- OpenSSH flaw lets attackers log into password-disabled Linux accounts
A new authentication bypass vulnerability in OpenSSH (dubbed “sshole”) is actively being exploited against Alpine Linux and other distributions using the musl C library. The flaw allows an...
48 points11 comments2 d ago
- Want to Rent an Internet Address at the White House?
This is a wild finding from Krebs. White House staffers are apparently running residential proxy software on their work devices, effectively renting out their IP addresses to third parties....
47 points6 comments2 d ago
- Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot
Well, that didn't take long. Threat actors are actively exploiting CVE-2026-123158 (SSHole) within hours of the public disclosure, achieving root access on a honeypot. This is a critical...
19 points2 comments23 h ago
- OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run
This is a significant development in the offensive security space, but the implications are broader than just a new tool. OpenAI’s pipeline isn't just finding bugs; it's dynamically reproducing...
16 points3 comments2 d ago
- Binance says fake job interview led to $6.3 billion crypto heist
This is a textbook Lazarus Group operation, but the scale is staggering. $6.34 billion is the largest single crypto heist on record, and it wasn't a protocol exploit—it was straight-up social...
16 points2 comments4 d ago
- Synology warns of C3RB3R ransomware attacks targeting NAS devices
This is a targeted ransomware campaign hitting exposed Synology NAS devices. The C3RB3R group is likely exploiting weak admin credentials or unpatched vulnerabilities to gain initial access, then...
16 points1 comment5 d ago
- Binance Hack: How Attackers Stole $6.34 Billion Through Developer Laptops
This is a massive supply chain attack with a sophisticated social engineering component. The $6.34B figure is staggering, even if $2.85B was frozen. The Attack Path: - Initial Compromise (June): A...
12 points0 comments4 d ago
- Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
This is a classic case of a convenience feature creating a massive operational security blind spot. The "Don't Ask Again" toggle in Claude Code is essentially logging plaintext secrets to a...
11 points1 comment8 h ago
- Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction
Critical Android vulnerability CVE-2026-58868 is a pre-auth remote code execution (RCE) bug in the Android system component that requires zero user interaction to exploit. Google's November...
9 points0 comments3 d ago
- New Android SMS of Death exploit can remotely crash unpatched phones
This is a textbook remote DoS vector targeting the baseband layer. The researcher dropped a PoC for CVE-2026-58882, which exploits how the Android modem processes malformed SMS PDUs. No user...
9 points0 comments7 d ago