassed 1,000 VulnCheck-authored exploits, each of which anchors a powerful defensive artifact package designed to give security teams and cyber operators insight into attacker capabilities from exposure through execution and post-exploitation. | Exploit blog | VulnCheck |
|
31.10.26 |
PHP2Shell Exploits: What the Underground Really Thinks - | Update (as of October 29, 2026): As expected, the exploits have matured and two cybersecurity vendors have reported working reliable exploits for Apache/mod_php and nginx/PHP-FPM. Honeypots have also witnessed in-the-wild Apache/mod_php exploitation. More information in our Flare Intelligence report (in-platform). | Exploit blog | Flare |
|
31.10.26 |
How eSentire Responded to a Citrix NetScaler Zero-Day in One Day | Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 were exploited from at least September 8, nearly three weeks before Citrix disclosed them on September 27, 2026. eSentire's Threat Response Unit (TRU) warned 15 exposed customers by noon the next day. TRU then hunted customer telemetry and found signs of exploitation across 10 customers. | Exploit blog | eSentire |
|
24.10.26 |
Plug me if you can: Exploiting USB Printer Drivers in Windows | Windows loads the appropriate kernel driver by interpreting USB Descriptor when a USB device is connected. If the data sent by the device is not properly validated, this can lead to kernel-level vulnerabilities. | Exploit blog | Ethiack |
|
24.10.26 |
Cisco Secure Email & PAN-OS Zero-Days Exploited | Cisco and Palo Alto Networks have patched two actively exploited zero-day vulnerabilities that can lead to root-level code execution on security appliances. CISA has flagged both vulnerabilities as known exploited flaws, adding them to its Known Exploited Vulnerabilities (KEV) catalog. | Exploit blog | SOCRADAR |
|
24.10.26 |
Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) | SOPHOS | The previous update (October 22 16:18 UTC) reported that Sophos observed successful exploitation of PHP2Shell in customer environments. Upon further analysis, we are correcting that assessment as Sophos customer telemetry shows scanning and a small number of failed exploitation attempts. As of this update, there is no evidence of a successful compromise due to these vulnerabilities. | Exploit blog | SOPHOS |
|
17.10.26 |
Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD | Calif frequently publishes our offensive research and work, but we otherwise don't draw much attention to the defensive work we do — assisting open source projects with remediation, patch generation, cryptographic improvements, and internal engineering projects we carry out for our clients. | Exploit blog | Calif |
|
17.10.26 |
Ivanti Connect Secure Zero-Day CVE-2026-104935 Exploited in Chained Attacks | Ivanti released fixes on October 13, 2026, for CVE-2026-104935, an Ivanti Connect Secure zero-day that attackers exploited before a patch existed. Volexity, which uncovered the activity during an incident investigation, tracks the attacker as UTA0576. According to the published analysis, the actor chained three vulnerabilities to move from an unauthenticated web request to root-level code execution on an ICS VPN appliance running version 22.8R2.4, which was fully patched at the time. | Exploit blog | SOCRADAR |
|
17.10.26 |
Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days | Proofpoint identified four espionage-motivated threat actors employing a new exploit kit that chains multiple Chrome browser and Microsoft Windows vulnerabilities. Proofpoint is tracking the exploit kit used in this activity as BlueMoon. | Exploit blog | Proofpoint US |
|
17.10.26 |
Vulnerability Discovery and Exploitation Trends in the AI Era | Google Threat Intelligence Group (GTIG) examines vulnerability disclosure and exploitation statistics to evaluate the impact of artificial intelligence (AI) on the vulnerability threat landscape. We found that AI is measurably changing not just the pace of vulnerability discovery and exploitation, but also the types and typical risk profiles of vulnerabilities that are being discovered. | Exploit blog | Google Cloud Blog |
|
17.10.26 |
