Author: Lucas Dodgson, Tobias Oberdörfer, Robin Hilber Published: June 9, 2026 Source: https://labs.infoguard.ch/posts/ghost-sender/ Summary InfoGuard Labs disclosed “Ghost-Sender,” a universal email spoofing technique against Microsoft Exchange Online. When a tenant routes inbound mail through a third-party gateway via an external MX record, an attacker can bypass that gateway entirely by speaking SMTP directly to the … Read more
Author: Oren Yomtov Published: March 26, 2026 Source: https://www.koi.ai/blog/shadowprompt-how-any-website-could-have-hijacked-anthropic-claude-chrome-extension Summary Koi Security researcher Oren Yomtov disclosed “ShadowPrompt,” a vulnerability chain in Anthropic’s Claude Chrome extension (reported as having 3+ million users) that let any website silently inject prompts into the AI assistant with no user interaction. By combining an overly permissive origin allowlist in the … Read more
Author: Jay Chen, Royce Lu Published: October 31, 2025 Source: https://unit42.paloaltonetworks.com/agent-session-smuggling-in-agent2agent-systems/ Summary Palo Alto Networks’ Unit 42 details “agent session smuggling,” an attack technique against multi-agent systems that communicate over the Agent2Agent (A2A) protocol. A malicious or compromised remote agent abuses the stateful, multi-turn nature of an active A2A session to covertly inject extra instructions … Read more
Author: Ron Bobrov, Barak Sternberg, Nevo Poran Published: June 9, 2026 Source: https://tenetsecurity.ai/blog/agentjacking-coding-agents-with-fake-sentry-errors/ Summary Researchers at Tenet Security describe “Agentjacking,” an indirect prompt-injection attack class in which a malicious error event is planted in a victim’s Sentry error-tracking project and later read by an AI coding agent. Because the agent cannot distinguish data it retrieves … Read more
Author: Mandiant / Google Threat Intelligence Group (GTIG) Published: June 11, 2026 Source: https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit Summary Mandiant and the Google Threat Intelligence Group report a zero-day exploitation and extortion campaign by ShinyHunters (tracked as UNC6240) against Oracle PeopleSoft environments, running from May 27 to June 9, 2026. The actor exploited CVE-2026-35273, a critical (CVSS 9.8) unauthenticated … Read more
Author: Sergiu Gatlan Published: June 1, 2026 Source: https://www.bleepingcomputer.com/news/microsoft/critical-windows-netlogon-remote-code-execution-flaw-now-exploited-in-attacks/ Summary BleepingComputer reports that CVE-2026-41089, a critical remote code execution vulnerability in the Windows Netlogon RPC interface, is now being exploited in attacks according to Belgium’s Centre for Cybersecurity (CCB). Rated CVSS 9.8, the flaw affects Windows servers acting as domain controllers and can be triggered … Read more
Author: Rapid7 Published: May 29, 2026 (last updated June 3, 2026) Source: https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257/ Summary Rapid7 reports active in-the-wild exploitation of CVE-2026-0257, an authentication bypass in the Palo Alto Networks PAN-OS GlobalProtect portal/gateway. The flaw stems from improper certificate handling in the authentication override feature: when the certificate used to encrypt authentication-override cookies is reused for … Read more
2023-09-25 https://blog.thalium.re/posts/rooting-xiaomi-wifi-routers
Company: Thalium Website: https://blog.thalium.re/ Overview Thalium is a cybersecurity research team that is part of the Thales group. Based in Rennes, France, the team focuses on threat intelligence, vulnerability research, and red team tool development, and publishes technical security research on its blog. Products & Services As presented on its site, Thalium’s public work centres … Read more
Author: Julien R. (SoEasY) and Marin Duroyon Published: September 25, 2023 Source: https://blog.thalium.re/posts/rooting-xiaomi-wifi-routers/ Summary Researchers at Thalium documented a chain of remote code execution vulnerabilities affecting Xiaomi Wi-Fi routers built on a shared, OpenWrt-derived codebase, with the MI AIoT Router AC2350 as their primary target. The work spans three attack surfaces — LAN post-authentication, LAN … Read more
