Tim Peck

Researchers identified a stored XSS vulnerability in Open VSX that allows attackers to hijack extension maintainer accounts and distribute malicious updates to millions of developers.

The ClickFix campaign leverages social engineering on Steam forums to trick gamers into executing PowerShell commands that install XMRig crypto miners.

The ServiceNow Red Team developed Dark, an open-source Mythic C2 agent written in Crystal that features in-memory Beacon Object File (BOF) execution for macOS and Linux.

An unidentified operator deployed 28 malicious 'evil-twin' Open VSX extensions that exfiltrate developer environment data to i.apee.my.id using multiple network evasion techniques.

Security researchers analyzed a potential RCE chain in Microsoft Exchange Server SE involving MRSProxy authentication bypass and NTLM relay via PetitPotam.

Researchers discovered two Active Directory vulnerabilities, ResetNightmare (CVE-2026-27912) and KerberLoss, that leverage default UPN self-write permissions and Unicode bypasses to achieve full domain takeover.

The XSS2Shell (CVE-2026-64638) chain exploits a parser differential in WordPress Core to achieve unauthenticated reflected XSS, which can be escalated to full remote code execution through DOM clobbering and Same-Origin Method Execution.

UNC5142 utilizes a Python-based RAT named DeviceManager, delivered via ClickFix campaigns, leveraging Ethereum smart contracts for resilient C2 infrastructure resolution and DNS for communication.

Gunra is a Conti-derived ransomware-as-a-service (RaaS) targeting global critical infrastructure using double-extortion and cross-platform encryptors.

Russian-speaking operators are using custom platforms like camview and open-source scanners to exploit vulnerabilities in IP cameras and routers across Ukraine and Europe to build proxy networks.