ARMORY CASTLE Exploits BeyondTrust | On October 15, BeyondTrust disclosed a vulnerability, CVE-2026-102764, impacting BeyondTrust Remote Support (formerly Bomgar) appliances. BeyondTrust Remote Support is an enterprise secure remote access solution that enables IT teams to securely access and troubleshoot remote endpoints. The successful exploitation of this vulnerability results in the arbitrary upload of files. | Exploit blog | Google Cloud Blog |
|
17.10.26 |
WP2Shell Exploit Chain: Anatomy of a Sophisticated WordPress Attack | WP2Shell is a critical WordPress Core exploit chain disclosed in July 2026 that can enables pre-authentication remote code execution (RCE) on vulnerable WordPress installations. The chain is particularly significant from a threat-intelligence perspective because it removes the requirement for an attacker to first obtain valid credentials or authenticate to the target application. | Exploit blog | SEQRITE |
|
10.10.26 |
DarkSword/Coruna Open Directory Finding Report | Open directories on five hosts exposed the full DarkSword/Coruna iOS exploit-and-harvest platform, from the C2 delivery server to the per-wallet theft modules. The infrastructure was still in use at triage time. | Exploit blog | Censys |
|
10.10.26 |
Critical N-able N-central Vulnerability and Active Exploitation | UPDATE 9/6/26: N-able issued [Hotfix 4 (2026.3 HF4)] to address CVE-2026-86218, an actively exploited pre-auth RCE zero-day with a 10.0 CVSS score that supersedes all prior hotfixes. On-premises N-central users must apply HF4 immediately, as systems running HF3 remain vulnerable to this newly disclosed flaw. Hosted (NCOD) instances have already been patched by N-able. | Exploit blog | Huntress |
|
7.10.26 |
CITRIX 0-DAY EXPLOITS: CVE-2026–88771 & CVE-2026–88772 IN THE WILD | NOTE: This is an analysis of the artifacts and samples found during the hunt of SLAPSHOT, WHIPSHOT which is a Python tunneler used to proxy traffic into internal networks. The analysis is done using various AI Models and if you find any irrelevancy, please do report directly. This article is intended for Network Defenders, Threat Analysts, SOC and IT Administrators. | Exploit blog | THE RAVEN FILE |
|
6.10.26 |
IQUALIF Leak, IUT Breach, SMTP Dump and Struts Exploit | SOCRadar Dark Web Team identified several new underground posts, including an alleged IQUALIF-based French residential data leak, an alleged breach affecting IUT Paris Seine, and an alleged initial access auction for a U.S. manufacturing company. Other posts advertised an alleged 19 million SMTP credential dump and access to servers reportedly compromised through CVE-2017-5638. | Exploit blog | SOCRADAR |
|
6.10.26 |
FortiMail Zero-Day Under Active Exploitation | Fortinet has confirmed that CVE-2026-104286, a critical path traversal flaw in FortiMail, is being exploited in zero-day attacks, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on the same day the advisory went live. | Exploit blog | SOCRADAR |
|
3.10.26 |
Swarming Against Citrix 0-Day Exploitation | GreyNoise observes adversary activity through our Global Observation Grid (GOG), a network of sensors that draws attacker scanning and exploitation onto infrastructure we control. This lets us study adversary infrastructure, tooling, and tradecraft directly, without waiting for a victim investigation. | Exploit blog | GREYNOISE |
|
3.10.26 |
Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation | GreyNoise observes adversary activity through our Global Observation Grid (GOG), a network of sensors that draws attacker scanning and exploitation onto infrastructure we control. This lets us study adversary infrastructure, tooling, and tradecraft directly, without waiting for a victim investigation. | Exploit blog | GREYNOISE |
|
27.9.26 |
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft | As an update to the June 2026 post, ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit, Mandiant and Google Threat Intelligence Group (GTIG) have identified renewed mass exploitation of CVE-2026-35273 by UNC6240 (ShinyHunters), along with expanded global targeting across multiple sectors. | Exploit blog | GTI |
|
26.9.26 |
A spy trojan swaps zero-days for a plain phishing email | The link in the email pointed at an image file. The web server sent back a program. What arrived on two separate customer networks was a one megabyte Windows executable named image.pif, and in both cases somebody double clicked it. | Exploit blog | IntelFusions |
