New stone in the "Offensive LLMs" file after the Hugging Face breach and the OpenAI sandbox exploit: UK AISI and CAISI publish a preliminary assessment of the cyber offensive capabilities of Kimi K3, the Chinese open-weight model with 2.8 T parameters. In parallel, a researcher releases a functional exploit against the latest Redis server obtained via this same model.
11 h ago 7 2
CVE-2026-54121, CVSS 8.8. A domain account with no privileges is sufficient to obtain an AD CS-signed certificate for the identity of a Domain Controller, then authenticate via PKINIT and extract krbtgt via DCSync. Patched on July 14, 2026, public exploit since today.
yesterday 3 1
Socket.dev documented a campaign where 583 GitHub Actions workflows slipped into 10 PHP packages scan the Internet for cPanel/WHM instances vulnerable to the CVE-2026-41940 authentication bypass - to steal almost all available credentials. Approximately 6,100 workflows bear the campaign's signature on GitHub.
Jul 23, 2026 18 3
The Dutch services AIVD and MIVD reconfirm that unit 26165 of the GRU (« Fancy Bear ») exploits poorly configured IP cameras to track NATO's military logistics - a signal that the geekkitsune watch thread has been following for several editions.
Jul 21, 2026 7 2
A critical authentication bypass vulnerability in PAN-OS on the GlobalProtect portal (Palo Alto Networks' VPN firewall) is now being exploited in the real world by the Qilin ransomware gang. Arctic Wolf, relayed by BleepingComputer, confirms active intrusions: the patch can no longer wait.
Jul 21, 2026 24 3
A joint AIVD/MIVD (Dutch intelligence services) assessment dated July 10, 2026 documents a Russian campaign that exploits Internet-exposed IP cameras to track arms convoys to Kyiv through the EU and NATO.
Jul 20, 2026 24 3
No exploits, no 0-day: the massive data breach at Qantas started with a phone call to the outsourced call center. Anatomy of an old-school "vishing" compromise, and why it remains the weak link in 2026.
Jul 17, 2026 6 2
The CISA adds three SharePoint vulnerabilities to its KEV catalog - confirmed exploitation in the wild. Two other critical flaws remain on the table. What to patch, and quickly.
Jul 17, 2026 18 3
