AI Writer Author: FearsOff (research team; no individual author bylined) Published: July 21, 2026 (last updated July 26, 2026) Source: https://fearsoff.org/research/fastjson-1-2-83-rce Summary FearsOff disclosed CVE-2026-16723, a remote code execution vulnerability affecting fastjson 1.2.68 through 1.2.83 — including 1.2.83, the final 1.x release long considered the “safe” version because it ships with AutoType disabled by default. The researchers … Read more
Author: VulnTracker Published: May 6, 2026 Source: https://vulntracker.io/blog/palo-alto-pan-os-cve-2026-0300-unauth-rce-active-exploitation/ Summary VulnTracker reports on CVE-2026-0300, a critical unauthenticated remote code execution flaw in Palo Alto Networks PAN-OS firewalls that, at the time of writing (May 6, 2026), was under active exploitation with no patch available until May 13, 2026. An unauthenticated attacker can obtain full root control … Read more
Author: VulnTracker Published: June 2, 2026 Source: https://vulntracker.io/blog/palo-alto-globalprotect-auth-bypass-cve-2026-0257-actively-exploited Summary VulnTracker reports on CVE-2026-0257, a CVSS 9.1 critical authentication bypass in Palo Alto Networks PAN-OS GlobalProtect that is being actively exploited in the wild and was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on May 29, 2026. A remote, unauthenticated attacker can bypass authentication … Read more
Author: rootxharsh Published: May 20, 2026 Source: https://www.hacktron.ai/blog/cve-2026-0265-panos-globalprotect-cas-auth-bypass Summary Hacktron’s writeup describes CVE-2026-0265, a JWT algorithm-confusion vulnerability in the Cloud Authentication Service (CAS) used by Palo Alto Networks PAN-OS with GlobalProtect. Because the token-verification code selects the signature algorithm purely from the attacker-supplied alg field and never cross-checks it against the expected key type, an … Read more
Author: impost0r Published: June 29, 2026 Source: https://ret2p.lt/2026/06/29/cottou.html Summary “Cottou” is a writeup by impost0r describing an out-of-bounds segment-index flaw in Apple’s dyld dynamic linker that can be turned into arbitrary code execution when a malicious dynamic library is loaded. The bug lies in how dyld processes rebase opcodes while binding a Mach-O image: a … Read more
Author: Nebula Security Published: June 29, 2026 Source: https://nebusec.ai/research/v8-cve-2026-6307-writeup/ Summary Nebula Security published a technical writeup, dubbed “Longinus,” of CVE-2026-6307, a high-severity flaw in Google Chrome’s V8 JavaScript engine. The bug lives in the TurboFan JIT compiler and is notable because a single vulnerability crosses two security boundaries at once: it yields a stable arbitrary … Read more
Author: Lucas Dodgson, Tobias Oberdörfer, Robin Hilber Published: June 9, 2026 Source: https://labs.infoguard.ch/posts/ghost-sender/ Summary InfoGuard Labs disclosed “Ghost-Sender,” a universal email spoofing technique against Microsoft Exchange Online. When a tenant routes inbound mail through a third-party gateway via an external MX record, an attacker can bypass that gateway entirely by speaking SMTP directly to the … Read more
Author: Oren Yomtov Published: March 26, 2026 Source: https://www.koi.ai/blog/shadowprompt-how-any-website-could-have-hijacked-anthropic-claude-chrome-extension Summary Koi Security researcher Oren Yomtov disclosed “ShadowPrompt,” a vulnerability chain in Anthropic’s Claude Chrome extension (reported as having 3+ million users) that let any website silently inject prompts into the AI assistant with no user interaction. By combining an overly permissive origin allowlist in the … Read more
Author: Jay Chen, Royce Lu Published: October 31, 2025 Source: https://unit42.paloaltonetworks.com/agent-session-smuggling-in-agent2agent-systems/ Summary Palo Alto Networks’ Unit 42 details “agent session smuggling,” an attack technique against multi-agent systems that communicate over the Agent2Agent (A2A) protocol. A malicious or compromised remote agent abuses the stateful, multi-turn nature of an active A2A session to covertly inject extra instructions … Read more
Author: Ron Bobrov, Barak Sternberg, Nevo Poran Published: June 9, 2026 Source: https://tenetsecurity.ai/blog/agentjacking-coding-agents-with-fake-sentry-errors/ Summary Researchers at Tenet Security describe “Agentjacking,” an indirect prompt-injection attack class in which a malicious error event is planted in a victim’s Sentry error-tracking project and later read by an AI coding agent. Because the agent cannot distinguish data it retrieves … Read more