|
26.9.26 |
Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation | GreyNoise observes adversary activity through our Global Observation Grid (GOG), a network of sensors that draws attacker scanning and exploitation onto infrastructure we control. This lets us study adversary infrastructure, tooling, and tradecraft directly, without waiting for a victim investigation. GreyNoise has been tracking malicious use of an IP address since early June 2026 due to its frequent use in scans and attacks against a variety of technologies. We are withholding the exact IP address due to victim sensitivities and operational risk. Once these factors have been mitigated, GreyNoise will publish an update. | Exploit blog | greynoise.io |
|
26.9.26 |
Serverless, Not Riskless: Exploiting Unauthenticated API Gateways in AWS | TL;DR – Unauthenticated Amazon Web Services Application Programming Interface (AWS API) Gateway endpoints backed by over-permissioned Lambda functions create a repeatable attack chain from a single HTTP request to credential extraction with no AWS credentials required. | Exploit blog | GUIDESECURITY |
|
26.9.26 |
SalesBleed: 0-Click Data Exfiltration in Agentforce | We found a way to pull sensitive account data out of Salesforce Agentforce without ever logging in, or requiring the victim to click anything. The entry point was a public Web-to-Lead form, the exit was a DNS query. We call it SalesBleed. | Exploit blog | Zenity Labs |
|
26.9.26 |
Spraying in the Andes: TeamFiltration Returns to Exploit Forgotten Service Accounts | Proofpoint researchers identified an active TeamFiltration campaign - tracked as UNK_CondorFiltration, that targeted over 5,700 accounts across 28 Microsoft 365 tenants in Latin America, focusing intensively on Chilean organizations. | Exploit blog | PROOFPOINT |
|
18.9.26 |
One Patch Behind: Nightmare-Eclipse's ShieldCrash and the Defender Bypass That Won't Stay Fixed | The originally released PoC had issues that broke exploitation. That PoC has been revised by the author. We have reviewed the revised version of the exploit and have validated that it now functions as expected in our lab. We have added a section at the end of our original article discussing this update and our results. | Exploit blog | LEVELBLUE |
|
18.9.26 |
Novee Exploitability Validation for External Reports | Traditional tooling tells you what might be wrong. Novee’s Exploitability Validation tells you what's actually exploitable, right now, and proves it. | Exploit blog | NOVEE |
|
15.9.26 |
The fake worker threat and the rise of human infiltration | How fake workers exploit trust, business processes and digital identities to gain legitimate access to organizations | Exploit blog | BARRACUDA |
|
12.9.26 |
The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE | This research demonstrates post-exploitation techniques that could allow an attacker with root access on a compromised Kubernetes node to misuse an open standard and reference implementation for machine identity known as SPIFFE/SPIRE to impersonate co-located workloads and harvest SPIFFE Verifiable Identity Documents (SVIDs). | Exploit blog | Palo Alto |
|
12.9.26 |
Active exploitation of Cisco Secure Firewall Management Center vulnerabilities | Cisco Talos is actively tracking the exploitation of two vulnerabilities in Cisco’s Secure Firewall Management Center (FMC) Software. | Exploit blog | CISCO TALOS |
|
10.9.26 |
StyleSmuggler: Unpatched Magento and Adobe Commerce Zero-Day Exploited | Attackers are actively exploiting an unpatched zero-day vulnerability in Magento Open Source and Adobe Commerce that allows unauthenticated remote code execution and persistent backdoor installation. | Exploit blog | SOCRADAR |
|
5.9.26 |
Attackers exploit a Chrome flaw, update your browser now | Google has shipped a new Chrome desktop release that closes 12 security holes, and one of them was already being used in attacks before the fix arrived. Hong Kong's HKCERT, relaying Google's advisory, rates the release "Extremely High Risk" on the strength of that single bug. | Exploit blog | INTELFUSIONS |
