en
CVE-2025-48595: Android Framework Integer Overflow — Privilege Escalation and Stalkerware Chains
Technical root cause of the Android Framework integer overflow zero-day exploited in commercial surveillance spyware.
en
en
TeamPCP Supply Chain Attack: Trivy, KICS, and Bitwarden CLI Backdoors — Full Analysis
Full forensic analysis of the TeamPCP campaign: tag poisoning and entrypoint backdoors injected into Trivy, KICS, and Bitwarden CLI.
en
CVE-2026-3055: Citrix NetScaler SAML IDP Memory Overread — Technical Analysis & Remediation
Technical root cause and active exploitation telemetry for the Citrix NetScaler SAML session memory overread flaw.
en
CVE-2026-41089: Windows Netlogon 0-Click RCE — Domain Controller Exploitation Deep Dive
Technical breakdown of the 0-click unauthenticated remote code execution flaw in Windows Netlogon allowing Domain Controller takeover.
en
Security Roundup: Megalodon GitHub Attack, Ghost CMS Exploitation, MiniPlasma & YellowKey Windows 0-Days, DirtyDecrypt LPE — Week of May 28, 2026
Weekly briefing: Megalodon backdoors 5,500 GitHub repos, Ghost CMS SQLi hijacks 700 sites for ClickFix, and MiniPlasma Windows 0-day.
en
DirtyDecrypt PoC (CVE-2026-31635): Linux Kernel LPE via rxgk Missing COW Guard
Technical exploit breakdown of DirtyDecrypt: achieving local root privilege escalation via missing Copy-On-Write guards in Linux rxgk.
en
CVE-2026-45585 (YellowKey): BitLocker Bypass via FsTx + WinRE — Physical Access, No Credentials Needed
Technical root cause of YellowKey: bypassing BitLocker full-disk encryption via WinRE transaction replay without knowing user credentials.
en
MiniPlasma Windows 0-Day: SYSTEM Shell on Fully-Patched Windows 11 via cldflt.sys Race Condition
Exploit analysis of MiniPlasma: triggering a race condition in cldflt.sys to spawn NT AUTHORITY\SYSTEM shells on fully patched Windows 11.
en
CVE-2026-26980: Ghost CMS SQL Injection Actively Exploited to Hijack 700+ Sites for ClickFix Attacks
Technical breakdown of the Ghost CMS SQL injection exploited at scale to inject fake browser update (ClickFix) malware into 700+ websites.
en
Megalodon: 5,561 GitHub Repos Backdoored via Infostealer-Sourced CI Credentials
How campaign Megalodon weaponized infostealer-harvested developer secrets to backdoor 5,561 GitHub repositories in automated CI runs.
en
CopyFail, Dirty Frag, and Fragnesia: The Linux Kernel Page Cache LPE Trilogy
Technical breakdown of CopyFail, Dirty Frag, and Fragnesia: how three page-cache memory flaws enabled unprivileged local root escalation in the Linux kernel.
en
Security Roundup: Exchange Zero-Day, GitHub Breach, Cisco SD-WAN, Defender Zero-Days — Week of May 21, 2026
Weekly briefing: Microsoft Exchange OWA zero-day XSS, TeamPCP GitHub breach (3.8K repos), Cisco SD-WAN UAT-8616, and Defender zero-days.