| 27.8.26 | TrendAI™ Advances Threat Hunting to Dynamic, Real-World Exploitation of AI Infrastructure | The new threat hunting component of the TrendAI™ agentic exploit-remediation engine, code name AESIR, extends visibility beyond vulnerability disclosure. Its first published investigation links over a year of honeypot data to the LF3 loader framework. | Exploit blog | Trend Micro |
| 27.8.26 | Exploiting SMTP with Unicode Bidi Override Spoofing: The Gap Between Auth & Render | Security Joes researchers, led by Red Team Lead Anna Breeva, discovered a new email spoofing technique that abuses Unicode bidirectional (Bidi) controls together with SMTPUTF8 to make an attacker-controlled email address visually appear to belong to a trusted domain. | Exploit blog | Security Joes |
| 22.8.26 | Death By 20,000 PoCs | VulnCheck researchers curated 20K+ public exploits and vulnerability analyses in 2025. As of mid-August 2026, we’ve already reviewed 17,800+ PoCs and write-ups, putting us 87% of the way to 2025’s numbers with another 4.5 months left to go in the year. | Exploit blog | VULNCHECK |
| 22.8.26 | Stitching the Kill Chain: Detecting NTDS.dit Exfiltration with Trellix Helix Correlation | This blog continues the series exploring NTDS.dit credential theft, building on our earlier work. In this analysis, we examine the underlying methodologies used in these attacks and how Trellix Helix identifies them. We will highlight the Advanced Correlation Engine (ACE)'s capability to consolidate telemetry from policy, network, and endpoint sources. | Exploit blog | TRELLIX |
|
8.8.26 |
CrowdStrike 2026 Threat Hunting Report: Exploitation Window Closes as AI Use Accelerates | Real-world case studies and observations demonstrate an increase in attacks on trusted relationships and adversarial use of AI. | Exploit blog | CROWDSTRIKE |
|
1.8.26 |
Fastjson RCE (≤1.2.83): Active Exploitation Detected — Detection & Mitigation | A remote code execution vulnerability in Fastjson affects every version up to and including 1.2.83. A remote attacker can run arbitrary code on a vulnerable server by sending it specially crafted JSON — no user privileges, no victim interaction, and no third-party libraries required. ThreatBook TDP® (Threat Detection Platform) has already captured this vulnerability being exploited in the wild, so if you run an affected version without SafeMode enabled, treat remediation as urgent. | Exploit blog | THREATBOOK |
|
1.8.26 |
Open Directory Stages NGINX Rift and Ghost CMS Exploits Against Government and Financ | Disclosure note: This research was conducted jointly by Hunt.io and Bob Diachenko, security researcher and journalist. Thailand's national CERT and NCSA were notified on July 15, 2026, and acknowledged receipt the same day. Publication was held for the standard 7-day disclosure window. | Exploit blog | HUNT.IO |
|
1.8.26 |
XMRig Covert Ops: The Cryptomining Campaign That Abuses Trusted Access and Deploys Forensic Smokescreens | Dive into a covert Linux XMRig campaign exploiting trusted access, weaponizing PAM to create forensic smokescreens, and deploying self-unlinking payloads. | Exploit blog | GROUP-IB |
| 25.6.26 | Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager | In early 2026, Mandiant identified a threat actor targeting SD-WAN infrastructure at a service provider. After gaining initial access, the threat actor exploited a zero-day vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN to escalate privileges from a compromised administrative account to root-level access. | Exploit blog | GTI |
| 19.6.26 | From SQLi to RCE – Exploiting LangGraph’s Checkpointer | AI agents need memory. Frameworks like LangGraph provide it through checkpointers – persistence layers that store execution state. But what happens when that persistence layer isn’t locked down? | Exploit blog | CHECKPOINT |
| 13.6.26 | ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit | Mandiant and Google Threat Intelligence Group (GTIG) have identified an active compromise and extortion campaign attributed to UNC6240 (ShinyHunters) targeting Oracle PeopleSoft application infrastructure. | Exploit blog | GTI |
| 13.6.26 | Borrowed Trust – Systematic Exploitation of Abandoned Cloud DNS Delegations to serve Thai Gambling SEO Content | Cyble's latest analysis exposes 163 organizations compromised via abandoned DNS delegations in a Thai gambling SEO poisoning campaign. | Exploit blog | Cyble |
| 13.6.26 | From SQLi to RCE – Exploiting LangGraph’s Checkpointer | AI agents need memory. Frameworks like LangGraph provide it through checkpointers – persistence layers that store execution state. But what happens when that persistence layer isn’t locked down? | Exploit blog | CHECKPOINT |
| 30.5.26 | While Russian-speaking threat actors have historically dominated the phishing-as-a-service (PhaaS) landscape, a rival ecosystem is rapidly growing within the Chinese-language underground. Google Threat Intelligence Group (GTIG) analyzed a dozen current PhaaS offerings in the Chinese underground, all of them mature services and many likely tied intricately to the broader criminal ecosystem in that region. | Exploit blog | GTI | |
| 16.5.26 | Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities | Cisco Talos is tracking the active exploitation of CVE-2026-20182, an authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage. | Exploit blog | CISCO TALOS |
| 11.4.26 | Adobe Reader zero-day vulnerability in active exploitation | On April 7, 2026, a security researcher described an Adobe Reader zero-day vulnerability that has been exploited since at least December 2025. The vulnerability allows threat actors to execute privileged Acrobat APIs via specially crafted malicious PDF files that execute obfuscated JavaScript when opened. Exploitation allows attackers to steal sensitive user and system data and to potentially launch additional attacks and remotely execute code. | Exploit blog | SOPHOS |
| 8.3.26 | Look What You Made Us Patch: 2025 Zero-Days in Review | Google Threat Intelligence Group (GTIG) tracked 90 zero-day vulnerabilities exploited in-the-wild in 2025. Although that volume of zero-days is lower than the record high observed in 2023 (100), it is higher than 2024’s count (78) and remained within the 60–100 range established over the previous four years, indicating a trend toward stabilization at these levels. | Exploit blog | GTI |
| 1.2.26 | PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups | PeckBirdy is a sophisticated JScript-based C&C framework used by China-aligned APT groups to exploit LOLBins across multiple environments, delivering advanced backdoors to target gambling industries and Asian government entities. | Exploit blog | Trend Micro |
| 17.1.26 | A 0-click exploit chain for the Pixel 9 Part 3: Where do we go from here? | While our previous two blog posts provided technical recommendations for increasing the effort required by attackers to develop 0-click exploit chains, our experience finding, reporting and exploiting these vulnerabilities highlighted some broader issues in the Android ecosystem. This post describes the problems we encountered and recommendations for improvement. | Exploit blog | Project Zero |
| 17.1.26 | A 0-click exploit chain for the Pixel 9 Part 2: Cracking the Sandbox with a Big Wave | With the advent of a potential Dolby Unified Decoder RCE exploit, it seemed prudent to see what kind of Linux kernel drivers might be accessible from the resulting userland context, the mediacodec context. As per the AOSP documentation, the mediacodec SELinux context is intended to be a constrained (a.k.a sandboxed) context where non-secure software decoders are utilized. Nevertheless, using my DriverCartographer tool, I discovered an interesting device driver, /dev/bigwave that was accessible from the mediacodec SELinux context. | Exploit blog | Project Zero |
| 17.1.26 | A 0-click exploit chain for the Pixel 9 Part 1: Decoding Dolby | Over the past few years, several AI-powered features have been added to mobile phones that allow users to better search and understand their messages. One effect of this change is increased 0-click attack surface, as efficient analysis often requires message media to be decoded before the message is opened by the user. | Exploit blog | Project Zero |
| 10.1.26 | CISA Known Exploited Vulnerabilities Surged 20% in 2025 | CISA’s Known Exploited Vulnerabilities (KEV) catalog grew by 20% in 2025, including 24 vulnerabilities exploited by ransomware groups. | Exploit blog |